U.S. Department of Housing and
Urban Development, Washington, DC
Review of the U.S. Department of Housing and Urban
Development’s Compliance With the Travel and
Purchase Card Programs
Office of Audit, Financial Audits Division Audit Report Number: 2016-FO-0006
Washington, DC September 29, 2016
To: Keith W. Surber, Chief Procurement Officer, N
Towanda A. Brooks, Chief Human Capital Officer, A
Courtney B. Timberlake, Deputy Chief Financial Officer, F
/s/
From: Thomas R. McEnanly, Director, Financial Audits Division, GAF
Subject: HUD Needs To Improve Its Monitoring of the Travel and Purchase Card
Programs
Attached is the U.S. Department of Housing and Urban Development (HUD), Office of Inspector
General’s (OIG) final results of our review of HUD’s compliance with the travel and purchase
card programs.
HUD Handbook 2000.06, REV-4, sets specific timeframes for management decisions on
recommended corrective actions. For each recommendation without a management decision,
please respond and provide status reports in accordance with the HUD Handbook. Please furnish
us copies of any correspondence or directives issued because of the audit.
The Inspector General Act, Title 5 United States Code, section 8M, requires that OIG post its
publicly available reports on the OIG Web site. Accordingly, this report will be posted at
http://www.hudoig.gov.
If you have any questions or comments about this report, please do not hesitate to call me at
202-402-8216.
Audit Report Number: 2016-FO-0006
Date: September 29, 2016
HUD Needs To Improve Its Monitoring of the Travel and Purchase Card
Programs
Highlights
What We Audited and Why
We audited HUD’s compliance with the fiscal year 2015 travel and purchase card programs
based on our required fiscal year 2014 risk assessment. Our 2014 risk assessment determined the
U.S. Department of Housing and Urban Development’s (HUD) agencywide charge card program
to be at medium risk for fraud. Offices of inspector general are required to (1) conduct periodic
assessments of the agency charge card programs, (2) perform analyses or audits as necessary, and
(3) report to the head of the executive agency the results of such analyses or audits. Our audit
objective was to determine whether HUD had sufficient and effective controls to (1) prevent and
identify improper and potentially unallowable uses of cards and (2) recognize patterns of violation.
What We Found
While HUD stated that it had implemented controls to identify cardholder travel card program
violations, it did not successfully identify patterns of abuse. Specifically, we identified 3,671
instances of cardholders using their travel card without an approved official temporary duty
station travel document. These transactions totaled $528,147.
Additionally, although HUD monitors purchase card use through periodic reviews, the purchase
card program’s internal controls needed improvement. Specifically, we identified 85
transactions totaling $96,408 with (1) separation of duties and administrative issues, (2) split
purchases, or (3) purchases requiring special attention or that could be made by means other than
purchase cards.
What We Recommend
We recommend that HUD review the identified 3,671 transactions totaling $528,147 to determine
whether these transactions were for official Government travel, identify additional transactions
made outside official travel, and ensure that appropriate action is taken.
Additionally, we recommend that HUD (1) clarify roles and responsibilities regarding the duties
that must be separated and the overlap that might be allowable in smaller field offices, (2)
establish a periodic review of the official cardholders, (3) enforce retention of supporting
documentation and make it available to auditors, and (4) review supporting documents to
identify overlapping functions and responsibilities.
Table of Contents
Background and Objective......................................................................................3
Results of Audit ........................................................................................................5
Finding 1: HUD’s Travel Card Monitoring Had Weaknesses..................................... 5
Finding 2: The Purchase Card Program’s Internal Controls Had Weaknesses...... 10
Scope and Methodology .........................................................................................14
Internal Controls ....................................................................................................17
Appendixes ..............................................................................................................18
A. Schedule of Questioned Costs .................................................................................. 18
B. Auditee Comments and OIG’s Evaluation ............................................................. 19
2
Background and Objective
On October 5, 2012, President Obama signed the Charge Card Abuse Prevention Act of 2012,
Public Law 112-194. The Charge Card Act was designed to prevent recurring fraud, waste, and
abuse in governmentwide charge card programs. This law requires all executive branch agencies to
establish and maintain safeguards and internal controls for their use of purchase cards, travel cards,
and centrally billed accounts. The Charge Card Act also establishes additional reporting and audit
requirements, consistent with existing statutory responsibilities, to avoid improper payments and
protect privacy among other things.
On September 6, 2013, the Office of Management and Budget (OMB) issued Memorandum M-13-
21 to provide guidance on implementing the Charge Card Act. It required all agency card
management plans to be reviewed and updated as necessary to prevent duplicate reimbursements.
The guidance included penalties for charge card violations to prevent the Government from
spending money on unused tickets and deterring employee misuse of Government cards.
Additionally, beginning in fiscal year 2013, each agency with more than $10 million in purchase
card spending the prior fiscal year was required to submit semiannual reports of employee
purchase card violations and the disposition of these violations, including disciplinary actions
taken. Further, it required offices of inspector general (OIG) to (1) conduct periodic assessments of
the agency charge card programs; (2) identify and analyze the risk of illegal, improper, or mistaken
purchases and payments; (3) perform analyses or audits as necessary; (4) report to the head of the
executive agency concerns regarding the results of such analyses or audits; and (5) report to OMB
on the implementation of recommendations made to the head of the executive agency.
The General Services Administration (GSA) administers the Government charge card program, also
known as the GSA SmartPay program. This program provides purchase charge cards to agencies or
departments throughout the U.S. Government to streamline small purchases, facilitate payment
processes, minimize paperwork, and simplify the administrative effort associated with procuring
goods and services. In addition, each agency contracts with a commercial provider for Government
travel accounts through GSA SmartPay master contracts. GSA negotiates master contracts with
national banks, such as Citibank, JP Morgan Chase, and U.S. Bank, to provide charge cards to
Federal employees. The U.S. Department of Housing and Urban Development (HUD) uses
Citibank as its purchase and travel card provider.
The GSA SmartPay travel account may be used for authorized official travel and authorized travel-
related expenses only. When traveling for the Government, use of a Government travel account is
required unless an exemption has been granted. Government travel accounts are VISA or
MasterCard branded and can be used at any location that accepts those credit card types, including
internationally. The travel account may not be used for personal expenses at any time and must not
be used by any other person.
3
The Office of the Chief Financial Officer (OCFO) administers the travel card program. OCFO
monitors the travel card program but does not have its own travel card policy. Instead, it relies on
the Federal Travel Regulations. 1
Regarding the purchase card program, the Office of the Chief Human Capital Officer (OCHCO) is
responsible for compliant administrative execution, and the Office of the Chief Procurement Officer
(OCPO) is responsible for oversight and compliance to reduce potential card misuse and abuse.
OCHCO is responsible for monitoring HUD’s purchase card program, with the exception of the
Office of Public and Indian Housing’s Real Estate Assessment Center’s (REAC) Reverse Auction
Program charges. OCPO’s Government Purchase Card (GPC) Program Policy Guide establishes
policies and procedures for the use of the governmentwide purchase card at HUD. This policy
applies to all GPC transactions, both “purchase-pay” (micropurchases) and “payment only” (all
other transactions), while the REAC Reverse Auction Program charge cards are used to pay
contractors for completed inspection work. REAC maintains physical custody of the purchase cards
that the contractors and inspectors use to bill HUD for completed inspection work. The Reverse
Auction Program - Business Rules provides guidance and policy for contractors interested in
participating in HUD’s Reverse Auction Program.
Our audit objective was to determine whether HUD had sufficient and effective controls to (1)
prevent and identify improper and potentially unallowable uses of cards and (2) recognize patterns
of violation.
1
The Federal Travel Regulation is the regulation contained in 41 CFR (Code of Federal Regulations) Chapters
300 through 304.
4
Results of Audit
Finding 1: HUD’s Travel Card Monitoring Had Weaknesses
While HUD had implemented controls to identify cardholder travel card program violations, it
did not successfully identify patterns of abuse. Specifically, we identified 3,671 instances of
cardholders using their card without an approved official temporary duty station travel
document. These violations occurred because HUD had not successfully implemented necessary
internal controls over its travel card program and did not ensure that the Government-issued
travel card was returned to the agency as part of the employee’s separation process. As a result,
future unauthorized transactions may not be identified and rectified in a timely manner, and
$528,147 in travel card charges was unsupported.
Monitoring Procedures
During fiscal year 2015, HUD contracted with the Administrative Resource Center (ARC)
Travel Services to provide monthly reports to the agency that identify questionable credit card
transactions. ARC compares the transaction date of each credit card charge to trip dates on the
travelers’ authorizations and vouchers from HUD’s travel system. 2 ARC identifies questioned
credit card transactions based on its defined criteria for each expense transaction type category.
ARC also conducts a scan of the reports to identify possible Federal Travel Regulations
violations and then sends the reports to OCFO for further review. However, HUD did not
compare the monthly reports to one another to identify patterns of violations.
OCFO stated that once it receives the reports, it provides them to the appropriate program office
administrative officer to confirm whether the transactions were related to official travel. The
program sends the results back to OCFO and works with OCHCO’s Employee Labor Relations
Division to process any necessary penalties or discipline. OCFO stated that it did not have the
authority to penalize employees for prohibited card use but the Employee Labor Relations
Division had that authority. The program office provides information to OCFO on substantiated
violations quarterly, and OCFO maintains a spreadsheet with the number of reported violations.
However, OCFO did not follow up on administrative penalties or the status of the transactions
reported to the various program offices. It inquired only about whether credit cards should be
canceled. Although OCFO explained its process, we were unable to determine whether HUD
took appropriate action because we were not provided evidence of HUD’s review of the ARC
reports or its communication and followup with the program offices.
2
HUD uses Concur to process and approve travel authorizations and vouchers and make official travel
arrangements.
5
Sample Transactions Without an Official Travel Authorization
We examined a sample of 192 transactions and identified 61 questioned transactions made by 43
cardholders totaling $22,707 that could not be matched to an official temporary duty station
travel authorization. 3 For 26 of the 61 questioned sample transactions, we discovered that
• 6 of those questioned transactions totaling nearly $99 were made about a month after the
employee’s last official travel period and 2 to 6 days after the employee left the agency.
• 15 of the questioned transactions totaling more than $5,632 were associated with 13
cardholders who did not have any travel documents (temporary duty station
authorizations or vouchers) at all.
• 5 of questioned transactions totaling nearly $3,992 were made by a cardholder who had
only one official travel order during our review period.
The remaining 35 questioned transactions totaling $12,984 were made by 28 cardholders who
did not have official travel documents associated with the sample transactions. Our questioned
sample transactions are as shown in the table below.
Table 1: Questioned sample transactions summary
Questioned Number of Number of Questioned
transaction category transactions cardholders dollar amount*
Transactions after
6 1 $99
separation
Transactions by
cardholders without
15 13 5,632
any travel
documents
Transactions by a
cardholder with only
5 1 3,992
one official travel
document
No travel documents
associated with the 35 28 12,984
sample transaction
Total questioned
61 43 22,707
sample transactions
* Questioned dollar amounts are rounded to the nearest dollar.
These occurrences were contrary to the Federal Travel Regulation, which defines official travel
as “travel under an official travel authorization from an employee’s official station or other
authorized point of departure to a temporary duty location and return from a temporary duty
location, between two temporary duty locations, or relocation at the direction of a Federal
agency.” In addition, the cardholder guide and agreement state that the travel card may be used
3
The remaining 131 sample transactions were associated with official travel and were not reviewed further.
6
only for official agency and organization travel and travel-related expenses, including air and rail
tickets, transportation services, lodging, automobile rental, food service establishments, fuel, and
ATM access if authorized. Further, the Citibank Statement of Cardholder Responsibility
provides that when the cardholder separates from the agency, the card must be turned in to the
supervisor and the coordinator will be notified to cancel the account.
Transactions Made by Cardholders Without Any Official Travel Documents
Since we discovered that 15 of the 61 questioned transactions totaling more than $5,632 were
associated with 13 cardholders who did not have any travel documents (temporary duty station
authorizations or vouchers) at all, we performed an additional analysis. Specifically, we
performed an analysis to identify all cardholders in our travel card population 4 without any
temporary duty station authorizations. Our additional analysis identified 245 cardholders
(including the 13 employees identified from our sample review) with 3,529 transactions totaling
more than $464,464, who used their travel card without official travel documentation. The
transaction dates ranged from October 1, 2014, to May 29, 2015, the number of transactions
ranged from 1 to 309, and the total questioned amounts ranged from $2 to $18,161. The travel
card charges were for things such as airfare, rental cars, hotels, gas, parking garages, and ATM
withdrawals. These transactions were not identified during ARC’s analysis. Therefore, OCFO
did not follow up with the program offices to ensure that the transactions were researched and
appropriate action was taken.
Transactions Made by a Cardholder With Only One Official Travel Authorization
We identified 5 of the 61 questioned transactions totaling more than $3,991 made by a
cardholder who had only one official travel order during our review period. Four of her
questioned transactions were made at Caesars Palace, prompting us to review all of her
transactions during our review period. Specifically, the cardholder used her travel card 110
times between October 1, 2014, and May 9, 2015. However, we could associate only nine
transactions to official travel documents. The remaining 101 transactions (including the 5
questioned transactions) totaling nearly $50,600 were outside the official travel period. A
majority (78 transactions totaling nearly $48,799) of the 101 transactions were made at Caesars
Hotel and Casino in Las Vegas, NV, or were for cash withdrawals from various ATMs. These
transactions continued for months without detection.
Therefore, based on these additional analyses, our total questioned transactions are as shown in
the table below.
Table 2: All questioned transactions summary
Questioned Number of Number of Questioned
transaction category transactions cardholders dollar amount
No travel documents
associated with the 35 28 $12,984
sample transaction
4
After excluding OIG transactions, our population included 45,484 travel card purchase and ATM transactions.
7
Questioned Number of Number of Questioned
transaction category transactions cardholders dollar amount
(continued) (continued) (continued) (continued)
Transactions after
6 1 99
separation
All transactions by
cardholders without 3,529 245 464,464
any travel documents
All transactions by a
cardholder with only
101 1 50,600
one official travel
document
Total questioned
3,671 275 528,147
sample transactions
When asked about the questioned transactions, OCFO stated that HUD employees were
permitted to use the Government-issued travel cards for Government relocation and emergency-
related travel. Because the transactions were related to special circumstances, there would be no
travel authorizations in HUD’s travel system for these transaction types. While the GSA
SmartPay program states that travel cards may be used to pay for all official Government travel
and related expenses, the emergency and relocation approved traveler lists provided were
insufficient to determine whether the employees listed matched to the employees we identified as
having used their travel cards without temporary duty station authorizations.
Conclusion
HUD had not successfully implemented necessary internal controls over its travel card
transactions. OCFO did not identify these noncompliant transactions and ensure that appropriate
action was taken and ensure that the Government-issued travel card was collected as part of the
employee’s separation process. As a result, future unauthorized transactions may not be
identified and rectified in a timely manner, and a total of $528,147 in travel card charges was
unsupported.
Recommendations
We recommend that the Deputy Chief Financial Officer
1A. Review the identified 3,671 transactions totaling $528,147 to determine whether they
were for official Government travel. If they were not for official travel, OCFO should
determine whether the cardholders paid the credit bill for the improper charges, request
reimbursement when applicable, and ensure that appropriate administrative sanctions are
taken.
8
1B. Review all transactions made by the 28 5 cardholders identified during our review to
identify additional transactions made outside official travel. If the cardholders were not
on official travel, OCFO should determine whether the cardholders paid the credit bill for
the improper charges, request reimbursement when applicable, and ensure that appropriate
administrative sanctions are taken.
1C. Strengthen controls to identify cardholders who use their travel card outside official
travel in a timely manner, including deactivating travel cards when unauthorized
transactions are identified.
1D. Ensure that travel cards are collected and deactivated immediately when an employee
separates from the agency.
1E. Provide refresher training to cardholders on appropriate travel card use.
5
Recommendation 1B excludes the 15 cardholders who were identified as having no or only one set of travel
documents and the employee who used the card after separation. Those 15 cardholders’ transactions are
accounted for in recommendation 1A.
9
Finding 2: The Purchase Card Program’s Internal Controls Had
Weaknesses
OCHCO’s and OCPO’s collaborative monitoring of the purchase card program’s internal
controls had weaknesses. Specifically, we identified 85 transactions totaling $96,408 with (1)
separation of duties and administrative issues, (2) split purchases, or (3) purchases requiring
special attention or that could be made by means other than purchase cards. This condition
occurred because OCHCO’s internal controls for the purchase card program were not sufficient
to identify violations. Overlapping functions and responsibilities leave HUD vulnerable to
internal controls being bypassed without timely detection.
Separation of Duties
HUD did not always ensure that there was adequate separation of duties. There were instances
in which purchase cardholders and designated approving officials were also the authorizing
officials or approvers for regional offices. The HUD purchase cardholders signed the form
HUD-10.4 6 as authorizing officials or were approvers on the Administrative National Service
Request System for the regional offices. For the separation of duties violations that occurred at
the regional offices, OCHCO and OCPO stated that those offices might be staffed by only three
people, implying that regional offices were understaffed. Therefore, functions and
responsibilities overlapped. While we understand that the regional offices might be understaffed,
the failure to separate responsibilities could result in internal controls being bypassed. The
identified lapse in internal controls occurred because HUD had not clarified roles and
responsibilities in the GPC policy regarding the duties that must be separated and the mitigating
controls in smaller field offices.
The separation of duties issues we found were not isolated. They occurred both at HUD
headquarters and regional offices. OCHCO and OCPO had not detected the separation of duties
issues we found because management control was not properly designed to identify overlapping
functions and responsibilities. Instead, the oversight approach was to perform reviews of
blocked merchant category codes and ad hoc 7 exception reports related to declined transactions
and purchase card use trends. This oversight was not sufficient to detect separation of duties
issues since OCHCO and OCPO excluded reviewing supporting documentation to identify
overlapping functions and responsibilities. Individuals with overlapping functions and
responsibilities could potentially circumvent internal controls, which would not be detected in a
timely manner.
HUD’s GPC policy states that to ensure that management controls are not bypassed, the
responsibilities, functions, and duties of the cardholder, approving official, and agency program
coordinator must not overlap. The policy affirms that part of the key management control is the
separation of duties so that a participant in the HUD GPC program is not permitted to serve in
two or more roles for the same transaction, such as performing the duties of both a cardholder
6
Form HUD-10.4, Requisition for Supplies, Equipment, Forms, Publications and Procurement Services
7
An ad hoc review is done as needed.
10
and approving official or having the cardholder certify funds availability for purchases to be
made with his or her card. It clarifies that in no instance may an approving official be
subordinate (organizationally) to a cardholder. It also states that the assignment of duties, such
as authorizing, approving, and recording transactions; receiving assets; approving cardholder
statements; making payments; certifying funding; and reviewing or auditing, must be assigned to
separate individuals to the greatest extent possible. 8 Further, OMB Circular A-123, appendix B,
states that general responsibilities of charge card managers in implementing risk management
controls, policies, and practices include ensuring separation of duties among key functions, such
as making purchases, authorizing purchases and payments, certifying funding, and reviewing and
auditing.
The designated approving official has overlapping roles and responsibilities, to include
reviewing and approving cardholders’ transactions and ensuring that each transaction is legal,
proper, and mission essential. The designated approving official is also responsible for
determining the spending limit, selecting qualified cardholders, changing card and monthly
limits, and approving purchases and payments. According to OMB Circular A-123, appendix B,
duties among key functions, such as making purchases, authorizing purchases and payments,
certifying funding, and reviewing and auditing, must be separated. In some instances, the
authorizing official and the designated approving official are the same person.
Administrative Issues - Documentation Missing or Not Provided
HUD did not provide all required documentation to support procurement card transactions.
Specifically, during our review, we noted that supporting documents, such as Citibank
statements, forms HUD-10.4, and receipts and invoices, were not always provided. We also
noted other administrative issues, such as signatures on the Citibank statement not being
traceable to the OCHCO list of authorized signers and the forms HUD-10.4 not being signed by
the authorizing official.
HUD’s GPC policy states that “prior to initiating a purchase transaction using the GPC, the GPC
holder must obtain written pre-approval.” The pre-approval should list all items being
purchased. Additionally, all GPC cardholders must maintain a file of all original records and
documents related to monthly purchases. In accordance with Federal Acquisition Regulations
(FAR) 4.805, the cardholder’s GPC files must be retained for 3 years after payment and then be
stored according to HUD procedures for onsite and offsite storage.
HUD purchase card approving officials are responsible for reviewing and approving cardholders’
transactions and must ensure that each transaction is legal, proper, mission essential, and in
accordance with GPC policy. Additional approving officials are responsible for ensuring that all
approvals and documentation are available for each purchase and maintaining reconciliation
files.
8
This sentence contains the same language used in OMB Circular A-123, Appendix B, Improving the Management
of Government Charge Card Programs, Attachment Glossary. OMB Circular A-123, appendix B, prescribes
policies and procedures to agencies regarding how to maintain internal controls that reduce the risk of fraud,
waste, and error in Government charge card programs.
11
Split Purchases
In reviewing the purchase card sample, we identified split purchases totaling $23,635 9, in which
a purchase cardholder, on three occasions, split a transaction into several transactions to avoid
exceeding the micropurchase threshold of $3,000. 10 During its periodic review, OCHCO also
found each of these three purchases, which were split into two or more transactions and made
from the same vendor on the same date, exceeding procurement authority. Split purchases
violate FAR, subpart 13.003(c)(2), which states that one must not break down requirements
combining more than the micropurchase limit into several purchases that are less than the
applicable threshold merely to avoid any requirement that applies to purchases exceeding the
micropurchase threshold. OCHCO referred the cardholder to OIG Office of Investigation for
further review. Upon notification of the referral, the employee retired from HUD.
HUD could not provide documented clearance or approval for purchases requiring special
attention 11 when a purchase card was used to pay for the monthly extension of a radio
maintenance contract. Card purchases are permitted under the HUD GPC program if the
cardholder follows the conditions applicable to noncontracting cardholders.
Additionally, our sample included categories of purchases that could be made by means other
than purchase cards to better combine purchases and obtain lower prices. Specifically, we found
that a purchase cardholder used the card to pay for monthly radio maintenance services totaling
$3,396 ($1,698 each month x 2 months), which exceeded the single limit of $3,000 and exceeded
procurement authority. This type of transaction falls under purchases requiring special attention
for acquisition of products and services, and cardholders have certain restrictions on purchases
when using the card. Card purchases are permitted under the HUD GPC program if the
cardholder follows the conditions and restrictions applicable to noncontracting cardholders.
We expanded our sample and found four additional charges for the same monthly radio services,
for the same amount, and from the same vendor. In total, the purchase cardholder charged
$10,188 (6 x $1,698) for radio maintenance services. These transactions should have been
processed through OCPO and marketed for bids. These transactions violated FAR, Simplified
Acquisitions, subpart 13.003(b)(1), which states, “Acquisitions of Supplies or services that have
an anticipated dollar value exceeding $3,000 are reserve[d] exclusively for small business
concerns and shall be set aside.” Therefore, OCPO needed to have processed this procurement
9
The total amount consisted of the following: $8,844 (split into three transactions and purchased on October 1,
2014, from the same vendor) + $5,911 (split into two transactions and purchased on November 8, 2014, from the
same vendor) + $8,880 (split into three transactions and purchased on November 14, 2014, from the same
vendor).
10
Effective October 1, 2015, the micropurchase threshold amount had increased from $3,000 to $3,500.
11
This type of transaction falls under purchases requiring special attention for acquisition of products and services,
and cardholders have certain restrictions on purchases when using the card. An example is a monthly radio
service, the amount of which, when combined, exceeds the micropurchase threshold or single limit.
12
by putting it through a bidding process. The designated approving official approved the
purchases despite the GPC policy prohibition and clearance requirement, allowing the purchase
cardholder to continue using the purchase card to pay for the same monthly radio services.
Conclusion
HUD’s internal controls over purchase card use and the purchase card program need
improvement. OCHCO’s review of the purchase card transactions was not sufficient to identify
internal control weaknesses, such as separation of duties, because HUD had not clarified the
roles and responsibilities regarding the duties that must be separated and the overlap that might
be allowable in smaller field offices. Additionally, HUD had not established a periodic review to
ensure that supporting documentation is maintained and processed for the master file-official
cardholder records (for example, cardholder, spending authority, designated approving official
reviews), required supporting documents are signed by authorizing officials, and supporting
documentation is reviewed to identify overlapping functions and responsibilities. Overlapping
functions and responsibilities leave HUD vulnerable to internal controls being bypassed without
timely detection.
Recommendations
We recommend that the Chief Procurement Officer and the Chief Human Capital Officer
2A. Clarify roles and responsibilities regarding the duties that must be separated and
the overlap that might be allowable in smaller field offices.
2B. Establish a periodic review of the master file-official cardholder records (for
example, cardholder, spending authority, approving official reviews).
2C. Enforce retention of purchase card transaction supporting documentation,
including but not limited to clearances and approvals for purchases requiring
special attention and the authorizing official’s signature on the form HUD-10.4,
and make it available to auditors.
2D Review supporting documents to identify overlapping functions and
responsibilities.
13
Scope and Methodology
We performed our review from August 2015 through July 2016 at HUD headquarters in
Washington, DC. Our review covered the period October 1, 2014, through May 31, 2015.
To accomplish our objective, we
• Reviewed applicable laws and regulations;
• Reviewed HUD’s GPC Program Policy Guide;
• Reviewed the HUD REAC Reverse Auction Business Rules;
• Reviewed HUD’s Travel Standard Operating Procedures, Citibank Travel Card Guide,
and cardholder agreement;
• Reviewed ARC’s Travel Card Procedures and a sample of ARC reports provided to
HUD;
• Reviewed prior OIG reports;
• Interviewed HUD, Citibank, and ARC staff;
• Obtained HUD’s travel authorizations and vouchers processed during our review period;
• Obtained a listing of employees who left HUD between October 15, 2014, and May 15,
2015; 12
• Obtained the purchase and travel card blocked and allowable merchant category codes
listings; and
• Randomly selected and tested individual purchase and travel card transactions.
As part of our planning process, we determined that to conduct a comprehensive credit card
analysis, it was essential to have direct access to the Citibank system. Therefore, we requested
access to this system from HUD OCFO. However, HUD’s Acting Chief Financial Officer
denied our request. This restriction was a scope limitation imposed by HUD management, which
resulted in significant delays in the audit. While the Acting Chief Financial Officer did not
authorize the requested access, we requested and obtained access to HUD’s purchase and travel
card records directly from Citibank.
With access to the system, we were able to verify the purchase card data to the control totals.
However, we were unable to verify the travel card data. Since the assignment was delayed, we
analyzed the data retrieved from the system. After data analysis was performed, we learned that
the differences were related to transaction code groupings, which are not available to users. We
12
We obtained this listing from another assignment and determined that requesting a new report was not necessary
since the 30-day difference was determined not to be significant.
14
determined the differences to be immaterial when compared to the population. 13 Details of the
travel and purchase card transactions are discussed below.
During our review period, there were 51,851 purchase and 1,322 ATM transaction types (based
on transaction date) totaling more than $7.3 million. Of the 53,173 transactions,
• 7,689 transactions totaling more than $1.1 million were related to OIG. They were
comprised of 138 ATM cash advances and 7,551 purchases. To maintain our
independence, we did not review these transactions.
• 45,484 totaling more than $6.2 million were related to all other HUD offices (not OIG).
They were comprised of 44,300 purchases and 1,184 ATM cash advance transactions.
We performed additional analysis and selected nonstatistical samples from this
subpopulation.
Between October 1, 2014, and May 31, 2015, there were 14,781 purchase and 7 ATM
transaction types (based on transaction date) totaling more than $6.9 million. Of the 14,788
transactions,
• 1,879 totaling more than $625,000 were related to OIG. They were comprised of 7 ATM
and 1,872 purchase transaction types. To maintain our independence, we did not review
these transactions.
• 34 totaling more than $27,000 were related to the Federal Housing Administration
(FHA). They were comprised of all purchases. These transactions were not reviewed
since the nature of these transactions is not a typical purchase card purchase and the
count and amount were immaterial when compared to the population.
• 7,813 totaling more than $4.3 million were related to the Office of Public and Indian
Housing’s REAC Inspection Program. They were comprised of all purchases. We
selected a nonstatistical sample from this subpopulation.
• 5,062 totaling just under $2 million were related to all other offices (not OIG (bullet 1),
FHA (bullet 2), or the REAC Inspection Program (bullet 3)). They were comprised of all
purchases. We performed additional analysis and selected nonstatistical samples from
this subpopulation.
Our review of HUD’s travel and purchase card purchase and ATM transaction types included
tests for
• Blocked merchant category codes,
• Potential split purchases (this test was performed on purchase card transactions only),
13
Specifically, the ATM cash advance transaction type totals differed by 28 and $6,105, and the purchase
transaction type totals differed by 446 and more than $175,000. The total ATM and purchase count difference
was less than 1 percent, and the amount difference was only 2 percent of the population.
15
• Purchases made on weekends and Government holidays,
• Allowable but suspicious merchant category code transactions,
• Transactions made outside the United States and Puerto Rico,
• Transactions made without temporary duty travel authorizations or vouchers, and
• Transactions made after an employee left the agency.
To achieve our audit objective, we relied on HUD’s and Citibank’s computer-processed data.
We used the data to select nonstatistical transaction samples to review and perform detailed
testing. Although we did not perform a detailed assessment of the reliability of the data, we
performed a minimal level of testing and found the data to be adequate for our purposes.
We conducted the audit in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain sufficient, appropriate
evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective(s). We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.
16
Internal Controls
Internal control is a process adopted by those charged with governance and management,
designed to provide reasonable assurance about the achievement of the organization’s mission,
goals, and objectives with regard to
• Effectiveness and efficiency of operations,
• Reliability of financial reporting, and
• Compliance with applicable laws and regulations.
Internal controls comprise the plans, policies, methods, and procedures used to meet the
organization’s mission, goals, and objectives. Internal controls include the processes and
procedures for planning, organizing, directing, and controlling program operations as well as the
systems for measuring, reporting, and monitoring program performance.
Relevant Internal Controls
We determined that the following internal controls were relevant to our audit objective:
• Controls over the review of the travel card and purchase card programs, including the
identification of and actions taken for violations of policy.
We assessed the relevant controls identified above.
A deficiency in internal control exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, the
reasonable opportunity to prevent, detect, or correct (1) impairments to effectiveness or
efficiency of operations, (2) misstatements in financial or performance information, or (3)
violations of laws and regulations on a timely basis.
Significant Deficiency
Based on our review, we believe that the following item is a significant deficiency:
• HUD’s monitoring of travel card program violations and GPC policies and procedures was
not sufficient to identify violations.
17
Appendixes
Appendix A
Schedule of Questioned Costs
Recommendation
Unsupported 1/
number
1A $528,147
Total 528,147
1/ Unsupported costs are those costs charged to a HUD-financed or HUD-insured program
or activity when we cannot determine eligibility at the time of the audit. Unsupported
costs require a decision by HUD program officials. This decision, in addition to
obtaining supporting documentation, might involve a legal interpretation or clarification
of departmental policies and procedures.
18
Appendix B
Auditee Comments and OIG’s Evaluation
Ref to OIG Auditee Comments – The Office of the Chief Financial
Evaluation Officer
Comment 1
Comment 2
19
Appendix B
Comment 2
20
Auditee Comments – The Office of Chief Procurement
Officer
Comment 3
Comment 4
Comment 5
21
Appendix B (cont)
Comment 6
Comment 7
Comment 8
Comment 9
Comment 10
Comment 11
22
Appendix B (cont)
Comment 12
Comment 13
Comment 14
Comment 15
23
OIG Evaluation of Auditee Comments From the Office of the Chief Financial Officer
Comment 1 OCFO stated that it has taken steps to strengthen internal control, including
conducting an internal review of the travel card program in April 2015. Since
action taken was near the end of or after our review scope, we did not evaluate
these measures during the course of our audit. We will review these
improvements during the audit resolution process and the next audit cycle.
Comment 2 OCFO stated that it would review the transactions identified in our report and
provide its findings by December 31, 2016, work with ARC, and refer employees
to travel card information on GSA and Treasury Web sites. While we appreciate
OCFO’s willingness to review and report on the identified transactions, we also
recommended that OCFO review all transactions made by the 28 cardholders
identified as having no travel documents associated with the sample transaction
and identify additional transactions made outside official travel (recommendation
1B). We will review all steps taken during the audit resolution process.
24
OIG Evaluation of Auditee Comments From the Office of the Chief Procurement Officer
Comment 3 We agree with the proposed change and have clarified OCPO’s administrative
responsibility in the background section of the report.
Comment 4 We disagree with HUD’s comments that the separation of duties we found were
isolated. Therefore, we revised the report to clarify that the separation of duties
issues we found were not isolated but occurred in both HUD headquarters and
regional offices. For our audit period of October 2014 through May 2015, we
discovered instances where cardholders and designated approving officials signed
HUD10.4 as the authorizing official (authorizing and approving payments for
transactions), creating an overlap in functions. GPC policy does not identify
situations that specifically allow these functions to overlap and the review process
does not specifically look for instances when functions overlap. Regarding
designated approving officials authorizing and approving cardholders’
transactions, the GPC policy is not clear which of the overlapping functions may
be allowable at the regional offices. OMB Circular A-123, appendix B(4.3) states
that the general responsibilities of charge card managers in implementing risk
management controls, policies, and practices include ensuring separation of duties
among key functions such as making purchases, authorizing purchases and
payments, certifying funding, and reviewing and auditing.
HUD’s focus was to monitor blocked MCC usage, perform periodic transaction
reviews, and ad hoc reviews related to declined transaction reports and trends; its
review process did not include reviewing supporting documentation to identify
overlapping functions.
Comment 5 We agree with OCPO’s and OCHCO’s proposal to expand their review of
purchase card transactions to include a review of supporting documentation to
identify overlapping functions and responsibilities and strengthen internal control.
We added this as recommendation 2D. We will review any action taken during
the audit resolution process.
Comment 6 We disagree with HUD’s comment because while HUD’s routine review of
MCCs is a good internal control, it does not address the issue of separation of
duties. We clarified the report language regarding the review of blocked
merchant category codes and HUD’s ad hoc review of exception reports related to
declined transactions and purchase card use trends.
Comment 7 We disagree with HUD’s response regarding missing documentation. Of the 85
transactions in our finding, 18 involved missing supporting documents. GPC
policy required that supporting documents be retained for 3 years, yet HUD was
not able to provide the supporting documents. OMB Circular A-123, appendix B,
states that the general responsibilities of charge card managers in implementing
25
risk management controls, policies, and practices include ensuring that cardholder
statements of account 14 and supporting documentation 15 are reviewed and used to
monitor delinquency, misuse, and other transaction activities. Therefore, the
supporting documents for the transactions made during our review period should
have been available.
Missing documentation was one of the issues we discovered leading us to the
significant deficiency. Other issues we discovered were separation of duties, split
purchases, and purchases requiring special attention or that should be made by
means other than purchase cards.
Comments 8 Based on HUD’s comments, we clarified the language in the report regarding split
purchases comprised of eight transactions that were made from the same vendor
on the same day (see footnote 9). On three occasions, the cardholder split a
transactions into two or more transactions. Each of the three purchases was made
on the same date and from the same vendor. Additionally, in light of newly
provided supporting documentation, we clarified the nature of how the cardholder
separated from HUD from terminated to retired.
We disagree with HUD’s response that we should not have cited the split
transactions as a weakness in the program since HUD found them during its
transaction review. We acknowledged that HUD identified the split transactions
during its transaction review and referred the cardholder’s transactions to OIG’s
Office of Investigation for further review.
Comments 9 We agree with HUD’s response and clarified that the effective date was October
1, 2015 in footnote 10.
Comments 10 We disagree with HUD’s response. We discussed the findings with HUD
officials during a meeting on May 12, 2016. HUD officials, however, did not
provide additional support to show that HUD had identified the same monthly
radio service maintenance transactions that we found. We also disagree that the
HUD officials informed us of the issuance of an August 2015 purchase order
during the May 12, 2016, meeting. We will review any available documentation
during the audit resolution process.
Further, we did not include this finding in the separation of duties section because
in this instance the cardholder exceeded the procurement limit. The purchase
should have been made by some other means than a purchase card.
14
OIG interpreted “cardholder statement account” to mean Citibank statements, which list charges made by the
purchase cardholder.
15
Supporting documentation not provided included copies of form HUD-10.4 signed by the authorizing official
and copies of Citibank statements.
26
Comments 11 We removed the language from the finding and the recommendation related to
consequences for designated approving officials who fail to adequately perform
their management and oversight responsibilities. The designated Approving
Official’s roles and responsibilities have been added to the separation of duties
section of the finding.
Comments 12 We disagree. The significant deficiency refers not only to the unauthorized act of
one cardholder, but also to the overall condition of HUD’s internal controls in its
management of the government purchase card programs. Our finding included
separation of duties, split purchases, missing or not provided documentation, and
purchases requiring special attention or that should be made by means other than
purchase cards.
Comments 13 We clarified the separation between the purchase card and travel card programs in
the background section of the report.
Comments 14 HUD concurred with recommendations 2A-2C. We will review the action taken
during the audit resolution process.
Comment 15 According to the HUD’s comment 2, OCHCO will begin to review supporting
documentation to identify overlapping functions and responsibilities. Our
recommendation 2D is in line with this statement and any actions taken in this
regard will be evaluated during the audit resolution process.
27
HUD Needs To Improve Its Monitoring of the Travel and Purchase Card Programs
Published by the Department of Housing and Urban Development, Office of Inspector General on 2016-09-29.
Below is a raw (and likely hideous) rendition of the original report. (PDF)