U.S. Department of Housing and Urban Development, Washington, DC The Government Purchase Card Program Office of Audit, Financial Audits Division Audit Report Number: 2015-FO-0006 Headquarters July 7, 2015 To: Keith W. Surber, Acting Chief Procurement Office, N Towanda Brooks, Acting Chief Human Capital Officer, A //s// From: Thomas R. McEnanly, Director of the Financial Audits Division, GAF Subject: HUD Did Not Evaluate and Report Potential Violations of Its Government Purchase Card Program Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our review of HUD’s purchase card program. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at (202) 402-8216. Audit Report Number: 2015-FO-0006 Date: July 7, 2015 HUD Did Not Evaluate and Report Potential Violations of Its Government Purchase Card Program Highlights What We Audited and Why We audited the U.S. Department of Housing and Urban Development’s (HUD) administration of its purchase card program in accordance with the Charge Card Abuse Prevention Act of 2012. Our 2013 risk assessment review identified HUD’s purchase card program at medium to high risk for fraud or misuse,1 and our review of HUD’s Semiannual Purchase Card Violation Report (audit memorandum number 2014-FO-0801) raised concerns regarding HUD’s internal controls over the purchases made within this program. The objective of the audit was to determine whether HUD evaluated and reported improper and potentially illegal uses of government purchase cards. What We Found Purchase card transactions were generally supported. However, HUD did not evaluate a potential violation to determine whether it constituted a significant weakness and could have provided better transparency by reporting the potential purchase card violation in its reports to the Office of Management and Budget. Specifically, HUD did not evaluate or report a violation in which an employee made fraudulent purchases totaling $11,938 from August through October 2013. What We Recommend We recommend that HUD revise existing procedures to include the evaluation of the impact of identified violations on HUD’s purchase card program controls and how violations will be reported. 1 The Office of Inspector General’s fiscal year 2013 risk assessment of HUD’s agencywide charge card program identified potential split purchase transactions, questionable purchases made with third-party credit card processors, and missing purchase card activity data. Table of Contents Background and Objective......................................................................................3 Results of Audit ........................................................................................................................ 4 Finding: HUD Did Not Evaluate and Report a Potential Purchase Card Violation . 4 Scope and Methodology ...........................................................................................7 Internal Controls ......................................................................................................8 Appendix ...................................................................................................................9 A. Auditee Comments and OIG’s Evaluation ............................................................... 9 2 Background and Objective The General Services Administration (GSA) administers the Government Charge Card program, also known as the GSA SmartPay program. This program provides purchase charge cards to agencies or departments throughout the U.S. Government to streamline small purchases, facilitate payment processes, minimize paperwork, and simplify the administrative effort associated with procuring goods and services. GSA negotiates master contracts with national banks, such as Citibank, JP Morgan Chase, and U.S. Bank, to provide charge cards to Federal employees. The U.S. Department of Housing and Urban Development (HUD) uses Citibank as its purchase card provider. On October 5, 2012, President Obama signed the Charge Card Abuse Prevention Act of 2012, Public Law 112-194. This law requires all executive branch agencies to establish and maintain safeguards and internal controls for their use of purchase cards, travel cards, integrated cards, and centrally billed accounts. On September 6, 2013, the Office of Management and Budget (OMB) issued Memorandum M-13-21, which provides guidance on the implementation of the Charge Card Act. The Charge Card Act was designed to prevent recurring fraud, waste, and abuse in governmentwide charge programs. It requires offices of inspector general (OIG) to (1) conduct periodic assessments of the agency charge card programs; (2) identify and analyze the risk of illegal, improper, or erroneous purchases and payments; (3) perform analyses or audits as necessary; (4) report to the head of the executive agency concerns regarding the results of such analyses or audits; and (5) report to OMB on the implementation of recommendations made to the head of the executive agency. In addition, the Charge Card Act requires the OIGs of each executive agency to submit semiannual joint purchase and integrated card violation reports2 to the Director of OMB that at a minimum, provide summary descriptions of confirmed violations involving the misuse of charge cards and disciplinary actions taken. The Charge Card Act requires agencies to submit a semiannual report summarizing descriptions of (a) confirmed violations involving misuse of a purchase card, and (b) all adverse personnel actions, punishments, or other actions taken in response to each reportable violation involving misuse of a purchase card to OMB. Our audit objective was to determine whether HUD evaluated and reported improper and potentially illegal uses of government purchase cards. 2 According to the Charge Card Act and OMB guidance, a semiannual joint purchase and integrated card violation report is to be prepared by the agency head and inspector general for submission to OMB 120 days after the end of the semiannual reporting periods (that is, April 1 to September 30 and October 1 to March 30). The violation report should be incorporated into the existing charge card management plans, which are due to OMB on January 31and July 31 of each year. 3 Results of Audit Finding: HUD Did Not Evaluate and Report a Potential Purchase Card Violation Purchase card transactions were supported. However, HUD did not evaluate a potential violation to determine whether it constituted a significant weakness and could have provided better transparency by reporting the potential purchase card violation in its reports to OMB. Specifically, HUD did not evaluate or report a violation in which an employee made fraudulent purchases totaling $11,938 from August 2013 through October 2013. This occurred because HUD’s existing purchase card policies did not include specific procedures to evaluate violations for purchase card program weaknesses and criteria to report violations to OMB. As a result, HUD did not determine whether its program was at risk for future abuses, and its report may not have been transparent or include all required disclosures. OMB uses the report to ensure that misuse is addressed and resolved. Purchase Card Transactions Were Generally Supported During fiscal year 2014, HUD significantly reduced the number of unblocked merchant category codes to reduce the risk of improper transactions. HUD also implemented a standardized process to review transactions monthly and a requirement that purchase cardholders make purchases through the GSA Advantage system. This requirement ensures that HUD gets GSA-negotiated prices from GSA-approved vendors. We reviewed a sample of purchase card transactions and found that HUD complied with its purchase card policies and the Federal Strategic Sourcing Initiative. For questionable purchases, we determined that purchase cardholders provided documentation to support the use and purpose of the purchases and the purchases were properly approved by the user’s immediate supervisor. We also found no significant incident involving split purchase transactions. Purchase Card Violations Were Not Evaluated or Reported HUD did not evaluate or report a purchase card violation by a HUD employee who made $11,938 in fraudulent purchases from August through October 2013. The HUD employee charged the amounts below for personal use using the employee’s government purchase card. The employee was placed on administrative leave, and the violation was referred to OIG. OIG obtained an indictment against the employee in January 2014. 4 Merchant category Merchant category description Amount code 5411 Grocery stores and supermarkets $7,357 5331 Variety stores $2 7011 Lodging (hotels, motels, and resorts) $2,039 4814 Call through use of magnetic stripe, $203 reading telephones, or telecommunication services 5912 Drug stores and pharmacies $1,280 4812 Telecommunications equipment, $176 including telephone sales 4899 Cable, satellite, and other pay $488 television and radio services 7399 Business services not elsewhere $30 classified 7299 Other services not elsewhere $21 classified 4111 Transportation – suburban and local $190 commuter passenger, including ferries 5812 Eating places, restaurants $152 Total amount $11,938 The Charge Card Act requires that confirmed violations be reported in the semiannual joint purchase and integrated card violation reports to OMB. OMB defines a confirmed violation as a deficiency that, according to management’s judgment, should be communicated to OMB because it represents significant weaknesses in the design or operation of the charge card program. Further, a confirmed violation is one that adversely affects the organization’s ability to meet its internal control objectives, as envisioned by the Charge Card Act, to prevent fraud or abuse of government charge cards. HUD did not report the violation because it believed it should not do so until OIG confirmed that the transactions violated Federal regulations. Typically, these investigations, if accepted by OIG, may take months or years to complete. According to the Charge Card Act, HUD is responsible for determining whether a violation represented a significant weakness in its controls. Therefore, HUD has the authority and responsibility to independently determine whether a reportable violation occurred. HUD stated that it evaluated the matter immediately after discovery and took several actions to strengthen the controls over the program, however evidence of these actions was not provided and accordingly were not part of our audit. 5 HUD should not have waited for the results of the OIG investigation to determine whether the purchase card misuse constituted a significant weakness and whether or not to report the violation. HUD’s existing policies did not include procedures and criteria to (a) complete an evaluation of a violation to determine if it is indicative of a significant weakness in controls and (b) determine what constitutes a violation that is reportable in the semiannual joint purchase and integrated card violation report to OMB. Reporting violations as soon as HUD completes its evaluation would provide better transparency to OMB regarding weaknesses in HUD’s purchase card program. Accordingly, the semiannual joint purchase and integrated card violation reports submitted to OMB on January 31 and July 31, 2014, did not include this violation and may not have included any other violations that occurred during the reporting period because some violations might have been under OIG review at the time. However, an OIG investigation should not prevent HUD from determining whether weaknesses in the design or operation of its purchase card program caused the violation and reporting such instances in the semiannual joint purchase and integrated card violation report. Conclusion HUD did not report the violation because its existing policies did not include procedures to complete an evaluation of violation to determine whether weaknesses in HUD’s purchase card program existed. Additionally, HUD’s existing policy did not include criteria and procedures to report violations in the semiannual joint purchase and integrated card violation report to OMB. As a result, HUD did not determine whether its program was at risk for future abuses and its report may not have been transparent or include all required disclosures. Recommendations We recommend that Office of the Chief Procurement Officer 1A. Improve existing policies to include (a) robust procedures to evaluate violations to determine whether they constitute a significant weakness in the design or operation of the purchase card program and (b) specific criteria to determine which violations will be reported. 6 Scope and Methodology We performed our review from May 2014 through January 2015 at HUD headquarters in Washington, DC. Our review covered the period April 1, 2013, through March 31, 2014. To accomplish our objective, we Reviewed applicable laws and regulations, Reviewed HUD’s Government Purchase Card Program Policy Guide, Reviewed prior OIG reports, Interviewed HUD staff, Randomly selected and tested individual purchase card transactions, and Reviewed monthly purchase card transaction reports. The universe of the credit card transactions covered the period April 1, 2013, to March 31, 2014, and consisted of 10,182 transactions totaling more than $3.3 million. This review did not include travel card transactions.3 Our review of HUD’s purchase card transactions included tests for Blocked and overridden merchant category codes, Compliance with GSA’s Federal Strategic Sourcing Initiative, Split purchases, and Unusual restaurant merchant category code transactions To achieve our audit objective, we relied on HUD’s computer-processed data. We used the data to select a sample of disbursements to review. Although we did not perform a detailed assessment of the reliability of the data, we performed a minimal level of testing and found the data to be adequate for our purposes. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 3 This universe excludes separately monitored purchase card transactions made within the Real Estate Assessment Center’s Reverse Auction mortgage and Federal Housing Administration programs. 7 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to Effectiveness and efficiency of operations, Reliability of financial reporting, and Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: HUD’s controls for reporting to OMB. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, identify, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiencies Based on our review, we believe that the following is a significant deficiency: HUD did not develop procedures for evaluating purchase card violations to determine whether internal control weaknesses are required to be reported to OMB (finding). 8 Appendix Appendix A Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments Evaluation Comment 1 9 Ref to OIG Auditee Comments Evaluation Comment 2 Comment 3 Comment 4 Comment 5 10 Ref to OIG Auditee Comments Evaluation Comment 5 (cont) 11 OIG Evaluation of Auditee Comments Comment 1 We disagree with HUD’s response. Although HUD stated that it reported the misuse of the purchase card in its quarterly report to OMB dated January 31, 2014, HUD did not report the violation in its semiannual joint purchase and integrated card violation reports submitted to OMB on January 31 and July 31, 2014 as is required by the Charge Card Act. The semiannual report is different in that it requires agencies to report summary descriptions of (a) confirmed violations involving misuse of a purchase card, and (b) all adverse personnel actions, punishments, or other actions taken in response to each reportable violation involving misuse of a purchase card; details which were not included in the quarterly report to OMB. Further, the current HUD’s Government Purchase Card Program Policy Guide does not state that OIG has to confirm the purchase card violations before reporting it to OMB. In addition, HUD did not provide the documentation to support that it evaluated the matter immediately after discovery of the incident and took the actions listed in their formal comments in order to strengthen its controls and accordingly, they were not reviewed as part of this audit. Comment 2 We disagree with HUD’s response. As stated in comment 1 above, HUD states that they evaluated the violation as required, however documentation to support the evaluation was not provided for our review. Further, HUD did not report the violation in its semiannual joint purchase and integrated card violation reports to OMB. HUD needs to include in its policy criteria to determine which identified violations constitute significant weaknesses to the purchase card program and which violations will be reported to OMB. Comment 3 OMB memo M-13-21 requires that the agency or OIG confirm the identified violations; therefore, the agency can make the determination without OIG’s confirmation. In addition, HUD’s current Government Purchase Card Program Policy Guide does not state that OIG has to confirm the purchase card violations before reporting it in the semiannual joint purchase and integrated card violation report to OMB. HUD has the authority and responsibility to independently determine whether a reportable violation occurred. It should work with OIG in cases that are referred and accepted to ensure that reporting will not interfere in an investigation. Comment 4 As mentioned in comment 1 above, HUD did not provide the documentation to support that it determined if the violation found in our review constituted a significant weakness for the purchase card program; therefore we do not have evidence that its evaluation was conducted. In addition, HUD did not report the 12 violation in its semiannual joint purchase and integrated card violation reports submitted to OMB on January 31 and July 31, 2014. Existing policies do not include HUD’s procedures to conduct an evaluation and criteria to follow when determining if a violation has occurred that warrants reporting. Language clarify that HUD’s existing policies did not include these procedures have been added to the final report. Comments 5 The procedures outlined serve as a starting point and should be expanded upon and incorporated into formal policy to be followed by responsible HUD personnel. The completion of such actions will be evaluated during the audit resolution process. The recommendation will remain open until sufficient evidence is provided to satisfactorily close out the recommendation. 13
HUD Did Not Evaluate and Report Potential Violations of Its Government Purchase Card Program
Published by the Department of Housing and Urban Development, Office of Inspector General on 2015-07-07.
Below is a raw (and likely hideous) rendition of the original report. (PDF)