Issue Date April 15, 2009 Audit Case Number 2009-FO-0004 TO: Darlene F. Williams, General Deputy Assistant Secretary, Office of Administration, A FROM: Thomas McEnanly, Director, Financial Audits Division, GAF SUBJECT: Review of HUD’s Internal Controls over Processing of Personnel Actions HIGHLIGHTS What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) Office of Administration’s internal controls over the processing of personnel actions in response to an anonymous complaint received by our office. The complaint was accompanied by a binder containing specific examples in support of the complaint allegations. Our initial survey review indicated that the allegations were valid and warranted further review. Our objectives were to determine why (1) human resource actions were not processed in a timely manner, (2) employee requests to waive the automatic collection of payroll overpayments were not processed before collection actions began, (3) adequate documentation to support job vacancy announcements was not maintained, and (4) employees were able to initiate their own personnel action requests. What We Found The design and implementation of HUD’s internal controls over collection waivers, new hire paperwork, processing of awards, promotions, within-grade increases, pending personnel action requests, and job vacancy announcements were inadequate. The issues identified in our review indicated a lack of internal controls to ensure (1) the timely processing of collection waiver requests and new hire paperwork, (2) that employees were afforded the opportunity to request a collection waiver before salary offsets were taken, and (3) that Office of Personnel Management job announcement policies and procedures and record- keeping standards were followed. Finally, in certain circumstances, the HR Connect system lacked the controls to prevent employees from being involved in the processing of their own personnel action requests, which made HUD vulnerable to the processing of potentially fraudulent actions. What We Recommend We recommend that the Director of HUD’s Office of Human Resources implement a tracking system for (1) monitoring new hire accession paperwork and (2) processing awards, promotions, within-grade increases, transmittal of application status notification letters, and collection waiver requests. Additionally, policies and procedures regarding the processing of collection waiver requests should include timeliness standards for the research and review phases to ensure that decisions are made in a timely manner and that collection actions are not premature. In addition, we recommend that policies and procedures be established to include supervisory review of pending new hire paperwork actions, job announcement case files, and checklists upon closeout. Staff should be retrained regarding new hire paperwork policies and procedures. We also recommend that the Director of the Office of Human Resources ensure that staff performs the necessary reviews to certify that each job vacancy case file properly supports the recruitment process and employees do not participate in the processing of their own personnel action requests. Lastly, we recommend that all employees be informed that it is not allowable to participate in the processing of their own personnel action requests. For each recommendation without a management decision, please respond and provide status reports in accordance with HUD Handbook 2000.06, REV-3. Please furnish us copies of any correspondence or directives issued because of the audit. 2 HUD’s Response We provided our audit results to HUD’s Office of Administration during the audit. We also provided our draft report to HUD’s General Deputy Assistant Secretary for the Office of Administration, its Deputy Assistant Secretary for Human Resource Management and the Office of Administration staff during the audit. Additionally, we held an exit conference with the Deputy Assistant Secretary for Human Resource Management on February 13, 2009. We asked HUD’s General Deputy Assistant Secretary for the Office of Administration to provide comments on our draft audit report by February 27, 2009, and written comments were provided and dated February 27, 2009. The Office of Administration generally agreed with our findings and recommendations, though comments on the report solely focused on our report recommendations. The complete text of the written comments, along with our evaluation of that response can be found in appendix B, except for 25 pages of documentation that was not necessary for understanding the Office of Administrations’ comments. 3 TABLE OF CONTENTS Background and Objectives 5 Results of Audit 6 Finding 1: HUD Did Not Complete Critical Human Resources Activities in a Timely Manner 15 Finding 2: HUD’s Human Resource Management System Did Not Have Adequate Controls to Prevent Users from Participating in Their Own Personnel Actions Scope and Methodology 17 Internal Controls 20 Appendixes A. Human Resource Management Organization Chart 22 B. Auditee Comments and OIG’s Evaluation 23 4 BACKGROUND AND OBJECTIVES The U.S. Department of Housing and Urban Development’s (HUD) Office of Administration provides a full range of administrative services to headquarters and field office customers in support of HUD’s mission. As head of the Office of Administration, the Assistant Secretary for Administration is responsible for developing and promulgating policies, standards, procedures, administrative systems, and materials related to the human resource and administrative management of HUD. In addition, the office oversees the implementation of these policies and directives at headquarters and in the field. The Deputy Assistant Secretary for Human Resource Management is responsible for providing technical services and meeting specialty skill needs to support HUD’s mission and department- wide initiatives and for providing policies, guidance, and innovative strategic planning in the area of human capital management. This function is supported by three offices, which have overall responsibility for providing technical services in their organizational specialty areas. These offices provide the Office of Administration with the following core cross-functional services: statutory and regulatory support, performance standards development, quality control, specialty skill leadership, and project support for departmental national initiatives. The two human resource management offices1 most relevant to our review are (1) The Office of Human Resources, which includes the following functional divisions and work units: Human Resource Systems and Payroll Support; Executive Personnel Management Division; Human Resources Policy, Research, and Development Division; and the Employee Service Center. (2) Human Resource Management Information Enterprise Resource Management Planning Systems Staff. HUD uses the HUD Integrated Human Resources and Training System (HIHRTS) to process personnel actions. HIHRTS is a Web-based human resource management system with tools for employees, managers, and human resources (HR) professionals. In September 2004, HUD entered into an interagency agreement with the U.S. Department of the Treasury (Treasury) to use its enterprise human resources solution, HR Connect. HR Connect is the human resources management system on which HIHRTS was built. It is a government-wide system that is used by Treasury and other agencies. HUD’s “Go Live” date was April 13, 2005. The objectives of our audit were to determine why (1) personnel action requests, new hire paperwork, and waiver requests were not processed in a timely manner; (2) employees were not afforded the opportunity to request a waiver before the collections process began; (3) adequate documentation was not maintained to support the job vacancy announcements; and (4) employees were able to initiate their own personnel action requests. 1 The human resource management organization chart is included in appendix A of this report. 5 RESULTS OF AUDIT Finding 1: HUD Did Not Complete Critical Human Resources Activities in a Timely Manner HUD’s Office of Human Resources did not ensure that the processing of new hire paperwork, awards, promotions, within-grade increases, pending personnel action requests, collection waiver requests, and job vacancy documentation was completed in a timely manner. Additionally, overpayments were collected before employee notification, and job vacancy files were not adequately maintained. These conditions occurred due to HUD’s lack of management oversight of these critical actions. The delay in processing new hire actions adversely impacted employee pay and benefits processing and coverage. Also, the untimely processing of collection waiver requests and premature debt collections could result in the employee’s encountering undue financial hardship. As a result, HUD did not have adequate assurance that the selection process and other major human resource activities were performed in accordance with applicable laws, regulations, principles, and standards. New Hire Actions Were Not Processed in a Timely Manner Staffing and classification HR specialists did not process new hire actions in a timely manner. During the period January 1, 2006, to September 30, 2007, 261 emergency salary payments were made to 222 HUD employees. Based on our review of the Emergency Salary Payment Listing, the majority of emergency payments were made because the HR specialist did not process the required paperwork in time for it to be included in the payroll processing cycle for the effective date. Specifically, 227 of the 261 emergency salary payments were made to 190 of the 222 employees due to new hire paperwork not being processed in a timely manner. Of the 190 employees, the paperwork of 36 employees had not been processed for more than one pay period. For 31 of these 36 employees, this error occurred for two or three consecutive pay periods. HUD’s policy2 is that the HR specialist should enter new hire actions into the system during the first week of the processing cycle. The HR specialist is also required to determine whether the action has been entered into the National Finance Center database. If the accession is not in the database, the HR specialist must determine whether the action fell onto a suspense list. Additionally, HUD policy3 indicates that new hire actions must be entered into HIHRTS upon acceptance of the offer by the selectee. The results of our review indicated that the responsible HR specialists did not always follow this procedure. 2 HUD Office of Human Resources Standard Operating Procedure (SOP 06-01), Accessions and No Pay Procedures. 3 Standard Operating Procedure, Recruitment Request. 6 Management did not ensure that new hire actions were processed in a timely manner. This deficiency put new employees at risk of not being paid by the prescribed pay date. Our review identified 21 of 36 employees who were paid between one and five days after the official pay date. Additionally, employees’ benefits processing could have been impacted. Although HUD’s Office of Human Resources acknowledged this flawed practice, no efforts had been made to rectify the situation. However, HR officials expressed the belief that moving the Employee Service Center from Chicago, Illinois, to Washington, DC, headquarters would facilitate coordination and communication. Awards, Promotions, Within-Grade Increases, and Pending Personnel Actions Were Not Performed in a Timely Manner HUD had not established administrative controls to ensure the timely processing of awards, promotions, within-grade increases, and pending personnel action requests. These administrative controls are necessary to ensure the preparation of accurate program office operating records, accounts, and financial and statistical reports. Administrative controls are an element of the internal control standards4 issued by the U.S. Government Accountability Office. Those internal control standards state that good human capital policies and practices, e.g., hiring, promoting, compensating, and supervising employees, are a critical control environment factor. The lack of a policy and procedure framework was an indication that HUD had not clearly defined fundamental administrative controls. As part of our review of the allegations made in the complaint, we selected a sample of HUD employees from the HIHRTS database.5 The sample included 25 employees who received promotions, 25 employees who received a within-grade increase, and another 25 employees who received individual cash awards during the period January 1, 2006, to September 30, 2007. In addition to our review of processed personnel actions, we performed an analysis of all pending personnel action requests as of February 29, 2008, to determine how long they had remained pending. We determined that 14 days was a reasonable time for the Office of Human Resources to process personnel action requests after receipt. Awards. Nine of the twenty-five employees had individual cash award transactions that took longer than 14 days to process by HR staff. For all nine questioned transactions, we attributed the delay in processing to the agency’s 4 Internal Control Standards in the Federal Government, AIMD-00-21.3.1, November 1, 1999. 5 See the Scope and Methodology section for details of transaction population and sample selection parameters. 7 implementation of the Office of Personnel Management’s (OPM) required changes to the award “nature of action” codes. Promotions. We identified 13 of 25 employees who had promotion transactions that took longer than 14 days from the date of receipt to be processed by the Office of Human Resources. Eight of the transactions took more than 30 days to be processed. The Office of Human Resources contended that it did not process promotions based upon the date of receipt but, rather, upon the effective date. Specifically, to ensure timely processing, actions were required to be processed by the last day of the processing cycle in which the effective date fell. Therefore, we performed a second review of the 13 questioned promotion transactions based upon the above criteria. Although promotion transactions took longer than 14 days to be processed, we found that all but 3 of the 13 questioned transactions were processed by the last day of the processing cycle in which the effective date fell. Regarding the three transactions that were not processed within the prescribed timeframe, the Office of Human Resources approved two actions 4 and 16 days after the last day of the processing cycle. For the third transaction, the program office did not submit the action to the Office of Human Resources until after the transaction effective date. However, the action was not processed until 66 days after receipt. While HUD determined that it was sufficient to process promotion actions based on the effective date, it is our opinion that it would be advantageous to process promotion actions as received by the office. Although there are no HUD-specific personnel action processing timeframe criteria, by processing actions as received, HUD could prevent the office from having transactions idling in its work list. Within-grade increases. Twenty of the twenty-five employees had their within- grade increases processed more than 14 days after the effective date. For these 20 employees, we attributed the delay to corrections being made related to the within-grade increase. Within-grade increases are not generally processed by HR specialists via HIHRTS. These corrections were necessary because HIHRTS and the National Finance Center did not automatically update the last equivalent increase date when there was a promotion or pay-related action. As a result, HR specialists had to manually update the date. Although the Office of Human Resources had been aware of this problem since 2005, the problem persisted. Pending personnel action requests. As of February 29, 2008, there were 53 pending requests according to the HIHRTS pending and processed report. Our review found that 27 of the 53 pending requests were awaiting HR action or final approval. Seventeen of the requests had been awaiting final HR approval from 10 to 483 days. The remaining 10 had been sent to the Office of Human Resources for authorization/approval but had not received action. These 10 transactions had been awaiting HR action from 126 to 325 days. Two of the fifty-three requests were later processed on or around the review’s cutoff date and were no longer pending. Of these two requests, one took 204 days to process, and the other took 8 20 days. The remaining 24 pending requests were still awaiting program management authorization and, therefore, had not been sent to the Office of Human Resources for approval. All of these 24 transactions had been idle for more than 100 days. We inquired as to the status of the 27 pending requests that were awaiting HR action or final approval and found that although some of these actions had been deleted or processed, the amount of time that the actions were pending after submission for authorization and approval was extensive. Specifically, these 27 transactions had been pending between 10 and 493 days as of February 29, 2008. Follow-up showed that 11 of these actions were still pending as of July 18, 2008. Overpayment Collection Waiver Requests Were Not Processed in a Timely Manner and Collections Were Taken Prematurely Overpayment collection waiver requests were not processed in a timely manner, and collections were initiated before the employee was notified or before a decision was reached on the waiver request. There were 51 such requests made by HUD employees between January 1, 2006, and September 30, 2007. We reviewed a random selection of 10 waiver requests and found that final decisions were not made in a timely manner. For example, For five requests, a final decision was not reached for more than a year. Specifically, it took from 466 to 1,036 days for final decisions to be reached. For four requests, it took between 36 and 200 days for a decision to be reached. For the remaining collection waiver request, we were unable to determine how long it took for a decision to be reached because the original waiver request was not in the file and could not be located by HR staff. Additionally, for three of the waiver request files reviewed, collections were taken before the employee was notified of the overpayment or before a decision was made regarding a waiver request contrary to federal statutes and HUD policy. Title 5 U.S.C. (United States Code) 55846 provides an employee the opportunity to have an overpayment claim waived in whole or in part by an authorized official. Further, 24 CFR (Code Federal Regulations) 17.1287 sets forth 6 5 U.S.C. 5584 is entitled “Claims for overpayment of pay and allowances and of travel, transportation, and relocation expenses and allowances.” 7 24 CFR 17.128 is entitled “Notice requirements before offset.” 9 requirements that must be followed before an offset can be made against an employee to satisfy a claim of overpayment. Specifically, deductions may not be made unless HUD first provides the employee with a minimum of 30 calendar days’ written notice. Further, the Office of Human Resources’ Employee Service Center Standard Operating Procedures provides procedures for processing waiver requests for salary overpayments. This guidance states that the personnel/pay specialist must notify the affected employee in writing of the overpayment. If a waiver is requested by an employee, the personnel/pay specialist is responsible for requesting that the National Finance Center delay the collections pending a waiver decision. Employee Service Center personnel are also required to monitor the case to determine whether a suspension of collection extension is warranted to ensure that collections are not taken before a decision has been reached. We found that the waiver processing delays were attributed to multiple review levels. Specifically, the Employee Service Center pay specialist was required to research and review the waiver request and create the report of investigation.8 Then the report of investigation was to be sent to the Policy, Research, and Development Division for another round of review and research before being submitted to the person responsible for making a decision. Although an element of the pay specialist’s performance standards includes timeframes for completing the waiver review, neither review processes had established timeframes defined in formal Office of Human Resources standard operating procedures. Ultimately, collections were taken from employees before notification or before decisions were rendered because the pay specialists did not request either suspensions of collections or suspension extensions as required. As a result, employees could encounter undue financial hardship due to premature collections or untimely processing of waiver requests. Specifically, if the waiver request process is not properly followed, up to 15 percent of the employee’s pay could be deducted to satisfy the assumed overpayment. 8 A report of investigation, outlining the circumstances of the overpayment, is required for each waiver. 10 Job Vacancy Case Files Were Not Adequately Maintained and Required Documents Were Not Completed in a Timely Manner Between January 1, 2006, and September 30, 2007, HUD posted 1,350 vacancy announcements. We selected a nonstatistical random sample of 15 job vacancy announcement files to review and found that the files were not adequately maintained and required documents were not completed in a timely manner to ensure compliance with OPM record-keeping standards. For 11 of the 15 case files reviewed, required documents were missing, incomplete, and/or not submitted in a timely manner. Specifically, case files reviewed were missing applications, certificates of eligibles, and/or application status notifications. In some instances, the certificates of eligibles were missing required information such as the required signatures, reasons for nonselection, and/or a return date. Additionally, regarding the 11 case files, certificates of eligibles and application status notification letters were not submitted in a timely manner. Contrary to the 15-day timeframe included in OPM’s 45-day hiring model, for three of the files reviewed, certificates of eligibles were not submitted to selecting officials until 17 to 32 days after the announcement closing date. Additionally, in five of the case files, applicants received application status notifications well beyond the prescribed 45-day timeframe in which a selection should be made. Specifically, it took between 43 and 173 days after the 45-day timeframe for applicants to receive status notifications of their eligibility, referral/nonreferral, and selection/nonselection status. Regarding the remaining four files, the Office of Human Resources could not locate them when we initially reviewed the files in March 2008. The files were subsequently located in July 2008. Our review found that two of the files were missing many basic required documents. Specifically, these two files did not include any candidate applications, many application status notification letters were missing, eligibility forms were incomplete, and the certificates of eligibles were not signed by the selecting official(s) and did not indicate whether a selection had been made. The other two files contained incomplete and/or missing required documentation, similar to that noted during our initial review of the case files. The following table provides the details of missing, incomplete, and untimely documentation for all 15 case files. 11 Initial review* Follow-up of Total (11 of 15 files) 4 missing files* Missing and incomplete documentation: Missing candidate applications 4 2 6 Certificate of eligible applicants Certificate missing from file 1 1 Incomplete certificate (missing HR specialist and/or 3 2 5 selecting officer signature, reason for nonselection, and/or return date) Missing notification letters (receipt, notice of 7 3 10 eligibility/noneligibility, notice of referral/nonreferral, or notice of selection/nonselection) Untimeliness: Untimely submission of certificate of eligible applicants to 3 1 4 selecting official Untimely notification to candidates of application status 5 1 6 *Since case files could have more than one occurrence of missing, incomplete, and/or untimely documentation, the columns do not total 15. Both OPM and HUD provide guidance regarding the timeframes in which certain steps should be completed during the hiring process. The OPM hiring model states that the certificate listing of eligible applicants should be forwarded to the selecting official within 15 days after the job announcement has officially closed. To ensure compliance with OPM’s model, HUD policy9 states that the following must be completed by the HR specialist within 15 days after the job vacancy closing: Receive the applications, Enter applicant information into Merit Staffing Control System, Initiate acknowledgement letters, Screen applications for minimum qualifications and send ineligible letters to applicants who do not meet minimum qualifications, Rank eligible applicants or conduct panels, and Forward the certificate of eligible applicants or selection roster to the selecting official. Additionally, both OPM and HUD provide guidance regarding documents that should be maintained in the job vacancy files. The OPM Delegated Examining Unit Handbook includes a pledge to applicants, which states that the following principles should be reflected in an agency’s recruitment process: 9 Office of Human Resources’ Standard Operating Procedure, Recruitment Request. 12 Prompt acknowledgement that their application has been received, Regular updates on the status of their applications as significant decisions are reached, and A timely decision-making process. Additionally, the handbook states that it is the agency’s responsibility to ensure that (1) a certificate is returned by a selecting official, (2) the case file documents the action taken on each of the eligible applicants that were certified for selection, (3) the certificate is signed and dated by the selecting official, (4) applicants are notified of the status of their applications including assigned ratings if requested, and (5) HUD complies with OPM’s schedule of records retention/disposition. It also includes a listing of required information that must be included on the certificate of eligible applicants or an equivalent form, identifying the job for which qualified eligible applicants are being referred. In addition, HUD policy10 states that the case files should contain documentation such as the staffing request, position description, notice of position vacancy, initial screening worksheet for merit staffing actions, panel rating worksheets, selection roster, and applications for federal employment. We attributed the missing, incomplete, and untimely documentation and missing case files to the Staffing and Classification Division’s not ensuring that each job announcement case file was documented, closed out, and filed adequately and in a timely manner. Additionally, it did not have a system in place to verify that application status notification letters were mailed in a timely manner. We also noted that the division failed to have an adequate filing system, which would ensure that all case files were properly filed, maintained, and protected. When case files do not contain the information required by OPM and the Merit Staffing Handbook, HUD cannot be assured that all major steps in the examining process were performed properly and in a timely manner for each job announcement. Further, it cannot be determined whether applicant assessments and selections were made in accordance with applicable laws, regulations, principles, and standards and that the agency’s vacant positions were filled with the best qualified candidates. Recommendations We recommend that HUD’s Director of Human Resources 1A.Establish a tracking system for logging the new hire’s (1) entrance on duty, (2) paperwork completion due date, (3) responsible HR specialist, (4) 10 HUD Merit Staffing Handbook 335.1, REV-3, paragraph 3-10. 13 actions’ completion dates, and (5) specialist certification to ensure that new hire paperwork is processed in a timely manner. 1B. Retrain staff regarding new hire paperwork policies and procedures. 1C. Establish policies and procedures for a supervisory review of pending new hire paperwork. 1D.Fully utilize available reports (SINQ, Pending Actions, and Department of Treasury Mismatch Report) to track the processing of awards, promotions, and within grade increases, and revise or create Standard Operating Procedures to ensure these reports are monitored. 1E. Establish policies and procedures for a supervisory review of pending actions, awards, promotions, and within-grade increases. 1F. Implement a process to streamline the collection waiver request review process to ensure that decisions are made in a timely manner and that collections are not initiated prematurely. 1G.Revise policies and procedures regarding the processing of collection waiver requests to include specific timeliness standards for the research and review phases. 1H.Provide training to staff regarding the file management requirements and ensure that the staff fully uses the merit staffing case file checklist to ensure that each case file includes all required documentation that supports the recruitment process. 1I. Develop procedures for supervisors to follow in reviewing the checklist and case file upon case file closeout to ensure that it is closed out and filed properly and in a timely manner. 1J. Develop a tracking system for monitoring the transmission of notification letters to applicants and selectees/nonselectees to ensure timely notification during and throughout the application and selection processes. 14 Finding 2: HUD’s Human Resource Management System Did Not Have Adequate Controls to Prevent Users from Participating in Their Own Personnel Actions Despite system rules, certain system users were able to participate in the processing of their own unallowable personnel action requests. These transactions were possible due to insufficient system internal controls within HIHRTS/HR Connect. Although we found no evidence of any illegitimate transactions, the system weaknesses resulted in HUD’s being vulnerable to the processing of potential fraudulent personnel actions. HIHRTS/HR Connect Did Not Prevent Users from Participating in Their Own Actions Based on our review of system controls, HIHRTS/HR Connect11 lacked internal controls to prevent certain system users from participating in the processing of their own unallowable personnel action requests. For the period January 1, 2006, through September 30, 2007, we found 33 instances in which 20 employees were able to request, initiate, authorize, and/or provide final HR approval for their own individual cash or time-off award, detail, extension, promotion, and transfer personnel action request transactions.12 The types of actions a system user can initiate are dependent on the security profile. All HIHRTS/HR Connect system users are given a security profile that defines which menus, pages, and records they are authorized to access. The page tabs that employees can see are determined by the user’s security profile. Whether a person can view certain menu items is also determined by a user’s role and security profile. To view the manager’s tab, the security profile must have the supervisory codes enabled. All employees have access to the employee tabs and can perform functions using the employee self-service feature. The manager and proxy/group tabs are visible to managers and the designated proxies, which gives them the authority to initiate and approve these types of actions. By using the employee self-service feature, employees were able to make changes to their own personnel information, obtain information about their job and benefits, and use online vehicles for job applications. Managers were able to produce documents to recruit, promote, and award employees; compile various 11 HUD’s Integrated Human Resources and Training System/HR Connect (HIHRTS/HR Connect) is the application that supports HUD’s human resource functions. 12 Between January 1, 2006, and September 30, 2007, there were 1,753 employee-initiated personnel action request transactions. Of those 1,753 transactions, 1,720 represent requests that employees are allowed to initiate (i.e., retirement, data changes, and resignation actions). 15 reports; and conduct a range of management functions via the manager self- service component. The proxy/group tab allowed a proxy to initiate and/or approve personnel actions on a manager’s behalf. Federal information systems requirements13 state that there should be controls in place that prevent users from having all of the necessary authority or information access to perform fraudulent activity without collusion. However, employees were able to participate in the processing of their own personnel action requests because they were either associated with a work list that allowed them to create their own actions or were proxies, which gave them the ability within the system to initiate and approve these types of actions. Although, we found no evidence that these transactions were not legitimate, HUD was vulnerable to the processing of potential fraudulent personnel actions. As a result of our review, the Office of Administration requested that Treasury implement an emergency system release that would prevent proxies from being able to participate in their own personnel action requests. On June 13, 2008, Treasury informed HUD that it had put the emergency release into production. The release added security to prevent employees from participating in the processing of their own unallowable actions. Recommendations We recommend that HUD’s Director of Human Resources 2A. Inform employees that it is not allowable to participate in the processing of their own actions. 13 National Institute of Standards and Technology Special Publication 800-53, Revision 2, Recommended Security Controls for Federal Information Systems, dated December 2007. 16 SCOPE AND METHODOLOGY In December 2007, the HUD Office of Inspector General (OIG) received an anonymous complaint regarding the lack of accountability, lack of responsibility, and mismanagement occurring within the Office of Administration. Specifically, the complaint alleged the following: inaccurate processing of pay and benefits; implementation of a costly system that had serious deficiencies; lack of a fair and equitable process to address overpayment collection waiver requests as the result of administrative errors, the lack of proper notification to request such a waiver, and inconsistent treatment in granting waiver requests; and garnishment of paychecks without due process. A binder, which included documentation supporting these allegations, was also provided. The documentation included memorandums to the Secretary of Administration documenting the problems encountered by HUD staff, e-mails from various HUD staff documenting specific problems that were occurring, and a listing that documented each HUD staff member who had encountered a problem with the Office of Administration and a description of that problem. To accomplish our objectives, we obtained an understanding of applicable health benefits, within-grade increase, promotion, award, payroll, HIHRTS/HR Connect, waivers, and job vacancies/new hires policies, procedures, and/or flow charts. Additionally, we evaluated HIHRTS/HR Connect system functionality, interviewed responsible persons, and reviewed interagency agreement procurement files and documentation detailing the testing of the system and any issues noted during testing before implementation. Initially, we limited our review to the types of allegations contained in the complaint binder. We selected a nonstatistical sample of 55 of 198 complaint allegations that were documented in the binder and contacted the HUD staff affected. The 55 complaint allegations encompassed 50 HUD staff members. We sent 50 questionnaires to the affected HUD staff members regarding the 55 complaint allegations.14 We received 21 responses. In those responses, 14 complainants provided information that supported the original complaint allegations. The other seven complainants responded that they had not encountered any issues. Regarding the remaining 29 questionnaires, 24 did not respond, and five individuals were no longer HUD employees and could not be contacted. Other methods were employed in an attempt to validate all allegations whether the employee responded or not. In addition to submitting questionnaires, we obtained data from HIHRTS/HR Connect to determine whether the issues extended to all HUD employees who had the same types of personnel actions. Our primary analysis regarding personnel actions (within-grade increases, promotions, awards, and health benefits) was performed using two reports containing information on all HUD employees extracted from HR Connect. The first report provided by HUD, as of February 8, 2008, contained 36,401 pending and processed personnel actions for the period January 1, 2006, through September 30, 2007.15 This report detailed the current status of the action and the proposed effective date and 14 Some employees had more than one issue; therefore, they may have been counted more than once in our sample. 15 The report provided by HUD was originally provided as several PDF files. We were able to convert these reports into an Excel file so that we could readily analyze the data. 17 action for each employee’s personnel action request. Since this report did not contain all information needed, such as when the action was requested and processed, we requested a more detailed report. The second report, created by Treasury as of February 29, 2008, specifically to fulfill our request, contained requests that were submitted, in process, and/or completed during the same period, January 1, 2006, through September 30, 2007. This report provided the work in process detail16 for the 36,401 personnel action request transactions provided in the first file. The second file contained 138,824 transactions. Although the data included all personnel action requests for our period of review, we only reviewed the types of actions found in the complaint binder related to certain types of with-in grade increases, promotions, and award actions. We analyzed and/or extracted data from both reports using Computer Assisted Audit Tools, Audit Command Language, and Microsoft Excel software. We used these reports to determine the following: (1) how long it took to process the personnel actions from submission/request to completion, (2) how long pending requests remained in process, and (3) whether there were personnel actions that had been submitted but no action had been taken. Details for each analysis performed were discussed in finding 1. The following table documents the entire population of personnel requests; subset population of certain types of with-in grade increases, promotions, and award actions; and sample statistics for the personnel action requests we reviewed. Population and sample statistics for processed and pending personnel action requests for the period January 1, 2006, through September 30, 2007 Entire population Subset population Pending Within- Individual personnel grade cash action All data increases Promotions awards Benefits requests Employees 9,762 117 554 141 2 48 Requests 36,401 123 647 147 4 53 Transactions 138,824 228 3,256 688 4 101 Sample total Sample from subset population Employees* 124 25 25 25 2 48 Requests 146 30 32 27 4 53 Transactions 405 52 137 111 4 101 *Note: The sample number of employees does not equal the sample total (124), since one employee was included in both the cash award and pending sample selections. In addition to the data analysis, we reviewed and analyzed a report of emergency salary payments and samples of waiver request and job vacancy announcement files for the period January 1, 2006, through September 30, 2007. 16 The work in progress detail includes such actions as the request, initiation, management authorization(s), and HR specialist approval. 18 We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 19 INTERNAL CONTROLS Internal control is an integral component of an organization’s management that provides reasonable assurance that the following objectives are achieved: Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls relate to management’s plans, methods, and procedures used to meet its mission, goals, and objectives. They include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objectives: Effectiveness and efficiency of operations – Timely processing of overpayment collection waiver requests, new hire paperwork, job vacancy documents, and personnel action requests. Compliance with applicable laws and regulations – Policies and procedures that management has in place to ensure that personnel action requests, overpayment collection waivers, and new hire paperwork are processed and job vacancy files are maintained in accordance with applicable policies and procedures. We assessed the relevant controls identified above. A significant weakness exists if management controls do not provide reasonable assurance that the process for planning, organizing, directing, and controlling program operations will meet the organization’s objectives. Significant Weaknesses Based on our review, we believe that the following items are significant weaknesses: HUD lacked internal controls to ensure (1) the timely processing of personnel actions requests, overpayment collection waiver requests, and new hire paperwork; (2) that employees were always afforded the opportunity to 20 request a waiver before deductions were taken; and (3) that OPM job announcement policies and procedures and record-keeping standards were followed. In certain circumstances, HR Connect lacked the controls to prevent employees from being involved in the processing of their own personnel action requests, which made HUD vulnerable to the processing of potential fraudulent actions. 21 22 APPENDIXES Appendix A HUMAN RESOURCE MANAGEMENT ORGANIZATION CHART Assistant Secretary for Administration Keith Nelson General Deputy Assistant Secretary for Administration Dawn Luepke Deputy Assistant Secretary for Human Resource Management Barbara Edwards Associate Deputy Assistant Secretary for Resource Management Sharman Lancefield HR Management Information & Enterprise Resource Management Planning Systems Staff Charles Butler Office of Human Office of Training Resources Services Emmett Aldrich William Johnson Human Capital Employee Career Management Staff Development Pamala Taylor Division Reginald Hayes Leadership & Management Division Compensation, Headquarters Executive Human Resources Mia Beckett Headquarters Field Staffing & Organization Labor & Field Labor & Personnel Employee Policy, Research Staffing Classification Analysis Employee Employee Management Service Center & Development & Classification Division & HR Systems Relations Relations Division Division Karen Bruno Division Program Technical Division Jim Fruge Division Division Carlos Osegueda Earnestine Pruitt Lou Reese Training Division Vivian White William Rice Carolyn Davis Francine Sutton 22 2 Appendix B AUDITEE COMMENTS AND OIG’s EVALUATION Auditee Comments 23 24 25 26 27 OIG Evaluation of Auditee Comments Instead of commenting on our report as a whole, the Office of Administration/Office of Human Resources (OA/OHR) only commented on our report recommendations. Since our review and in response to our recommendations, OA/OHR has started making steps towards addressing the concerns noted in our report. Specifically, OA has begun or plans to: revise or develop new Standard Operating Procedures regarding: the processing of new hire paperwork, monitoring of personnel action request reports, and salary overpayments and waiver requests processes; develop a tracking mechanism for the hiring process based on OPM's new "End to End" guideline; use the USA staffing eRecruitment to advertise HUD job announcements; and retrain staff on new hire paperwork requirements and job vacancy case file management. Although some progress has been made, we will need additional documentation before OIG can concur on the steps taken or in progress. 28
Review of HUD's Internal Controls over Processing of Personnel Actions
Published by the Department of Housing and Urban Development, Office of Inspector General on 2009-04-15.
Below is a raw (and likely hideous) rendition of the original report. (PDF)