U.S. DEPARTMENT OF HOUSING AND URBAN DEVELOPMENT OFFICE OF INSPECTOR GENERAL February 5, 2018 MEMORANDUM NO: 2018-KC-0801 Memorandum TO: Pamela H Patenaude, Deputy Secretary, S Keith W. Surber, Chief Procurement Officer, N Towanda A. Brooks, Chief Human Capital Officer, A Irving Dennis, Chief Financial Officer, F George Tomchick, Deputy Chief Financial Officer, F //signed// FROM: Ronald J. Hosking, Regional Inspector General for Audit, 7AGA SUBJECT: Risk Assessment of Fiscal Year 2016 HUD Charge Card Programs INTRODUCTION The U.S. Department of Housing and Urban Development, Office of Inspector General (HUD OIG), has completed its annual risk assessment of HUD’s charge cards as required by the Government Charge Card Abuse Prevention Act of 2012, Public Law 112-194, and Office of Management and Budget (OMB) Memorandum M-13-21. Our objective was to analyze the risks of illegal, improper, or erroneous purchases in HUD’s fiscal year 2016 travel and purchase card programs. We found that a moderate risk remained in HUD’s travel card program and a low risk was associated with HUD’s purchase card program. This memorandum does not contain recommendations. We will use the risk assessment to determine the scope, frequency, and number of periodic audits or reviews of charge card programs. METHODOLOGY AND SCOPE Our audit period generally covered October 1, 2015, through September 30, 2016. We performed our audit work from October through December 2017. We conducted onsite work at HUD headquarters in Washington, DC. To accomplish our objective, we reviewed prior OIG audit reports, reviewed the status of charge card audit recommendations, reviewed applicable laws and regulations, reviewed HUD’s policies and procedures, interviewed HUD officials, and reviewed fiscal year 2016 HUD travel and purchase card transactional data. Our assessment is based on our analysis of HUD’s fiscal year 2016 travel and purchase card transactions, the results of our fiscal year 2016 audit of HUD travel and purchase card programs, the status of currently open charge card recommendations, and our review of HUD’s most recent semiannual reports to OMB on charge card violations. We used GAO government auditing standards, issued January 2012, section 6.15a-g as guidance to help us determine the risk levels used in this memorandum. To achieve our objective, we relied in part on data obtained from Citibank’s Client Reporting System and CONCUR, HUD’s travel system. To test the data reliability, we compared the names and transaction amounts in the Citibank and travel system data with HUD records for a small sample and found the data to be adequate for our purposes. We directly accessed Citibank’s Client Reporting System to obtain all travel and purchase card transactions for fiscal year 2016. This action resulted in 95,578 travel card purchases totaling more than $13 million and 19,621 purchase card purchases totaling more than $8.7 million. We used data analysis tools (ACL and structured query language) to identify 3,160 travel card transactions with indications that they occurred without an authorization and 1,961 purchase card transactions with indications that they were potentially improper. We further analyzed these transactions in our audit of HUD’s fiscal year 2016 travel and purchase card programs and reported the results of our review on September 26, 2017 (HUD OIG audit report 2017-KC- 0009). We obtained and reviewed the current status of open charge card recommendations as of October 27, 2017. We also reviewed the results of our fiscal year 2015 charge card risk assessment to identify changes in travel and purchase card use. Finally, we interviewed HUD officials to determine whether there were any policy changes throughout the year. BACKGROUND On October 5, 2012, President Obama signed the Charge Card Abuse Prevention Act of 2012, Public Law 112-194. The Charge Card Act was designed to prevent recurring fraud, waste, and abuse in governmentwide charge card programs. This law required all executive branch agencies to establish and maintain safeguards and internal controls for their use of purchase cards, travel cards, and centrally billed accounts. Further, it required offices of inspector general to (1) conduct periodic risk assessments of the agency charge card programs; (2) identify and analyze the risk of illegal, improper, or mistaken purchases and payments; and (3) perform analyses or audits as necessary. The General Services Administration (GSA) administered the government charge card program, also known as the SmartPay program. This program provided purchase and travel cards to agencies or departments throughout the U.S. Government. GSA designed purchase cards to streamline small purchases, facilitate payment processes, minimize paperwork, and simplify the administrative effort associated with procuring goods and services. GSA designed travel cards to facilitate official government travel, including airfare, rail, or bus tickets; lodging; meals; rental cars; and other miscellaneous expenses. HUD used Citibank as its purchase and travel card provider. HUD contracted with the Accounting Resource Center (ARC) within the Bureau of the Fiscal Service, U.S. Department of the Treasury, to provide supportive services to the HUD travel and purchase card programs. ARC assisted with the opening and closing of Citibank card accounts, placing and removing purchasing blocks for HUD-restricted merchant category codes, generating regular monitoring reports, and assisting HUD with required OMB reporting. Citibank used merchant category codes to identify transactions by merchant or by type of good or service purchased. The Office of the Chief Financial Officer (OCFO) administered the HUD travel card program. This responsibility included managing the day-to-day operations, monitoring card use, and reporting to OMB on the status of the travel card program. OCFO established travel card policies and used the Federal Travel Regulations at 41 CFR (Code of Federal Regulations) Parts 300 through 304 to administer the program. The Office of the Chief Procurement Officer (OCPO) administered the HUD purchase card program with the assistance of the Office of Chief Human Capital Officer (OCHCO). OCPO established purchase card policies and used the Federal Acquisition Regulations at 48 CFR Part 24 to administer the program. OCHCO managed the day-to-day operations, including monitoring purchase card use. RESULTS OF REVIEW Moderate Risks Remained in HUD’s Travel Card Program HUD’s travel card program had a moderate risk of susceptibility to illegal, improper, or erroneous purchases. Risk-increasing factors included a continuation of identified potentially unauthorized travel transactions from the prior year’s OIG audit, unclear program guidance, and an increase in travel card use from fiscal year 2015. Risk-decreasing factors included HUD’s timeliness in closing open travel card recommendations. In our fiscal year 2016 audit of HUD’s travel card program, we found that some HUD employees used travel cards for potentially improper charges. Of the more than 95,000 travel card transactions, 3,160 transactions totaling more than $550,000 contained indications that the employee incurred the charge without a travel authorization. We tested a sample of 35 cardholders from the 3,160 and found that 18 of them used their travel cards without an authorization. HUD used multiple sources of guidance to establish its travel policy, but these sources were either outdated or unclear as to which was the primary source, or they did not clarify that all travel card use must be authorized. HUD’s travel card use increased from fiscal years 2014 to 2016. The chart below shows an increase from more than $11 million in 2014 to more than $13 million in 2016. Annual travel card purchases $13,500,000 $12,960,783 $13,013,045 $13,000,000 $12,500,000 $12,000,000 $11,500,000 $11,000,000 $11,076,078 $10,500,000 $10,000,000 2014 2015 2016 HUD closed all open travel card recommendations from our fiscal year 2015 audit (HUD OIG audit report 2016-FO-0006). Low Risks in HUD’s Purchase Card Program HUD’s purchase card program had a low risk of susceptibility to illegal, improper, or erroneous purchases. Risk-increasing factors included noted difficulties with ARC’s ability to properly block certain restricted merchant category codes. Risk-decreasing factors included fewer identified transactions with control issues from the prior year’s OIG audit, HUD’s timeliness in closing open purchase card recommendations, and a decrease in purchase card use from fiscal year 2015. During our fiscal year 2016 audit, we found that ARC did not provide HUD assurance that agency-requested blocks were put into place. Restricted merchant category codes were unblocked when they should have been blocked from purchase card use. We found four purchase card transactions with indications of control issues in fiscal year 2016. This number is down from 85 identified transactions in fiscal year 2015. Also, HUD had closed all open purchase card recommendations from our fiscal year 2015 audit, and total purchase card activity had decreased in recent years. The chart below shows a decrease from more than $9 million in 2014 to more than $8 million in 2016. Annual purchase card use $12,000,000 $10,913,509 $10,000,000 $8,737,208 $9,714,938 $8,000,000 $6,000,000 $4,000,000 $2,000,000 $0 2014 2015 2016 CONCLUSION The Charge Card Act requires annual risk assessments of travel and purchase card programs in order to determine the scope, frequency, and number of periodic audits or reviews of these programs. We found a moderate risk remained in HUD’s travel card program and a low risk was associated with HUD’s purchase card program. As a result, we plan to audit the travel card program for fiscal year 2017. This memorandum does not contain recommendations. Appendix A Auditee Comments and OIG’s Evaluation HUD chose not to provide written comments.
Risk Assessment of Fiscal Year 2016 HUD Charge Card Programs
Published by the Department of Housing and Urban Development, Office of Inspector General on 2018-02-05.
Below is a raw (and likely hideous) rendition of the original report. (PDF)