oversight

Audit of the U.S. Office of Personnel Management Travel Card Program

Published by the Office of Personnel Management, Office of Inspector General on 2018-01-16.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

U.S. OFFICE OF PERSONNEL MANAGEMENT
   OFFICE OF THE INSPECTOR GENERAL
            OFFICE OF AUDITS




    Final Audit Report
  AUDIT OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT'S
                 TRAVEL CARD PROGRAM

             Report Number 4A-CF-00-15-049
                     January 16, 2018
            EXECUTIVE SUMMARY
            Audit of the U.S. Office of Personnel Management’s Travel Card Program

 Report No. 4A-CF-00-15-049                                                                         January 16, 2018


Why Did We Conduct the Audit?              What Did We Find?

The objective of our audit was to           We determined that the Office of the Chief Financial Officer needs
determine whether the U.S. Office of        to strengthen their controls over its travel card program. Our audit
Personnel Management’s (OPM)                identified eight areas requiring improvement, as follows:
internal controls for travel cards were
effectively developed and implemented         1.	 Travel Operations lacks clear, concise, and accurate policies
to prevent and detect travel card fraud,          and procedures, governing their Travel Charge Card Program.
misuse, and abuse by program                  2.	 Out of 75 travel card program participants sampled, we
participants.                                     determined that 93 percent of the participants had not
                                                  completed the required training.
What Did We Audit?                            3.	 Out of the 324 travel card transactions selected for testing, we
                                                  found that 33 transactions, totaling $8,158, were missing
The Office of the Inspector General has           travel authorizations and 28 transactions, totaling $27,627,
completed a performance audit of                  were missing required receipts.
OPM’s travel card program. Our audit          4.	 We determined that 21 restricted cardholders made 68 cash
fieldwork was conducted from                      advance transactions that exceeded their seven-day limit,
December 17, 2015, through                        totaling $17,493. Three of the 21 restricted cardholders also
September 27, 2016, at OPM                        exceeded their billing cycle limits, totaling $3,509.
headquarters, located in Washington D.C.      5.	 Travel Operations did not provide support that cardholder
                                                  accounts with delinquencies of 61 days or more were
                                                  suspended or cancelled.
                                              6.	 Travel Operations did not immediately cancel 176 travel card
                                                  accounts of employees that separated from OPM.
                                              7.	 We were unable to determine if inactive cardholder’s
                                                  accounts had been deactivated because documentation was
                                                  not provided to show that periodic reviews of cardholder
                                                  activity had been completed.
                                              8.	 Travel Operations does not have controls in place to ensure
                                                  that the travel card data reported in the Annual Financial
                                                  Report is accurate.



_______________________
Michael R. Esser
Assistant Inspector General for Audits

                                                      i
                  ABBREVIATIONS


AFR          Annual Financial Report
ATM          Automatic Teller Machine
CBIS         Consolidated Business Information System
CFO          Chief Financial Officer
E2           Carlson Wagonlit’s E2 Solutions Travel System
FTR          Federal Travel Regulation
FY           Fiscal Year
GAO          U.S. Government Accountability Office
GSA          U.S. General Services Administration
HR           Human Resources
IBA          Individually Billed Account
MCC          Merchant Category Code
OCFO         Office of the Chief Financial Officer
OIG          Office of the Inspector General
OMB          U.S. Office of Management and Budget
OPM          U.S. Office of Personnel Management
The Charge   The Government Charge Card Abuse Prevention Act of 2012
Card Act
TOC          Travel Organizational Contact
TTRA         The Travel and Transportation Reform Act




                               ii
                          TABLE OF CONTENTS


                                                                                                                              Page

       EXECUTIVE SUMMARY ......................................................................................... i

       ABBREVIATIONS ..................................................................................................... ii 


I.     BACKGROUND ..........................................................................................................1 


II.    OBJECTIVE, SCOPE, AND METHODOLOGY ....................................................7

III.   AUDIT FINDINGS AND RECOMMENDATIONS...............................................10


       1. Policies and Procedures ........................................................................................10

       2. Training..................................................................................................................13

       3. Controls over Travel Card Transactions ................................................................16

       4. Excessive Cash Advances ......................................................................................19

       5. Delinquent Cardholder Accounts...........................................................................20

       6. Cancellation of Travel Cards .................................................................................23

       7. Periodic Reviews of Cardholder Activity ..............................................................24

       8. Agency Financial Report .......................................................................................26

       APPENDIX	 The Chief Financial Officer’s response to the draft report,
                 dated August 17, 2017.

       REPORT FRAUD, WASTE, AND MISMANAGEMENT
                                 I. BACKGROUND

This final audit report details the findings, conclusions, and recommendations resulting from our
performance audit of the U.S. Office of Personnel Management’s (OPM) travel card program.
The audit was performed by OPM’s Office of the Inspector General, as authorized by the
Inspector General Act of 1978, as amended.

The Travel and Transportation Reform Act (TTRA) of 1998 (Public Law 105-264) requires
government employees to use the Government travel card for travel expenses when on official
business. The purpose of the TTRA is to reduce the overall administrative costs of travel for the
Federal government and take advantage of rebates offered by card-issuing banks under the U.S.
General Services Administration (GSA) SmartPay 2 program1. OPM selected JPMorgan Chase
as its card-issuing bank.

In accordance with the TTRA, GSA issued the Federal Travel Regulation (FTR), which sets
forth policies and procedures governing the use of Government travel cards and restricts usage to
official travel expenses only.

PROGRAM PARTICIPANTS

OPM’s travel card program is administered by the Office of the Chief Financial Officer’s
(OCFO) Travel Operations, under the oversight of the Deputy Chief Financial Officer (CFO).
OCFO is responsible for issuing internal travel policy guidance and processing procedures.
Travel Operations serves as the intermediary between the cardholder, JPMorgan Chase, and
OPM. Travel Operations is also responsible for administering and managing the travel card
program and providing oversight and administration assistance for the travel card program
throughout OPM at the agency level, as follows:

Deputy CFO: Oversees and reviews reports sent to OPM program offices from Travel
Operations.

Acting Chief: Oversees OPM’s travel operations and travel card management program.




1
 GSA SmartPay 2 is the name of the Federal government’s purchase, travel, and fleet charge card program. Each
Federal agency issued a task order to one of the three card-issuing banks (Citibank, JPMorgan Chase, and U.S.
Bank) contracted with the Federal government to provide purchase, travel, and fleet card services.

                                                   1                         Report No. 4A-CF-00-15-049
Agency Program Coordinator: Provides day-to-day activities relating to travel cards,
including processing travel card applications, answering questions, and submitting monthly
reports to OPM programs.

Travel Compliance Officer: Handles the compliance and internal control reviews for travel
transactions, reimbursement and payments.

Agency Charge Card Program Manager: Provides charge card policy and serves as the
liaison between OPM and GSA’s Office of Charge Card Management.

Travel Operations Coordinator: Oversees Carlson Wagonlit’s E2 Solutions Travel System
(E2)2.

Numerous OPM program offices and individuals are also involved in the travel card program at
the program level, including:

Organizational Program Coordinator: An individual within an OPM program office
responsible for the overall management and oversight of the accounts under their span of control.

Approving Official: The approving official is the individual, typically a supervisor responsible
for approving the cardholder’s travel authorization and signing the cardholder’s voucher,
indicating approval for payment and for its content.

Travel Cardholder: The individual who is issued and authorized to receive a charge card.
OPM’s travel card program has the following travel cardholder accounts:

            Individually billed accounts: A charge card account established by JPMorgan at the
             request of the agency program coordinator for the individual traveler to pay for
             official travel and travel related expense. OPM reimburses employees for authorized
             expenses related to official Government travel. The employee is responsible for
             making payment to JPMorgan Chase.

            Centrally billed accounts: A centrally billed account is established to pay for official
             travel expenses and is paid by the program office to which the account is assigned.
             Centrally billed accounts are paid daily and directly by OPM programs to JPMorgan
             Chase.

2
  E2 is a comprehensive electronic travel service employees use to plan, book, track, approve, and request
reimbursement for official Government travel. OPM makes E2 available to agency employees and requires them to
use the system to initiate authorizations prior to embarking on travel and to request reimbursement for expenses
upon their return.
                                                    2                         Report No. 4A-CF-00-15-049
See Figure #1– GSA User Guide for the Travel Card for some of the cardholder responsibilities.

                                   GSA User Guide for the Travel Card

Figure 1. DOs and DON’Ts for travel card use provided by the U.S. General Services
Administration users guide for the travel cardholder.
                             DOs                                                        DON’Ts
 DO use your government travel charge card to pay for           DON’T use your travel charge card for personal use.
 official travel expenses.
                                                                DON’T obtain travel advances through the ATM which
 DO obtain travel advances for official travel through an       exceed your expected out of pocket expenditures for a
 ATM, if authorized by your agency.                             trip.
 DO track your expenses and keep receipts while on travel so    DON’T obtain travel advances through the ATM
 you have accurate information for filing your travel claim.    unless you are on travel or will be on travel shortly.
 DO file your travel claim within five days after you           DON’T allow your monthly bill to become overdue
 complete your trip or every 30 days if you are on continuous   because this could result in suspension or cancellation
 travel.                                                        of your card.
 DO submit payment in full for each monthly bill.               DON’T wait for receipt of your monthly billing
 DO follow your bank’s dispute process for charges that are     statement to file your travel claim.
 incorrect.                                                     DON’T forget that the card is issued in your name and
 DO contact your bank’s customer service number if              liability for payment is your responsibility.
 you have questions about your monthly bill.                    DON’T write your personal identification number
 DO be aware that misuse of the travel charge card              (PIN) on your card or carry your PIN in your wallet.
 could result in disciplinary actions by your agency.           DON’T use card to cover the expenses of other
 DO be aware that failure to pay your bill in a timely manner   government employees (except when sharing
 can result in suspension or cancellation of your card.         transportation, such as taxi).
 DO return your travel charge card to your
 Agency/Organization Program Coordinator (A/OPC) to be
 destroyed if you leave your agency or retire.
 DO immediately report your lost or stolen card to your
 A/OPC and the card-issuing bank.
 DO destroy any lost or stolen cards that are recovered.
 DO be aware of identity theft schemes attempting to gain
 access to financial information.
 DO check with your a/OPC and/or agency policy before
 using your travel card to cover local travel expenses.


POLICIES AND PROCEDURES

Travel Operations is regulated by the Government Charge Card Abuse Prevention Act of 2012
(the Charge Card Act) and the U.S. Office of Management and Budget (OMB) A-123, Appendix

                                                        3                       Report No. 4A-CF-00-15-049
B (OMB A-123). The Charge Card Act requires all Federal agencies to establish and maintain
safeguards and internal controls, while OMB A-123 sets the policies and procedures used to
maintain internal controls that reduce the risk of fraud, waste, and error in the Government
charge card programs. OMB A-123 also establishes statistical reporting requirements and
suggested best practices for card use.

To provide FTR guidance for OPM employees’ conduct while on travel, adherence to the
requirements of the Charge Card Act, and assist OPM employees with the aspects of the charge
card program3, the following documents have been issued:

OPM’s Financial Management Manual, Chapter 17, provides travel policy guidance to be
followed by OPM employees who travel on official government business. The guidance
contained in chapter 17 implements or references the FTR and provides specific procedures to
OPM. Specifically, it discusses:

       OCFO and program office responsibilities pertaining to travel;

       Travel authorizations4 and travel vouchers5;

       Government travel cards;

       Rental vehicles;

       Travel advances;

       Transportation expenses and per diem allowances;

       Foreign and local travel; and

       Relocation expense allowances.




3
  The charge card program includes Federal government purchase, travel and fleet charge cards. For the purposes of

this audit, we focused on the travel card section of the program.

4
  A travel authorization is written permission allowing an individual or group of individuals to take one or more 

specific official business trips, which must include specific purpose, itinerary, and estimated costs. 

5
  A travel voucher is a written request, supported by documentation and receipts, for reimbursement of expenses 

incurred in the performance of official travel. 

                                                     4                          Report No. 4A-CF-00-15-049
OPM’s Charge Card Management Plan6 outlines the policies and procedures for the
management of the GSA SmartPay 2 program and specifically addresses personnel management;
training; and risk management. The transaction data related to OPM’s travel card program is
maintained in OPM’s Consolidated Business Information System (CBIS)7, which is used to
reconcile transactions from centrally billed accounts, E2, and PaymentNet. Travel Operations
relies on the information produced by these collective systems to perform oversight of the travel
card program activities.

AUDITS AND REVIEWS

Public Law 112-194 requires charge card managers to perform periodic reviews to determine
whether each travel charge cardholder has a need for the travel charge card. Currently, Travel
Operations performs the following reviews:

Compliance Review: Individually billed accounts are reviewed monthly at the end of the
reporting cycle8. All account activities available from PaymentNet, are compared to travel
authorizations available in E2, to look for card activity not consistent with travel authorizations.
In addition, Travel Operations looks at the merchant category code (MCCs), date, amount, and
city and state of the transaction. Incidents of potential misuse are reported to the appropriate
managers of the cardholder, Organizational Program Coordinators and OPM’s Human
Resources’ (HR) office for follow-up and appropriate disciplinary action. Appropriate
disciplinary actions could be, but are not limited to, reprimand, suspension, or cancellation of the
employee’s travel card. OPM’s HR office makes decisions about appropriate employee
disciplinary actions; however, once these decisions are made, Travel Operations is not updated
on the status of the disciplinary action taken.

Voucher Review: As required by the FTR, employees must submit a voucher within five
working days of returning from official travel. Once the travel cardholder has submitted the
appropriate documentation in E2, their Approving Official certifies that this information is
correct. On a monthly basis, Travel Operations performs a review of this process by selecting a
certain number of vouchers. The number of vouchers selected depends on the number of
vouchers submitted for that reporting period. If Travel Operations considers there to be a “high”
amount of vouchers, they select only the vouchers                           for review. However,

6
  The Charge Card Management Plan is required by OMB Circular A-123 Appendix B. Each agency must develop

and maintain written policies and procedures for the appropriate use of charge cards consistent with the 

requirements of the guidance. Agencies must submit a copy of their plan to the OMB MAX website on an annual

basis, and no later than January 31 of each calendar year. 

7
  CBIS is OPM’s financial management system that aids in OPM’s management of the agency’s financial resources. 

CBIS provides functionality for OPM’s general ledger, accounts payable, accounts receivable, and other financial 

resources management. 

8
  The reporting cycle ends on the 28th of each month. 

                                                    5                         Report No. 4A-CF-00-15-049
if they consider there to be a “low” amount of vouchers, they select the entire population for
review.9 During this voucher review, Travel Operations reviews travel authorizations, mode of
travel, reservations, type of airfare, actual expenses, and submitted documentation.

Automatic Teller Machine and Delinquency Report Review: Travel Operations and the
Deputy Chief Financial Officer both review and distribute monthly, to OPM program offices, an
automatic teller machine (ATM) Report that shows every cardholder who received an ATM cash
advance, and a Delinquency Report that shows accounts with past due balances. Travel
Operations does not require program offices to respond confirming the receipt and/or review of
the ATM Report that has been distributed to them.
Cardholder Status Review: Quarterly, Travel Operations uses the Cardholder Status Report
from PaymentNet to review the employees’ accounts to identify employees who have not used
their travel cards for one year or more.

PREVIOUS OFFICE OF THE INSPECTOR GENERAL REPORTS

In fiscal year (FY) 2001 and 2002, the Office of the Inspector General (OIG) conducted two
audits related to travel cards: the Audit of Internal Controls over OPM’s Travel Card Program
and the Audit of OPM’s Travel Card Transactions10. The final reports were issued in 2001 and
2002, respectively, and all recommendations from both audits have been closed.




9
  Travel operations was unable to define what is considered a “high” and “low” amount of vouchers that are selected

for their voucher review process.

10
   OPM-Office of the Inspector General Audit Report Number 4A-CF-00-01-102 and 4A-CF-00-01-103, 

respectively. 

                                                     6                          Report No. 4A-CF-00-15-049
II. OBJECTIVE, SCOPE, AND METHODOLOGY

OBJECTIVE

The objective of our audit was to determine whether OPM’s internal controls for travel cards
were effectively developed and implemented to prevent and detect travel card fraud, misuse, and
abuse by program participants.

The recommendations included in this final report address the objective.

SCOPE AND METHODOLOGY

We conducted this performance audit in accordance with generally accepted government
auditing standards as established by the Comptroller General of the United States. These
standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our audit objective.

The scope of our audit covered the travel card program’s policies and procedures and
individually billed account transactions from October 1, 2014, to September 30, 2015. We
performed our audit fieldwork from December 17, 2015, through September 27, 2016, at OPM
headquarters, located in Washington, D.C.

To accomplish our audit objective noted above, we:

     	 Interviewed Travel Operations personnel;

     	 Reviewed training records to ensure that training requirements were met for the sampled
        agency program coordinator, organization program coordinators, approving officials, and
        Individually Billed Account (IBA) travel card holders;

     	 Analyzed travel card accounts of separated employees;

     	 Sampled and tested travel card transactions to determine if the transactions were properly
        authorized, adequately documented, monitored and for legitimate business purposes;

     	 Analyzed MCCs11 to determine if blocked MCCs were processed;

11
  Merchant category codes are established by the card issuing bank and are assigned to vendors as a means to
identify the merchant type. Each cardholder account is set up with default merchant category codes that will allow

                                                     7	                         Report No. 4A-CF-00-15-049
         	 Analyzed ATM cash advances to test for individuals who exceeded the established
            withdrawal limits; and

         	 Performed an analysis on the necessity of travel cards.

In planning our work and gaining an understanding of the internal controls over OPM’s travel
card program, we considered, but did not rely on, Travel Operations’ internal control structure to
the extent necessary to develop our audit procedures. These procedures were analytical and
substantive in nature. We gained an understanding of management procedures and controls to
the extent necessary to achieve our audit objective. The purpose of our audit was not to provide
an opinion on internal controls but merely to evaluate controls over OPM’s travel card program.

Our audit included such tests and analysis of Travel Operation’s records; documented policies
and procedures; transactional data; and other applicable information, as we considered necessary
under the circumstances. The results of our tests indicate that with respect to the items tested,
Travel Operations needs to strengthen controls over its’ processes.

In conducting the audit, we relied to varying degrees on computer-generated data. Due to the
nature of the audit, we did not verify the reliability of the data generated by the systems
involved. However, while utilizing the computer-generated data during our audit, nothing came
to our attention to cause us to doubt its reliability. We believe that the data was sufficient to
achieve our audit objectives. We did not evaluate the effectiveness of the general application
controls over computer-processed performance data.

Stratified random sampling was used to select samples for testing, utilizing Microsoft Excel, in
order to accomplish our audit objective. Our sampling methodology consisted of selecting:

    	 1,626 ATM cash advances, out of 8,674 IBA transactions, by filtering the data to test for
       individuals who exceeded the established ATM withdrawal limits of $300 every seven
       days/$1,200 per billing cycle for unrestricted travel card holders and $200 every seven
       days/$600 per billing cycle for restricted travel card holders;

    	 25 random IBA travel cardholders, out of 1,863, to ensure their transactions were
       properly authorized, adequately documented, monitored and for legitimate business
       purposes; and


the processing of transactions that fall under the specified merchant category code. If a transaction is attempted with
any merchant that is categorized by a merchant category code blocked by the OCFO, the transaction will be
electronically denied at the point of attempted purchase.
                                                       8	                         Report No. 4A-CF-00-15-049
    	 Training records for 25 random IBA travel cardholders, out of 1,863, all 26 approving
       officials, the agency program coordinator, and all 23 organization program coordinators.

The samples selected during our review were not statistically based. Consequently, the results
from our samples were not projected to the populations.

.




                                            9	                     Report No. 4A-CF-00-15-049
III. AUDIT FINDINGS AND RECOMMENDATIONS

 The sections below detail the results of our audit on OPM’s travel card program.

 1. Policies and Procedures

    Travel Operations lacks clear, concise, and accurate policies and procedures governing their
    Travel Charge Card Program. Specifically, we found:

           Travel Operations did not corroborate with OPM's Employee Services to formulate
            written penalties to deter misuse of the Government charge cards.

           Travel Operations does not have concise, written procedures for their Compliance and
            Voucher Review processes.

           OPM’s annually mandated Charge Card Management Plan on THEO, OPM’s intranet,
            is over 10 years old; the last plan published on OPM’s intranet is dated May 5, 2006.

           The guidance regarding ATM Limits in OPM’s Charge Card Management Plan
            contradicts with chapter 17 of OPM’s Financial Management Manual. In addition, the
            Agency Program Coordinator and Organizational Program Coordinator’s roles and
            responsibilities overlap.

    Public Law 112-194, requires that, "Each executive agency has specific policies regarding
    travel charge cards issued for various component organizations and categories of component
    organizations, the credit limits authorized for various categories of card holders, and categories
    of employees eligible to be issued travel charge cards, and designs those policies to minimize
    the financial risk to the Federal Government of the issuance of the travel charge cards and to
    ensure the integrity of travel charge card holders."

    OMB Circular A-123, Appendix B requires that "each agency must develop and maintain
    written policies and procedures for the appropriate use of charge cards consistent with the
    requirements of this Guidance. The plan should be updated annually, or more frequently, if
    necessary to remain current. Agencies shall submit a copy of their plan to OMB, Office of
    Federal Financial Management, on an annual basis, not later than January 31st of each calendar
    year."




                                              10                        Report No. 4A-CF-00-15-049
OMB Memorandum 13-21 states, "Additional requirements of the Charge Card Act include
augmentation of existing internal controls. At a minimum, all agency Charge Card
Management Plans shall be reviewed and updated, as necessary, to ... deter employee misuse of
Government cards, by implementing penalties for charge card violations that are jointly
developed by agency charge card management and human resources components. ... Because
Government charge card program oversight involves multiple agency functions, successful
implementation of the Charge Card Act will require collaboration across agency charge card
and human capital components, and Inspectors General (IGs)."

OPM’s Charge Card Management Plan outlines the policies and procedures within OPM
critical to the management of the Travel, Purchase, and Fleet Charge Card Programs. This
guidance is intended to ensure systems of internal controls are followed and help mitigate the
potential for fraud, misuse, and delinquency.

OPM’s Financial Management Manual, chapter 17, references the
FTR and provides guidance on certain procedures specific to
                                                                            Policies and
OPM, such as the on-line travel authorization and travel voucher
                                                                         procedures are not
system not covered by the FTR. The travel activities discussed in
                                                                         clear, concise and
this chapter include preparation and approval of travel
                                                                             accurate.
authorizations, preparation and submission of travel vouchers, and
the payment process.

By Travel Operations not issuing a current, clear, and accurate set of policies and procedures
for OPM employees to follow, the potential for fraud, waste, and abuse of the travel card
program is increased. Furthermore, lack of consistency creates confusion among users and
decreases the accountability between employees and their program managers.

Recommendation 1

We recommend that Travel Operations ensure that all travel card policies and procedures,
governing OPM's travel card program, are accurate and consistent with one another and contain
all areas/requirements outlined by laws and regulations pertaining to OPM's government travel
card program.

OCFO’s Response

The OCFO concurs with the recommendation and they are “in the process of enhancing its
travel program policies and procedures to mitigate the identified risks and promote greater
accountability in the use of OPM funding resources.”

                                         11                       Report No. 4A-CF-00-15-049
Recommendation 2

We recommend that Travel Operations ensure that roles and responsibilities are clearly
articulated to avoid ambiguity of delegated duties.

OCFO’s Response

The OCFO concurs with the recommendation. “[CFO Management] will be updating the
Travel Policy and Government Travel Charge Card Plan to clarify roles and responsibilities
for all components of OPM's travel card program to include annual training and reminders
on travel card policies and procedures.”

Recommendation 3

We recommend that Travel Operations collaborate with OPM's Employee Services to
formulate written penalties to deter misuse of OPM's travel charge cards.

OCFO’s Response

“CFO Management generally agrees with OIG’s recommendation. However, we request that
Employee Services (ES) be designated the lead with CFO serving in an analytical and
consultative role to formulate written penalties and disciplinary procedures. We believe this
more accurately reflects our respective roles in defining and implementing any disciplinary
actions related to card misuse.”

OIG Comment

Since the OCFO oversees the travel card program, and should ensure successful
implementation of the program, we believe that OCFO should take the lead and collaborate
with OPM's Employee Services. Our recommendation is supported by Memorandum 13-21,
which specifies a joint effort to develop written penalties by the agencies’ charge card
managers and human resources components.

Recommendation 4

We recommend that Travel Operations immediately replace the Charge Card Management
Plan, dated May 5, 2006, located on THEO, with the version dated January 2017. Travel
Operations should also ensure that THEO is immediately updated when a new version of the
Charge Card Management Plan is released or updated.


                                        12                       Report No. 4A-CF-00-15-049
   OCFO’s Response

   The OCFO concurs with the recommendation. The OCFO plans to issue an updated Travel
   Policy and Government Travel Charge Card Plan and will post them on THEO.

2. Training

   We judgmentally selected travel cardholders and managers
                                                                                             Cardholders and
   (approving officials, agency program coordinator, and organization                      managers did not take
   program coordinators) to determine if initial and refresher training                    the required training.
   requirements were met. Details of our review were provided to 

   Travel Operations separate from this report; however, we found 

   cardholders and managers had not taken the required training, as 

   summarized below: 


                                                                                  Number of Employees    Number of Employees
                                                            Number of Employees      Missing Initial      Missing Refresher
                Employee Role:        Total Universe
                                                                Sampled:           Cardholder Training    Cardholder Training
                                                                                      Certification:         Certification:

   Cardholder                             1863                      25                    20                      2


   Approving Officials                     26                       26                    26                     26


   Agency Program Coordinator               1                        1                     1                      1


   Organization Program Coordinator        23                       23                    23                     23



   Travel Operations stated that the authority to manage and control travel cards is specifically
   delegated to individual OPM program approving officials and program coordinators who are
   responsible for the review, authorization, and approval of travel cards under their jurisdiction,
   as well as ensuring that their employees have undertaken training. We were not provided any
   documentation, such as an appointment or delegation letter, that formally appoints approving
   officials and program coordinators with the responsibilities as outlined by Travel Operations.
   Such documentation should outline the approving officials and program coordinators
   responsibilities and duties as it relates to managing travel cards for their respective program
   office.

   OMB’s Circular A-123, Appendix B, requires all program participants, including cardholders
   and charge card managers (agency organizational program coordinator, approving officials, and
   other accountable/billing officials), to be trained in charge card management. The Circular
   states that “The general training requirements for all charge card programs are:

                                                       13                            Report No. 4A-CF-00-15-049
   	 All program participants must be trained prior to appointment;

   	 All program participants must take refresher training, at a minimum, every 3 years;
      [and]

   	 All program participants must certify that they have received the training, understand
      the regulations and procedures, and know the consequences of inappropriate actions.”

OMB’s Circular A-123 Appendix B, Section 3.5.2, requires travel charge card program training
as follows:

   	 “Cardholder[:] Training for travel charge cardholders … must provide general
      information on traveling for the government and review how to use a travel charge card,
      including agency travel charge card policy and procedures, and proper card use. …
      Even if the approving official is not a travel charge cardholder, this individual is
      required to take the same training as travel charge cardholders.

   	 [Agency Organizational Program Coordinator:] Training on the roles and
      responsibilities of the [agency organizational program coordinators] is required prior to
      appointment, including proper management, control and oversight tools and techniques
      … The [agency organizational program coordinators] must also receive the same
      training as the cardholders.”

OMB’s Circular A-123, Appendix B, Chapter 4, Risk Management, also requires charge card
managers to oversee “the establishment and maintenance of master file/official cardholder
records, including training, appointment, single and monthly purchase limits, and related
records … .”

OPM’s Charge Card Management Plan requires training for the travel card program as
follows:

   	 Cardholders: Travel card applicants are required to complete the online GSA Travel
      Card Web-Based Training available at: https://training.smartpay.gsa.gov/training/travel-
      card-cardholders prior to being issued a charge card. Cardholders must certify they
      have received the training, understand the regulations and procedures, and know the
      consequences of inappropriate actions. Each organizational program coordinator will
      maintain a copy of the certification of completion. For refresher training, cardholders
      must complete the above training again at a minimum of every three years.


                                        14 	                     Report No. 4A-CF-00-15-049
   	 Agency/Organization Program Coordinators: OPM uses GSA’s online training website:
      https://training.smartpay.gsa.gov/training/travel-card-aopc for training and refresher
      training for agency organizational program coordinators. This training teaches the basic
      roles and responsibilities of agency organizational program coordinators. The agency
      organizational program coordinators are required to maintain and retain copies of the
      training certifications for three years.

Without adequate training and the absence of documents to support that travel cardholders and
managers have been trained, there is an increased risk that there are participants who have not
been properly trained in the proper usage of the travel card. Individuals not properly trained
can lead to an increase in card misuse and abuse and failure to comply with requirements of the
travel card program.

Recommendation 5

We recommend that Travel Operations ensure all travel cardholders, approving officials, the
agency program coordinator, and agency organizational program coordinators, that have not
taken the mandatory initial and refresher training, complete the training within an appropriate
timeframe, or suspend the use of their travel card and/or oversight duties until training is
completed.

OCFO’s Response

“CFO Management concurs with OIG’s recommendation, noting that it released the Travel
Card training for cardholders in July 2017 as an annual refresher on travel card policies
and procedures. Records of training will be maintained by the CFO's [Financial Operations
Management] FOM organization. In addition, the CFO will be drafting new guidance for
approving officials (to include appointment letters) of their oversight role and
responsibilities.”

Recommendation 6

We recommend that Travel Operations formally appoint approving officials and program
coordinators through appointment letters, which outline their basic responsibilities and duties
related to the travel card operations for their respective program office.




OCFO’s Response

                                         15 	                    Report No. 4A-CF-00-15-049
   “CFO Management concurs with OIG’s recommendation, noting that the CFO will also
   draft new guidance for approving officials (to include appointment letters) of their oversight
   role and responsibilities.”

   Recommendation 7

   We recommend that Travel Operations coordinate and partner with OPM program approving
   officials, program coordinators, and any appropriate program offices to implement controls to
   ensure card users and oversight personnel receive the required training on the appropriate use,
   controls and consequences of abuse before they are given a card, and/or appointment to the
   position. Documentation should be maintained to support the completion of initial and refresher
   training.

   OCFO’s Response

   The OCFO concurs with the recommendation and has “taken steps to deliver an annual
   refresher training that provides procedures and guidelines for travel card use.”

3. Controls over Travel Card Transactions

   We selected a judgmental sample of 324 travel card transactions, totaling $73,713, out of
   25,259 travel card transactions, totaling $5,240,987, from October 1, 2014, to September 30,
   2015, to ensure that the transactions were properly authorized and approved; adequately
   documented; and for legitimate government business purposes. We reviewed the transactions
   to determine whether the transactions were approved and supported government business
   expenses. We also checked Travel Operations’ compliance reviews to determine if transactions
   that were not approved and/or did not support government business expenses were captured
   during the Travel Operations' one hundred percent transaction compliance review process.

   Out of the 324 transactions selected for testing we found that 33 transactions, totaling $8,158,
   were missing travel authorizations and 29 transactions, totaling $27,627, were missing required
   receipts. As a result, we were unable to validate that the travel card transactions were properly
   authorized and that employee travel vouchers, along with the required supporting receipts for
   transactions over $75, were approved in E2. Details of our review were provided to Travel
   Operations separate from this report. For the transactions we reviewed, Travel Operations did
   not ensure that travel card transactions were properly authorized and adequately documented
   for appropriate, legitimate government business purpose.

   Travel Operations stated that they perform one hundred percent travel card transaction reviews
   during their monthly required travel charge card compliance review, as outlined by OPM’s
   Charge Card Management Plan; however, due to a lack of supporting documentation, we were
                                            16                        Report No. 4A-CF-00-15-049
unable to verify that one hundred percent of travel card transactions were reviewed during these
reviews. Travel Operations regularly reviews JP Morgan Chase’s reports and OPM’s E2 travel
system to determine if cardholders’ activities are in compliance with policies. For example,
charges on the travel cards are compared with travel authorizations to determine if the
cardholder was on travel during the period the charge card was used. We determined that there
was a weakness in Travel Operations’ compliance review methodology because they do not
review the travel authorizations and vouchers associated with the transactions during the one
hundred percent transaction compliance review, which only looks at certain aspects of
transactions which appear to be anomalies. The current compliance review process cannot
capture unauthorized travels or missing voucher submissions without comparing the travel
authorizations and vouchers with the transactions.

The U.S. Government Accountability Office’s (GAO) Standards for Internal Control in the
Federal Government states that “Transactions are authorized and executed only by persons
acting within the scope of their authority. This is the principal means of assuring that only
valid transactions to exchange, transfer, use, or commit resources are initiated or entered into.
… Management clearly documents internal control and all transactions and other significant
events in a manner that allows the documentation to be readily available for examination.”

OPM’s Financial Management Manual, Chapter 17, section 17.5 states, “The traveler must
enter the TA [Travel Authorization] in the Travel Authorization/Voucher application of GSA’s
FEDdesk system to initiate trip. The authorizing official must enter his/her approval of the TA
[Travel Authorization] in FEDdesk before the traveler incurs expenses.”

The FTR, Section 301-11.25 states that “You must provide a lodging receipt and a receipt for
every authorized expense over $75, or provide a reason acceptable to your agency explaining
why you are unable to furnish the necessary receipt(s) … .”

OPM’s Charge Card Management Plan, states that “travel charge card accounts are generally
reviewed monthly and always at the end of the reporting cycle. Account activity is compared
to travel authorizations to look for card activity not consistent with a travel authorization.
Incidents of potential misuse are reported to appropriate managers, O[rganizational] P[rogram]
C[oordinator]s and OPM’s Human Resources Office for follow-up and appropriate disciplinary
action, to include: reprimand, suspension or termination.”

Unsupported transactions provide an increased risk for abuse or misuse of the travel card and
subsequently agency resources.




                                          17                        Report No. 4A-CF-00-15-049
Recommendation 8

We recommend that Travel Operations strengthen its oversight and monitoring of travel card
transactions, to include but not be limited to, ensuring travel cards are being used and approved
in accordance with regulations and guidance.

OCFO’s Response:

“CFO Management concurs with OIG’s recommendation. To ensure travel card monitoring
activity is adequately documented, the Agency / Organization Program Coordinator (A/OPC)
within CFO and the program coordinators within OPM program offices, will maintain
supporting documentation to support each month the monitoring control activity performed
and any actions taken to notify employees and their supervisors of any infractions identified.
If there is evidence of fraud, waste, or abuse, the matter will be submitted to the Deputy CFO
who will report the matter to ES and the OIG’S for investigation, if applicable. The CFO
will maintain a record of any notifications submitted to the OIG and ES.”

Recommendation 9

We recommend that Travel Operations provide frequent reminders to the approving officials on
their responsibilities when reviewing travel authorizations and vouchers. Reminders should
include such things as GSA’s best practices for travel charge cards to ensure travel cardholders
submit receipts for expenses over $75 when submitting their vouchers, and that travel
authorizations are approved prior to travel.

OCFO’s Response

The OCFO concurs with the recommendation. Travel operations staff will communicate
quarterly with the Travel Organizational Contacts (TOCs) and will provide additional
training on an as needed basis. In addition, CFO's [Financial Operations Management]
FOM will conduct targeted audits to evaluate the TOCs’ travel voucher review process.

Recommendation 10

We recommend that Travel Operations develop written procedures for their Compliance
Review and Voucher Review processes. At a minimum, procedures should include verifying
and validating travel authorizations, receipts, and vouchers.

OCFO’s Response

“CFO Management generally concur with OIG’s recommendation. A post audit compliance
checklist was documented and executed. However, the CFO FOM organization will
                                         18                        Report No. 4A-CF-00-15-049
   document formal compliance review procedures and will include a modified travel approval
   procedure task list to assist supervisors in their review, verification, and validation of travel
   authorizations, receipts, and vouchers before approval.”

4.	 Excessive Cash Advances

   We reviewed all 1,626 ATM cash advances, from October 1, 2014, through September 30,
   2015, and determined that:

      	 Twenty-one restricted cardholders made 68 cash advance transactions, totaling $17,493,
         which exceeded their seven-day limit of $200. Travel Operations only detected 2 of the
         68 transactions during their compliance review.

      	 Three out of the aforementioned 21 restricted cardholders made cash advance
         transactions, totaling $3,509, which exceeded their billing cycle limit of $600.

   Details were provided to the OCFO separate from this report.

   Travel Operations’ monitoring procedures include providing monthly ATM Activity Reports to
   office heads and organization program coordinators, and requesting that they review and verify
   specific information about each employee listed. However, Travel Operations could not
   provide documentation to support that the program offices were actually reviewing the reports
   and responding to Travel Operations with the results of their reviews. In addition, Travel
   Operations’ monitoring procedures did not include identifying the travel cards used for
   unauthorized transactions.

   OPM’s Charge Card Management Plan states, “Applicants who do not consent to a credit
   check; or who consent to a credit check but attain a FICO score of less than 660, are issued a
   restricted travel card with a limit of $2,000 and an ATM limit of $200 every seven days/$600
   per billing cycle.”

   Lack of a robust system of internal controls for preventing cardholders from exceeding their
   ATM cash advance limit of $200 every seven days/$600 per billing cycle, increases the risk
   that cash advances are used for expenses unrelated to Government travel.


   Recommendation 11

   We recommend that Travel Operations ensure organizational program coordinators review and
   certify monthly ATM Reports to help identify cardholder cash advances taken in excess of their
   ATM limit.
                                          19 	                     Report No. 4A-CF-00-15-049
   OCFO’s Response

   The OCFO concurs with the recommendation and stated that they will work with their bank
   card provider and agency program coordinators to perform quarterly reviews of travel
   cardholder ATM limits.

   Recommendation 12

   We recommend that Travel Operations follow up with organizational program coordinators to
   ensure that appropriate actions are taken against employees who have used their travel card for
   unauthorized transactions during each billing cycle.

   OCFO’s Response

   “CFO Management concurs with OIG’s recommendation. The CFO FOM organization will
   update the Travel Policy to officially direct OPM organizational program coordinators to
   review travel card transactions on a monthly basis for validity. Management will require
   organizational program coordinators to report any employee travel card activity that is
   identified as misuse (i.e. double airfare, cancelled airfares, and charges and cash advances
   without related travel authorization, etc.) to the CFO travel manager and employee
   supervisor and approving manager. CFO Management will also retrain all organizational
   program coordinators and Centrally Billed Account travel cardholders to ensure any
   suspicious or inappropriate activity or abuses are communicated to the approving manager.
   This notification will require the OPC to respond with actions they have taken against the
   cardholder.”

5.	 Delinquent Cardholder Accounts

   Travel Operations did not provide support that cardholder accounts with delinquencies of 61
   days or more were suspended or canceled. Specifically, we were unable to verify that:

      	 All 22 delinquent cardholder accounts, totaling $61,189, listed in the Cancellation
         Report for July 1 to October 31, 2015, were suspended.

      	 Six out of 22 delinquent cardholders were suspended after appearing twice or more,
         during a 12-month period, on the delinquency reports.

   Details regarding the delinquent cardholder accounts were provided to the OCFO separate from
   this report.

                                            20 	                     Report No. 4A-CF-00-15-049
OMB’s Circular A-123, Appendix B, section 4.3 states, “The general responsibilities of charge
card managers in implementing risk management controls, policies and practices [for travel
charge card program] are [as follows]: … Ensuring that cardholder statements of account and
supporting documentation are reviewed and utilized to monitor delinquency, misuse, and other
transaction activities … .” Section 4.4 states, “Charge card managers are responsible for
ensuring that payment obligations are paid on time and that all relevant Prompt Payment Act
requirements are met.” The specific risk management controls, policies, and practices for
addressing payment delinquencies, “Where individual cardholders are responsible for making
payments to the charge card vendor, charge card managers are required to:

   	 Closely monitor delinquency reports from charge card vendors;

   	 Contact the delinquent cardholder promptly to ensure payment is made or to obtain a
      remediation plan;

   	 Formally notify the cardholder that delinquency in payment may result in disciplinary
      action; [and]

   	 Incorporate all controls, practices and procedures related to individually billed account
      delinquencies into the agency’s charge card management plan … .”

Moreover, OMB A-123, Appendix B, section 4.5 states, “Payment delinquency associated with
a Government travel charge card is prohibited.”

SmartPay 2 Master Contract, C.1.18.2.1 Suspension Procedures, states, “If payment for the
undisputed principal amount has not been received by the close of the 60th calendar day from
the billing date of the billing period in which the charge appeared, the Contractor may suspend
the account on the 61st day, unless otherwise directed by the [Agency Organizational Program
Coordinator].”

OPM’s Financial Management Manual, Chapter 17, specifically states, “Employees with a
delinquent account may be subject to disciplinary action. An account may be cancelled if the
account has been suspended twice during a 12-month period for non-payment of undisputed

principal amounts and becomes past due again in accordance with the terms of the vendor 

bank’s Cardholder Agreement.” 


OPM’s Charge Card Management Plan states, “It is the cardholder’s responsibility to pay all
outstanding balances on individually billed travel cards. If the cardholder fails to pay the
balance, the serving bank or its collection agency may use whatever lawful garnishment and
                                           21 	                     Report No. 4A-CF-00-15-049
   salary offset remedies available in the collection process, including reports to credit bureaus in
   accordance with the servicing bank’s individually billed travel cardholder agreement.”

   With delinquent accounts, totaling $61,189, not being suspended after 61 days or more, OPM is
   at risk of not being in compliance with Federal law, and leaving the cards in the hands of the
   cardholder increases the chances for fraud, misuse, and abuse of the travel card.

   Recommendation 13

   We recommend that Travel Operations ensure that payments are made or to obtain a 

   remediation plan for all outstanding balances on delinquent accounts, totaling $61,189. 


   OCFO’s Response

   The OCFO concurs with the recommendation and states that delinquent accounts totaling
   $61,189 have been reduced to zero percent.

   OIG Comment

   The OCFO did not provide support with their response to show that the delinquent accounts
   have been reduced to zero percent; therefore, we will verify this information during the audit
   resolution process.

   Recommendation 14

   We recommend that Travel Operations strengthen internal controls to confirm that delinquent
   accounts are monitored and ensure that all delinquent cardholder accounts are either suspended
   or canceled, as appropriate.

   OCFO’s Response

   The OCFO agrees that delinquent cardholder accounts should be suspended or cancelled.
   “CFO's FOM organization prepares monthly reports for management review based on data
   provided by the bank card provider. Delinquent Cardholder Accounts are reviewed by
   organization program coordinators to identify accounts for possible suspension or
   cancellation. Accounts with delinquencies after 61 days are suspended and accounts with
   delinquencies after 120 days are canceled.”

6. Cancellation of Travel Cards

   Travel Operations did not immediately cancel 176 travel card accounts of employees that
   separated from OPM.
                                           22                      Report No. 4A-CF-00-15-049
  Number of accounts   Percentage of universe     When Account was Cancelled after Separation
          3                     2%              1 year or greater
         17                    10%              At least 3 months but less than 6 months
         17                    10%              At least 2 months but less than 3 months
         48                    27%              At least 1 month but less than 2 months
         91                    52%              At least 1 day but less than 1 month
         176                  100%                                     Total

OPM’s Charge Card Management Plan provides best practice to ensure effective risk
management controls when cardholders terminate employment with OPM. However, the
policies and procedures do not provide guidance on verifying if separated employees’ travel
card accounts are immediately cancelled upon employment termination.

Public Law 112-194, Government Charge Card Abuse Prevention Act of 2012, requires each
executive agency to ensure “that the travel charge card of each employee who ceases to be
employed by the agency is invalidated immediately upon termination of the employment of the
employee … .”

GAO’s Standards for Internal Control in the Federal Government, Principle 10 – Design
Control Activities, advises management to limit “access to resources and records to authorized
individuals, and assigns and maintains accountability for their custody and use. Management
may periodically compare resources with the recorded accountability to help reduce the risk of
errors, fraud, misuse, or unauthorized alteration.” Additionally, management is advised to
“clearly [document] internal control and all transactions and other significant events in a
manner that allows the documentation to be readily available for examination.”

OPM’s Charge Card Management Plan, dated January 2015, states that “When a cardholder
resigns, retires, or transfers to another Government agency, the cardholder must return the
destroyed card to his/her [Organization Program Coordinators]; or to the [Agency Program
Coordinator] for cancellation.”

OPM’s Financial Management Manual, Chapter 17 – Travel Policy, states that “Employee
participation in the [Government Travel Card Program] will be terminated under the following
conditions: The cardholder is no longer employed by OPM[;] Misuse of the card by the
cardholder[;] Employee goes on leave of absence without pay for over 12 months[; and]
Vendor decides to cancel the card at its discretion.”




                                           23                            Report No. 4A-CF-00-15-049
   As a result of separated employees’ travel cards not being cancelled immediately upon
   termination of employment; it increases the opportunity for continued use, which can result in
   travel card misuse and abuse.

   Recommendation 15

   We recommend that Travel Operations ensure that an analysis is routinely performed to certify
   that travel cards are not used after the separation date.

   OCFO’s Response

   The OCFO concurs with the recommendation and states that they “will generate a monthly
   report of active and suspended cards and distribute to organization program coordinators to
   review, confirm, and cancel travel card accounts for employees who have separated from
   OPM … .”

   Recommendation 16

   We recommend that Travel Operations implement stronger internal controls to ensure that
   travel card accounts are immediately cancelled upon separation of the cardholder’s
   employment.

   OCFO’s Response

   The OCFO concurs with the recommendation and stated that they “will utilize the employee
   separation report received from the payroll provider to ensure that travel card accounts of
   separated employees have been cancelled on a monthly basis.”

7. Periodic Reviews of Cardholder Activity

   We reviewed cardholder reports to determine if Travel Operations was monitoring and tracking
   cardholders who have not used their travel card for 365 days or more and to verify if inactive
   accounts had been suspended. We were unable to determine if inactive cardholder’s accounts
   had been deactivated because Travel Operations did not provide evidence that they had
   completed quarterly reviews to identify cardholders who have not used their cards within 365
   days and that those accounts were deactivated. Due to organizational turnover of human
   capital, documents were not retained to support that periodic reviews were conducted.

   However, our testing identified that from October 1, 2014, through September 30, 2015, there
   were a total of 361 employee travel card accounts that had not been deactivated due to lack of
                                            24                       Report No. 4A-CF-00-15-049
activity for a year or more. The number of days of inactivity for the 361 employee travel card
accounts, which had a status of either active or new, ranged from 365 to 2,464 days.

Public Law 112-194 - OCT. 5, 2012 126 STAT. 1445, Government Charge Card Abuse
Prevention Act of 2012, states, “Periodic reviews [shall be] performed to determine whether
each travel charge card holder has a need for the travel charge card.”

OPM’s Charge Card Management Plan states, “On an annual basis, employees’ accounts are
reviewed to identify employees who have not used the travel charge card for one year or
more. Travel cards that have not been used for one year or more are deactivated.”

GAO’s Standards for Internal Control in the Federal Government, Principle 10 states,
“Management should design control activities to achieve objectives and respond to risks.”
More specifically, that “Management clearly documents internal control and all transactions
and other significant events in a manner that allows the documentation to be readily available
for examination. … Documentation and records are properly managed and maintained.”

As a result of Travel Operations not performing and documenting the periodic reviews to
identify travel charge cardholder that have not used the travel charge card for one year or more,
there is an increased potential for misuse, abuse, and fraud.

Recommendation 17

We recommend that Travel Operations identify cardholders that have not used their travel card
for one year or more and deactivate travel cards in a timely manner.

OCFO’s Response

“CFO Management concurs with OIG’s recommendation and will institute a Travel Card
account inactivity monitoring procedure where we will notify organization program
coordinators of travel card accounts that are inactive for 365 days or more.”

Recommendation 18

We recommend that Travel Operations enforce policies and procedures to conduct periodic
reviews of travel card accounts to ensure cards are needed by the employees to which they are
issued.

OCFO’s Response


                                         25                        Report No. 4A-CF-00-15-049
   “CFO Management concurs with OIG’s recommendation and will institute a Travel Card
   account inactivity monitoring procedure where we will notify organization program
   coordinators of travel card accounts that are inactive for 180 days or more. Organization
   program coordinators will be required to provide a response to cancel the card if it is
   determined that the cardholder no longer has a need for the card or has separated from
   OPM. Responses not received from identified organization program coordinators will be
   reported to the Deputy Chief Financial Officer for further action.”

   Recommendation 19

   We recommend that Travel Operations establish and implement controls to properly document
   and retain support for the periodic reviews of inactivity.

   OCFO’s Response

   “CFO Management concurs with OIG’s recommendation and will maintain records of
   information received from organization program coordinators and that [are] generated by
   the CFO's FOM organization on the periodic reviews of travel card accounts.”

8. Agency Financial Report

   Travel card usage is reported in Table 18 of OPM’s FY 2015 Annual Financial Report (AFR).
   Table 18 reports the effectiveness of OPM's travel card usage by monitoring the percentage of
   the total outstanding balances that are 61 or more days old. Table 18 also compares OPM's
   percentages that are 61 or more days old to Government-wide percentages.

   Travel Operations does not have controls in place to ensure that the travel card information
   reported in the AFR is accurate. When we requested support for the travel card reporting they
   provided data from GSA. GSA compiles financial data from JPMorgan Chase, Citibank, and
   U.S. Bank for the Federal government's travel card program and reports on it broken out by
   Federal agency on their website. Travel Operations retrieves OPM’s travel card program and
   the Government-wide travel card program data from GSA's website and forwards that
   information to OCFO's Financial Services for inclusion in OPM’s AFR.

   Travel Operations did not analyze or validate OPM's travel card data from the GSA for
   accuracy prior to the results being reported in the Table 18 of OPM's FY2015 AFR. In
   addition, Travel Operations did not properly cite GSA as the source of the travel card data
   reported in AFR.

   GAO’s Standards for Internal Control in the Federal Government, Principle 10, advises that
   “Management clearly documents internal control and all transactions and other significant


                                            26                       Report No. 4A-CF-00-15-049
events in a manner that allows the documentation to be readily available for examination. …
Documentation and records are properly managed and maintained.”

Principle 13 - Use Quality Information/ Relevant Data from Reliable Sources, states,
“Management should use quality information to achieve the entity’s objectives.” More
specifically, it states that “Management obtains relevant data from reliable internal and external
sources in a timely manner based on the identified information requirements. Relevant data
have logical connection with, or bearing upon, the identified information requirements.
Reliable internal and external sources provide data that are reasonably free from error and bias
and faithfully represent what they purport to represent.”

By not validating OPM’s travel card data received from GSA, information reported in OPM’s
FY 2015 AFR may be erroneous. In addition, by not properly citing the source of the travel
card data in the AFR, readers may be misled to believe that the data presented is OPM
generated.

Recommendation 20

We recommend that Travel Operations provide support to validate the travel card information
provided in Table 18. Furthermore, we recommend Travel Operations improve internal
controls over its travel card reporting process to ensure the integrity of the travel card data
reported in the AFR. These controls should include verification and validation of the travel
card information prior to reporting it in the AFR.

OCFO’s Response

The OCFO concurs with the recommendation and stated that they “will utilize officially
sourced data from [GSA]. … Source data from GSA will be verified and validated using data
received from the bank card provider prior to reporting within the AFR.

Recommendation 21

We recommend that Travel Operations properly cite the source of the travel card data reported
in OPM's AFR when the data is provided from sources external to OPM.

OCFO’s Response

The OCFO concurs with the recommendation “and will make the proper citations as
recommended.”




                                          27                       Report No. 4A-CF-00-15-049
                                                   APPENDIX



                              UNITED STATES OFFICE OF PERSONNEL MANAGEMENT
                                                    Washington, DC 20415


Chief Financial
                                                     AUG 1 7 2017
    Officer



    MEMORANDUM FOR


    THROUGH:
                                    Chief Financial Office

    FROM:                           	ROCHELLE BAYARD

                                    Associate Chief Financial Officer, Financial Operations Management


    SUBJECT: 	                      Management Response to Draft Report on the Audit of OPM's

                                    Travel Card Program (Report No. 4A-CF-00-15-049)



    The Office of the Chief Financial Officer appreciates the opportunity to provide a response on the Inspector
    General's Draft Report on the Audit of OPM's Travel Card Program (Report No. 4A-CF-00- 15-049). We are
    committed to ensuring proper oversight of OPM's travel card program to mitigate risk of fraud or inappropriate
    use.

    We generally agree with the findings and recommendations in the report and recognize that there are
    opportunities for enhancing OPM's internal controls and guidance around the Travel Card Program and usage of
    the Travel Card to the extent feasible in supporting OPM's mission. However, for Recommendation #3, we
    request that Employee Services be designated the lead with CFO serving in an analytical and consultative role to
    formulate written penalties and disciplinary procedures. We believe this more accurately reflects our
    respective roles in defining and implementing any disciplinary actions related to card misuse.

                                                      Deleted by OIG
                                                Not Relevant to Final Report
    Additionally, OPM's delinquency rates for individually billed accounts, for the timeframe indicated in Finding
    #5 where delinquent accounts totaled $61,189.00, have been reduced to 0% confirming that all outstanding
    accounts have been paid or charged off.

    We hope your staff will take these comments into consideration as part of the final report. In addition, we are
    including our initial response to the recommendations in the report. If you have any questions, please contact
    me by email or a member of your staff may contact                    at               .

    Attachment



                                                                                       Report No. 4A-CF-00-15-049
cc: 	   Jason Simmons
        Chief of Staff

        Norbert Vint

        Acting Inspector General


        Mark Lambert
        Associate Director, Merit System Accountability and Compliance

        Dan Marella

        Deputy Chief Financial Officer


        Janet Barnes
        Director, Internal Oversight and Compliance


        Senior Team Leader, Internal Audits Group

                           

        Chief, Policy and Internal Controls





                                                                         Report No. 4A-CF-00-15-049
                   CHIEF FINANCIAL OFFICER'S MANAGEMENT RESPONSETO
              DRAFT REPORT ON THE AUDIT OF OPM's TRAVEL CARD PROGRAM
                              (REPORT     No. 4A-CF-00-15-049)


Recommendation 1

We recommend Travel Operations ensure that all travel card policies and procedures,
governing OPM's travel card program, are accurate and consistent with one another and
contain all areas/requirements outlined by laws and regulations pertaining to OPM's
government travel card program.

       Management Response: CFO Management concurs with OIG’s recommendation and is
       in the process of enhancing its travel program policies and procedures to mitigate the
       identified risks and promote greater accountability in the use of OPM funding
       resources. These updated policies and procedures will address the recommendation
       above, and will include enhanced controls to monitor and verify OPM's government
       travel card program with specific guidelines outlined by Federal Travel Regulations.

Recommendation 2
We recommend Travel Operations ensure that roles and responsibilities are clearly
articulated to avoid ambiguity of delegated duties.

       Managem ent Response: CFO M anagement concurs with OIG’s recommendation and as
       noted in Respon se #1 above, we will be updating the Travel Policy and Government
       Travel Charge Card Plan to clarify roles and responsibilities for all components of OPM's
       travel card program to include annual training and reminders on travel card policies and
       procedures.

Recommendation 3
We recommend Travel Operations collaborate with OPM's Human Resources to formulate
written penalties to deter misuse of OPM's travel charge cards.

       Management Response: CFO Management generally agrees with OIG’s recommendation.
       However, we request that Employee Services (ES) be designated the lead with CFO serving
       in an analytical and consultative role to formulate written penalties and disciplinary
       procedures. We believe this more accurately reflects our respective roles in defining and
       implementing any disciplinary actions related to card misuse.

Recommendation 4
We recommend Travel Operations immediately replace the Charge Card Management Plan,
dated May 5, 2006, located on THEO, with the version dated January 2017. Travel
                                                                               Report No. 4A-CF-00-15-049
Operations should also ensure that THEO is immediately updated when a new version of the
Charge Card Management Plan is released or updated.

        Management Response: CFO Management concurs with OIG’s recommendation, noting
        that it plans to issue an updated Travel Policy and Government Travel Charge Card
        Plan to include specific guidelines outlined by Federal Travel Regulations. The
        documents will be officially posted to OPM internal intranet (THEO) and
        communicated to all OPM employees upon posting on THEO.

Recommendation 5
We recommend that Travel Operations ensure all travel cardholders, approving officials, the
agency program coordinator, and agency organizational program coordinators, that have not
taken the mandatory initial and refresher training, complete the training within an appropriate
timeframe, or suspend the use of their travel card and/or oversight duties until training is
completed.

        Management Response: CFO Management concurs with OIG’s recommendation,
        noting that it released the Travel Card training for cardholders in July 2017 as an
        annual refresher on travel card policies and procedures. Records of training will be
        maintained by the CFO's FOM organization. In addition, the CFO will be drafting new
        guidance for approving officials (to include appointment letters) of their oversight role
        and responsibilities.

Recommendation 6
We recommend that Travel Operations formally appoint approving officials and program
coordinators through appointment letters which outline their basic responsibilities and duties
related to the travel card operations for their respective program office.

       Management Response: CFO M anagement concurs with OIG’s recommendation, noting
       that the CFO will also draft new guidance for approving officials (to include
       appointment letters) of their oversight role and responsibilities.

Recommendation 7
We recommend that Travel Operations coordinate and partner with OPM program approving
officials, program coordinators, and any appropriate program offices to implement controls to
ensure card users and oversight personnel receive the required training on the appropriate use,
controls and consequences of abuse before they are given a card, and/or appointment to the
position. Documentation should be maintained to support the completion of initial and
refresher training.

       Management Response: CFO Management concurs with OIG’s recommendation and have
       taken steps to deliver an annual refresher training that provides procedures and
       guidelines for travel card use. Where appropriate, the CFO will coordinate with
       program offices as it develops draft guidance for approving officials and resulting
       ap pointment letters role and responsibilities.
                                                                                 Report No. 4A-CF-00-15-049
Recommendation 8
We recommend that Travel Operations strengthen its oversight and monitoring of travel card
transactions, to include but not be limited to, ensuring travel cards are being used and
approved in accordance with regulations and guidance.

       Management Response: CFO Management concurs with OIG’s recommendation. To
       ensure travel card monitoring activity is adequately documented, the Agency /
       Organization Program Coordinator (A/OPC) within CFO and the program
       coordinators within OPM program offices, will maintain supporting documentation to
       support each month the monitoring control activity performed and any actions taken
       to notify employees and their supervisors of any infractions identified. If there is
       evidence of fraud, waste, or abuse, the matter will be submitted to the Deputy CFO who
       will report the matter to ES and the OIG’S for investigation, if applicable. The CFO
       will maintain a record of any notifications submitted to the OIG and ES.

Recommendation 9
We recommend that Travel Operations provide frequent reminders to the approving officials
on their responsibilities when reviewing travel authorizations and vouchers . Reminders
should include such things as GSA's best practices for travel charge cards to ensure travel
cardholders submit receipts for expenses over $75 when submitting their vouchers and travel
authorizations are approved prior to travel.

       Management Response: CFO Management concurs with OIG’s recommendation. CFO
       travel operations staff will communicate quarterly with approving officials, organization
       program coordinators, Travel Organizational Contacts (TOCs) and will provide
       additional training, as needed, through informational emails to ensure that everyone
       understands the agency's policy as to the requirement for receipts for all travel expenses
       of $75 or more for validating vouchers claimed for reimbursements. CFO's FOM
       organization will ensure that targeted audits are conducted to assess that travel
       approving officials (i.e., the supervisors/ managers of travelers) are reviewing travel
       vouchers for adequate and appropriate receipts or documentation to support all
       expenses charged.

Recommendation 10
We recommend Travel Operations develop written procedures for their Compliance Review
and Voucher Review processes. At a minimum, procedures should include verifying and
validating travel authorizations, receipts, and vouchers.

       Management Response: CFO Management generally concur with OIG’s recommendation.
       A post audit compliance checklist was documented and executed. However, the CFO FOM
       organization will document formal compliance review procedures and will include a
       modified travel approval procedure task list to assist supervisors in their review,
       verification, and validation of travel authorizations, receipts,and vouchers before
       approval.
                                                                              Report No. 4A-CF-00-15-049
                                           Deleted by OIG
                                     Not Relevant to Final Report

Recommendation 12
We recommend that Travel Operations ensure organizational program coordinators review
and certify monthly ATM Reports to help identify cardholder cash advances taken in excess
of their ATM limit.

       Management Response: CFO Management concurs with OIG’s recommendation. The
       CFO's FOM organization will work with our bank card provider and agency program
       coordinators to perform a periodic review of travel cardholder A TM limits. The review
       will be conducted quarterly beginning October 1, 2017 with the quarterly results being
       finalized within 30 days after the end of the quarter.

Recommendation 13
We recommend that the Travel Operations follow up with organizational program
coordinators to ensure that appropriate actions are taken against employees who have used
their travel card for unauthorized transactions during each billing cycle.

       Management Response: CFO M anagement concurs with OIG’s recommendation. The
       CFO FOM organization will update the Travel Policy to officially direct OPM
       organizational program coordinators to review travel card transactions on a monthly
       basis for validity. Management will require organizational program coordinators to
       report any employee travel card activity that is identified as misuse (i.e. double airfare,
       cancelled airfares, and charges and cash advances without related travel authorization,
       etc.) to the CFO travel manager and employee supervisor and approving manager. CFO
       M anagement will also retrain all organizational program coordinators and Centrally
       Billed Account travel cardholders to ensure any suspicious or inappro priate activity or
       abuses are communicated to the ap proving manager. This notification will require the
       OPC to respond with actions they have taken against the cardholder.

Recommendation 14
We recommend that Travel Operations ensure that payments are made or to obtain a
remediation plan for all outstanding balances on delinquent accounts, totaling $61,189.00.

        Management Response: CFO Management concurs with OIG’s recommendation and
        OPM's delinquency rates for individually billed accounts, for the timeframe indicated
        in Finding #5 where delinquent accounts totaled $61,189.00, have been reduced to 0%, a
        confirmation that all outstanding accounts for the reviewed timeframe have been paid
        or charged off.




                                                                                 Report No. 4A-CF-00-15-049
Recommendation 15
We recommend that Travel Operations strengthen internal controls to confirm <Deleted by OIG,
Not Relevant to Final Report> delinquent accounts are monitored; and ensure that all delinquent
Cardholder accounts are either suspended or canceled, as appropriate.

       Management Response: CFO Management partially concurs with OIG’s recommendation.

                                           Deleted by OIG 

                                     Not Relevant to Final Report 



       CFO's FOM organization pre pares monthly reports for management review based on data
       provided by the bank card provider. Delinquent CardholderAccounts are reviewed by
       organization program coordinators to identify accounts for possible suspension or
       cancellation. Accounts with delinquencies after 61 days are suspended and accounts with
       delinquencies after 120 days are canceled.

Recommendation 16
We recommend that the Travel Operations ensure that an analysis is routinely performed to
certify that travel cards are not used after the separation date.

       Management Response: CFO Management concurs with OIG’s recommendation. To
       ensure pro per oversight in reviewing and assessing open Travel Card for separated
       employee, the CFO's FOM organization willgenerate a monthly report of active and
       suspended cards and distribute to organization program coordinators to review, confirm,
       and cancel travel card accounts for employees who have separated from OPM on a
       monthly basis.

Recommendation 17
We recommend that Travel Operations implement stronger internal controls to ensure that
travel card accounts are immediately cancelled upon separation of the cardholder's
employment.

        Management Response: CFO Management concurs with OIG’s recommendation. To
        ensure pro per oversight in reviewing and assessing open Travel Card for separated
        employee, the CFO's FOM organization will utilize the employee separation report
        received from the payroll provider to ensure that travel card accounts of separated
        employees have been cancelled on a monthly basis.

Recommendation 18
We recommend that Travel Operations identify cardholders that have not used their travel
card for one year or more and deactivate travel cards in a timely manner.


                                                                                 Report No. 4A-CF-00-15-049
        Management Response: CFO M anagement concurs with OIG’s recommendation and will
        institute a Travel Card account inactivity monitoring procedure where we will notify
        organization program coordinators of travel card accounts that are inactive for 365 days
        or more.

Recommendation 19
We recommend that Travel Operations enforce policies and procedures to conduct periodic
reviews of travel card accounts to ensure cards are needed by the employees to which they
are issued.

        Management Response: CFO Management concurs with OIG’s recommendation and will
        institute a Travel Card account inactivity monitoring procedure where we will notify
        organization program coordinators of travel card accounts that are inactive for 180
        days or more. Organization program coordinators will be required to provide a response
        to cancel the card if it is determined that the cardholder no longer has a need for the card
        or has separated from OPM. Responses not received from identified organization
        program coordinators will be reported to the Deputy Chief Financial Officer for further
        action.

Recommendation 20
We recommend that Travel Operations establish and implement controls to properly
document and retain support for the periodic reviews of inactivity.

        Management Response: CFO Management concurs with OIG’s recommendation and
        will maintain records of information received from organization program coordinators
        and that generated by the CFO's FOM organization on the periodic reviews of travel card
        accounts.

Recommendation 21
We recommend that Travel Operations provide support to validate the travel card
information provided in Table 18. Furthermore, we recommend Travel Operations improve
internal controls over its travel card reporting process to ensure the integrity of the travel
card data reported in the AFR. These controls should include verification and validation of the
travel card information prior to reporting it in the AFR.


       Management Response: CFO Management concurs with OIG's recommendation. The
       CFO's FOM organization will utilize officially sourced data from the General Services
       Administration (GSA) who administers the master contract for the SmartPay Travel
       Card Program for all agencies for reporting within the annual Agency Financial Report
       {AFR}. Source data from GSA will be verified and validated using data received from
       the bank card provider prior to reporting within the AFR.


Recommendation 22

                                                                                  Report No. 4A-CF-00-15-049
We recommend that Travel Operations properly cite the source of the travel card data reported
in OPM's AFR when the data is provided from sources external to OPM.

        Management Response: CFO Management concurs with OIG's recommendation. The
        CFO's FOM organization will utilize officially sourced data from the General Services
        Administration (GSA) who administers the master contract for the SmartPay Travel
        Card Program for all agencies for reporting within the annual Agency Financial
        Report [AFR} and will make the pro per citations as recommended.




                                                                                       Report No. 4A-CF-00-15-049
       Report Fraud, Waste, and Mismanagement


                     Fraud, waste, and mismanagement in Government
                    concerns everyone: Office of the Inspector General
                   staff, agency employees, and the general public. We
                      actively solicit allegations of any inefficient and
                   wasteful practices, fraud, and mismanagement related
                     to OPM programs and operations. You can report
                              allegations to us in several ways:



    By Internet:        http://www.opm.gov/our-inspector-general/hotline-to-report-fraud-waste-
                        or-abuse


     By Phone:          Toll Free Number:                (877) 499-7295
                        Washington Metro Area:           (202) 606-2423


       By Mail:         Office of the Inspector General
                        U.S. Office of Personnel Management
                        1900 E Street, NW
                        Room 6400
                        Washington, DC 20415-1100