oversight

New Methods Needed for Checking Payments Made by Computers

Published by the Government Accountability Office on 1977-11-07.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                           DOCUIIEJi llESOIIE


lew 8&tbods leeded for Cbecking Payasnts lIade tr Coaf~ters.
PGIISD-76-82; 8-101081. 10Yesber 7. 1977. 33 pp. + 6 appendices
(111 pp.).

Report to the CODgress; Dr Bobert r. leller. lcting Coaptroller
General.
Issne lrea: lntoaitic Data Processing: osing Res~lts of lDP
    systess (103): Internal luditing Systess: S~fficiencr of
    Federal lllditors and conraqe(201);lceounting and Unancial
    Be porting (2800).
Contact:' rinancial and General lIa-nageHnt Studies DiY.
Budget PUD!:tion: lIiscellaaeous: lutoeatie Data frocessillg
    (1001'); lIiscellaneous: rinallcill! lIanag.aent alld Infouatioll
    Sr ate.s 1'1'002).
Orgallization concerned: Office of lIanageaent and Budget.
Congressional Releyance: Bouae Coaaittee on lrsed SerYices;
    senate Co.sittee  on  lrsed Ser.icea; Congreas.
lutboritr:Blidget and lccountiug Proclidu,ns lct of 1950.
          fA-e rederal Goyernaent disturses .700 billion anlluallr.
largely through huge. decentralized. ceaputeriaed. cashless
systess. !he law reqnires thos~ ~ho approYe indiYidual
payaents--certifying and dishursi~9 officers--to a.aure that
payaents are legal. proper. ane: correct. Under tae cur:cellt
srstes it is often iapossible for the reaponsitle psrson& to
exaaine th~ ~asic docuaents preYioualr ueed to deteraine that
payaents vera proper. Recoaaeudations: ihs Dirscter of ths
Office of lIanageaent and Budget should i.sue guidelines
req~irin9 departaent and agen~J heads to: designate an operating
official at the assistant secretarr or coaparatle leYel to
reYiev each autoaated paraellt siBt.a and the cQntrols b~ilt illto
it to deteraine whether th~y are operating effsctiwslr amd call
be relied ou to coapute paraente that are accurate and legal;
direct that s~ch reYievs be aaGe at least anne~llr. s~ppleaented
by interia chects of a~jor srste, changes; direct the certifring
or disbursillg officer t.o certifr or disburse autosated payaeets
only ~hell notified ~y the designated operating Official that the
autoaated systea aud the cOlltrols b~ilt into it are operatin~
eff~LtiYely; require a writtell stateaect froa the de6igllated
operating official if the official dsterainss that the srstea is
not operating effectiYely and that correctiYe actio~ could not
be taken before the next Youcher prep.ration; and froyide that.
vhen significant srstea deficiencies are identified. the
desi9llated operatin9 official aust aasuse responsibilitr for
subsequent certification that the payaents ars otberwiss proper.
 (luthor/SC)
               REPORT TO THE CONGRESS
_^vvP ^y:.„^

       . ,     BY THE COMPTROLLER GENERAL
yfy
 '((I n •S '
               OF THE UNITED STATES



               New Methods Needed For
               Checking Payments Made By
               Computers
               The Federal Government disburses $700 bil-
               lion annualiy-largely through huge, decentral-
               ized, computerized, cashless systems. The law
               requires those who approve individual pay-
               ments-certifying and disbursing officers-to
               assure that payments are legal, proper, and
               correct.

               In the days before the computer and today's
               large volume of transactions, certifying and
               disbursing officers could physically examine
               each supplier's invoice and the supporting
               documentation before payment. Today such
               an examination is virtually impossible for
               many of the disbursing systems that use com-
               puters extensively. To adapt to this change in
               operating procedures without losing essential
               controls over disbursements, agencies need to
               review periodically the details of how these
               systems operate so that certifying and disburs-
               ing officers will have assurance that internal
               controls reasonably protect against theft and
               error.

               The Office of Management and Budget and
               t h e o t h e r departments that commented
               agreed that such reviews are needed and of-
               fered various suggestions for improving the
               procedures.

               FGMSD-76-82                                       NOVEMBER 7,   1977
B-101081
                                                                                            p-'yy§f0^M:^^yyy^i::-:wi

                                                                                                                                                         i^'''^y?'jMy




a p p r b^ftji'i^b^'pitjfet e:r m i ^
i^gai;';5;v;Whxi:0,/-^^          veri^;i.catl^6n':^:bf«;:tr^
is;^;a:-vai-uable^;^'functloh;,^'>^^
vised"'.; tai^deal/:^^          aut<j#a:teie4;Vp'aym^
p o r t >we^'i^ecoffirnend that'';the.^ IJir-ectdr:/• :•;-Ofiix^
.arid :,BUdigife;t->;|dif e c t Pedeiralf agertcx^^s,^
each: .•^vitbmatjted^payment ;systeTn':'.arid-^;i-t;i$:r"^
opei:'ai::iri^' .effei'ctively and ^can^',be'-':rexiled-•:p;ri;!^                     'k:c>mp;iii€^'j.:|»^y=^^
ments/^that'-/are;i       accurate     and- 'legal."\';•••';;•• •                             '/•///yyyyyyyyyi^.:':
      •The •0;ff;iice of Manageme.nt-.and;;6udget      • #nicS:a1;^h''fe|;?^^^
partments    that;- commented on -pur ;.pr.P|>b^se(d.;:r:epPr;t;-.:agtf^        yyyy
that such .rigyiews are 'nee:ded;.:-and;-o£-fe:redjva^^
tions .for iinptPving     the ••prpcedutesv.;:;-f; \ '           ••'/yyy;yyyyyy::yy^
       Our r e v i e w was made p u r s u a n t t P t h e Budget ari#
ing A c t , 1 9 2 1 {31 U . S . C . 53) ; arid t h e Accpiiritiiig /arid
i n g A c t o f 1950 ( 3 1 U . S . C . 6 7 ) .
           C o p i e s . ^ P f - t h i s r e p o r t . .are..:beih<gf,>sen.t.,"tp';:j-th:e^^^
O f f i c e -of •Management and ;Budg[€!t:,;;-^rid:-:the^^:^^
department.^'rtarid agenciesvv ; ^-i'-/"-^"!. •;;'-:i^^^^                                                                                                            "                   "
                                                                                                                                                  •• • ' ^ > v ; • • • ^ ' • ! v ; v ^ ' / : : ^
                                                                                                                                                   •--'-^t';•••:'.-•          ••I'-.-M:-:-^--
                                                                                                                                                   • : ~ y .•^;->',>,'^v,^" ^'''•{j
                                                                                                                                                    • • ",••••'•' ••,',h"''-7-^'';V:;P'"^
                                                                                                                                                  '••••-••^•'•-^yy-y'::^}-^

                                                                                                •',' i-y                                          •"'v.:-;-;;;it:^.;^i?'^'-;^



                                                                                                                                                  yyyyiii
                                                                                                1         -   •   -   •       -   ,



                                                                                                                                                  ^ ••-.'.. V.i.-'.io'^-^K-t;.--;;'-.
                                                                                                •     •''•-.(--.                                  ,'/V'-;:'".''T-i^:;'5',ii-;^'^,\r-::-r

                                                                                                '.y^-y.'..
                                                                                                        •:c,y^y *'ivv'5^;^i^^


                                          ^(i^J iIJ^ C b m p t r o i l e r i^jenems^y                                                             ;, '-lyy-yy^y-^y
                                                                                                                                                  -;' •'•'V r;-^;'         •'•'r^r^:y!/'y^


                                            • •:-:->v.-S-;o-f :''€he:.:^;Uri:t€ed               AAA. -
                                                                                                                                                  M^0M^ -P:! .^V'w,;v;;>;;v;;;v^
                                                                                                                                                    -•*.•, •'-•.•.',i V,.L",—.'."i.-.'
                                                                                                                                                  •; ••:- •,>T',A^i".',;-;'"':>-V''''^^'/^^
                                                                                                                                                  '•.•• •.y-A-^~:-;.V {iZi'''-.'>'.i«
                                                                                                    ';'!v-ri'"'rt.'
                                                                                                    : \--,-'-y''•yyy'^^^y^^
                                                                                                .'•:.'',•'••'                                 •
                                                                                                                                                  y^y^!y^iM^
                                                                                                                                                  yy^'i:^^^^%
                                                                                                    yy                                            •y-y/yy?^i^}
                                                                                                                                                  '^'.rrH-r.;;yH^?'-^'^^
                                                                                                                                                   'C -..' -('.,i-'f--'i'ni;;t.'i-;i^;.'-
                                                                                                ,'•.'••,•••
                                                                                                                                                  :.;,:•.', ^ a . < ; i < ? i S 4 i i . ; :
                                                                                                                                                  ^v,r; '•^;::^^^A^^,•^4^

                                                                                                                                                  -:^^^;?^gs^:gfi?
                                                                                                                                                  -•• ••f^^.i?^^?^^vJ;^^
                                                                                                ; t"-,; y -^.;:^-;Ti.^-;^kkivv.:
                                                                                                           .-..:,-ik,-'..i.,,.^.;\.-.i.;.-.„;W,;,-
                                                                                                           :;•;•; hi-?-1 •;•'-••• •.j'-;:>,-i=r'''f^
                                                                                                                                                  '•:v>;.?;'^-':>Tn^^^?it
                                                                                                                                                  ; . -.,:.i:;<ji'"i-:i:i >:il^i!iVi
                                                                                                                                                  '.'";<-\:       i-yy}syyy-
                                                                                                                                                  -•.-,'^.^ -'ft'^-.'i ..i"1i:,\s":'
                                                                                                                                                  r^ ^••^^•:otV;^;-^'iMVi^'.
                                                                                                                                                  '••v-;'"'~;^:v>^>i'fe^^T''
                                                                                                *', y'-^y^'^:&<yy.
                                                                                                                                                  \y':<] ifA';W^-'Cst;'.f'!?>'^'
                                                                                                                                                  C^.'r''l^>'';;vi''^'';^-S^
                                                                                                    ' '. l-"/'l''


                                                                                                                                                  ymim.
                                                                                                                                                   . ... ••:'-,":r*:u'T;.^i.:(;,;.',.j'-:;^;i



                                                                                                                                                  ysM:
                                                                                                      ,   .           .   ;           ,   •   ;
                                                   NEW   METHODSCNEEDEDSFOR
REPORT TO THE CONGRESS                             GHEickiNG PAYMENTS-MADE
                                                   tiTf; COMPUTERS

            '^•B-:'I!/9:'^W--1
            Mie;|^y;iJttin o f a p c o u n t i n g , auciiJting, a n d
            ippfit^icpl::^^;:!^ in the Fedetai GoV(^rnment has
            !?eyMyed^^^^
             •'V^iiiil -i^ig^                                    estab-
             lished/-1^^^^        to the huge, decentralized,
            :Cci!?riE>ut<^rize   largely cashless system used
            :';i^daYy^^}.'^;
             EE^FEGT iOf AUTOMATED DATA PROCESSING SYSTEMS
            ituhajB^;^!^    beien GPverninent pplicy that those
            V^hbi^a^prpye payment of Federal funds take per-
            sPnal Iresponsibility for the accuracy and l e -
            tfalltY; P^^^ payments made. Before the advent
            pifmet:hswized tabulating equipment and ulti-
            mately t^^ compiiter, when payments were pro-
            cessed by manual methods, the persons having
            this resp^                could readily examine doc-
            uments that enabled them to make such a deter-
            minatiPn.
             For example, the responsible person could e x -
             amine an order for purchase of an item, a
             documerit showing receipt of this item, and an
             invoice from the supplier showing his charge
             for the item. Thereby he could reach a con-
             clusiph that the payments were properly a u -
             thPrizedv the amount w a s accurate, the goods
             or seryices had been received, and the Fed-
             e r a l (abyernment had incurred a legal obli-
             gatiPri.
             Since the 1940s the situation has changed con-
             siderably and the responsible person (called a
             certifying officer in civilian agencies and a
             disbiirsing officer in defense agencies) often
             is requir    to apprpve payments for large
             ampunts as being legal, prPper, and correct
             withbutjexamining the basic dpcuments on
             which jth^ determination was preyiously made.
              This change is largely attributable to the
              great y61ume of Pederal payments being made
              today; arid the use of the computer to make
              them.
Taar fih—t. Upon reinnoval, the report
cover date should be noted hereon.                                    FGMSD-76-82
 Curri^rit^lyi^ f t h e Feiderai iG<y^
.'abolifc:y^$'7^0'0:;,:'^b 1 ipriv:^:ia:riri;U;all^^i;;'f^;MPs|^^:^
 ;paymP:ri:tsv^}ai:e''pr.ocessi^d/
'• t^s.V'-!wh:iGri: o f te-ri': ..do^ .'nbt?;;ip:r:oyid^'ti.ther.':;^^
 d:ata:^:th^;;^c^r t i f y.i,ng\op.r-•idisbur-s-ing;^^^
 cari^ readil;^ examine',''.;-vAmbynts^:-"d^q.e::':;;eT^^
 for salijty inpayments a r e P^lpialafed i r i s M
 compu:t(ir:y;system,' ' The~:"f'M^tprS::;:used^ t'b'-^vnia'l^'efS^i-p
  t h e s e icdniputations a r e r a r e l y c h e c k e d ;by^^
 c e r t i f y i n g : o r d i s b u r s i n g o f f i c e r . Th#prp;f^|:S;
 cess Pf matching an order for an item withlin;^^^
 receiving documents and a vendor's invpice;|;i,y^^^^
 is often performed by computer at locatipris||:
 far removed from the paper documents inypl\^pd5.
 Again, the certifying or disbursing Pf f icer; ^ J   ^
                                                      ^
                                                      ^
 has little opportunity to examine the dpcu- ;
 ments supporting the payments.

 In some instances, certifying officers are
 presented with computer tapes evidencirig
 payrolls involving millions of dbllars.
 There is virtually no practical way they
 can satisfy themselves by examining sup-
 porting documents that the payments being
 made are, in fact, accurate arid legal since
 they cannot read the tapes or check the com-
 puter computations. Regardless of this situa-
 tion, they are asked to certify that these
 payrolls (usually a grand total) are ac-
 curately and legally computed and to take
 personal financial responsibility for any
 errors,

 NEW METHODS NEEDED
 TO ASSURE ACCURATE PAYMENTS
 The age of the computer calls for a change>! • i
 in the approach to determining whether: pa^;T^^^^^
 ments ar^ accurate arid legal. V^rificattapnign
 of transactions by certifyirig arid disbursirigl
 officers is a valuable task, butKthe m^thodSri
 employed need to be revised to; icPnform t^
 modern technology,    (See ch. 3v);
  This revision can best be accomplished by 5i^^^^
  informing the certifying offic^ripr dispirsgf
  ing officer whether or riot the ?netw;ork;:pf^
  computer system controls is furictiPnirijglf^^^^
  properly. With this infprmatioirij,; theyC;iwpu|dn
  have a reasonable basis for ait-testirig^ j^^
  legality and accuracy of paymerits    -madeyyyy§
                                     ii                          "yyyy

                                                                               •ij.
v\-'''Au''




             v;;>5;::-J-::::|;:'::||^hji|^^
             :;:^-^|||;'£';:i;.^:#i^d^^
             :/yyyi/fw^^j^^^^
             yyyy:^^^$30^ay^^                                                   • s. 'tespprisi-i.,/ •
                ;;• Pi;';;;;;:;v;}'biili^^ V'-i^hc 1 ud(§;;Sidpri-t^i|yi.n0;-:::;putmoded:'• p r o - •''"
             ::;E:|S:;9#.^^                                                              ••
             rsw-:s!:PiESWlix^1^                                        .systems
             y^iyy^^!^                                                is requi-red, .•
             ;v;;vWi;:J:i;;\::^ri:^^                      -to "'issue and' aaminis-
                     ;.:-/^;!#';i|ie;^-'!;;;r^<^                .the systematic
             y - y y y ' y ^ m i s m - ^ y agenci&is ofv their operations.
                ;•; • ^^^^;^^^^^                       the Director, Office of
             ^^^^ ^^^^^^ ^ ^^^^^^^: -M^         and Budget, issue guidelines re-
                         ^''^^•'^'i^W'ii^ department and agency heads to:
                               -^Diesi^nate an operating official at the
                                   Assistant secretftary or comparable level
                                   to review each automated payment system
                                   and the controls built into it to deter-
                                   mine whether they are operating effec-
                                   tiye^Iy and can be relied on to compute
                                   payments that are accurate and legal,
                               —Direct that such reviews be made at least
                                 arinually, supplemented by interim checks
                                 of major system changes,
                               — D i r e c t the certifying or disbursing of-
                                  ficer to certify or disburse automated pay-
                                  ments only when notified by the designated
                                  operating official that the automated sys-
                                  tem aind the controls built into it are
                                  bperating effectively.
                               --^Requi^ a written statement from the des-
                                 jignated operating official if the official
                                 djsteirmines that the system is not operating
                                 effectively and that corrective action
                                 ppuid not be taken before the next voucher
                                 preparation. This statement should enumer-
                                 ate the steps planned to accomplish adequate
                                  system controls and to recoup erroneous pay-
                                 miintis that may result before correctiye ac-
                                 tibri vcan be taken, A copy pf this statement
                                  should be provided to GAO for its considera-
                                  tiori in reviewing agency systems and ac-
                                  couritable officer activities and in subse-
                                  quently considering any accountable officer
              Tear StiBgt                                       iii
• • /;r'equie^s3t:^::?f o r •, rel^ie-fclifr pnt;^:^,ilabil.i^y;?-f 6
 ;--f;l:eg^l^:^!br;:Unaccutiit,e,?;|^a
  • • ' m a t e d l - p a y m e n t . .'..sys-tems^.; •;•;••;:.

—-Provide that, when significarit: system- dprr;
  ficiericiies are identif i^d/:t^
  operating pfficial must ciS|Si3^
  bi:lity£:fbr subsequerit certification that,
  on the J bas is of available eyide(rice, the
  paymeritsi are otherwise prpperi^f The off 1^
  cial shpuld continue to certify paymerits
  until he or she informs the head of the
  agericy in writing that the system is pper--
  ating effectively,

GAO also will require certifying or disburs-
ing officers who request relief from illegal
or inaccurate payments made by automated sys-
tems, including operating officials desig-
nated to certify payments«when system defi-
ciencies are noted, to show that they could
not reasonably have known that the payment
was illegal, improper, or incorrect. In
reviewing requests for relief, consideration
will be given to whether or not the officer
possessed evidence at the time payment was
approved that the system could be relied
on to produce accurate and legal payments.
 (See pp. 16 to 18.)

 AGENCY COMMENTS
 The Office of Management and Budget and five
 departmerits which commented on this report
 generally agreed that automated pjayment sys^
 tems should be reviewed periodically to as-
 sure their reliability. They aliso raised
 some related issues. (See ch. 4.) GAO is
 sending copies of this report to all depart-:
 ments and agencies for their irifbrmatiPri,
 use, and guidance pending issuarice of guider^
 lines by the Office of Manageinent and Bud-^ ;;
 get.




                                     IV
                            :0::oyrt.:^e/m:xy^y::y^^
Wyy AyM:y yyAy :yy:::/yAy Ayy            yy^yyy/missj^
mmi^^jSifyAAyA/yr':/:--^'--AAA::AAAAyAA''•''''^•AA^yA:^MA-
:Mjm!00:y$iyyy                                   y:y::yy\
yy/Myyy/:m!s^iaWc^                                          . y-/:(:yy
yy:yyyyyyyy^sppns-ibii±tY                          and
/•y:::yy!y'/:My^:/"-'^^^^                                      .'."'"•" -^z
 •\-:/yyyy::i:y:§yyiP\^^                                           • ;i2..
  y/yyyiiyhyy^^^                                  matters           3':.
   ;:i& ;^V :       fc^^         TO -EXAMINE, CERTIFY,
      -V:       I ^y MTO^ DISBURSE i^AYMENTS                          4
  ::-<-[y:-:r:-::y :;y/y0^3mMai:-^s^                                      4
                  yyPiUtomate^ systems                               4
                         Annuity payment systems                    6
                         Payrpll systems                            8
                         Purchase systems                          10
                   : Some systems not reliable                     11
    3            NEW METHODS NEEDED FOR CHECKING PA!^-
                   MENTS MADE BY COMPUTERS                         14
                     Conclusions                                   15
                     RecPmmendations                               16
                     Future requests for relief of certi-
                       fying or disbursing officers                17
    4            AGENCY COMMENTS AND OUR EVALUATION                 19
                     Need for review of automated payment
                       systems                                     19
                          Agencies' comments                       19
                          Our evaluation                           21
                     How frequently should reviews be made?        23
                          Agencies' comments                       23
                          Our evaluation                           24
                     When should accountable officers certify
                        and/or disburse automated payments?        24
                          Agencies' comments                       25
                          Our evaluation                           25
                     Agencies' comments on other matters
                        related to accountable officers' per-
                        sonal financial accountability and
                        responsibility                             28
                          Personal financial responsibility        28
                          Our evaluation                           29
^;:i,;-i.';0/




                CHAPTER
                              Is the concept of certifying
                                officers outdated?                       29
                              Our evaluation                             30,
                           SCOPE OF REVIEW                               31

                APPENDIX
                      I    June 2, 1977, letter from the Deputy
                             Director, Office of Management and
                             Budget                                      34

                  II       May 24, 1977, letter frpm the Assise     y.
                             tant Secretary for Administration,     N{
                             Department of Agricult^ure

                 III       June 23, 1977, letter frpm the
                             Assistant Secretary fPr Administration,
                             Department of Commerce                      :-'^^|l:
                  IV       June 3, 1977, letter from the Assis-
                             tant Secretary of Defense (Comptroller) ::,i4||:|
                           May 19, 1977, letter frpm the Inspectpr
                             General, Department of Health, Educa- :
                             tion, and Welfare                           '/^Ui.
                  VI       May 18, 1977, letter from the Fiscal
                             Assistant Secretary, Department of
                             the Treasury                                •*^4Wi
                                ABBREVIATIONS

                 GAO       General Accounting Office

                 HEW       Department of Health, Education, and^ip

                 OMB        Office of Management and^Budget

                 VA         Veterans AdministratiPri^
                          CHAPTER 1
                        INTRODUCTION

     Automated systems are used to process billions of
dollars of Federal disbursements. These include
     —most civilian and military payrolls;
     —most benefit payments, including those administered
       by the Civil Service Commission, Railroad Retirement
       Board, Social Security Administration, and the
       Veterans Administration (VA);
     —income tax refunds;
     --public debt redemptions and interest payments;
     --reyenue shar ing payments;
     --many grant, loan, and contract disbursements;
     --•-reirabursements to the Federal Reserve System
       for Government checks paid by the System; and
     --many payments for equipment, supplies, services,
       rerits, and utilities.
     The Department of Agriculture and VA are in the^ process
of centralizirig and automating all types of payments. If
the paiyment Centers prove advantageous, other agencies can
be expePtedtp follow suit.
RESPONSIBILITY- FOR LEGALITY AND
ACCURACY: OF PAYMENTS
     Payments Jmade by the Government must be legal and
accurate; to prevent losses tP the Gpvprnment arid tp avoid
unjustly eririching payePs who are oyerpaid or imppsing hard-
ships pn payees who are underpaid.
     To help insure that payments are legal and correct, the
Budget and/Accounting Procedures Act of 1950 and related
laws place-responsibility on:
     --The Director, Office of Mariagement and Budget (OMB), to
       isSvie airid administer regulations concerning the
       systematic review:.bY,';;a^erici^|^^o:f^^^^
       'on a continuing'.baisi:s:i:..:.:.;;^':---y^^^^^^^                           ':'-'':yyi0y/
       Executive agency head^ to estabiish and maipiain::?^^^^^
       systems of accounting arid iriternail coritrPlifp^ig^^
       to provide effective coritrpl over:andaccpurtta^
       for a l l funds, property, arid p thei: a s s e t s :|Ppwhiph;£|^^^^^
       the agency i s responsible, incliiding apprpprf^at^gg| • | | |
       internal'-':audit.                                   '•/yyyyy
     — T h e CpmptrPller General to prescribe the prinpiples,^ g
        standards, and related requiremerits for accounting ^v;
        to be observed by each executive agency.
       The heads of civil executive agpncies to destghate
       employees to certify all paymerits and b e personally                              iv
       accountable therefor (certifying o f f i c e r s ) .
     — T h e heads of other executive agericies (princtp^lly i c
        the military departments) to designate emplpyfes -t^, , .
        disburse payments and be persPnally accountable
        therefor (disbursing o f f i c e r s ) .
     The Comptroller General's principles and standards ;ire^w
lating to control over disbursements require each paymen^ ^^^^; g^
voucher to b e :
      — A p p r o v e d by an official cognizant o f the facts.                     g |
                                                             "•'.:'.   '.'••'••'   •''.   y y :

      — A u d i t e d by the agency prior to certification tp;,
         determine that the goods or services have bpenif ,i^^; ;fe^
          received; the quantities,      prices> and computations^ g^^^
          ar e acciir a te; the paymerits ar e pr oper ly authpr^zef y,gg;s
          approved, and documented and are permitted burlawv^^^re^^^
          in accordance with applicable agreements, ,an<l^:;p^^
          have novt previously    been made; the appr opt iat^p;:||s'g^^^^^
          from which the payment will bp; made is; ayailape;,|or .g:
          that purpose; and all applicable discounts           andji|:|grtQ
          deductibris have been taken.                      y/:yyyy:yy:
       —Certified    as required    by law. /              ^ yyAAiyAA.
 PURPOSE OF REVIEW .                                 •••-:?£;^-.,Si-|viiS!
      We reviewed the processing P f various kirids|b|||pnpritsg
 with emphasis o n computerized payment:s/: in 25 a c t p i l ^ e j p i i ^ ^
 22 executive departments and agencies;. Our inten^^wastp,^^^
 determine how well certifyirig arid disbursing f p i i p p r ^ p u ^ d ^ ,
 ascertain the accuracy arid legality pf;payment:s|^rtA|tOi|.^p^^^^^^^




                                                                                                  SI?
¥<iefle|iti|p|Si^^^
;;:ipi(d!ai!^^pr^|y^
;riEiiNiiiEiiRii|ife'^^^                                                                .;•;.-;/-• •
;';;;:/-:r;::;v;;i^;;^e::^tt?ii^^iir^
;:fp^.;;:;;/iii|«^piijM^^iP^
 •irip,l:\id^riif;;^l^
 ;:":{:;;;':;;7:?';ri-:'';|ifipi^                                       •. A u t b m a t P d ; f ; - D e c i s i b r i ^ l i ; ;
•::;.:yM-;:'^^::i;:y;ma:il^rip;-B^^                                          Federii'Gbveiririm^tl-"'
yLy/y:/i/p^                                                                       • • yy:i •: -;• / y y
  : y : P-rS^X^lc^^                                                              Programs"
K^''-:;:fv;;:;Sj;:;;lfC^
: S^^^                                                                     Protection For
      ;>^?^^^^^^^/; B ^                                                     Facilities"
.••;:'^:;Mi'M^^                                       1-976;)-.;':;/'
^^^^^ • :T                                   Security Income Payment Errors C a n B e
     ;:I;V vR^^                         (HRD-76-159, Nov. 1 8 , 1976) .

   yyy--:-ytli^€i^-:'/Tc^- A p p l y A d e q u a t e Controi;s I n T h e A r m y
         KuStkhda^^                                            Implementatioh
 : -/y::y!TMtiatis4-:r]iii^^                 (FGMSD-'77-4, Jiiiy 5 , 1 9 7 7 ) .
     ---"Computer Auditing In The Executive Departments:
   ^ X   N^^       Is Being Done" (FGlMSD-77-82, Sept. 29,
     y^'yys/iyy:                                                                                                 -•/'/^y
                                                                       : .;ii c'i'SsfSWs^lSlfiv




                                  ^cHAPtM/yy/yr ;^. •'. /y:yyAyAA/>^ASSii$'
                        METHODS USED TO :EXAMINE>v
                    CERTIFY, AND DiSBOitSEmYMENTS;

     Our review showed there were Widejiyariatiortsliri^^^^
methods used to examine and .c.er.tify;;;paymfent.s'w-';-'';;;;l^
variations related largely to whetherrtiariualof;PPmprit^^
data processing systems were. used..v' '-", ^^'.":••';;•:•;'
MANUAL SYSTEMS                                              ' • • ^^•'^.i;SiSiSiili3J
     In manual data processing systems,;:the certifj^ing^ or^^^^
disbursing officers usually super.yised:;;;;the pjay;ipier;;kS;^-^^^^^^
voucher examiners, and similar employPes who cpmpufet^^^
and/or verified the correctness pf trarisactioris,;ti;^^
employees examined the source documerits suppprtirig;^^ 1 ^ ^
and made sure that
      — e a c h transaction was supported by proper, documeri*;^^^^^^
         tation arid was not obviously improper or incp^reptj;^!^^^^^^^
      —each dpcument had been' •properl,y-.':::approvedf;:;;ari(d|;;:M
        'processed;.-through all-' the''.required' -stepsf-eix^tiy^^
        was complete;                         •           • •yy:y:yyyy-/y
      — t h e data in the various documerits;was cpnsisfe^^
      — a l l computations were correct;;;;:and
      — t h e transactions complied;-:with;;':the lawsV.;-;r;iiile]s;r:i^^^^^^
         and regulations which ^they''wer^ieE;responj5i!bl-eSfpit^^
         enforcing.'^                      ••'.•;:••;;;';;:-               -'yyyyy&yy
     The key employees who processed transactipris^is
initialed the source documents arid, i n M ^
the certifying or disbursing ofiicers itbat theitt^aris^pti^
were legal and accurate. These dpcumerits were;|therii|prP^e;n^^
or were readily available, to these pfficers;arid|tG^^
the basis for certification or disbur'semiBnt.;;'-;::;;':.^'^^^^^
AUTOMATED    SYSTEMS                                           l/yyyAAA/::
     In automated systems, certifying pr disbursing.;^^b^^
do not directly supervise the entire ^J>rbcess^^^^b^^^
basic input data, computing payment amounts, airid;|ni!a;irit^
records of payments made. They must rely on t:hPse:;i^hp|^^^^




                                                                                                  -^
priginatex;t:r           arid Pn the; cPmputer systems and;^the
cbntfWl^is?:^^                                   extent, in cef^-
tifytrig'^^thatvp^      are proper, legale and accurate.

   ; Taa^                 degree of this dependency, the
deyeiPpit^ritlpf^^^                            be taken into
acppunt, •;';A^            systems grew in stages from the rudimen-
tary ixufiched^^^^^^     systems of the 1950s to the high-spePd,
self-cbrttrpllied^^^^^^^                computers of today. While
few Fedi^r^i a^^^^^         still use punched card equipment, many
are still using relatively simple secPnd-generation computer
systems for prbcessing payments.
      Punched card equipment eliminated many manually pre-
pared a;rid maintained paper records and replaced them with
machine-rprepareid punched cards. Punched card systems still
prpvided accPuntable officers with physical records (print-
outs) that thfey could rely on as evidence to support pay-
ments. The cards, like documents, could be counted,
tabulated, stoired, and retrieved as needed.

     With the advent of the first- and second-generation
electronic cpmputers, many of the punched card records and
files were replaced with magnetic tape. The problems of
accountable officers were compounded in that they no longer
had tangible records they could see and use, except when
intermediate hard-copy printouts were prepared. These print-
outs showed how the data was processed, and the reels of
magnetic tapia could be stored and printed at a later date
as the need arose.

     In current third-generation computers information is
volatile, esppcially in real-time systems; old information
ceases to exist as soon as new data is created and redbrded
unless speciaii steps are taken to save the old data. Con-
sequently, accpuntable officers no longer have tangible
evidence shPwing how data was processed and payments
calculated.

     Certifying or disbursing officers have always had the
responsibility to satisfy themselves that payments are
proper, legal, and accurate. In manual, punched card, and
early first- and second-generation computer systems, account-
able officers could, to some degree, independently investi-
gate the propriety of payments by reviewing documents,
punched card files, and related tabulations, or intermediate
computer printouts reflecting how data was processed. How-
ever, in mpdern computer systems, accountable officers have
no way of independently investigating the propriety of
computer ^generated p a y m e n t s . I n s t e a d , Jthey m u s t rMlV'^^lw^
s o l e l y o:n" t h e computer systems'."

          T h e automated s y s t e m s w e reviewed p r o c e s s e d larger;^:;^:^^
v o l u m e s o f p a y m e n t s . T h e d a t a in t h e spjjrce dpcuinenl:^
e n t e r e d in the c o m p u t e r s , and t h e d a t a , r a t h e r thani^thierltlS^^^^^
d o c u m e n t s , w a s then p r o c e s s e d . T h e f u n c t i o n s p £ 1^(^jpi(yjcid^^
c l e r k s and voucher e x a m i n e r s w e r e perjEormed b y t h e p m p l < ^ ^
w h o p r e p a r e d , t r a n s m i t t e d , t r a n s c r i b e d , a n d contfpiii|d5 the^^^^
d a t a e n t e r e d intp t h e computer s y s t e m arid b y computer l ; t ^
p r o g r a m s , e q u i p m e n t , and o p e r a t o r s .

          P a y m e n t v o u c h e r s w e r e p r e p a r e d from c o m p u t e r - p r o d u c e d
t o t a l s and u s u a l l y showed o n l y t h e t o t a l s o f l a r g e g r o u p s ;^^^^^^^
of p a y m e n t s , w i t h i n d i v i d u a l p a y m e n t s b e i n g conta;ined privyanj-S ;^^
a t t a c h e d m a g n e t i c t a p e . M o s t o f t h e c e r t i f y i n g offifee^rs-V^^
p e r s o n a l l y or through e m p l o y e e s reportirig to them, cpmp^i^Pd ;p^
the v o u c h e r s to some sort o f o v e r a l l c o n t r o l t o t a l . Most:^^•;^^^^^
of t h e c e r t i f y i n g or d i s b u r s i n g o f f i c e r s said t h e y hadltp-^^^^^ ;?^^^
r e l y o n t h e s y s t e m for a s s u r a n c e o f t h e c o r r e c t n e s s o f Jthe^^ W^^^
payments.

          Spme e x a m p l e s o f the a u t o m a t e d p a y m e n t s y s t e m s w e
o b s e r v e d a r e listed b e l o w .

Annuity payment             systems

      We o b s e r v e d the c e r t i f i c a t i o n o f iponthly a n n u i t y payr-7;;v|
merits m a d e b y t h e Air F o r c e , t h e C i v i l S e r v i c e Commissionv^^;}^^^^
and t h e R a i l r o a d R e t i r e m e n t B o a r d .

          In all o f t h e s e s y s t e m s , r e c o r d s o f a n n u i t a n t s ' erititiieg'
m e n t s , p a y m e n t s , and d e d u c t i o n s w e r e m a i n t a i n e d by; Pomputfer^v'^;^
C h a n g e s o f e n t i t l e m e n t s , d e d u c t i o n s , arid other dataIsju^
m a i l i n g a d d r e s s e s w e r e p r o c e s s e d into t h e computei: file^;S;f:^^
t h r o u g h o u t or at t h e end o f t h e m o n t h . O n c e a mprith ?th(e|^;;|^^^
f i l e s w e r e p r o c e s s e d to p r o d u c e m a g n e t i c t a p e s corit'airi^irig?:;::;:;^^^^^
c o n t r o l t o t a l s and t h e d a t a n e e d e d to w r i t e a n d m a i l chSee^
to r e c i p i e n t s . Payment v o u c h e r s w e r e p r e p a r e d frPni ;the^;:Sf^;S^^
control totals.                                                                    .•-r^ i;-;§;SfM!-S||

      The vouchers, which were certified (by the ce0::i/typLiiqj//y
 officers) and disbursed (by disbursing officers) ,shpWed;Sv^^^^^^^
 only the totals of the payments. The individual paymerits;Ci^^^^^^^
 were contained in tapes which were used to writP arid|;mail;;;||^^^
 the checks.                                                                        • •':':'yyyyyy
       y - Air FbtcP^^ re tired pay system
          ; As^< p^^          1975, the Air Force retired pay system
     pa:id;gab<)Ut';^^      retired military personnel whose
     arinualpannu^                                     The data for
     thfese ;;jp|yTB^       compiled by the fiscal branch, supjpprt
     diyisibrii^sdife^             reserve and retired pay. Air iFiorGe
     PirianPe|<i€nt<B^^^^ The fiscal branch prepared a monthly voucher
     for" th^ tptetl^ m         payment from control totals which werie-
     preparpdJ^aT^d r^               other organizations. The branch
     superyispr> ici'd^      also checked the totals of the checks
     writteri; agairist^^^    vouchigr. The amourits paid to indty;idual
     retiteeisSw;ereidetermined and verified elsewhere. The dis-
     bursing-pffic^          was accountable for these and all the
     other :papien5t|5;m^    by the Finance Center was an Air Fprce
     captain who yws^^^^^       of the accounting and finance division
     of the direct^^^^^^    of resource management. His division
     mairiti^iried accpunts for and disbursed about $7 billion an-
     nually, but tppk no part in determining the legality or
     accuracy of the amounts paid to retirees.

          Civil Service retirement system
          The Civil Service Commission paid about $7 billion to
     about 1.3 millibn retired civil service employees or their
     survivors during fiscal year 1975. These payments were
     certified by the GS-11 chief (or the 6S-7 or GS-9 assistants)
     of the review and control unit of the fiscal divisiori of
     the Bureau of Retirement, Insurance, and Occupational
     Health. Additions, deletions, and changes to the master
     file were verified and transcribed from source documents
     onto computer input forms by other organizational units.
     The computer input forms were sent to the review and con-
     trol unit, which established controls over them and serit
     them to the data processing unit for input into the
     computer.

          Once a month the computer processed the updated master
     file to produce control totals of payments and deductions
     from which the payment voucher was prepared and certified.
     The voucher and a magnetic tape containing all the changes
     made tP the master file during the month were sent to a
     Treasury disbursing office, which used the tape to update
     a duplicate master file it maintained and used to write
     the checks. The chief of the review and control unit said
     that she relied on the other organizational units to
     provide reliable data.




L.
     Railroad retirement pay system ;;::•;                 '://:-y/yy:/'•//{
     The Railroad Retirement Bpai:|l|:Sj-iaiitomated ;sYst<eift^ 1^
about $3 billion to 1 million retirisd railroad^^^iw^
their survivors during fiscal yeeir; 1975. Mpst P^|;th€iii^^^
ments were certified by the GS-7: supPrvispr of theSpayi^
and notification unit, payment fecprdSf sec tiPriJ^^^
of special services and payment rpcpr^;s;. Bureau of V B ^
Claims. The unit receives ad jud ica tfed-phangpstha^^^
manual computation (such as retroactive; changies);irii;iB0tki^:s4t^
computations, transmits them for inputs into the bPinpyie^^
and checks computer outputs to see that the data ]ha^;laeem
properly entered in the computer. Al:l other chauagies4«pfi;p^^^
transmitted directly to the computer input unit bi^iit^e;;?;-}^
adjudicators, bypassing the payment arid notif ica tipri^vuwit;.^^;®^
     The computer master file is updated once a mpnth^aiid;;^^^^^^^^
control totals and payment tapes are produced. Thjecpn
totals and payment tape totals are balanced by anothpfctiujrii^gS
and are sent to the payment and notification unit, vrKid^
prepares and certifies the payment voucher from the^cPritfblv^^^
totals. The only payments that the certifying offitier^lcpnl^Sl^^^^
trols or has knowledge of are those requiring manual :/cpmpitt^
tation. The responsibility for determining the le^alifey;;pjE^^^^
all payments and the accuracy of the mechanically icpmiput^s^^^
payments is shared by many employees, and the ceftijEyitigl^: g^
officer does not have the documentation necessary to |inakel ;^
such determinations.                              • ': /y:-:-//^://
Payroll systems                                                        yy/i
     Today nearly all Federal payrolls are computer ized .and ||;|
involve millions of people and billions of dollar^s. ; 0 M n i i||
     We observed the certification of payrolls in seyPrwal§::? ;:^^^^
locations, the largest being in the Air Force and    vK'y/y/y^
     All of the automated payroll systems that we pbseryi^
operate in basically the same way. '!rhe computer maintairi^
file containing a pay record for each employee. =feacfr^^v|^
record contains all the information lexcept the-hPu^
needed to compute each employee's gross pay and deductibri^
to prepare checks for employees and recipients bf jdpdUPtib^^
and to prepare reports of earnings, deductions, arid|;pa5^6n^
at yearend. '                                    '•/y/yyyyy
      During each pay period records are added, deletied>0^
 changed to reflect hires, separations, pr omo t ions Ve^P;c^^^

                                  8                     ..... 'y//y/y/
the end of each pay period,; the hours w6^       by each civilian
employee are entered;iri the, system^^^^^      computer prpcessps
the records to produce the listings ari^^^          needpd to
prepare pay checks, savirigsBbprids, taxl^P'^yments, and so
forth^ and control totals for accpuritiniglpurposes.
     Air Force military pay system
      The Air Force military pay system is centralized at
the Air Force Finance Center in Denver, Colorado. As of
June 30, 1975, the system paid about 600,000 Air Force
persorinel whose gross pay totaled about $4.4 billion
anriually. These payments were checked by the GS-11 chief,
disbursement branch, accounting division. Directorate of
Military Pay Operations. The accountable officer for (1)
pay deposited in banks (about half of the total net pay)
and (2) deductions from pay was the Air Force captain pre-
viously mentioned (see p. 7) in connection with the retired
pay system. The accountable officers for the rest of the
net pay were the disbursing officers at various Air Force
bases whc, on the basis of data electronically transmitted
to them from the .Finance Center, wrote checks payablo to
individual airmen.

     Routine pay change data was entered in computers at
about 275 Air Force field offices and transmitted electroni-
cally to the central computer at the Finance Center. Non-
routine changes were entered by the Center. The Center's
computer processed the changes and prepared the monthly
payroll, check iistings, and related control totals. A
voucher was theri prepared from the control totals.
The GS-11 branch chief who compared and balanced certain
control totals had no way to verify the accuracy of the
individual paymerits because he saw no source documents and
the volume Of changes (1.3 million in June 1975) iTsade such
verification impossible.
     The disbursing officer said he relied fully on his
employees to cPntrol the check-issue and accounting func-
tions, and hp had no way to determine the reliability of
the employees and systems not supervised by him that
prepared and processed the payiaents to retired and active
Air Force military personnel.
     VA pay system
     The VA pay system is centralized at its Data Processing
Center in Austin, Texas. During fiscal year 1975 the system
paid about $2.9 billion to 200,000 employees. These payments
were certified by a GS-9 supervisor in the payroll account-
                                9
••'•;•   ;1




              ing unit, finance division. The division is ;respbrisibip:^tp^
              the VA Controller to maintain certain accouriting;;cpn
              over the data processed by the 500 or more emplP5rePl|b^^
              department of dalta management at the Center .Charigesjjt^^
              the pay records and hours worked were transmittpdfii^lc^^
              form by 233 field stations to the Center, cprit:rpll3^d :a:-;g^^
              by the analysis and control division, and processed; byliM^
              computer in the operations division. The payrollyacdourit^
              unit compared control totals maintained by other pngpin|^|||f||
              stations and, on this basis, certified the paytollvpuche^fe^l'
              prepared by the computer, The individual payments w^
              listed on magrietic tapes which were sent to a Treasuryl^ia^iS^^
              bursing office for disbursement. The certifying bfficierav^^^^
              had no way to check the legality or accuracy of ^the vindi^ifi;
              dual payments since the substantiating documents werje^;^^;!^^^
              retained at the field stations. She said she reliPd pri^^^^^^;!
              her experience with the system for assurance that thp            Jf;;
              employees, controls, and system were reliable.

              Purchase systems
                   The centralization and automation of payments for       ; -J;
              purchases of supplies and equipment is a developing tf prid i,:C
              We reviewed the systems used by the General Services Admiri--;;;:
              istration and VA.
                   General Services system
                   The system processed the payments for warehPUsP ;/ i-'^^^^^
              replenishment purchases made by the 10 regional pfi&icPs.^^;:;^^^
              During fiscal year 1975 the system processed abo;ut 1:78y000:1 S
              payments totaling about $768 million. These paymerits^;^!^^^^^^:^^^^^
              were certified by a GS-13 chief of accounts payable. ;;";;§
                   Prices, quantities, and other infprination pertainirtqi^t^^^
              to goods ordered and received were eleGtronicallyltf;arisl^^&^^
              mitted by the regional offices to the computer sit€!|whefei||l^
              they were entered in the computer. The vendors suBmittedK^
              their invoices to the computer site, which also ;eritptpd£||^^^^^^
              them into the computer. The computer then cpmpaf;e<|il;thlf|^
              order/receiving data with the invoice data and-scbedUledlJ^;^^^^
              those that matched, prepared a check-issue ta^Paridp^^
              listing, and prepared a covering payment voucher;;;: f*^^^
              payment voucher was checked manually against the;viriy^
              for correct name, address, and amount, and on this; Bas^
              the certifying officer certified the cPVerirtg vPuphPrSK^^^

                   The certifying officer said the Pnly docunient:sj hip^^^
              were the check-issue listing and the covering voUc|iPf;;Mnd^^
              that he depended on other employees atnd the system to;;assii^p^^
                                                10                      •--•/yyyy
     fthiylegl^^       accuracy of the individual paymentsi
      ^^^^^ ; ^         system
       i ;Thisj^5^s^       paid the iriypices for purchases and
     admiri:i;ste;atiye]i!expense                    of 82 of vA^s
     233i; field s^              The system, Whibh is expected eyen^
     ttiall^;|%^^fvi^ all field stations, processed about 1.7
     miii!xpri;;|>ayme^^   totaling about $271 million during fiscal
     year ;i975>; T^        payments were certified by a GS-13 section
     chief otr; his/ass^            in the Finance Division,

           Some field ;Stations sent the original purchase orders,
     receiyirig reppfts, and invoices to the data processing
     center/but pthers electronically transmitted only the data
     and retained ;the supporting documents. In either case, the
     data wais entered in the computer system, which compared
     it and, if the-data all matched, prepared payment schedules.
     The certifying; officer certified computer-prepared vouchers
     showing the tptal of large numbers of payments which were
     included in accompanying computer-prepared listings or mag-
     netic tapes. The certifying officer's section was respon-
     sible primarily for reconciling control totals prepared
     and checked elsewhere. The certifying officer had no way
     to assure himself that each payment was legal and accurate.
     He relied upon the system, including the employees and proce-
     dures at the field stations,

     SOME SYSTEMS NOT RELIABLE
          We have observed several instances in which payments
     which have been processed by systems that could not be relied
     on to assure accuracy and legality were nonetheless certi-
     fied and disbursed. Examples follow:
          1. The Department of Health, Education, and Welfare (HEW)
     centralized and automated its employee payroll in 1965. In
     1968 we tested the system and found that, although internal
     auditors and study groups as far back as 1964 had found
     inadequacies in the system, effective corrective action had
     not been taken and errors continued to be made. We found
     that paychecks totaling $288,000 had been returned because
     they were erroneous. By our estimate, in the entire payroll
     for 1964, errors of about $900,000 in gross earnings, $3.1
     million in leave balances, and $7.1 million in the earnings
     and tax deductions shown on employees' annual withholding
     statements had been made. HEW subsequently redesigned its
     system to improve its accuracy (B-164031, Jan. 17, 1969).



                                     11

li
      We are following up on the^actiprij^ takeri:^^^^ b ^
the first of a series of planripiyiv repbriSs on thlsferi"^i;]pay^
roll system, we estimated that ;fpr p a l ^
7,200 payrpil checks issued were later4^
the. payees''were not entitled to;';;the'fjpirbPeedsi/;;;;*^^
estimated that wage and tax statemerit;^ pontainpd^^';^^
ments of gross pay amounting to $738,ipOO and thefpayiftrecord
contained erroneous gross pay amounts of $1.1 mill^ibri?;';;:;^
(PGMSD-76-68, Aug. 24, 1976).
     In the second report, we brpught to HEW's attenttbn; S^^
the need to follow required procedures for billinq arid^Wpli^^t
lecting thousands of dollars in salary overpayments yy^'-yy/y:
(PGMSD-76-96, Jan. 5, 1977).
     In the third report, we brought to HEW's attentipftfthes;!
need to improve its payroll system for the Coramissibned " ?i^s:|i
Corps of the Public Health Service. We recommended tlmt;^^^
(1) provide adequate controls to help insure that pnly|-^; ;; S
authorized and accurate payments are made, (2) fully im^
ment controls to prevent unauthorized payments under dutPfrjfBf
matic check processing procedures, (3) pay housing airid? b;iher|
living allowances on the basis of current rates, (4:);7Ppllect|
debts due from Corps officers promptly, and (5) evaluate ;;P||K
eligibility of officers to receive special retentibri bdriuses;
(FGMSD-77-23, May 3, 1977).                       '''.    /yy/M
     2. In 1975 we reported to the Congress on dpficipricie'p;
observed in a review of 66 automated payroll ing actlyiit^ips B^^
in the Department of Defense. The deficiencies inPluded^^^^ p^^
inadequate separation of duties to preclude fraud,; iriade^^^;;;|^^
quate physical control over equipment, records, arid cPmputpr^
programs to prevent unauthorized chariges, and inadeguate;;0^^
procedures to assure that all documerits affecting ipayy^^
promptly processed. We also noted that only 25 o'f-''^e:iSlS-/y/
activities had been reviewed by internal auditors witlii^^
2 years before our visits. Defense planned to cprre(Gtitl|e%
deficiencies we reported in a standard, Defense-Widptipa^rplli;
system it was developing (FGMSD-75-15, Mar. 24, 197^;);;;^%:$^^^^
     We recently reported to the Congress that the ArniyJVs^^i;;|^
standard civilian payroll system, the model develpped;;^fprM^^
the computerized system which may replace all Det^ns^^a^y^y^^
roll systems, did not contain adequate procedures :and;gc^
trols to prevent erroneous or fraudulierit paymerits;i^;l;;^iari^^
V7eaknesses were the same as we reported to the CprigrieSBiii^
March 24, 1975. The Army has taken or plans t o tajcP: ;acti^
to eliminate most of the weaknesses in the systemibefofP|i^
is used Defense-wide (FGMSD-77-4, July 5, 1977).

                                 12


                                                                      \'M
:,y:y^y^)^^:/B!ocji:a^ security Administration uses- a:;'h;;igh;ly;;;':^.!itp^^
m^t^idfl^jfst'dimut^^^      the monthly Supplemental ^SiePurity;^^^;^''^^^^^
iriPPme;;payi^          about 4 million recipieintsv Sbcial^                S
SPcurltyfe^tl          that fiscal year 1977 payments will
tbtal: abbut^^             of Federal and State funds. Social
S«Uritji^;;;als#            that over $1 billion was erronppusly
paid-tP;;f^            during the period from January 1974 to
Decembernl97Svi^v^^^ large number of these overpayments were
calUsed;; by iricpi^       untested, or uncontrolled automatic
datiaprpceissirig/ systems. For instance:
      T--We repiprted to the Congress that overpayments
        Ppuldrbe reduced $60 million a year if the
        system received accurate and timely informa-
        tion ;bn benefits paid to Supplemental Security
        IncPme recipients by the Railroad Retirement
        Bpard arid VA. Social Security said it is
        taking steps to obtain such information auto-
        matically from VA, the Railroad Retirement
        Board, and the Civil Service Commission's auto-
        inated systems (HRD-76-159, Nov. 18, 1976).
               •   .   ;            '   •   '   •




      —-We obSPrved that Social Security's quality assur-
        ance sample of payments during July to December 1975
        1975 showed total projected errois of about $425
        million, of which about 5 percent ($23 million) was
        attributed to the data processing system. We are
        continuing to independently review this system to
        determine how reliable it is in producing accurate
        and legal payments.
     4. The Department of Commerce paid $82.5 million in sala-
ries in 1974 to its 4,500 employees through use of a compu-
terized payroll system. Because of weaknesses in internal
controls, the computerized payroll system could not be
relied upon tp insure an accurate payroll or to protect the
Government from improper payments. Commerce has taken
actions to help insure that the payroll system includes
adequate internal controls (FGMSD-76-3, Nov, 10, 1975).
     5. The Department of Housing and Urban Development proc-
esses its payroll for about 17,000 employees on a central
computer system. A riumber of errors and overpayments iden-
tified by both GAO and the Department showed a basic need
for additional internal controls to safeguard the proper
disbursement of money. Department officials corrected
the design errors in the payroll system (FGMSD-75-31, June
18, 1975).


                                        13
                         CHAPTER 3
              NEW METHODS NEEDED FOR CHECKING
                PAYMENTS MADE BY COMPUTERS
     In manual systems, certifications or disbursements
are based on evidence provided by source documents and the
attestations of the employees who processed and examined
the source documents. In automated systems, this is not .
feasible; it would take too long and would duplicate much
of the work done by the computer and the employees who pro-
cessed the inputs, it is also infeasible to provide the
certifying or disbursing officer with a chain of signatures
attesting to the correctness of each transaction because
transactions are not processed individually, source docu-
ments are not readily available, and many operations arie
invisibly performed by computers.
     We believe the certification or disbursement of pay-
ments, regardless of how processed, should be based on evi-
dence that the payments are accurate and legal. In auto-
mated systems such evidence must relate to the system rather
than to individual transactions. Instead of certifying and,
disbursing officers being expected to be responsible for ex-
amining individual payments, they should be provided with in-
formation showing that the system on which they are.largely
compelled to rely is functioning properly. With this infor-
mation they would have a reasonable basis for attesting to
the legality and accuracy of the payments made.

     To assist agencies in evaluating automated systems, .
we have recently prepared four review guides: "Guide for
Reliability Assessment of Controls in Computerized Systems
(Financial Management Audits)," "Guide for Reliability As-
sessment of Computer Produced Data," "Guide for Evaluating
Automated Systems," and "Auditing Computers With a Test Deck."
These guides are designed to help (1) find out whether con-
trols over computer operations can be relied on, (2) measure
the risks in relying on computer-produced information, (3)
identify weaknesses in controls over computer operations and.
develop recommendations for improving controls, and (4) test
the adequacy of controls included in computer programs.
     An evaluation of computer operations performed in-ac-
cordance with these guides should (1) provide certifying
and disbursing officers with evidence of the extent to which



                              14
cora|iu;tef:Spf^            d a t a can meet requirements for assurinig ,
the^iegailt                           and c o r r e c t n e s s of paymients and;;(
idsri^ifir ;v^                        c o n t r o l s over computerized payment ;
syi^t<Bms; s M j t ^            accuracy of the computer-produced d ^ t a
iS''•mp;fe^vf u l l y ^ ^
coNctusi^Ni:'-S;-^,!Q;
      The aigPnpiP^^ that operate automated payment systems
Shpuid designate|an ppefating pfficial at the assistant
secretaryjiprc^            level to review such systems peri-
odically tp;d^           whether they can be relied on to pro-
duce legaiiarid; accurate payments. Such reviews should be
made^ at Ipiastv a^       and supplemented by interim checks
of major system;changes. They should be performed for the
desigriated .official by an agency component not involved in
operation pf the system.

      The desigriated assistant secretary or comparable offi-
cial in each agericy should be responsible for advising the
certifyirig prdlsibursing officer that the system is reliable.
If the autpmated payment system is determined to be defi-
cierit, we belleye the designated official should (1) deter-
mine whethier JE>iiyments must be made before the deficiencies
can be cpfrected and (2) become responsible for certifying
that the paymPrits are otherwise proper if they must be made
before system revision.
     The certification in these circumstances should be to
the effect that, on the basis of the evidence available to
thP designated official at the time payments must be made,
they appear proper, notwithstanding the fact that the uncor-
rected system deficiencies have been noted. We recognize
that the certification in these circumstances may result
in errPnePus payments. However, where urgency requires pay-
ment prior tP cpfrection of system deficiencies and where
the designated official takes all reasonable steps to as-
sure the corfectness of payments within the time available,
in our opinion the reasonable diligence and inquiry legally
required will have been satisfied.
     We believe that as a general rule the reviews of compu-
terized payment systems should be performed by an operating
organization rather than internal audit. We view these re-
views as part of an agency's system pf internal accounting
controls. The internal audit function, on the other hand,
acts as a separate, higher, and broader level of control re-
sponsible to top management. Accordingly, all certifying
and disbursing functions, including the periodic computer


                                            15
system reviews/ would be subject to evaluatiori p y - ; : M e - y 0 i : 0 § : y :
nal audit staff. We would not object, however'., ••toy:ii$0nc-i,^&yy/!:
assigning the computer system reviews to the iriterrilWliSludit^^^
staff, provided the staff does them regularly arid'Unfailirigly®^
     We recognize that, initially, the cpmputer system re-
views will be a sizable undertaking fpr the agencies. How-
ever, we are convinced they are needed. Also, once the ini- ,
tial review is completed and identified system weaknesses
are corrected, subsequent reviews could be more limited in.
scope.

     OMB's responsibilities and its relationships with the
executive agencies make it the most logical focal point for
directing the implementation of the new methods needed
for checking payments made by computers. OMB is responsi-
ble fpr assisting the President in the development and ef-
fective management of Federal programs. The Director's re-
sponsibilities include identifying outmoded programs and pre-
scribing Government-wide policies in the area of financial
management systems improvement. The Director also is required
to issue guidance concerning the systematic review by agencies
of their operations on a continuing basis. Generally, OMB
prescribes these Government-wide financial management poli-
cies by issuing directives.

RECOMMENDATIONS
     We recommend that the Director, Office of Management and
Budget, issue guidelines requiring department and agency heads
to:
      —Designate an operating official at the assistant
        secretary or comparable level to review each auto-
        mated payment system and the controls built into
        it to determine whether they are operating effec-r
        tively and can be relied on to compute payments
        that are accurate and legal.
       —Direct that such reviews be made at least annually,
         supplemented by interim checks of major system
         changes.
       —Direct the certifying or disbursing officer to cer-
         tify or disburse automated payments only when noti-
         fied by the designated operating official that the
         automated system and the controls built into it are
         operating effectively.


                                       16
•f:;;tn;i||piRe^:|lifir;B^
y y / i - 4p|l^itl!in|plbSE;f i c i a l                                  • :;d e ternvlrips;;;: ;t ha.!'::? jv
y^-5';-::'';';|3S3iiie|::^^


:y://yy40^^^fi§03^^l^^:--^
;I S'|:Sl;|HS|^ii|m||i|iri^^
    •'r;§f;|$f ^lpfi|lit^                                 t.lVp-5ac tiP.ri;'7bari|b^^
 :t::;£i;;;S;:'K^^^ai^
:y::yy/%:$&i00^§^koyi^                                                in';reyiew^rig'l;JK;^
  £.7;^-|j;feH:;'!ag;<g'rip
/ y yy^/^i^/:iy0m^!^w^etit                                            ; • a,cppuntablp:•;:^•;•'l;;;;';^;^
/•:yyy:^^j§$:$e^^                                                                                        y/yyy/
y y y / ' i lipg^ali-pi'g^in^afc^^                                   '. by • ^a u tpm'a tPd'^';:;-^';;.:.:.;
:/::yy:y/g>i^^0ri^                                                  .                 \:yy/y::y^///y//:/
;-:^''';'ijS;^;S;Pric>Sr4
•7:;:;;i*;^5;:.rSi';;a[re:^
;:.:;,;;S;;?£;;;f ;ff;m^Bgg    rPsppiris-i-)M.;lity-:f^                           . p e r t i f i;r:'';.;^:;^ ;•;
T'5i:;r®tf::;':^b#ili#;5|t^^i-# ^:pnf::tlie;:;Jbasis;;!;pf ;•;• ayailabie        ;;;;pyidefncey;;-;,.,^-,-.         •/
;^V-iy^l:#--:';|-^;:|t^         •;ate;;Pthei:-W;ise'/;'^^             ;:The^;-ipffiPiai;-';;-; y y i : :
y''yy:yiacmi!6       ;vbGrit:iriup',;t^"";per;tify;;;^           .u'n;til' • he;i: ;pr-;wshe ij:
              informs the head of the agency^^                              that the
              system is operatirig ef f e e tive ly-i.
          After some e x p e r i e n c e h a s been gained in doing the annual;
r e v i e w s , w e will inPbrpbfate a p p r o p r i a t e s t a n d a r d s , p r P c e -
d u r e s , and related requiremierits intp t h e G A O Policy and P r o -
c e d u r e s Manual for G u i d a n c e of F e d e r a l A g e n c i e s .

 F U T U R E R E Q U E S T S F O R RELIEF O F C E R T I F Y I N G
 OR DISBURSING OFFICERS                     ;; • ' . ' : / : ^ ~

         In gen(^fai>: ;Gertifying or disbursing o f f i c e r s a r e l e - •
 gaily liable^^; fpf|;illeic|ial arid inacpufate p a y m e n t s , b u t m a y bP
 relieved offtheir; liability a t the d i s c r e t i o n o f t h e C o m p -
 troller Gerieral^;lThe Comptrollef^^^^^G                     p o l i c y h a s b e e n ;;
 to g r a n t feli|ef^;;if the o f f i c e r s were not p e r s o n a l l y n e g l i -  ^
 g e n t and cpuldfribt, with reasonable d i l i g e n c e , have d e t e r -
 mined t h a t the;;; j^^                   imprpper. Since the Pfficeris
 were n p t Ireguijf)^^^     p o s s e s s evidprice of the reliability o f
 automated ?i?ystems^ even though this w a s the only practical
 way they jcpulidyy^           themselves that the p a y m e n t s produced
 by such sy^tPms;|were legal and a c c u r a t e , the o f f i c e r s w e r e
 virtually assiufed; of being relieved bf l i a b i l i t y if any
 such payments were e r r o n e o u s .

          In the f u t u r e , when a certifying or disbursing officer
  requests relief from an i l l e g a l , improper, or incorrect p a y -
  m e n t made using an automated system, G A O will continue to

                                                      17
                                                                                                                                                    I!
                                                                                                                                                   Mi
                                                                                                     .i''i::V'Bij.^;;-SEs;:i;aS4;*S!;
                                                                                                                                                 4m

                                                                                                          pymmmyy
                                                                                  yyyMisy$y'yyym
                                                                                  yA^ymymyy^'"^
require.;:the;;pff i c e r • to sho\/;;t^atKh^i.^pf'^ishe.,.was-;;:riPti:jnP||l:|^mymsii0:yy'
in pef.tifyiri^;;:;p'ayments later;;;ndetPftmiri€d;^>^
accuratev-;'• ;ilPweyef , ...consideratjipri•:>^will;:^^be';i;;glyieriatb:>;;Wiefi|(p'|'''"" ivsi:
or not;'.the.;pffi;c^f poss'e:s;sed|;.:eyideriPe:'';at^
ment aj>proyai;;^;thkt the" system-^;:pp;uidtfbe^^
accurate.•arid "'legal -paymentS'.;;::(:l'n;-;;Ga'sP^;';ini-.^^^^
na ted ass i stari:t;::;Sec r e taf y :;Epf \'-compar;ablei^
the agency;^;head;>^hd -GAO'-'with..;a^^wr;:itt^ri:-;sita;jt^
tive system'.PPntfpis•^co.uld;^:;riptr;.b^
v o u c h e r '^ p f epa tation and •'icertif ies ;;;|ha;tf.the^^paiy^
                                                                                                                                                    .l-^H;
wise proper.; ^GAO'^will'-notbCoris.ider:s:th^^
t r o l s as /ev.idertPe; of •negligertpei=iri;ydet"^f.min.'irig^^                                                                      •'••'i^'vi^^-i'^JH
certifying•••.of;f;ic:ial                  • shPuld.'-:he'7held;;:l;iabl;e'^^fdr;;;-:?a^                                                       /::y/3-
p a y m e n t , ••.pri.or •••;^.to;;.;r e c e i p t -;'bf'-an.^^;.adyariPe:^;;deGisl;bri^^                                                  -''l-^k';'^f!i
the traditional;;;requirements'Vthat-du;(Br^car;e;Jb^^                                                                                     '••';t;^.:i-i?
making the payTrieri;ts and that dil'igeritie;ffbrt;';^be;j^^                                                                                    y y
coup- a n y erfori^ous paymentSL.wili;/'stilf:^i>e;:c:priiidet^^^                                                                        •-•;^';K|
requests '   -
             ^ fbr;'Waiver of;' liabillt7;^^-7';Alfe'b>;;;';shp^ul
ing o f f i c i a l 'fail to ' take\re:a-SPriable;j;ste;ps^'^^
adequate-Poritfpis for- future 'paymerit"P'V:;i;^the-.--r;eaSPri&^^^^
failure will b e taken into accPurit iripany req#est^j;fbr ^^^
of liability            c.Pricerning- such-" futur;6                       ::j^aym&ntsyy//§:0y/yyyy


                                                                                                ^'ili-A




                                                                                                                •:-'.fMi^^7j:-;,k




                                                                                                     y^imysiy.


                                                                                                              yy'yyM




                                                       18

                                                                                             ' ^ i
                              yy? •...          ':yA/Mhi0My//.t
                              ;l&NCY^iO*mENTS
         y:yy$n:;%i^jl;;§^x,M:71, ;;':we;;;;ierit-;;;p:Uf;:-^:pft>pbspdS repp'f t'! tp;;.:the v^hPadis;-
      ;;bf;;;;i;liC;;;age|iP.|#|;;||-n
                                                                          Date commerits
                            '•;';H.gAgency: •                             were febeiyied-
                      cc.(Ei^;p|;;Managem^                                    June    2,/1911'
              ^|)#paf^tmisfri||;'pi Agricult'uf.e''"'                         May 24, 1977
              ;|^ep|if t^isrrit; p^ Commerce                                  June 23, 1977^
              ;:DPi^aiife||n                                                  June 3 , 19177
              ;Debatriiiient b                Educatibn,
              .;--:y^an[d;';Wpljfare /                                        May      19,      1977
              ;-iqfepi§?§ii|prif^^of the;'Treasury^                           May      18,      1977
      iS^e-:;.:^]^yy:yi!ine fpllowlng sectipri^ (1) summarize the ageri-
      cies'J;;'^PnimPn^                our prcppsed recommendatipris and tl^^ geriefai
      fi^rietibris; arid^^^^^^                           of c e r t i f y i n g airid disbursing;;
      Q f f i . ( ^ 0 ^ / ^ 6 < y y p r e s e n t out e v a l u a t i p n and f i n a l posii^ibri
      a f t e r Cppn^id^                   of the comments. Not a l l a g e n c i e s icom-
      iip|e,ritedl;pn;7all^^^                                                          • ' ' ' • • C ^^'v. •;•:-..--
      IJEESlFORlREVljiW^^k^F
      AUTOMAlgED -PAY^i^Nt SYSTEMS
              JPrbpps^^
               --;WP; i:^p<D!jn|fi^  t h a t t h e D i r e c t o r , Office of Managemerit; /
           tftf^ ' a r i i l i ^    i s s u e a d if e d t i v e : p r o v i d i n g for agency tf;
                  ;hpsids; ;tb                 ari b p e r a t i n g o f f i c i a l or iprgariiza^ j;
                ; t^ip                                                             s y s t e i n t c deter--;
                  m^                 the system and t h e c o n t r o l s b u i i t iriito ; i
                   it-aretfpj^                                    arid can be r e l i e d on
                   to c.oinpute payments t h a t a r e acGurate and l e g a l .
      Agerip ies'1 coiiniinPrits
             OMB agreed with our recommendation that computer sys-
       tems should bei reviewed periodically by operating personnel,
       as well as b3^ agency auditors, to Assure their feliability
       and iritpgfity.; Since computer system review arid- certifIca-
       tiori afe only Priie part Pf the autpmated payment prpce;sis, OMiB
       pointed but the need to address the broader pefspective of
       quality control throughout the pverall system, including the
       step-s of data acquisitiPn, establishment of payment briteria;,
       voucher examination, and data input. It pointed put that


                                                          19


Itf
                                                                                                      :• -'... -.V • 'i {o^i'i^-v^v;-;^;;;;:?;; •




t h e s e contrPls'/;..proba-bly v^ry-;;.'^mPing;;;;:thetfa^
e f f e c t iye-nes-s>r;::soph i s t ica'tipri-,; :}ar^;-;;.-f

         Tre-asu-ryn';ai:so a g r e e d that;:.:;autpmated
s h o u Id -'-'be ••' r e y i evtred- - p e r i b d i c a;l ly-;7by;; ;;bpe.r;a.ti n^g ;;;;;,pPf ;Sp-nnBl:^:';a:i?^
w e l l a s ' internai'l' a u d i t o r s , . ';tb vpf Pvid;P.;;t';||sSuraripptf^^
the reliability of the systems. It tPb p e r c e i v e d l t h ^
overall certification problem is brba|der than ,<ju^ll^
over computer^^generated data- The sheer vdlunie-airi^ ; P ^
of transactions make it extremely dif;fi:cult.fpr^^i^^
dual to • ver ify'.that-• every '' itPm";hP. sigris is"''pf'ope;r;flnf;;<i"ipr;y7^^
respect.'                                                                       :'-/:'/:y/yyy//y
      Commerce agreed with our cpnclusipn that the;-yPfi;ti|pa^lS^
tion methods now employed by certifyirig arid disbufsirig :;'b^^
ficers should be revised to better cPpe with bpmpu^pr;lzbd:;sp
ment systems and suggested that bur r;epbft give rPPb;g;ri;;it^
(1) the existence of current reviews of systems,Jj[c2):;al^
isting infernal controls, and (3) the;Natipriol BufPau; JpfM^
Standards' responsibilities  for Federal    agencies'tfirifb:|M^i^
standards.'-                      '.''••-'' '"""'•••         y/'[Z'^yyy/yy
      Defense agreed that the shift frbm manual tc^;c
supported financial systems requires ripw methpds f^fj^b^
payments, and that the evidence of accuracy and;leg|ili^i^;;|^
payments must relate to the system rather than£tp|^
transactions; it also agreed that acppUritable^;pifi^P!tii^
receive assurance of proper functipning of the aulpnia^
tem. It emphasized that the basis for asstirirtig'^-p^
tems functioning is laid in the design, develpE«nerit^^
ing of the systems, as well ais proper system^ =^^
i ng ope r^at i on'.' -In th is' cori'nect ion;,.;'' it ;;.s t:a.t ed';'';'t'ha;tKt1i^
fying or disbursing officer s h P u l d h a y p apprbprisTtiSlli^t^^
review resources and should cPritiriudusly pxefciSes;te<;t^^^
to insure ;qUa'lity control- over' pperatlhg' 's.ystem&:.':;tf|;;;;y"^^^^^
     Agriculture agreed with the basic; concept t^^
fying officer must rely on the automated system ;aridl|f;|^i^t^^
procedures to provide reasonable assurgince thattfpay^
proper.                                    -...-:•.,.-:.•;-,...;-vvv-tf-.. :i/-yAy/yAy:/AA/y
           HEW .ag-rped with" our'' Gbnc'iusibn,;ii^;at', "If.;;^
o f f i c e r , we're "pr.pvided w i t h ;'iri f o r jnna;tii!Erti;;;'t hat'':;'t^
f u n c t i o n i n g , p r b p e r l y , t h e r e •;wbUl<3c-'be-;'':M;;ireas^^
a t t e s t i n g t o t h e l e g a l i t y and accUraP^i of thp'payinie^
           While a l l s i x age.nc'ies 'agrePid', w i t h '^€he-;iie:€i!iyiyr^
 each automated; ;payments system" ;tb;;'dptefm:ine ;wh^;th^rtfit^^^
 r e l i e d Pn, t h e r e was some "di'Sagr.p'emetj-t;;on •whP't;hP;f-j|a;;;|^ep^l';:a
 o r g a n i z a t i o n needs t o be d e s i g n a t e d t p perform thipSif^
                                             20-.                         •^-••'//yy/z/i.
         '';' In' this, regard:               wy///y///::'. /y/1:. :::y:y/:y:yy
         J ^^.T-TfpaSuf y'l and^ HEW sta|e4;;;7;res:peptlye^^ •";thattff',;;.'':-^.;tf
         "tf'' -{I")"'the.'systems 5hould.:'j;;rematiritf^    .to";,i;n;--;' ';.;;';;''•
           i: .^^^fpendeht audits by irit^jcnalV audatpfs^ a^                  ";• ^ "
            7 ^ intprrial^ auditprs should;;;rip;tv:be^^^^     ^ put ;bif!'
           - ' the review responsibili;ty;S|;ri
               be one of the several i M b g i c ^ l c ^
             ^ ^^in the review.
           .--pMBi believes the quality cpritrpl^^^
            "^ should'fest squarely pri ;;^gpnpy;mariagefs arid; is
               developing a program which wi;^             agencies
I          . tp^ciertify their computer SystPm^            reli-
I              ability. O M B also statied ithat 1 ^
               arid management reviews shpuldrGpntin
               as •'necessary.
           '--Agriculture did not agreP that a sepafate prgarii-
              zafibri w a s needed to ppffbrnv these reviewsr it
              stated that it involVpis the ceftifying pff^^
              in the systems desigriari<3 development pfpcess t o ,
              assure that proper cpritfpis are includpd^^^^
              certifying officer determines that proper audit
              standards are us^d. A l s P , once the system is in
              operation, it is contiriually mPriitored by t h e a^
              counting units through its bu^tputs and sampling:
              o1^ transactions, and niajbr changes to the system
              are validated through the use of test data.
      Our;:eyaIuatiPn
              As riptpdtf^bove, the six agencies generally agreed that
      autpmatPd f^aj^                        should b e reviewed periodically ';;
      to dWtefto-irie;^l5^             they cari be relied on to produPe IPgal
:^y   .arid;-;;acPU:ra;teM^;fe^me'rit's. ' -'
            It i^';tj:;ue that the quality cpntrol respohsiblity riests'
      with agency :mariagers, arid it appeafs Ibgica^ that they shbuId;
      use their iritptri^^ audit staffs to make the reviews. O u r pfb-
      posed rebbWmiridatibri in the d r a ^           calling for a d e s -
      ignated sepafate^ o                organiizatibn to cbriduPt fevlews
      was made bri the assumption that^^^^^^             departments; and
      agencies either did not have adequate internal audit staffs
      to perform this function or the staffs did not have adequate
      expertise to make systems reviews. In bur report to the Cpn-
      gress, "Ari O^efView Pf Federal Internal Audit, Office of Man-
      agement and Budget and Other Federal Departments and Agencies"
       (FGMSD-76-50, NOV. 29, 1 9 7 6 ) , we pointed out (p. 15) that
      the complete or partial absence of internal audit capability
                                            21
means that the-Federal expenditJufeMafb^nbt.ib^
to the imfiprtarit i n t e r n a l Goritfbl;;prpy:ided by^^
cially in thosp agencies in which; internal audittf^tfff^i^^
required to' -spend as-^much:a;S '6'0 7tb4-SiJl^i^efberi^^
on audits of;"gr;a'rits. . Also,''7a-s"s.t;ated:vp;ri':.;paige./^^^^
port, the intefrial reviews pf the ;aut;bro|rt:<Bd^^^;fe^
will be a •sizab'ie^ undertakirig.,tf:;arid--;;t'hPrPfpre'-')w^
substantial; f Psbiif ces, 'at •'lbast;'!iri;itiai;iy.              '••;|-:tf':;^'atf*:'^^^^^^^
     We of course encourage agency heads tb desigriate'-Sth^^^^
ternal audit staff to review aUtPmatpd^paymenitsysl^m^
eration, as well as participate iri the;;develppmer|t;v^d^
of new system's •;t:b help-insure'"that ^adequaite cbrttrb
audit trails'-^afe 'providPd. tfWe'haye';thbr.efpre;;^f;ey^
recommendatioris (see p. 16) to E>fbyide t^
alternative of using the agency'stfiritpfrial auditjstaj^^^
the system reviews when adequate staff (both in-j^^
numbers) is available. If the system reviews ;are;cb
by a separate ofganization, they s h o u l d % e subject; to;fe
tion by the internal audit staff ,;alpng with the ifu^
the certifying and disbursing officef's;? in additipji;;;as^^^^
cated by OMB (see p. 19) , there is a cpntinubus need;|^
that adequate quality controls haye been establisheidfi^
effectively operating from datta acqAJiSitiori to butpu

     As Commerce suggests, the scope Of ;separatei;bri^ariiz^
or internal audit reviews should be fbfmulated aftef^!^t
effectiveness bf the existing systi^ms^ibf; intefrial icbritrb^
considered and after it is detPriniried whPthpr Nat^^^
of Standards guidelines are"'beiritj."met".-'-"'"           '•''':''y:^:yyysy
     With respect to Defense's view that the certifyirigtf<«
disbursing officer should have apprppflate internilj fI#r;;S|||^
sources. Pur -feyised' re'comme'nda'tiPris.5shb:uld.;aile'y;^
minimize therie.ed-for' such" ari arfarig;emerit. ;.'Ad;;|di;S;qu^;s^d/;^^
page 16, we are recommending that the; pprtifyin^g^b^^
bursing officer approve payments only wjhenribtifiiPdfbySa^";P^
designated, of.ficial at .the. ..assi.stant'7.|iecfetary:^"b:f|^|iQnH!itf^^
parable- level-:that the .automated';;systPra;.:;;is .:r.e;l
the designated official detefmirieSthfpugh a^^^^
that the system; is deficient, 'we''bel'ieve:;thte;;dp;i^;i§^
official shpu'ld;;b'e respons;iblptff,or';,.;eff^c.tirvg;.:.',;bbrfje'i?t^
action and 'cPttifying subSequprit.-paymerit^. if^^thP^^^^^
not be correctPd'-before payme-ri:ts'-must'^fbeJ^'madie;.; y'y:yy:yyyyy^y

     We also agree with Agriculture that accPuntai^
as users of the System, should be inyplyed in the^^^^




                                                 22
  arid;dpypii^                                                    an August 2,
  19'^f p | i > b k l e t
.;|ieaf                   ripd.;;;|i;bcmt;;Aeq                  &;''''other •'-•"Iri- •' ••'•"^
 ;fpfmit*<ari^;;i|yBt^                                      ;
  HQwIJRJMNTffiliHOULD REVltWS BE MADE?^
  ,-^;-';:r''^?if'cjpps[pd;;^;;^

      ;o^f;-1We^                   tlie p i t e c t p r . O f f i c e o f Managemerit
 ^^^^^ •::          tf       Issue a^ directive prbviding fbr agency
 , ,;; :^^^^^^^^^                reviews pf each autpmatpd parent
              System tbbe^                                    re-
               sults to,,be furnished to the appropriate certifying
               and disbursirig officers.
Agencies' comments
     Commerce pointed out that its internal audit staff is
heavily involved in helping to develop effective system
controls. In addition, (1) the bureau and dlepairtmental
systems staffs work closely with our office iri djesigriirig
and implementing- accounting controls, (2) iriterrial audits
of operating firiancial systems include review of accburit-
ing controls, and (3) changes to automatic data processing
systems are also reviewed by systems staffs. Thus, Com-
merce takes the position that our proposed recommendatiPn
that each automated payment system be reviewed at least
quarterly would result in excessive reviews. Commerce
recommended that reviews be made whenever there is a
significant change to systems, and at least yearly.
     HEW also believed that the reviews should be less
than quarterly—preferably on an anriual basis. HEW also
suggested that we assess the staffing resources needed t:o
make the required reviews, and expressed its concern for
the additional staffing npeded to review HEW's numerous
payment systems.
     Agriculture stated that certifying officers should be
empowered to demand special reviews whenever they believe
that the system is not operating as designed or is operating
in a deficient manner. This demand. Agriculture states,
should be in the form of a letter to the agency head, who
would provide interim parent instructions and a time frame
for completion of the review.
      The other agencies did not comment on the proposed
 quarterly frequency of the reviews.


                                         23
                                                                                            '.'i:'{i
                                                                                                       •:mym
                                                                                                       .1 • it-ifjiiii ;:A




                                             y/ ymy:                                        yx
Our eyaiuatiori ; '' •' '•''^y/yy/yyyy: :-::yy///yyyyyy/^
           The -f•fequpricy and l.ritfe'ri;slty;;;'b^.;:rPyiews-;;-;bf^^                     /i
payment ^"sy.is'tpms:;::shoul-d:, .p,f;;.bp^u.r,sp>t;ibptfide;t
cons.ider'at'i'Pn'ypf a nuraibef-'-/d:f;i-l<ey;;;fib
pat.ibn..'of"'reV/iew s t a f f . s iri;:;the';;des;i^ritfarid;;;d^
systems'; - .adlequ-acy o f intern'al;-;ip:bn§fblis;^-;f .fe^u^^
a d e q u a c y p f e x i s t i n g r e v i e w s ; riumbefv s i z e / a a
of - syis'tem^P^;; -VPl^Ume'-'and: 'airiburitc-%f ;/tf'arisactibri'^^^
and ^capability-'xjf' 're-vxew ';§taff •>;^^p;t.c.';'ltfTh:e ::p:i;f-cUmS;tari;b!ers.^^-at^^^
each''of'•'• ther'de|:iartmPnts-;arid'.;'ag^
and . w i l l • w^;r^f a,n't revlews'^'•a;t'^':diffefprit:-;S^^^^
vaf'ying -'iritervs'ity, -arid'';r equ;ife;;"^dxff er'e;rit-:s-^^
do n o t 'belieye>--/therefore;>."that:5it-;l-stf
r e v i e w and d e t e r m i n e t h e s t a f f i r i g f e s b u r c e s rie^Pd ^a^^^
a g e n c y t o r e y i p w t h e au-toma'ted'-;pai7neri;t;-.-systems4"tftf
       We have teyised         the recommerided          ffequericy
from cjuarterly        :tb annually   (see p. 16)?^ recP^
quarterly      fevteWs     could         betfexcessiye,tfe;spePiailM^^
tems are maintained           and operat;ed         effectively;/^^:^H^
so dbing,      we; iriclude    the caveat     that       iritiefim;phe^^
undertaken       whPn significant      chari^esiai^e      made t;bXtj^;^ ;sV^t<B
between'''aririual'.reviews.       '        -                       [^yMy/Z/y/y/
          We c o n c u r i n Agr i c u l t u r e ' s s u g g p s t i o n t h a t J P ^ r t i f ^ i r i i W I
o f f i c e r s s h o u l d r e q u e s t s p P c i a i f e y i e w s wheripyPrSthbiy^^
p e c t System d e f i c i e n c i e s .       These x e q u e s t s , ! ^ ^
be based on. evidence                of^ •the-:'su;ppeGtedUdef ictpricyf^^^^^
these requests              Should be made to a                         d^signated^offipl^
the assistant             secretary       or comparable               ipvelwhp>;ai^?^^^
mended on page 16, should be fespbnsiblP                                for ;ass;iir^^
automated- paymPrit sys-tems,;af-e^ .furict:ibriirig-'' ;ipr'P.per;iyi;;tftfv^                            y
WHEN SHOULD ACCOUNTABLE OFFICERS 'tf^--4^'':tf--' ' - ' • • • • ' \ ' ' : y : y y / / / / / y y / l
CERTIFY AND/OR DISBURSE AUTOMATED; PAYMENTS?
         Proposed        recommendations^:                                     1'--y:yy//y'yy:
         We recommend t h a t thP D i r e c t p r , ; Off i c e pf^^^M^
         and- Budget ^^ i s s u e a •directiVej;-;p*;;PV^idirig-.;;;fb;fV^^
         heads     tor                                   /;•:;:;;.-':-•:.:•;....-:tf. •••-•'•••'•::yy:::yy//yyy
         —D i f e c t c e r t i f y ing^ •orv;diSbu-fSi'rig-;;;:pff i;Gers;'-;t^^
          or d i s b u r s e automated payrtierit:«'bnly wheri;^th^y
          been p r o v i d e d w i t h t h e r e s u l t : s r b f s y s t e m feylews^^^
          d i s b u r sement h a s been authori:zed i by t h e ;^a5l;eriPy;fhea^



                                                    24
.^''v^^^^tfp;!;-^!^!^©*!!;!^                                         : system's;:.;;
•••^;.,-;-:tfW"i;Mpfl'fe^^                                               the."'
•'i;'-^;5-'i'Stfl''^tb<^f^:lfy'^                                       a written '
--'-X-"tftf ;;7:;:sfea^^                                                  -cpuld-^:
^^^ • W^^^                                                           preparation>
 •['•yy^yi^pp^::^^^                   .statemerit;, shoUl'd-'.:;al so b.e pro-
    ••.:7'§tf'-^;yld^dtf           • •'

J^g.eriP'i;e.s^'G ^b'bmm^n;t^s
 ^^^^;tf;tfC^                     t h a t the most important legal impact;
of/the tepP^^                  question bf what happens if the head
of thPvl^gpt^                    a report that a computer system does
riot sUppprt thP^^^                       payroll. Presumably, Commerce
statpp>{^(%)^^^^^                                     the disbursement
dirpbtly/pfj^;^^             pass the problem on to the certifying
bffiPer ;^ri% (2^^^^            existirig legislation governing payment
aPcp;Uritabilityi/j|the Secretary or the certifying officer would
stillibei^ersbrial^ liable for the amount of any payment
authbriized-.-"-,;"-";.--":^
        tfCommerce further states that in situations in which the
 certifyirig offiper is notified that the system either can
 or Pariribt be felled o n , the Comptroller General's decisions
 as;i^ell as puf;recommendation provide no assurance that the
 certifyirig off icier can rely on either of these notices. To
 supppf t this,; xipmmerce states that 49 C o m p . G e n . 3 8 , 55 Comp.
 G e n i ; 2 9 7 , and precedent Comptroller General decisions estab-
 lished cieafly that the certifying officer must seek a
 Comptrollef General's decision in order to be sure of finan-
 cial prptectipn. In the case of a report that the system
 cannot be relied upon. Commerce believes no alternative a c -
 tion is pbssible; the payroll must be sent to the Comptroller
 General for a decision regardless of the exigencies of timely
 payment.
      In the bpiriion of Agriculture, automated payments
 should be interrupted only as a last resort. It also sug-
 gests that specific guidelines should be provided on what
 documentation must accompany relief requests made by a c -
 countable officers.
       The other four agencies did not provide specific com-
  ments on the above proposed recommendation.
  Our evaluation
       The Comptroller General has traditionally considered
  relief proper when erroneous payments have been made under


                                                 25
conditions when certifications of bulky payrolls pr-ypupripfs^^
were based onicomputations and audits by others pn;;Whi^S^
accountable officer relied. In accordance with thijs;; lo
standing standard of care, when an accountable    6£:£i:jcei:i;M0yi/y§:
formally notified by the designated operating offiPxal^^^
he or she can rely on the determination that the ppmputei|iziidi|
system controls are operating effectively and    etrpnPoUsJp^^
ments are nevertheless made as a result of inadequajBes-lbpm^^
puterized system controls, we will consider him of ;heri^^tp?;tf^
have exercised due care and therefore not to be    perspnal^
liable for the erroneous payments.                   '• yyyyWM
     In a case in which the computerized system canriptrfbef ;|||]|
relied on, our recommendation (see p> 17) states triatiithP; ,3^^
agency head shpuld elevate certifying pfficer authprityltp; ^^l;^
the assistant secretary or comparable official respbnslb^l^^tf^
for automated payment system review so that the desijgriat|^dtf|p;;
official may certify that, on the basis of available eyidPriPei;;^
payments were otherwise proper and that urgency preclude;stf|y
correction of system deficiencies before payment. As^iSt^atedl;;;:/
on page 18, the intent of this recommendation is that Wheri3tf^^
it is determined that a payroll or other payment must;jbip^^^^^^^^S^^
made prior to correction of system deficiencies, arid thattfvii^^
payments otherwise appear proper, we will not regard]t^e7:;^^;;P^^
absence of such controls as evidence of neg 1 igence if> i:die|piS:^S|';
mining whether the certifying official should be hpldtfi ;tf:;iv^^^^^
personally liable for any erroneous payments made pfipf>^^^^^^^f#^^^
to the receipt of a formal advance dicision (prior tptfpp^3peiif)t
from the Comptroller General. The notification totf(3A|itfspg|i
gested in the recommendation should enumerate the s;teE>^f;pKb~PiH^
posed to accomplish adequate system cpntrols and to rePpup0K|tf
erroneous payments. However, the practical         real±ttp^^/py2L/y:y
situation, in which time exigencies preclude correctiPri|bf;=|:?§|?
system deficiencies prior to payment, will be giveri; great^|;;55^®^^^
weight in any requests for waiver of liability.           •--'•':yy://i/pi
     Although the two cases cited by Commerce may reaspiiab^
be interpreted as standing for the pfoppsition that l;h^>|^
way for a certifying officer to be sure of finaneial;:pr^c^^
tection is to seek an advance decisiPii, they also rePP^riizel^iJi^
that relief is authorized when the accountable ofiAp!et::::i$y/?o:yi:
without fault or negligence. The first case cited jft49^ebn^
Gen. 38) involved a situation in "which:/;.;an Air Fp-fcP;g;disEife£3fil!
bursing officer had sufficient doubt about the leg;ali;ty;fbfyl|f^^^
certain per diem payments to request adyice frPm h;ighertf;tf^^^^
authority within his organization, but did not requestsfan|j^^
advance decision from the Comptroller GPneral. Thej'^ec
stated that the urgency of the paymerits involved;wa^lri*^
apparent and concluded that substitutirig guidance frpmjtf;tftf^^^^


                                  26


                                                                            ';,/-
        iPr; authPtlty for the f e^qulfemPrit ;that douptf ul payihPnts l^?
 be;;isubmitted'?^^ the' -Comptrb'ller-;:;;-Genef'al for adyarice •;^dbbi-^;'';'tf:';•;;
 sipri ;?wpU                                                   power to reridPf ;;
:pur'i-a,udi;5t;spfbpess •fr:uitlp's's-;:*;;-;^tf*^^          cited-'bdse 'dealis.-:'.;:'•;',.:
:Wi5th;-:;;-ia;§:tVl>P^^^^^^     '^p;feyipu;sly';dptefmined by .--"the - G-pmptrpl-
.l'eic;'|:t;PK|)(e;i;:uri|i-U^      ;;Howeyp.f-y;:vWe':;;;dP not bei;ieye '•th;at-\^th:is
depiisipri;!wpiild^^^               relief fof Pfrpneous payments v^hen; ;
a ;beitifiyiriq;g^ disbursirig officprtffplies in good faith ori
 a cbmpu;teflzed^^^^^^                                       informed has
 ap|)fbpfiate:l;sS|pg             to guarantep the accuracy of facts
 necessary to support an otherwise legal payment.

     Lik^wisev this case and similar cases would not be
applied to sittiations in which the agericy head determines
that ufgericy: requires voucher pfeparation and it is known
that adequate computerized safeguards do not exist because
the urgency which impels the agency head to direct payment
without requesting an advance decision from GAO will be
considered as justification for failure to follow the
traditional requirement that doubtful payments be submitted
in adVarice to;GAO. Where feasible, we assume the agency
head would secUfe the informal concurrence of an appro-
priate GAO Pfficial that urgency precludes seeking a formal
decision.

     The second case (55 Comp. Gen. 297) was in the nature
of an advisory opinion since it did not involve legal ques-
tions arising in a specific voucher presented for certifi-
cation. The case nevertheless summarized the statutory
authority and precedent decisions concerning advance deci-
sions and waiver of accountable officer liability. Of
particular relevance to the question Pf the acceptability
of a cOmputpfized system, the following statement is made:

             "We have never undertaken to formulate any
        general rule declaring what acts may carry exempt
        tion from liability for certification of incorrect
        facts. Rather, we have sought to apply the relief
        provisions by consideting the practical conditions
        and procedures under which certifications bf fact
        are made. Consequeritly, the diligence to be re-
        quired bf a certifying officer before requests for
        relief under the act will be considered favor ably'"
        Is a matter of degree dependent upon the practical
        conditions prevailing at the time of certificatibri,
        thP sufficiency of the administrative procedures
        protecting the interest of the Government, and the
        apparency of the error." (Underscoring supplied.)


                                             27
      We believp; that the flexibility:^i;ridicatedbyi;|^^
ment prpvides :adequate basis fof;i;mplen»eritatipri
mendatioris pn'pages 16 and• 17.       •••/.:::        •'•/yy/yyyy
      Agriculture' s position that automated paymeritis ;shbuld;|tf^
be interr:.upted'-:'-bnly as a last re.sbft'.-.;appears reasp;iiai?le|"S-§J^^
However, the decision as to apprbpria;te;action needed4^iri|:iStf;|i
cases in which the accountable off icers •receive a;lwtitt^
statement that effective controls could n o t be implementedi|=i^t^^
prior to voucher preparation, rests with the head bf"thel; i^^
agency.                                                           -''///y^y:
     As stated on page 1 7 , after some experience h a s beeri;; tf||^^^
obtained with the recommended procedures, we will proviidfe tfll
agencies with detailed guidelines, including a descfiptlpri:tf|w^^^
of the documentation which should accompany relief re- .:;SMj-:
quests, as suggested by Agriculture.                             ; ptf
AGENCIES' COMMENTS ON OTHER MATTERS RELATED TO
ACCOUNTABLE OFFICERS' PERSONAL FINANCIAL
ACCOUNTABILITY AND RESPONSIBILITY
   . The agencies, in addition to commenting on the recpm-|-^^tf^^^^
mendations in the proposed report, conunented on the certi^fjiS^
ing and disbursing officers' personal financial accouritajbixHl§;tf;
ity and other matters relating to accountable officefs^-furi^^
tions and responsibilities.                          ^ ^tfitf^^
Personal financial responsibility
     Treasury stated there is a pressing need for mpdefrijlziiigl
the whole concept of personal financial responsibllitj^i'bfjtf;^;;^^^
accountable o f f i c e r s — n o t only for those officialstffesppi^
sible for approving the payment of FPdpfal funds,:but;Ha(i;sb;;^^^^
for those collecting and disbursing the funds. Tr;easUryS|tf;®^
feels that a comprehensive interagency study shoUldtfbPi|made^
of the "archaic laws and procedures" gbverning theriper^pnal^^
financial responsibility of accountablb pfficPrstffpfyvfhpS^^^
purpose of (1) modernizing the laws arid simplifyingtffplati^^
procedures and (2) developing'reasoriable: and Pquitable^^^
standards of. accountability for -''a;ccbu;ntable offlber.b;-,;i;n
light of current: conditions. Treasury;recommeridpd;itj||;tiP^^^
the Joint Fiancial Management iraproypriiPrit Program Stlib^rlngjKte^
Committee be requested to initiate••-'the.;';'-irite-rageripiife?stwd^
OMB believes ..Treasury' s suggested .study;.;has mefit:,;a*|idtf^^
would support the study.                      : :•-'•..'.        •''':['•'• ^y'^iy::/:y:yM
     Defense, on the other hand, ' stated;;rthat •de.Spite;;:tftf;;;;;i^^^^^
continual changes in methods and increasing complex'lty/S;!!^
the principles of personal responsibility must be fetaiiledi^;^
                                     28                             yyy&
!•;   .-   '•




                Defense is concerned With the; tf:erid;;;t              pf
                responsibility of overall ;systpms;i                         tf
                ing arid disbursing officefsV feppnsibli^^
                Our evaluation
                       On several occasions in recent years we have considered
                the possible need for revising the basic concppts related tp
                the principle of personal finaricial accountability of account-
                able officers as provided by the law. After receiving the
                agencies' comments, and after further consideration of whether
                presentT^day conditions warrant revision of the personal finan-
                cial r;pSE^PriKibil^      of acpbuntable officers for illegal, im-
                prpper;v:;arid -irippjcrect payments, we again concludpd that the
                cPricppt of pefsprial financial liability is sound and essen-
                tial. We b^^           this liability is necessary to deter
                knoWirig Vand jWillf      wrongdoing and negligence, to provide
                a firiancial penalty without the necessity for civil suit or
                crimiriai prbseetion, and to provide GAO with a means to
                enforce itis decisions through the exception process.

                      The Comptfpller General has traditionally regarded the
                liability of accountable officers as applicable immediately
                upon the makiTi^^^^^   an erroneous payment, with waiver of
                liability bPirigtfgranted after the fact by the Comptroller
                General follpWfirig consideration of the circumstances of
                each indiViduail case. The possibility that a third party—
                the Comptroller General—might be called upon to make an
                af ter-thP-?f act jjudgment as to the accountable officer's
                negligence, arid therefore his financial liability in the
                case of an errprieous payment, provides a degree of control
                over accPuntable officers which would otherwise be lacking.
                The coritinued;fpceipt in GAO of formal and informal requests
                for advance decisions indicates the seriousness with which
                accouritable pfficers regard the indepPndence and impartial
                suppPrt Pf this Comptroller General authority.
                     Because of the concerns expressed by OMB and the Treasury,
                however, we interid to continue to study the concept of per-
                sonal accountability in our ongoing audit v.'ork.
                Is the concept of certifying officers outdated?
                     OMB believes it is time to review and update, consistent
                with modern management techniques, the concept of certify-
                ing officers. The problem of the sheer size of large-scale
                operating, accounting, arid information systems and the
                dispersion of the systems is further complicated by organi-
                zational alignments. Also, the wide application of letter-
                of-credit procedures and eiectronic-transfer-of-*^unds techni-
                ques will further complicate the true roles of certifying
                                               29
officers;,:. ... In-;;y;iew of • thi:S,;^';dMB;;';belleyes ;the-;;;^ribie|:pbri
certifying of fibers should bjeirPexamirtPd arid ;|^
made tb charigf^^existirig legislation to acPommpdateir^^
methods of mariagement and current informatipritfpfpGes^^
technology,   Iri this connpction, the Department^bfjC^
pointed out that all of the legislation and fegulsitdry ;rb7^^^^^^^^^^
quirements and computer reliability problems feiiulfetfpbm^
hensive organization of files of original recbrdsltp^. sUppP^r^^
payments, • . '        '•                         '• •  yy/:////yyy
     HEW suggested that the systems reviews be expartdpdtftp|p^^^^^
cover certification of payments made through    lei^i^i^S/^/Qi/iy/ffy:'^^:
credit,                                                    /^:y/'-/::yy/yy
Our evaluation
     The agencies' basic reasons for suggesting that; ;a| re3v?;;^^^^
view be made of the concept of certifying officers ;afp^^^^
(1) make the concept consistent with modern managempriti|;sS7^^^^
techniques and (2) accommodate the use of letter•^bfrr^pred;i;t:^^^
procedures and electronic transfer of funds. Our fecpit|iiimen-|^;|^^
dations are specifically directed to making the cpniGept ?bfiv^-5|
certifying officers consistent with management's;iriG*ea5sedM^^
use of computers,                                        y/yy:yyyy/
     Generally, the use of letters of credit, whiPh inyi^ly^^^^
obligation and recipient drawdown of funds prior; to;fi£^^
of the normal support that payments are proper, apppafst^^^
be similar to the use of interim payments under Pbst^
contracts. In this regard, the Comptroller Gerieraira|)prQved^^^^
(B-180264, Mar. 1 1 , 1974) certificatiori and payinenit^^;sp^^^^
terim payment vouchers without audit since a detail'pdtfa^
prior to final contract settlement would reveal anyf:!^
interim payments. In the case of letters of cfedit'/|;piii^
assurances that erroneous payments will be adjustedtfby;m
of later audit would provide an accountable offipefjwithtf^^^^^
adequate information to certify payments made, uridef^lpttipf^gjj^tf^
of credit without prior audit of the propriety bflsuci^^^^^
ments,                                             ''^•^"^'•y//yyyy^'':-::i
     with regard to electronic funds: transfers,tfW(#^^
our recommendations will cover this type of disbufjs^n^
adequately. Stripped down to essential? the bislcldi^f^
between an electronic funds transfer arid a checlt^;^^^
computer is the check itself, Theelpptronic fi^^^
system uses a computer in the same w a y as if a Phepk;|Wp;f;e^:i^^
be prepared, but instead of preparirig; :a(check iiit^
the payment to the payee via electfpnic;impuls(^tf S^T^^
of checking of computer systems we; have ;^reconim
be as beneficial for an electronic furidp trarisfet:|systPins^^^^
as it would be for a system in Which aiPheck is pti:^igi^
prepared,                                         ''"• ••'•••::y::/yy//y/
                                   30                        '•'"   ^/yy/M


                                                                              ^:M
    'w.i'ii;.




    3|||
I
    :ii3

                y/i:yyyy///yy                                                                                                 -            'y'/yy/yy^
                tftf;l;-:'^;tftf|;'l;l|l;fe|viptf                                                                             '.:'   , 'y/AAyA/yy//
y               ';:;S:;':-;;.;tf;.;||^ti|li||3^^
                ;;;tb;;.;.|q;i|i|||if|p|i^;;^^
                ;;iix#ifrt;i§|i|iip|igp|
                '^k;^LJn0/^                                     ttf 2\5:; ;;apt iV i t..i'ps:tf iri'.f'22j;'.^e >c.P cu t
                i;iiivPrit:|.0|rii'^|i^;r^^
                ^;i|eE;!|;i^ri;j||l|?||^^                                                                                            "' •Th;eSei-l5c>;ca^|:;-t|;|:
                ;;;tibn|^|w^;if||(j|^^
                ;;;pay)|i|riS;|pln5p|^                                                                                        :prpce:s;sp;&,tf{|:S'Qmpl'
                vfSteJldpsti^^                                                                                                   ' niethpd.^-';;wpr%;:;^al^^
                jibipidfpd'f:;;;;:r^                                                                                                    '' - y:y:iy)0-/y/
                i-;;-,':;7tf:^!if;tif|^iP2iliMi£^                                                                                           •'••;.;• ;;"^tftftf£7iitfl
                ;;i;*-tf^:|;D<^a:t                                                                                                              :[ :y::j:yy/
                /:yyp<0^/;^'^^^                                                                     •••.'.-                                   '.'.'-;."''--';:;:Kv;:;;tf;;i|M
                ;;:tf-;;tf:';^W^i^lll:rigftb^^^                         :•;•-",. '-•i';--;.-''-'              ;; ;'i-.;;.;-                  -'•^.-i-'-tfl-^-itfi;;-^:;!^
                ;;2;-|tfJ;|;;iyi;ltf^                                                                                                      V '--•-•";--'-;;^tf •;-'tf-;Stfl
                ;;;;:tf-tf;;;-;;;Bu:re'                                                                                                   :y •/'////y/^y^
                :i5tf;v^;^s7;<pi3t^                                                        "O- •";-"'';•'''•;                               :/''                '-/yy^y/
                tf'Stf!;^'|wa-s;h;in^                                                                                                        •':,.          •y&yyy]
                :;:3;;i;tf;sDpp;a^^                                                                         ^''''•'•/•''^li-W;"----"ifIIP
                :: :;'"i;';'^itf i*^;^tibriPl;tfiG                                          ...i;''..-;                    .-^';';--;;;;-'-;;'tftftf
                ;i •;;i;tf;;p§n;Aid^-^^                                                                               '''::;;;;tf.;:;;,'-;||;;||;5
                   tf;;it;tfFl^lb;;^^f'iria^                                -                                               ;ii-':-tf .tf ";l®-n
                tf':;|tf;:karisa;st;icit^                                                                                          .::////////:!
                '}My:$tie:i^<^y:                                    and/;;D"evelpprrie;nt';;Admi;ristratioh                •••'";-iiS-iilfi
                /;,i;;;tf;xi^h;ic-^g^                                   :'0.ff ice;.-'..'-..,,";;;:;. .• .[-y:',                                                       •:yy:y:fy/.
                .;''-""';.:;-.(.-^^;;;;eh.i;P^gpv^^^^^^                          '•:';. •.••.•-^•";''''tftf--'ii'-:'i'.;';i-''-                             '//y^/S:y
                '•5'V-'tf';Eny;ifvprimerit^^                                                                                                        :/yyy§/
                        'tfApcburi';t;ir^:;SO^                                    ;-;b;f :f ice ;•.                                                           y^Z/t/
                        ';;^;Cirtc;ijiri;a't^           "•...'                                                                                         '^'''yy/y/i

                  6.tf--jGI'ierip^f|ll:^;:Sp,ry;i'Pe^'Administra'tion;-.
                       '.:;;R:pg;i.Prt;'^-6:?tfj0^^^^                                                                                                  ,/ 'yZ/y
                          -kansa:s;tfC"-i;ty|;tf^                                                                                                         .-.•-••''.';'^1-*

                  7,       General Si^fvices Administration
                           Regibri'-75:--•-•'••'; ;;;;'."-'-;';-^
                           Fort Worth, tjrpxas



                                                                                                   31
:%a;:
itf''
$/
i'                                                                                                                                      .'.•;^.;.'>^^i'%:.:vV^:j';^i:^i.^:S;^^;;i.;:;r3;^5^--'
        8;. '.,;5;Depif •trnpnt of ''Beait-h;/.-:Ed-u'cstt^briv/'i;'arib;;^;:S5^
            ';-'^"tf;;:wbi-f if etf                •••yy'y:/Byyyy:^y           :yz/y                            ;;;:;-;;-,:;:gr::ssf||ji@;:
             '''.. N;it;iGrial;:^;;|nst i tute:s;;;-bf-fJHealth;-:"|tf;.;;;;:;>';tfi y/y/y::/.
                • F;ede;f al;;';A;f s i s t aripe:';:Firi'ari               .; •':.J:(.i';itf|;tf ••tf;.'-.-;/'r.;f;^^
               • B;et'hP5da;^'HMary 1 and;-:;;^:;.:-'-;i-                      '/y:/'"                          ""'"'"-"'^"•"^'"''•"''
        9.         p^pfiri^erit of Housing;'iarid;;Ulp;bantf^^^                                                                           //y///yyy-m9ttff;--
                    ;\.^;peypi;bpnient -"' '':'-'''':'':/• •yyyy:''                                                                                   /y/yy/y'y/:yys§M-
                • ••R'eg'i;briy^;7"f;tf^ ;'"' '".:[.':':^^:Zyyy •'       'yyyyyA/A:
                  kinp;a-isfCity, Mis'souri,';      '"';'•',?"itf;•.§;(:;    -yyyyy::
        10.. - Depa;rtinerit; of Justice              i i-;.-'..,';//'-'itf;;M;Si y//yyyy:
               ;p.rU:g;-';fe;rifbf cement'; Adrt:inisitratibri^;:;;;;^                     ::J''i;;i;tfiiii--i':;:Stf::^;:itf-:v'i';ii
               'Riegibri;'ivl0.tf;          S'-i-i i---''';ii'ii'i';'.'itf'ii'ii'ix^^^     ''i':ii'iii^tf7^1tf:iitf-tfi-:tf;^^^
                Karii5as--;C:it.y, M i s s o u r i . .-. •'-'i;-.-;-;::'-vii;i.i:'tfi;;'i: "''tf"ii;li'Mi8iiii:"^^^                                                               TV-flS-


        11.        Departmerit: of Labor
                   .Regl.bn;;>S;.-r7
                   Chipagb;;; ; i l l i n p i s
        12.        Nationa'l:;;Aeronautics   ,and:,,:Spiace§il;;l       '/yh/y/:/yy:
                      Admiri'is:t;ration               .-ii'tfiitf;;- . yyiyyy/y'/                                                                                         &^.i-"^;-i-

                   L.B. ..j;phrispn Space. Center"'.:"":;,.;;;;7-tfi'itf -/::yyyyyy
                • Houstoriv;;"iTexas                                                 . •y:y\                           :y/:/yyyy/yys^ssM§,
        13,       N a t i o n a l Science Foundation
                  W a s h i n g t o n , D.C.

        14.        Railro.a;d;;Retir ement.. BPard;i^-;:tftftf';';tf;tf                                             /yy/yyyr^--^-:>m'i&^t^-.--^?r
                   Chicagp;"';;"tllinois          •"••:" yzy/                                                           ^/yyyyL-y/f^^^y
        15.        Departmerit,'of . S t a t e .                          -';;.'i--i';iiiiXi:tf;tfi '          •.';i-.i:iiitf®;Ci:;i:tf?-iiiitf^^
                   wash.ingtpn;, D . C .                                  ,i.;;:.i-.;.':' ;.i;'-;-i-i/'itf     ..';i;;tf'S:-iiKfl??'tf'iii|:^^
        16.        Departmerit^ of Transpofta.tiQri';;;:;.;7:tf^tf                                           '^' y y y y y y y / ^ ^ ^ ^ ^ y ^
                   Fede-r.al;;;::H-i'ghway .-Adminiptra-tlbri;iiSvtf
                   Regiori",'i8;.-"-;               i..tf-i .;'••;'tftf;ii;:tfi                               :_tf^.:'/|;:-;i;tf;tf'-
                   Denver',.'-'Cblorado              i;'rii----i:'ii,';-^.-i;tfi'::\tf
        17.        U.S. Information    Agency .,;-;,--tf-'';;i:;(;;'tf;r-^
                   Washi'ngtbn,   D.C.                                   'y/yy-
                                                                                                                                                                    y/y^^W^^t '•'

        •18. Veterans. Administration •"• y:,:'yyy                                                                 •'y?/:y:yy/z-yyyiy&yM
                   Data Processing                     Center.          ''•';;                          .      :yyyyy:yy                                                           'iM
                   Austin,           Texas                                         ;;;i^-'iitfi;7:i;i -                                       /:yi^y/y:yyyy:sSM




                                                                            32
                                                                                                                                                                                                 .>-;;.t
     5lS^H££i;S2.9££l££££
1,   Department of the Air Force
     Accounting and Finance Center
     Denver, Colorado
2,   Department cf the Air Force
     Wright-Pattetson Air Force Base
     Dayton, Ohio
3,   Department of the Army
     Fort Knox, Kentucky
4,   Defense Supply Agency
     Delense Contract Administration
     Services Region
     Dallas, Texas
5,   Department of the Navy
     Regional Finance Center
     Norfolk, Virginia
6,   Department of the Navy

     NorfoTkT Virginia
7,   Department of the Treasury
     Regional Disbursement Center
     Chicago, Illinois




                               33
;;'::^;':i.-i;::


                   APPENDIX 1 ;..:|||;;;.:                           .      :/::m§g§§y;               :A:/y^l:mm§iS§
                               : :cEkEcirriyE-'OFFicii:^
                          J          10FFICE OF MANAGEMENT ANP BUDGET
                    X--                        W A S H I N G T O N . o;c.;; 205iD3;




                                                                                          JiJ|fi|97|||ii
                   Mr.   D. L. Scantlebury
                   Director, Division of Financial                                                 -/^\i.i-P^::|iilpi
                       and General Management studies                                                           tftf^^^^l^
                   General Accounting Office                                                          i''---;iWA|i:;iiii5|;
                   Washington, B.C. 20548                                                       ^^^^^^ itf^^

                   Dear M r . Scantlebury:                                                            ':..i-;;i;.;-K-'iiiii;'i#|;i

                   This is in reply to your draft report entitled "New; Metjfp(||||tf
                   Needed for Checking Payments Made by Computers." W e ;tpltdtfiis|:
                   the report with great interest and share your concefniitKatS^tf^^
                   certifying officers Who are legally accountable for p a § p i ^
                   generally do not have a systematic way of knowing - V i t i e ^ i a r y y /
                   such payments .are legal and accurate.              .- 'i.(-tfiii';|i;;:#tfl>;iii|

                   We agree that the advances in information processirig;;t^cih|-SiS#
                   nology have affected t:he methods established for certi;f}|lngr^?l^
                   whetzher payments are accurate and legal. We a l s q / a g ^ e ^ y a i y
                   a matter of good management, that cbmpiiter systems ;;siibul^
                   be revievwed periodically by operating; ;^ersonneil :a^W\i;Plii;|^
                   by agency auditors to assure tJieir reliability andj irii^^iiril^l
                   However, there is an implication throughout this; ireitort^M^
                   1:he certification of a computer system ias operatingiiprbppt^iy^^^^
                   will guarantee payments that are accurate and Ip^ill^ltf^iis^^^^^
                   implication can be misleading. In ari]^ ;automated^ipajT^
                   system, the cpmputer is only one elPmPriit in fihpypi^p^
                   For that reason, we believe it wotild;bei bene;ficiiai|i;jf^
                   report to address the broader perspective of qniiall^HEcPriScbitf
                   throughout the overall system, including the steps;i:pf|(aata::;'^^n^^^
                   acquisition, establishment of p^ynientjjpfiteria/^w
                   examination and data input.                        •••-'•ii-tf::;i':.-''i|tf'tf^^^^

                   W e have been informed by the agencies^ that certalKfcontrblsii^^
                   now exist. Some agencies use "test idiecks," statisticaltflitftfw;
                   sampling techniques, management reviews> and audits; iby^ljMl^^^^
                   internal auditors. These controls prblsably varytfambrigf#y^^^
                   agencies as to their effectiveness,.;; Sppliis.ticatiQnl^'^
                    Cormalization. Your draft report-'will'lundotibtPd^lySiitfl^
                                                                34                        . •'tf:i;^'i'':'i';i;i^iiiSilitfi';
     ip^B^t^mMyyyy            yy/:yy:y/yvyyy:y                               .';-vtfv;?APPENDIX^;; is

     ;;:'erip;ib]Ur:a^ei;^^
     ';;b;M-pr^;;;jgia                                        p a r t y ' o f ' • the;^;;i;b^eral'ltf •;!®
     ;;:mifii%:<iftferil^                                             ' t h e qu^:li:ty' ijppniti'f^
     ;;;rPs|ibnpil?liit^^                                          - agericy • ;'maria^ef;S:p;5;^;;s^        :
     ;|ireSj;alipaidy'vd^                                          w i l l ' re'quirp''-!'-ag(iricip|i;;'
     ;-tp;;y£:birti;^.:%;i^   cdbputef-•:';;systPmiS;.-''.a:s;: ;to reliability.;'"- 'While.;;'-
     .;s?iph;f;;i^;;;;p^                            ;giiarantpe accurate.^and .iPgal;;''':.:
      paj^erits^loit^;^^        provide a measure ;o;f systems reliability.
      lndPpeftdprit;#             and mariagement reviews- should, of course,
      cbrit;inii<e'itpy^                                              necessary.

      ThiS/^reppft-ialso raises serious questions as to whether or
      not the GpriiPbpt of the cPttifying officer is outdated as a
      rbsult of techriological advances. We believe that it is time
      to reyiew arid Update t:his concept to b e consistent with modern
      rhanagemerit tec^^^             As you suggest in the draft report,
      t:he ;adyPrit pf |riniodern computers and btther technological
      advanpeS ha^sire g^        birt:h to large-scale operating, accounting,
      arid irvfprmatipri systems. Oftentimes, t:hese systems are
      gebgraphically dispersed throughout the country, feeding
      information to a central computer either directly or indi-
      rectly from a multitude of locations and offices.

      The problem of sheer size and dispersion of the systems is
      further complicated by organizational alignments. Freguently,
      so-called certifying officers do not have organizational and
      operational responsibilities over all people and offices
      feeding and ha^^^     information. Also in many instances,
      the certifying officers do not even have operating cbntrpls
      over the computers that are processirig the information tha^
      they are required to certify. Moreover, the wider applicar-
      tion of letterrof-credit procedures and the electronic
      transfer of funds techniques will further complicate the
      true roles pftfthe certifying officers as we know them now.
      We, therefpre, believe that the whole concept of fiscal
      accountability and certifying officers should be reexamined,
      and recommendations made to change existing legislation to
      accommodate modern methods of management and the current
      state of the art in information processing technology.

       We understand that the Treasury Department has in the past
       suggested a study of the laws and procedures governing



                                                  35

i.
APPENDiik;'^l:-"Dii;i-;;;;-                           :;^i-i;^'i(-;i|;-;;|AE^^'ENiix;lltt^^



 the personal financial respprisibiiity of cPrtifiidrig^^^^^
 o f f i c e r s by t:he Joint Firiancia^l Mariagemervt I
 Program. We b e l i e v e t h i s suggPstibri has mefiititfandtf^^
 would support such a study.

                                        .Sincerely,

                                            ^ * ^ ^

                                        Jair^s T. Mclntyre> Jri.
                                        Deputy Director




                                   36
^•m.y^.-y'vmm
j'^'i'^i'i •'




^&y'' 'yyy:mm^^ty:y:-'-rr^^^^^^
[ir;.V'                                     . - . . . . . , . •     . .           .           .   ...
                                                                                                                               - •>.;-;^tf;.;;i:tf-;tf;APPEiiii!ix;:;ft^
                                                                                                                                             . . , . , , . . . . . , _ _ , „ . . , ,


ii-
ir,'?".

                                                                                  :DtPARTIilENt;dF AGRIGULTURE
p..i;;.y               ''^^''"-•••'-"•ySliHslj^                               - •;''•;•'-••;'"•';-P'rF''ce;;QrTHE--.sik:c»»ETARY
i l i'i^'i             .i'';;ii';'^:;;:?^llMI©f;':;'fc-i;v;i.^S^^         .     •:;;^-:''-;,;;'-o.-vvASHi.NGt6'N;-;:b..i;c




                                                                                                                                                       Hay;-
                                                   Mr. D.L. Scantlebury
                                                   Director
                                                   Division of Financial and
                                                    General Management Studies
                                                   U.S. General Accounting Office
                                                   Washington. DC 20548
 1"
                                                    D^af Mr^ Scantlebury:
                                                    Your leitter of March 17, 1977 requested our corranents on your d r a f t
                                                    reportAerititied "New Methods Needed f o r Checking Payments -iWade by
                                                    Cbitiputeirsi"^^^^ The report documents what f i n a n c i a l mahagerst have
                                                    perceived;for some time, i . e . , the r o l e of the c e r t i f y i rig o f f i c e f
                                                    haisjchariged d r a s t i c a l l y i n the advent of large scale computer
                                                    proemssiirig;Jdf payments. We wholeheartedly agree with the
                                                    ba$ic;concept that the c e r t i f y i n g ofi^icer must rely on the
                                                    auitomated systern and related procedures to provide reasonable
                                                    assurance t h a t payments are proper.

                                                     We do hot itgree that a separate organization i s needed to review
                                                     systems iriieach agency. Rather, we involve the c e r t i f y i n g
                                                     o f f i c e r i ; i r i the systems development process to assure himself
                                                     that pirbjper controls are included i n the system design. The
                                                     c e r t i f y i n g P f f i c e r determines that proper audit standards are
                                                     used andi^that proper s t a t i s t i c a l sampling c r i t e r i a are applied.
                                                     Ohce the system i s i n operation, i t i s continually monitored,
                                                     tySthe;accounting u n i t s , through i t s outputs and an occasional
                                                     sampilihg of transactions to assure the system i s operating as
                                                     des1gnedi;;;test data i s used to validate major changes to the
                                                     systeiii^ ; We do not believe that quarterly reviews w i l l serve
                                                     any pufpdie other than consuming paper and human resources
                                                     needlessly^ We believe that our system design procedures
                                                     described above and normal internal audits would provide
                                                     s u f f i c i e t i t ; review proceduresi.

                                                      Certifying o f f i c e r s should be emppwerled to demand special reviews
                                                      whenever they believe that the sysitiem 1s not operating a}S designed
                                                      or Isippefating i n a d e f i c i e n t manner; This demand should be I n
                                                      the f P r m o f a l e t t e r to the agiency head who i n turn would provide
                                                      interiin payment instructions and a time-frame f o r completion o f
                                                      the revlewv Automated payments should be interrupted only as a
                                                      last resort.

                                                                                                                 37

                I...
APPENDIX I I                                                          APPENDIX I I




 We have no Conceptual problem with ypur;relief prpvisipris regarictliril^^^^^
 certi 1^1 hg of fleers; howeverv si peC1fi:C|ui deli nes,will; ;ha
 provided on what idocumeritatiorilimust^at^         r e l i e f reiquests^fro^^
 certifiying; ofi^ieers. FurthermPre, w^ belieye that thejrteW5;p^
 could be furtheV" strengthened by call ifig^^^^ certificatipri 6|;:;s^^
 factors in the ADP and tel ecbmrnunicaitibns' envi ronmerrt .tf Physical
 procedural arid personnel security isHould ibie ponsidered,tfinya^
 hardware/softwar*e evaluation.'                                    '"''•'/':/=">••-Wyyy
 We appreciate the opportunity to comment pn the proposed :;proCpdureS;i^^^^^
 Sincerely,




                                            38

                                                                         m
        &Bm^MwMyy/                         yy/y/yt/yyAy/                           .:- •y;ApiMNDiixiiiii;ii"
itf:;
                                                         ' Tlw^ AissistatitriSitretiih*
                                                         ;;vvashingtbri.-'p.G,;; 20230-;-':----'      ''y'y:-yyyyyi^y^i

        yMlMmiy:


        Mr;.;vb. ti> Sc|in^
        D i t e c t b r ^ ; ; D i y i s i o n bf F i n a n c i a l
           andtfGerierai^M                             studies
        U . S . GPriefal; A c c o u n t i n g Of^^^
        Waishirigtbriy DVGv 20548
        Dear Mr. Scantlebury:
        This is;in response to your request of March 17, 19 77,
        for comments pri; the draft report to the Congress on
        "New MP^             for Checking Payments Made by
        Cpmpuliersi •' ;
        We agr;ep iwith ypur draft report's conclusion that the
        vefificatiori Methods now employed by certifying and
        disbursing bffibers should be revised to better cope
        with'computerized payments systems. Hbwever, we feel
        that ybuf repbrt would be strengthened and better
        accepted if certain changes were made. First, it should
        recbgnize the existence of systems reviews now in place.
        Second, it should demonstrate that all existing internal
        Goritrpis werptf£tdequately cbnsidere     Third, the draft
        should eyidpriPe consideration of existing laws regarding
        the iPgai rPSpbrisibilities of agericy heads and certifyirig
        officers.: Arid finally, the final report should point
        out the Neitiipnal Bureau of Standards' responsibilities.
        Under the Brbpiks Act, for Federal iriformation processing
        standards. ^^^iT^^^  standards would bei basic to implpmen-
        tatibribf the.report's recommended course of action.
        We suggest cpriSultation with NBS' institute for Cbmputer
        Sciences iand Technology conGerning their capabilities
        relevant to ybvir proposals.

         EXISTING REVIEWS OF SYSTEMS
         With respect to the laws requiring establishment and
         maintenairice of effective accountirig systems and internal
         controls, we feel that we are complying with these
         requirements through implementation of our Comptroller
         General approved accounting principles and standards.

                                                            39
liHvl
p.! If!




          APPENDIX I I I                        "^•''•'://yyyyyy           :-'-^f;-l|ii^iHi3ijti-iSi:i""'



          As you know, this apprpval was ;grantpd rafter atfppmpl(e^^
          review of the automatic: daitat';-pr<^Ps,sirig: fea:ture'st»'Qf||p^|;;|;^^
          system. Page 15 of yo'ur .draft;"i;giye;sr-;;t Depa"ftn»nt;:spiftf^^^
          Commerce as an example whelrb paty^ritsv>^         made ^ i n - p i r ^
          because of problems in computerlzed';ipayroll ' sys^emsZ:"////
          We are moving to solve these •problente:itfbecause'-;.!^
          November 10, 1975 report (FGMSIJ) 76-3) -you recphm^nd^dra^;?!^^
          that we:                                                  '-i'"i'•"';''i'i^'IfiistfS
                  "Make sure that the internal auditors
                  (1) become actively involved in designing                               ctf itfSfS
                  and developing automated systems>;;;and
                  (2) continually review these systems
                  after they become operational."
          As a point of information, our internal audit staff is ;^^^^; •!;|
          heavily involved in helping to develop, sound c o h t t p X s y y y y
          for the system. Also, our Bureau and Departmental systen^
          staffs work closely with your staff in;; designing aridtftf^^^^^^
          implementing accounting controls to mieet the Gpinpt^rpllerp|;tf
          General's requirements. Our audits bfi oper at iri<^ if ina^^
          systems include review of accounting Ppntrols. cihanges;itp'ttf
          ADP systems are also under review by Pvir systems staffsE^
          Hence, as far as the Department of Cpminerce is PbncieBried^
          we believe your recommendation that %ach automated;|payment^
          system be reviewed at least quarterly ;would requir&tfj^^
          that would be excessive. We suggest ;that il: would ;-b^;;nvpf^^;tf
          practical' to have reviews made'"wheripypr there is-;"^a;;;|;;'-;:;tf^^^
          significant change to systems and;at'';lieast anniia;llytf:^tffrf;;-;||^
           CONSIDERATION        OF ALL EXISTING INTERNAL; CONTROLS                          -//'y/iymy
           Your report is presented under the assilmptionthat^^
           total internal'control of the. computerl;zed syS-tpmstfyph^
           reviewed are part and parcel of the^ computer prpigr
           We have points of financial cbritrPlstfbther thari':;;jth-bSe;|||;;!;M
           built into the computer prograins. Celctifying^^^a^
           review the necessary dociimentsy ; suchtfaiS receiyingflrppof t^
           audit reports, personnel and other actions to; a:|Sutetft^
           p r o p r i e t y of payments. Even th6ugh;;|t]fie c e r t i ; l ^ i r i g | | p f f i b ^
           is ultimately.-responsible, he'^Isb''.^relies 'ori'';^bt]^'er;p|;tf||i:;-;;;^^^^
           responsible persons' actions arid eyaluations. ; i t ^
           apparent that the report takes intp; Pbnsideratij^
           laws and regulations pertaining to Inderal reppfdS;^§E^
           we believe provide adequate proteptiprr; and                          {iy^^t^t^yZyyiy!^
           Comptroller. General's decisions ;relating to' cef^t;i;fJiiingM«J^^
           officers' reliance on internal'cori'tr'''li                              '"'::yyyyyyyys:


                                                      40
APPENDIX III                                     ApPENblX;Jlll


CONSIDERATION OF EXISTING LAWS
The problem of accessibility of records for adminlstratiyp tf
review (preaudit) is the same as the problem of retainirigrtftf
records for internal audit and your audit. In btherriWof^dsftf
we must retain accounting records to meet yourtffejquirei^
for audit. Therefore, they must be available for revieW by;;
those responsible for certifications. 31 U.S.C. 200, fbrtf^
example, requires that no amount shall be recorded as an
obligation of the Government unless it is supported by
prescribed documentary evidence. 44 U.S.C. 3301 requires
us to retain our records i)i prescribed format, and Title 8
of the GAO policy manual places restrictions on our
disposal autJiority with respect to financial records.
We cpraply with all of these laws and regulations. Our
priginai dpcume^^^^ are retained and are available for
sUppbrtirig payments, facilitating audits, and adjudication
oif legal isspps>
All of ithesptf^lpigislative and regulatory requirements and
cornputer reliability problems require comprehensive
orgariizatibri b'f files of original records to support our
paymPnts. CbmplianGe witJi 31 U.S.C. 200, for example,
requires an ;x>rigoing system of accounts payable files to
mPet the documentation requirements for obligations.
 The need for records management systems to support these
 requirements is the reason for the following in the
 Department of Commerce Accounting Principles and Standards
 approved by the Comptroller General in 1969.
      o   The procedures covering the input of data
          to an automated system must provide for
          manuail extraction of necessary data and
          prpparation of reports in the case of
          equipment failure.
      o   Computer programs used in automated accounting
          systems must provide for an audit trail which
          *** provides for and facilitates application
          of financial auditing techniques.
 We apply these standards to all of our financial systems.
 The records are filed in an orderly manner for review
 by anyone entitled to look at them. We do not rely solely
 on computer controls to support our expenditures.




                              41
kp:BE!lJ0^:m0:gZy/                  . • '';^^ii;i;:';'^i'';"!;i';i^i-f'tfi;i;;';i';;'^B'itf   ' /y//:f0^^Xt^00miiB^


Rathpr;,'tfpurJ-;itPtia;l s y s t p i n ;^bf:;i:rite.rrii-al;i;;cbn'trp;l;"^^;iri(^
computefe;;';arid;;^;S^^     ,s-afe'guards;.v;vH9^^^^                      '"i'';';'iVi'i:|';;^-vs|tf^iitf;tf^^^^^

PerhapS;^;:::;the,.>mc>s;t. intportariittf;legalt-;;iOTpac;^ p.f .;thfe.;';r(|ipb3f
i s -•the;.::gue;sti;bn3;Pf what'.::hapj>ens;;;;^i;f'|ft^^
 ( i n "vCUf: ";pase';-;:thb;;:: Secrie ta'ry-':;bf;; •Cbnui»er(^ receiyes--:|;a :^ireE>b^;t;:f;-;;^tf i;tf
t h a t •••a; ;edmputPr-;|system-,:^doPstfri                      t h p : •;paymerit:;pf5-;ja|i:is
payroill...';----:';:p;res;uinably, the--. 'iSpbretary-;;;-mus.t authorizpMi^e-^tf^
d i s b t i r s e m P n t - ' d i - t e c t l y or- -,rnerelyr^pass;:ithe prpble'm;|bri^:;-;tGtf^^
certif yirig;..i;pff'icPr. -•Under::..;exiStirig;-;;.;;l^
payment i-apcountability,-; the-.;Sec.reftar5^=:;-;I;agency^;h^
become ..personally liable.-for^'the;'--amount^ of any ..^paymerityS^^^^^
she authorizes. We be lie vP^;:that'.;.theV-:pub lished {rppb'rt;tf;;;|utf^
should address this situation:.•-••.-                                             - '''i-';-:;:-i-:i.-iii^iitM^^iM^^^
In the situation where the certifying: officer is notified;i;tf;tt^^
either (1) that the officer can rely o n the system, pr;;|;2te^^^
that the officer cannot rely o n the system, tJie body f^tf tflStf?^^
Comptroller General's decisions, as well as your drafttfftf
recommendation, provides no assurance that the offipprtf i;^:; &
can rely on either of these notices.;;-;-cie'urrently,/'the;;i;iw^^^^^^
Comptroller General's decisicns-, 5-5 .;Gpinp. Gen. • ^ ^ y ^ y y y / y y M B
49 Comp. Gen. 3 8 , and precedent decisibris, estabilished ;?;;>tf^^
clearly that the certifying officer must seek a Gprnptrb
General's decision in order to be ; spfre of f inan dial ipr b
In the case of an adverse report, no alternative aPttipn^ii^
possible;' the payroll must, be sent-. tp;^;the Comptrpliertf/tftf^^^
General for a decision, regardless of-the exigenpipss^bf^ltii^^
payment.                                                    i'-i-iiii-tf''-riiii^^tfiiSS
As Stated at the beginning of this letter, w e certaJinly;p tf^^^^
agree witJi the proposition .that';ADP..;:sys:tems •shopldtfbe?;:;;:!!;;^!^^
checked periodically to ensure reliability. Hbweyer;i|v^
feel very strongly that quarterly rpyiews of eaehi^aUtbi^
payment is excessive to the requiremerits of pruderiiti;iaaLria;gPm&i^

Sincerely,                                                                                            :y:y/Zyyy:

     i - - • '- '                                                           ;V--- .           . • ^:iBlliliii
 Eisa A. Porter                                                                                 '^yy-''^::yy::zi/y:
 Assistant Secretary                                                                               •'•i-i;-;-''''^''i;i^;ii;::rtf^^^^^
   for Administration                                                                         ••..:-''*:tf;:,:;;;;*:;tftf-;;i-j^^^^^




                                                           42
    '^j^itrnM^m-y://.                              yy/yy/yy/yA/'    ''/yy^-^mmMm


                                            ./ZmiiAiii^

                        ,^,yy:AA: .-                               ^ Mim?
•cf3Mp-rRoi.;LER';;':tf"''   '"'i""'",;;'


      .• • MritfD^i^^illiiitfilibantlebury-
         jDii^fePjtb^                   of F i n a n c i a l
          '';:.\ii;&'^';;Genbr;a            '-Studies
             CenHgiral; A^
             Wishirigtbrip;i;i.C. 20548
          Dear Mr. Scantlebury:
          This is iri reply to your letter, March 17, 1977 to the
          Secretary;; bf-;Defense regarding GAO Draft Report "New
          Methbdis Neeided for Checking Payments Made by Computers,"
          FGMSb-76-i82v(OSD Case #4580).
           We agieeitf(1) that the shift from manual to computer
           supported ;financial systems requires new methods for
           checking;payments; (2) that the evidence of accuracy
           and legality of payments must relate to the system rather
           than tb; iridividual transactions; arid (3) that as part
           of this evidence certifying and disbursing officers
           must receiye; assurance that the automated system is
           functioning properly.
           Technology continues to make ADP more effective albeit
           more cpmplex. Therefore, the development of new
           methods is an evolutionary process. This process
           involves broad participation in the design, development,
           testing, operation, and maintenance of such highly complex
           systems. The basis for assuring proper function must be
           laid in design, development, and testing; and it must
           be maintairied throughout operation.
           Despite continual changes in methods and increasing
           complexity of participation, the principle of personal
           responsibility for certification and disbursement must
           be retained. Our efforts at readjustment of techniques
           ought to be focused upon overcoming the trend toward
           diffusion of responsibility for the overall system
           without clear cognizance by the certifying or disbursing
           officer over the information and resources necessary
           to take reasonable and prudent action.


                                                          43
   „ ^r,x^ V^;   i- *                                   APPENDIX ..IV
APPENDIX IV



We believe that: : (I) the chief accounting official of the
agency shpuld be responsible for system design; (2) the
internal audit ;-br*^anization of the agency should be
consulted in systeim design; (3) the internal audit organization
should participate in the system; prototype test arid;;iriSK,^^^^^^^^^^^
occasional operational review; (4) thetfcertifying ;Pr>;diSbur'^^
officer should have a reasonable degree; of cogriizaricp; pyei:;';*^^^
the manual and automated aspect;s ;p.f system oper'atipni'^ndi;/';;;;^^
over the quality control techniques which monitpr ;bp;tKltf;tf|;tf^^
aspects; and (5) the certifying of disbuifsing .officer;,;;yj;;;tfT,p^
should have appropriate internal rpvieWtffesources and^:0hbuld^*@^
continuously exercise tools and techniqubs to ensure; i:;tf:M^
quality control. The last of these, in. isolation,^^^; ^^^^;^^::tf^^
particularly on a quarterly cycle •For complete reasssssittsri1^p;;tf|
would not produce credible results.                 ":\'::yy:yyy
Finally, we need to be careful that the policies and^^^.^Ji;tf;tf
procedures which are ultimately settled upon are techriipaliyg ;;>^^^
adequate and are feasible of implementation since thpyiitftf;;tf;;^^^
must be carried out in a constrained resource enyirbnmerit^^tf^^^^^

                                     SincereIy,          ,. ;;v-'" /Zy/y/M




                                             •P.
                                              r> * r«


                              A;-




                                    44
APPENDIX V                                                APPENDIX V



             DEPARTMENT OF HEALTH. EDUCATION. AND Af.LFARt
                          OFFICE OF THE SECRETARY
                            WASHINGTON. D C   20201

                                                         MAY 1 9 1977
Mr. Donald L. Scantlebury
Director, Division of Financial
  and General Management Studies
United States General Accounting Office
Washington, D.C. 20548
Dear Don:
In reply to your letter dated March 17 to the Secretary regarding the
GAO draft report, "New Methods Needed for Checking Payments Made by
Computers," we agree that new methods for checking payments are neces-
sary. We also agree with the conclusion that the certification of
payments, regardless of how processed, should be based upon evidence
that the payments are accurate and legal. If the certifying officer
were provided with information that the system Is functioning properly,
he would have a reasonable basis for attesting to the legality and
accuracy of the payments made.

The draft report recommends that each organization establish a review
capability to attest to the reliability of systems and states that "such
reviews should be made at least quarterly and should be perfonned by an
operating rather than an internal audit organization." We believe that
the reviews should be less than quarterly—preferably on an annual
basis—and that the only restriction on "who reviews" should be to ex-
clude individuals responsible for the design and programming of the
system being reviewed. We shou*- not rule out internal auditors since
they seem to be one of several logical choices to assist In the review.

 While we are generally in agreement with the concepts proposed in your
 draft report, we suggest that "systems review" be expanded to cover
 certification of payments made through letters of credit.
 We also suggest strongly that you make a review of the staffing resources
 needed to implement your proposed requirements. Your report draft does
 not provide sufficient detail to permit us to make an assessment. Ac-
 counting and auditing resources are scarce in HEW. Additional staffing
 would be needed to establish review capabilities for HEW's numerous
 payment systems. This is a hurdle that will be difficult to overcome.
                               Sincerely yours,

                                 ftvj\
                               Thomas D. Morris
                               Inspector General
                                    45
APPENDIX VI                                                           APPENDIX VI




                             DEPARTMENT OF THE TREASURY
                                   W A S H I N G T O N . O.C. 20220

FISCAL ASSISTANT SECRETARV




       Mr. Donald L. Scantlebury
       Director, Division of Financial
         and General Management Studies
       U. S. General Accounting Office
       Washington, D. C. 20548

       Dear Don:

            This is in response to your letter of March 17, 1977 to the
       Secretary of the Treasury witli which you transmitted your draft report
       entitled "New Methods Needed for Checking Payments Made by Computers".
       As you requested, we are furnishing our views on the report from the
       standpoint of the Treasury's role as a central fiscal agency.

             As a matter of good management, we agree tliat automated payment
       systems should be reviewed periodically by operating personnel to pro-
       vide assurance regarding the reliability of the systems. We also feel
       tliat it is important that such systems and related processes remain
       subject to independent audits by intemal auditors. We doubt, however,
       that the specific recommendations in your report will really solve the
       problem. We perceive the overall problem as being somewhat broader
       than quality control over computer-generated data and feel that further
       study would be desirable before a final report is issued.

             In this present Jay and age, large-scale accounting systems exist
        in almost every agency. Computer processing may complicate the problems
        of an accountable officer, but they exist with or without the computer.
        The sheer volume and complexity of transactions makes it extremely
        difficult for one individual to verify tliat every item he signs is
        proper in every respect. At the same time, however, he is still per-
        sonally liable for losses under a law designed years ago to fit a much
        different environment.

             We have long been convinced that there is a pressing need for
        modernizing the whole concept of personal financial accountability of
        accountable officers--not only for those officials responsible for
        approving the payment of Federal funds, but also for those collecting
        and disbursing such funds. Attached are copies of pertinent letters
        on this subject dated September 6, 1968 and September 17, 1969 from the


                                          46
APPENDIX VI                                               APPENDIX VI



Treasury's then Acting Secretary Barr and Secretary Kennedy, respectively,
to Comptroller General Staats, outlining the accountability problem and
strongly recommending an inter-agency study of the matter. The pro-
posed study was deferred in each case at the request of the Comptroller
General, so as to assess the effects of certain actions planned or taken
by the General Accounting Office to ease the situation. While some
improvement did result from GAO's delegation of authority permitting
the administrative resolution of certain irregularities under specified
amounts, the basic accountability problem still exists.

     As indicated in your report, the system of accounting, auditing,
and control used in the Federal Govemment has evolved into a huge,
decentralized, computerized, largely cashless system today. In line
with these fundamental changes, we feel that a comprehensive, inter-
agency study should be made of tlie archaic laws and procedures goveming
the personal financial responsibility of accountable officers for the
purpose of (1) modernizing the laws and simplifying related procedures,
and (2) developing reasonable and equitable standards of accountability
for accountable officers in light of current conditions.

      We believe that such a study would be an appropriate project under
the Joint Financial Management Improvement Program, in line with its
primary mission of improving financial management activities through-
out the Government. We therefore recommend that the JFMIP Steering
Coiranittee be requested to initiate an inter-agency study of the entire
matter of personal financial accountability of accountable officers as
soon as possible.

     We would appreciate hearing from you further regarding this matter.

                                         rely yours,




                                        vid Mosso


Attachments

 GAO note!    Since these attachments deal with the same
              concerns expressed in Treasury's and OMB*s
              responses to our draft report, they were not
              included in this final report.


 (90108)


                                   47