U.S. Department of Housing and Urban Development, Washington, DC Review of the U.S. Department of Housing and Urban Development’s Compliance With the Travel and Purchase Card Programs Office of Audit, Financial Audits Division Audit Report Number: 2016-FO-0006 Washington, DC September 29, 2016 To: Keith W. Surber, Chief Procurement Officer, N Towanda A. Brooks, Chief Human Capital Officer, A Courtney B. Timberlake, Deputy Chief Financial Officer, F /s/ From: Thomas R. McEnanly, Director, Financial Audits Division, GAF Subject: HUD Needs To Improve Its Monitoring of the Travel and Purchase Card Programs Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector General’s (OIG) final results of our review of HUD’s compliance with the travel and purchase card programs. HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on recommended corrective actions. For each recommendation without a management decision, please respond and provide status reports in accordance with the HUD Handbook. Please furnish us copies of any correspondence or directives issued because of the audit. The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its publicly available reports on the OIG Web site. Accordingly, this report will be posted at http://www.hudoig.gov. If you have any questions or comments about this report, please do not hesitate to call me at 202-402-8216. Audit Report Number: 2016-FO-0006 Date: September 29, 2016 HUD Needs To Improve Its Monitoring of the Travel and Purchase Card Programs Highlights What We Audited and Why We audited HUD’s compliance with the fiscal year 2015 travel and purchase card programs based on our required fiscal year 2014 risk assessment. Our 2014 risk assessment determined the U.S. Department of Housing and Urban Development’s (HUD) agencywide charge card program to be at medium risk for fraud. Offices of inspector general are required to (1) conduct periodic assessments of the agency charge card programs, (2) perform analyses or audits as necessary, and (3) report to the head of the executive agency the results of such analyses or audits. Our audit objective was to determine whether HUD had sufficient and effective controls to (1) prevent and identify improper and potentially unallowable uses of cards and (2) recognize patterns of violation. What We Found While HUD stated that it had implemented controls to identify cardholder travel card program violations, it did not successfully identify patterns of abuse. Specifically, we identified 3,671 instances of cardholders using their travel card without an approved official temporary duty station travel document. These transactions totaled $528,147. Additionally, although HUD monitors purchase card use through periodic reviews, the purchase card program’s internal controls needed improvement. Specifically, we identified 85 transactions totaling $96,408 with (1) separation of duties and administrative issues, (2) split purchases, or (3) purchases requiring special attention or that could be made by means other than purchase cards. What We Recommend We recommend that HUD review the identified 3,671 transactions totaling $528,147 to determine whether these transactions were for official Government travel, identify additional transactions made outside official travel, and ensure that appropriate action is taken. Additionally, we recommend that HUD (1) clarify roles and responsibilities regarding the duties that must be separated and the overlap that might be allowable in smaller field offices, (2) establish a periodic review of the official cardholders, (3) enforce retention of supporting documentation and make it available to auditors, and (4) review supporting documents to identify overlapping functions and responsibilities. Table of Contents Background and Objective......................................................................................3 Results of Audit ........................................................................................................5 Finding 1: HUD’s Travel Card Monitoring Had Weaknesses..................................... 5 Finding 2: The Purchase Card Program’s Internal Controls Had Weaknesses...... 10 Scope and Methodology .........................................................................................14 Internal Controls ....................................................................................................17 Appendixes ..............................................................................................................18 A. Schedule of Questioned Costs .................................................................................. 18 B. Auditee Comments and OIG’s Evaluation ............................................................. 19 2 Background and Objective On October 5, 2012, President Obama signed the Charge Card Abuse Prevention Act of 2012, Public Law 112-194. The Charge Card Act was designed to prevent recurring fraud, waste, and abuse in governmentwide charge card programs. This law requires all executive branch agencies to establish and maintain safeguards and internal controls for their use of purchase cards, travel cards, and centrally billed accounts. The Charge Card Act also establishes additional reporting and audit requirements, consistent with existing statutory responsibilities, to avoid improper payments and protect privacy among other things. On September 6, 2013, the Office of Management and Budget (OMB) issued Memorandum M-13- 21 to provide guidance on implementing the Charge Card Act. It required all agency card management plans to be reviewed and updated as necessary to prevent duplicate reimbursements. The guidance included penalties for charge card violations to prevent the Government from spending money on unused tickets and deterring employee misuse of Government cards. Additionally, beginning in fiscal year 2013, each agency with more than $10 million in purchase card spending the prior fiscal year was required to submit semiannual reports of employee purchase card violations and the disposition of these violations, including disciplinary actions taken. Further, it required offices of inspector general (OIG) to (1) conduct periodic assessments of the agency charge card programs; (2) identify and analyze the risk of illegal, improper, or mistaken purchases and payments; (3) perform analyses or audits as necessary; (4) report to the head of the executive agency concerns regarding the results of such analyses or audits; and (5) report to OMB on the implementation of recommendations made to the head of the executive agency. The General Services Administration (GSA) administers the Government charge card program, also known as the GSA SmartPay program. This program provides purchase charge cards to agencies or departments throughout the U.S. Government to streamline small purchases, facilitate payment processes, minimize paperwork, and simplify the administrative effort associated with procuring goods and services. In addition, each agency contracts with a commercial provider for Government travel accounts through GSA SmartPay master contracts. GSA negotiates master contracts with national banks, such as Citibank, JP Morgan Chase, and U.S. Bank, to provide charge cards to Federal employees. The U.S. Department of Housing and Urban Development (HUD) uses Citibank as its purchase and travel card provider. The GSA SmartPay travel account may be used for authorized official travel and authorized travel- related expenses only. When traveling for the Government, use of a Government travel account is required unless an exemption has been granted. Government travel accounts are VISA or MasterCard branded and can be used at any location that accepts those credit card types, including internationally. The travel account may not be used for personal expenses at any time and must not be used by any other person. 3 The Office of the Chief Financial Officer (OCFO) administers the travel card program. OCFO monitors the travel card program but does not have its own travel card policy. Instead, it relies on the Federal Travel Regulations. 1 Regarding the purchase card program, the Office of the Chief Human Capital Officer (OCHCO) is responsible for compliant administrative execution, and the Office of the Chief Procurement Officer (OCPO) is responsible for oversight and compliance to reduce potential card misuse and abuse. OCHCO is responsible for monitoring HUD’s purchase card program, with the exception of the Office of Public and Indian Housing’s Real Estate Assessment Center’s (REAC) Reverse Auction Program charges. OCPO’s Government Purchase Card (GPC) Program Policy Guide establishes policies and procedures for the use of the governmentwide purchase card at HUD. This policy applies to all GPC transactions, both “purchase-pay” (micropurchases) and “payment only” (all other transactions), while the REAC Reverse Auction Program charge cards are used to pay contractors for completed inspection work. REAC maintains physical custody of the purchase cards that the contractors and inspectors use to bill HUD for completed inspection work. The Reverse Auction Program - Business Rules provides guidance and policy for contractors interested in participating in HUD’s Reverse Auction Program. Our audit objective was to determine whether HUD had sufficient and effective controls to (1) prevent and identify improper and potentially unallowable uses of cards and (2) recognize patterns of violation. 1 The Federal Travel Regulation is the regulation contained in 41 CFR (Code of Federal Regulations) Chapters 300 through 304. 4 Results of Audit Finding 1: HUD’s Travel Card Monitoring Had Weaknesses While HUD had implemented controls to identify cardholder travel card program violations, it did not successfully identify patterns of abuse. Specifically, we identified 3,671 instances of cardholders using their card without an approved official temporary duty station travel document. These violations occurred because HUD had not successfully implemented necessary internal controls over its travel card program and did not ensure that the Government-issued travel card was returned to the agency as part of the employee’s separation process. As a result, future unauthorized transactions may not be identified and rectified in a timely manner, and $528,147 in travel card charges was unsupported. Monitoring Procedures During fiscal year 2015, HUD contracted with the Administrative Resource Center (ARC) Travel Services to provide monthly reports to the agency that identify questionable credit card transactions. ARC compares the transaction date of each credit card charge to trip dates on the travelers’ authorizations and vouchers from HUD’s travel system. 2 ARC identifies questioned credit card transactions based on its defined criteria for each expense transaction type category. ARC also conducts a scan of the reports to identify possible Federal Travel Regulations violations and then sends the reports to OCFO for further review. However, HUD did not compare the monthly reports to one another to identify patterns of violations. OCFO stated that once it receives the reports, it provides them to the appropriate program office administrative officer to confirm whether the transactions were related to official travel. The program sends the results back to OCFO and works with OCHCO’s Employee Labor Relations Division to process any necessary penalties or discipline. OCFO stated that it did not have the authority to penalize employees for prohibited card use but the Employee Labor Relations Division had that authority. The program office provides information to OCFO on substantiated violations quarterly, and OCFO maintains a spreadsheet with the number of reported violations. However, OCFO did not follow up on administrative penalties or the status of the transactions reported to the various program offices. It inquired only about whether credit cards should be canceled. Although OCFO explained its process, we were unable to determine whether HUD took appropriate action because we were not provided evidence of HUD’s review of the ARC reports or its communication and followup with the program offices. 2 HUD uses Concur to process and approve travel authorizations and vouchers and make official travel arrangements. 5 Sample Transactions Without an Official Travel Authorization We examined a sample of 192 transactions and identified 61 questioned transactions made by 43 cardholders totaling $22,707 that could not be matched to an official temporary duty station travel authorization. 3 For 26 of the 61 questioned sample transactions, we discovered that • 6 of those questioned transactions totaling nearly $99 were made about a month after the employee’s last official travel period and 2 to 6 days after the employee left the agency. • 15 of the questioned transactions totaling more than $5,632 were associated with 13 cardholders who did not have any travel documents (temporary duty station authorizations or vouchers) at all. • 5 of questioned transactions totaling nearly $3,992 were made by a cardholder who had only one official travel order during our review period. The remaining 35 questioned transactions totaling $12,984 were made by 28 cardholders who did not have official travel documents associated with the sample transactions. Our questioned sample transactions are as shown in the table below. Table 1: Questioned sample transactions summary Questioned Number of Number of Questioned transaction category transactions cardholders dollar amount* Transactions after 6 1 $99 separation Transactions by cardholders without 15 13 5,632 any travel documents Transactions by a cardholder with only 5 1 3,992 one official travel document No travel documents associated with the 35 28 12,984 sample transaction Total questioned 61 43 22,707 sample transactions * Questioned dollar amounts are rounded to the nearest dollar. These occurrences were contrary to the Federal Travel Regulation, which defines official travel as “travel under an official travel authorization from an employee’s official station or other authorized point of departure to a temporary duty location and return from a temporary duty location, between two temporary duty locations, or relocation at the direction of a Federal agency.” In addition, the cardholder guide and agreement state that the travel card may be used 3 The remaining 131 sample transactions were associated with official travel and were not reviewed further. 6 only for official agency and organization travel and travel-related expenses, including air and rail tickets, transportation services, lodging, automobile rental, food service establishments, fuel, and ATM access if authorized. Further, the Citibank Statement of Cardholder Responsibility provides that when the cardholder separates from the agency, the card must be turned in to the supervisor and the coordinator will be notified to cancel the account. Transactions Made by Cardholders Without Any Official Travel Documents Since we discovered that 15 of the 61 questioned transactions totaling more than $5,632 were associated with 13 cardholders who did not have any travel documents (temporary duty station authorizations or vouchers) at all, we performed an additional analysis. Specifically, we performed an analysis to identify all cardholders in our travel card population 4 without any temporary duty station authorizations. Our additional analysis identified 245 cardholders (including the 13 employees identified from our sample review) with 3,529 transactions totaling more than $464,464, who used their travel card without official travel documentation. The transaction dates ranged from October 1, 2014, to May 29, 2015, the number of transactions ranged from 1 to 309, and the total questioned amounts ranged from $2 to $18,161. The travel card charges were for things such as airfare, rental cars, hotels, gas, parking garages, and ATM withdrawals. These transactions were not identified during ARC’s analysis. Therefore, OCFO did not follow up with the program offices to ensure that the transactions were researched and appropriate action was taken. Transactions Made by a Cardholder With Only One Official Travel Authorization We identified 5 of the 61 questioned transactions totaling more than $3,991 made by a cardholder who had only one official travel order during our review period. Four of her questioned transactions were made at Caesars Palace, prompting us to review all of her transactions during our review period. Specifically, the cardholder used her travel card 110 times between October 1, 2014, and May 9, 2015. However, we could associate only nine transactions to official travel documents. The remaining 101 transactions (including the 5 questioned transactions) totaling nearly $50,600 were outside the official travel period. A majority (78 transactions totaling nearly $48,799) of the 101 transactions were made at Caesars Hotel and Casino in Las Vegas, NV, or were for cash withdrawals from various ATMs. These transactions continued for months without detection. Therefore, based on these additional analyses, our total questioned transactions are as shown in the table below. Table 2: All questioned transactions summary Questioned Number of Number of Questioned transaction category transactions cardholders dollar amount No travel documents associated with the 35 28 $12,984 sample transaction 4 After excluding OIG transactions, our population included 45,484 travel card purchase and ATM transactions. 7 Questioned Number of Number of Questioned transaction category transactions cardholders dollar amount (continued) (continued) (continued) (continued) Transactions after 6 1 99 separation All transactions by cardholders without 3,529 245 464,464 any travel documents All transactions by a cardholder with only 101 1 50,600 one official travel document Total questioned 3,671 275 528,147 sample transactions When asked about the questioned transactions, OCFO stated that HUD employees were permitted to use the Government-issued travel cards for Government relocation and emergency- related travel. Because the transactions were related to special circumstances, there would be no travel authorizations in HUD’s travel system for these transaction types. While the GSA SmartPay program states that travel cards may be used to pay for all official Government travel and related expenses, the emergency and relocation approved traveler lists provided were insufficient to determine whether the employees listed matched to the employees we identified as having used their travel cards without temporary duty station authorizations. Conclusion HUD had not successfully implemented necessary internal controls over its travel card transactions. OCFO did not identify these noncompliant transactions and ensure that appropriate action was taken and ensure that the Government-issued travel card was collected as part of the employee’s separation process. As a result, future unauthorized transactions may not be identified and rectified in a timely manner, and a total of $528,147 in travel card charges was unsupported. Recommendations We recommend that the Deputy Chief Financial Officer 1A. Review the identified 3,671 transactions totaling $528,147 to determine whether they were for official Government travel. If they were not for official travel, OCFO should determine whether the cardholders paid the credit bill for the improper charges, request reimbursement when applicable, and ensure that appropriate administrative sanctions are taken. 8 1B. Review all transactions made by the 28 5 cardholders identified during our review to identify additional transactions made outside official travel. If the cardholders were not on official travel, OCFO should determine whether the cardholders paid the credit bill for the improper charges, request reimbursement when applicable, and ensure that appropriate administrative sanctions are taken. 1C. Strengthen controls to identify cardholders who use their travel card outside official travel in a timely manner, including deactivating travel cards when unauthorized transactions are identified. 1D. Ensure that travel cards are collected and deactivated immediately when an employee separates from the agency. 1E. Provide refresher training to cardholders on appropriate travel card use. 5 Recommendation 1B excludes the 15 cardholders who were identified as having no or only one set of travel documents and the employee who used the card after separation. Those 15 cardholders’ transactions are accounted for in recommendation 1A. 9 Finding 2: The Purchase Card Program’s Internal Controls Had Weaknesses OCHCO’s and OCPO’s collaborative monitoring of the purchase card program’s internal controls had weaknesses. Specifically, we identified 85 transactions totaling $96,408 with (1) separation of duties and administrative issues, (2) split purchases, or (3) purchases requiring special attention or that could be made by means other than purchase cards. This condition occurred because OCHCO’s internal controls for the purchase card program were not sufficient to identify violations. Overlapping functions and responsibilities leave HUD vulnerable to internal controls being bypassed without timely detection. Separation of Duties HUD did not always ensure that there was adequate separation of duties. There were instances in which purchase cardholders and designated approving officials were also the authorizing officials or approvers for regional offices. The HUD purchase cardholders signed the form HUD-10.4 6 as authorizing officials or were approvers on the Administrative National Service Request System for the regional offices. For the separation of duties violations that occurred at the regional offices, OCHCO and OCPO stated that those offices might be staffed by only three people, implying that regional offices were understaffed. Therefore, functions and responsibilities overlapped. While we understand that the regional offices might be understaffed, the failure to separate responsibilities could result in internal controls being bypassed. The identified lapse in internal controls occurred because HUD had not clarified roles and responsibilities in the GPC policy regarding the duties that must be separated and the mitigating controls in smaller field offices. The separation of duties issues we found were not isolated. They occurred both at HUD headquarters and regional offices. OCHCO and OCPO had not detected the separation of duties issues we found because management control was not properly designed to identify overlapping functions and responsibilities. Instead, the oversight approach was to perform reviews of blocked merchant category codes and ad hoc 7 exception reports related to declined transactions and purchase card use trends. This oversight was not sufficient to detect separation of duties issues since OCHCO and OCPO excluded reviewing supporting documentation to identify overlapping functions and responsibilities. Individuals with overlapping functions and responsibilities could potentially circumvent internal controls, which would not be detected in a timely manner. HUD’s GPC policy states that to ensure that management controls are not bypassed, the responsibilities, functions, and duties of the cardholder, approving official, and agency program coordinator must not overlap. The policy affirms that part of the key management control is the separation of duties so that a participant in the HUD GPC program is not permitted to serve in two or more roles for the same transaction, such as performing the duties of both a cardholder 6 Form HUD-10.4, Requisition for Supplies, Equipment, Forms, Publications and Procurement Services 7 An ad hoc review is done as needed. 10 and approving official or having the cardholder certify funds availability for purchases to be made with his or her card. It clarifies that in no instance may an approving official be subordinate (organizationally) to a cardholder. It also states that the assignment of duties, such as authorizing, approving, and recording transactions; receiving assets; approving cardholder statements; making payments; certifying funding; and reviewing or auditing, must be assigned to separate individuals to the greatest extent possible. 8 Further, OMB Circular A-123, appendix B, states that general responsibilities of charge card managers in implementing risk management controls, policies, and practices include ensuring separation of duties among key functions, such as making purchases, authorizing purchases and payments, certifying funding, and reviewing and auditing. The designated approving official has overlapping roles and responsibilities, to include reviewing and approving cardholders’ transactions and ensuring that each transaction is legal, proper, and mission essential. The designated approving official is also responsible for determining the spending limit, selecting qualified cardholders, changing card and monthly limits, and approving purchases and payments. According to OMB Circular A-123, appendix B, duties among key functions, such as making purchases, authorizing purchases and payments, certifying funding, and reviewing and auditing, must be separated. In some instances, the authorizing official and the designated approving official are the same person. Administrative Issues - Documentation Missing or Not Provided HUD did not provide all required documentation to support procurement card transactions. Specifically, during our review, we noted that supporting documents, such as Citibank statements, forms HUD-10.4, and receipts and invoices, were not always provided. We also noted other administrative issues, such as signatures on the Citibank statement not being traceable to the OCHCO list of authorized signers and the forms HUD-10.4 not being signed by the authorizing official. HUD’s GPC policy states that “prior to initiating a purchase transaction using the GPC, the GPC holder must obtain written pre-approval.” The pre-approval should list all items being purchased. Additionally, all GPC cardholders must maintain a file of all original records and documents related to monthly purchases. In accordance with Federal Acquisition Regulations (FAR) 4.805, the cardholder’s GPC files must be retained for 3 years after payment and then be stored according to HUD procedures for onsite and offsite storage. HUD purchase card approving officials are responsible for reviewing and approving cardholders’ transactions and must ensure that each transaction is legal, proper, mission essential, and in accordance with GPC policy. Additional approving officials are responsible for ensuring that all approvals and documentation are available for each purchase and maintaining reconciliation files. 8 This sentence contains the same language used in OMB Circular A-123, Appendix B, Improving the Management of Government Charge Card Programs, Attachment Glossary. OMB Circular A-123, appendix B, prescribes policies and procedures to agencies regarding how to maintain internal controls that reduce the risk of fraud, waste, and error in Government charge card programs. 11 Split Purchases In reviewing the purchase card sample, we identified split purchases totaling $23,635 9, in which a purchase cardholder, on three occasions, split a transaction into several transactions to avoid exceeding the micropurchase threshold of $3,000. 10 During its periodic review, OCHCO also found each of these three purchases, which were split into two or more transactions and made from the same vendor on the same date, exceeding procurement authority. Split purchases violate FAR, subpart 13.003(c)(2), which states that one must not break down requirements combining more than the micropurchase limit into several purchases that are less than the applicable threshold merely to avoid any requirement that applies to purchases exceeding the micropurchase threshold. OCHCO referred the cardholder to OIG Office of Investigation for further review. Upon notification of the referral, the employee retired from HUD. HUD could not provide documented clearance or approval for purchases requiring special attention 11 when a purchase card was used to pay for the monthly extension of a radio maintenance contract. Card purchases are permitted under the HUD GPC program if the cardholder follows the conditions applicable to noncontracting cardholders. Additionally, our sample included categories of purchases that could be made by means other than purchase cards to better combine purchases and obtain lower prices. Specifically, we found that a purchase cardholder used the card to pay for monthly radio maintenance services totaling $3,396 ($1,698 each month x 2 months), which exceeded the single limit of $3,000 and exceeded procurement authority. This type of transaction falls under purchases requiring special attention for acquisition of products and services, and cardholders have certain restrictions on purchases when using the card. Card purchases are permitted under the HUD GPC program if the cardholder follows the conditions and restrictions applicable to noncontracting cardholders. We expanded our sample and found four additional charges for the same monthly radio services, for the same amount, and from the same vendor. In total, the purchase cardholder charged $10,188 (6 x $1,698) for radio maintenance services. These transactions should have been processed through OCPO and marketed for bids. These transactions violated FAR, Simplified Acquisitions, subpart 13.003(b)(1), which states, “Acquisitions of Supplies or services that have an anticipated dollar value exceeding $3,000 are reserve[d] exclusively for small business concerns and shall be set aside.” Therefore, OCPO needed to have processed this procurement 9 The total amount consisted of the following: $8,844 (split into three transactions and purchased on October 1, 2014, from the same vendor) + $5,911 (split into two transactions and purchased on November 8, 2014, from the same vendor) + $8,880 (split into three transactions and purchased on November 14, 2014, from the same vendor). 10 Effective October 1, 2015, the micropurchase threshold amount had increased from $3,000 to $3,500. 11 This type of transaction falls under purchases requiring special attention for acquisition of products and services, and cardholders have certain restrictions on purchases when using the card. An example is a monthly radio service, the amount of which, when combined, exceeds the micropurchase threshold or single limit. 12 by putting it through a bidding process. The designated approving official approved the purchases despite the GPC policy prohibition and clearance requirement, allowing the purchase cardholder to continue using the purchase card to pay for the same monthly radio services. Conclusion HUD’s internal controls over purchase card use and the purchase card program need improvement. OCHCO’s review of the purchase card transactions was not sufficient to identify internal control weaknesses, such as separation of duties, because HUD had not clarified the roles and responsibilities regarding the duties that must be separated and the overlap that might be allowable in smaller field offices. Additionally, HUD had not established a periodic review to ensure that supporting documentation is maintained and processed for the master file-official cardholder records (for example, cardholder, spending authority, designated approving official reviews), required supporting documents are signed by authorizing officials, and supporting documentation is reviewed to identify overlapping functions and responsibilities. Overlapping functions and responsibilities leave HUD vulnerable to internal controls being bypassed without timely detection. Recommendations We recommend that the Chief Procurement Officer and the Chief Human Capital Officer 2A. Clarify roles and responsibilities regarding the duties that must be separated and the overlap that might be allowable in smaller field offices. 2B. Establish a periodic review of the master file-official cardholder records (for example, cardholder, spending authority, approving official reviews). 2C. Enforce retention of purchase card transaction supporting documentation, including but not limited to clearances and approvals for purchases requiring special attention and the authorizing official’s signature on the form HUD-10.4, and make it available to auditors. 2D Review supporting documents to identify overlapping functions and responsibilities. 13 Scope and Methodology We performed our review from August 2015 through July 2016 at HUD headquarters in Washington, DC. Our review covered the period October 1, 2014, through May 31, 2015. To accomplish our objective, we • Reviewed applicable laws and regulations; • Reviewed HUD’s GPC Program Policy Guide; • Reviewed the HUD REAC Reverse Auction Business Rules; • Reviewed HUD’s Travel Standard Operating Procedures, Citibank Travel Card Guide, and cardholder agreement; • Reviewed ARC’s Travel Card Procedures and a sample of ARC reports provided to HUD; • Reviewed prior OIG reports; • Interviewed HUD, Citibank, and ARC staff; • Obtained HUD’s travel authorizations and vouchers processed during our review period; • Obtained a listing of employees who left HUD between October 15, 2014, and May 15, 2015; 12 • Obtained the purchase and travel card blocked and allowable merchant category codes listings; and • Randomly selected and tested individual purchase and travel card transactions. As part of our planning process, we determined that to conduct a comprehensive credit card analysis, it was essential to have direct access to the Citibank system. Therefore, we requested access to this system from HUD OCFO. However, HUD’s Acting Chief Financial Officer denied our request. This restriction was a scope limitation imposed by HUD management, which resulted in significant delays in the audit. While the Acting Chief Financial Officer did not authorize the requested access, we requested and obtained access to HUD’s purchase and travel card records directly from Citibank. With access to the system, we were able to verify the purchase card data to the control totals. However, we were unable to verify the travel card data. Since the assignment was delayed, we analyzed the data retrieved from the system. After data analysis was performed, we learned that the differences were related to transaction code groupings, which are not available to users. We 12 We obtained this listing from another assignment and determined that requesting a new report was not necessary since the 30-day difference was determined not to be significant. 14 determined the differences to be immaterial when compared to the population. 13 Details of the travel and purchase card transactions are discussed below. During our review period, there were 51,851 purchase and 1,322 ATM transaction types (based on transaction date) totaling more than $7.3 million. Of the 53,173 transactions, • 7,689 transactions totaling more than $1.1 million were related to OIG. They were comprised of 138 ATM cash advances and 7,551 purchases. To maintain our independence, we did not review these transactions. • 45,484 totaling more than $6.2 million were related to all other HUD offices (not OIG). They were comprised of 44,300 purchases and 1,184 ATM cash advance transactions. We performed additional analysis and selected nonstatistical samples from this subpopulation. Between October 1, 2014, and May 31, 2015, there were 14,781 purchase and 7 ATM transaction types (based on transaction date) totaling more than $6.9 million. Of the 14,788 transactions, • 1,879 totaling more than $625,000 were related to OIG. They were comprised of 7 ATM and 1,872 purchase transaction types. To maintain our independence, we did not review these transactions. • 34 totaling more than $27,000 were related to the Federal Housing Administration (FHA). They were comprised of all purchases. These transactions were not reviewed since the nature of these transactions is not a typical purchase card purchase and the count and amount were immaterial when compared to the population. • 7,813 totaling more than $4.3 million were related to the Office of Public and Indian Housing’s REAC Inspection Program. They were comprised of all purchases. We selected a nonstatistical sample from this subpopulation. • 5,062 totaling just under $2 million were related to all other offices (not OIG (bullet 1), FHA (bullet 2), or the REAC Inspection Program (bullet 3)). They were comprised of all purchases. We performed additional analysis and selected nonstatistical samples from this subpopulation. Our review of HUD’s travel and purchase card purchase and ATM transaction types included tests for • Blocked merchant category codes, • Potential split purchases (this test was performed on purchase card transactions only), 13 Specifically, the ATM cash advance transaction type totals differed by 28 and $6,105, and the purchase transaction type totals differed by 446 and more than $175,000. The total ATM and purchase count difference was less than 1 percent, and the amount difference was only 2 percent of the population. 15 • Purchases made on weekends and Government holidays, • Allowable but suspicious merchant category code transactions, • Transactions made outside the United States and Puerto Rico, • Transactions made without temporary duty travel authorizations or vouchers, and • Transactions made after an employee left the agency. To achieve our audit objective, we relied on HUD’s and Citibank’s computer-processed data. We used the data to select nonstatistical transaction samples to review and perform detailed testing. Although we did not perform a detailed assessment of the reliability of the data, we performed a minimal level of testing and found the data to be adequate for our purposes. We conducted the audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective(s). We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 16 Internal Controls Internal control is a process adopted by those charged with governance and management, designed to provide reasonable assurance about the achievement of the organization’s mission, goals, and objectives with regard to • Effectiveness and efficiency of operations, • Reliability of financial reporting, and • Compliance with applicable laws and regulations. Internal controls comprise the plans, policies, methods, and procedures used to meet the organization’s mission, goals, and objectives. Internal controls include the processes and procedures for planning, organizing, directing, and controlling program operations as well as the systems for measuring, reporting, and monitoring program performance. Relevant Internal Controls We determined that the following internal controls were relevant to our audit objective: • Controls over the review of the travel card and purchase card programs, including the identification of and actions taken for violations of policy. We assessed the relevant controls identified above. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, the reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations on a timely basis. Significant Deficiency Based on our review, we believe that the following item is a significant deficiency: • HUD’s monitoring of travel card program violations and GPC policies and procedures was not sufficient to identify violations. 17 Appendixes Appendix A Schedule of Questioned Costs Recommendation Unsupported 1/ number 1A $528,147 Total 528,147 1/ Unsupported costs are those costs charged to a HUD-financed or HUD-insured program or activity when we cannot determine eligibility at the time of the audit. Unsupported costs require a decision by HUD program officials. This decision, in addition to obtaining supporting documentation, might involve a legal interpretation or clarification of departmental policies and procedures. 18 Appendix B Auditee Comments and OIG’s Evaluation Ref to OIG Auditee Comments – The Office of the Chief Financial Evaluation Officer Comment 1 Comment 2 19 Appendix B Comment 2 20 Auditee Comments – The Office of Chief Procurement Officer Comment 3 Comment 4 Comment 5 21 Appendix B (cont) Comment 6 Comment 7 Comment 8 Comment 9 Comment 10 Comment 11 22 Appendix B (cont) Comment 12 Comment 13 Comment 14 Comment 15 23 OIG Evaluation of Auditee Comments From the Office of the Chief Financial Officer Comment 1 OCFO stated that it has taken steps to strengthen internal control, including conducting an internal review of the travel card program in April 2015. Since action taken was near the end of or after our review scope, we did not evaluate these measures during the course of our audit. We will review these improvements during the audit resolution process and the next audit cycle. Comment 2 OCFO stated that it would review the transactions identified in our report and provide its findings by December 31, 2016, work with ARC, and refer employees to travel card information on GSA and Treasury Web sites. While we appreciate OCFO’s willingness to review and report on the identified transactions, we also recommended that OCFO review all transactions made by the 28 cardholders identified as having no travel documents associated with the sample transaction and identify additional transactions made outside official travel (recommendation 1B). We will review all steps taken during the audit resolution process. 24 OIG Evaluation of Auditee Comments From the Office of the Chief Procurement Officer Comment 3 We agree with the proposed change and have clarified OCPO’s administrative responsibility in the background section of the report. Comment 4 We disagree with HUD’s comments that the separation of duties we found were isolated. Therefore, we revised the report to clarify that the separation of duties issues we found were not isolated but occurred in both HUD headquarters and regional offices. For our audit period of October 2014 through May 2015, we discovered instances where cardholders and designated approving officials signed HUD10.4 as the authorizing official (authorizing and approving payments for transactions), creating an overlap in functions. GPC policy does not identify situations that specifically allow these functions to overlap and the review process does not specifically look for instances when functions overlap. Regarding designated approving officials authorizing and approving cardholders’ transactions, the GPC policy is not clear which of the overlapping functions may be allowable at the regional offices. OMB Circular A-123, appendix B(4.3) states that the general responsibilities of charge card managers in implementing risk management controls, policies, and practices include ensuring separation of duties among key functions such as making purchases, authorizing purchases and payments, certifying funding, and reviewing and auditing. HUD’s focus was to monitor blocked MCC usage, perform periodic transaction reviews, and ad hoc reviews related to declined transaction reports and trends; its review process did not include reviewing supporting documentation to identify overlapping functions. Comment 5 We agree with OCPO’s and OCHCO’s proposal to expand their review of purchase card transactions to include a review of supporting documentation to identify overlapping functions and responsibilities and strengthen internal control. We added this as recommendation 2D. We will review any action taken during the audit resolution process. Comment 6 We disagree with HUD’s comment because while HUD’s routine review of MCCs is a good internal control, it does not address the issue of separation of duties. We clarified the report language regarding the review of blocked merchant category codes and HUD’s ad hoc review of exception reports related to declined transactions and purchase card use trends. Comment 7 We disagree with HUD’s response regarding missing documentation. Of the 85 transactions in our finding, 18 involved missing supporting documents. GPC policy required that supporting documents be retained for 3 years, yet HUD was not able to provide the supporting documents. OMB Circular A-123, appendix B, states that the general responsibilities of charge card managers in implementing 25 risk management controls, policies, and practices include ensuring that cardholder statements of account 14 and supporting documentation 15 are reviewed and used to monitor delinquency, misuse, and other transaction activities. Therefore, the supporting documents for the transactions made during our review period should have been available. Missing documentation was one of the issues we discovered leading us to the significant deficiency. Other issues we discovered were separation of duties, split purchases, and purchases requiring special attention or that should be made by means other than purchase cards. Comments 8 Based on HUD’s comments, we clarified the language in the report regarding split purchases comprised of eight transactions that were made from the same vendor on the same day (see footnote 9). On three occasions, the cardholder split a transactions into two or more transactions. Each of the three purchases was made on the same date and from the same vendor. Additionally, in light of newly provided supporting documentation, we clarified the nature of how the cardholder separated from HUD from terminated to retired. We disagree with HUD’s response that we should not have cited the split transactions as a weakness in the program since HUD found them during its transaction review. We acknowledged that HUD identified the split transactions during its transaction review and referred the cardholder’s transactions to OIG’s Office of Investigation for further review. Comments 9 We agree with HUD’s response and clarified that the effective date was October 1, 2015 in footnote 10. Comments 10 We disagree with HUD’s response. We discussed the findings with HUD officials during a meeting on May 12, 2016. HUD officials, however, did not provide additional support to show that HUD had identified the same monthly radio service maintenance transactions that we found. We also disagree that the HUD officials informed us of the issuance of an August 2015 purchase order during the May 12, 2016, meeting. We will review any available documentation during the audit resolution process. Further, we did not include this finding in the separation of duties section because in this instance the cardholder exceeded the procurement limit. The purchase should have been made by some other means than a purchase card. 14 OIG interpreted “cardholder statement account” to mean Citibank statements, which list charges made by the purchase cardholder. 15 Supporting documentation not provided included copies of form HUD-10.4 signed by the authorizing official and copies of Citibank statements. 26 Comments 11 We removed the language from the finding and the recommendation related to consequences for designated approving officials who fail to adequately perform their management and oversight responsibilities. The designated Approving Official’s roles and responsibilities have been added to the separation of duties section of the finding. Comments 12 We disagree. The significant deficiency refers not only to the unauthorized act of one cardholder, but also to the overall condition of HUD’s internal controls in its management of the government purchase card programs. Our finding included separation of duties, split purchases, missing or not provided documentation, and purchases requiring special attention or that should be made by means other than purchase cards. Comments 13 We clarified the separation between the purchase card and travel card programs in the background section of the report. Comments 14 HUD concurred with recommendations 2A-2C. We will review the action taken during the audit resolution process. Comment 15 According to the HUD’s comment 2, OCHCO will begin to review supporting documentation to identify overlapping functions and responsibilities. Our recommendation 2D is in line with this statement and any actions taken in this regard will be evaluated during the audit resolution process. 27
HUD Needs To Improve Its Monitoring of the Travel and Purchase Card Programs
Published by the Department of Housing and Urban Development, Office of Inspector General on 2016-09-29.
Below is a raw (and likely hideous) rendition of the original report. (PDF)