CFPB Report: 2013-AE-C-017 September 30, 2013
We found that internal controls over the GTC issuance process are designed and operating effectively. However, internal controls over GTC monitoring and close-out are not designed or operating effectively. Specifically, we found the following:
The Charge Card Act requires that each agency ensure that the account of a separating employee is invalidated immediately upon the termination of employment. GAO's Standards for Internal Control in the Federal Government states that internal controls are an integral part of an entity's accountability for stewardship of government resources. It also states that key duties and responsibilities need to be divided or segregated to reduce the risk of error or fraud. Further, FTR § 301-52.18-19 outlines requirements regarding the timely reimbursement of travelers to ensure that cardholders are able to keep accounts current.
The conditions noted above occurred because the Travel Office has not developed processes to mitigate GTC account monitoring and close-out control weaknesses. Further, Travel Office controls related to voucher approvals and past-due notifications are not operating effectively because of the increased workload of the Travel Office staff. Finally, the lack of periodic refresher training contributed to CFPB staff submitting TAFs and authorizations with errors. As a result, the CFPB does not have reasonable assurance that its GTC program is operating efficiently and effectively, and the agency may be at increased risk of noncompliance with the requirements of the Charge Card Act, as well as reputational risk.
Our cash-advance-limit testing revealed that 137 of the 553 daily cash-advance transactions made during our scope were over the prescribed daily limit of $210 per day. These 137 cash-advance transactions were made by 17 employees. The withdrawal amounts that were over the daily cash-advance limit ranged from $220 to over $500, and cash-advance overages totaled about $13,000. According to BPD ARC, cash-advance limits are set at GTC account issuance.
We also tested 10 judgmentally selected transactions to determine the reasonableness of the cash-advance withdrawals based on the associated cardholders' expected out-of-pocket expenditures. We did not identify any instances in which the cash advance exceeded the expected out-of-pocket expenses for the trip. SmartPay2 states that cash advances are only allowed for business travel and should not exceed out-of-pocket expenses for a trip.
These 17 cardholders were able to exceed the prescribed daily cash-advance limit because Citibank did not activate the electronic key that sets the parameters for cash-advance limits at the time of account activation. The Travel Office manager acknowledged that there is currently no process in place for the Travel Office to verify that cash-advance limits have been activated for an account. According to BPD ARC, it has resolved the issue by directing Citibank to ensure that the cash-advance-limit activation is applied to existing and new accounts as of July 2, 2013. We did not perform additional tests to verify whether Citibank implemented the corrective action. Going forward, the Travel Office could use the Account Activity Report in the CCRS to monitor cash-advance transaction amounts. If the cash-advance limits are not set, the CFPB is at risk of cardholders withdrawing large amounts of cash.
We found that accounts for 18 of the 4910 GTC cardholders who separated from the CFPB during the period of our audit were closed more than 1 day after their separation date rather than immediately upon separation. For these 18 cardholders, the time elapsed from separation to closure ranged from 1 to 82 days. We did not identify any instance of use of the GTC by these 18 cardholders after their separation.
The Charge Card Act requires that each agency ensure that the account of a separating employee is invalidated immediately upon the termination of employment.11 In practice, the Travel Office stated that the process for closing the accounts of separated employees is performed by BPD ARC; however, this procedure is not currently set forth in a finalized CFPB policy.
The CFPB Travel Office does not have a process in place to ensure that the accounts of separated cardholders are closed immediately upon employee separation. BPD ARC is primarily responsible for closing accounts of separated CFPB employees. BPD ARC explained that it receives employee separation notifications for CFPB GTC cardholders from the CFPB and BPD Human Resources and that the cardholder departure dates provided on these notifications do not always match. BPD ARC officials also stated that the standard time frame to complete the exit clearance process, which includes the closing of GTC accounts of separating cardholders, is within 30 days from the date of notice from the CFPB or BPD Human Resources.
Although individuals with active GTCs after separation could potentially use their cards for personal use, we did not identify any unauthorized activity in any of these accounts. However, because the CFPB is not ensuring that GTCs are closed immediately upon employee separation, the agency is at risk of separated employees using the card, and it is also at risk of not complying with the requirements of the Charge Card Act.
We found that 134 of the 10,832 travel vouchers processed during our audit scope had an elapsed approval time frame between the receipt and approval dates in GovTrip that was greater than 30 days. Because GovTrip does not capture the number of times a cardholder resubmits a voucher with corrections to the Travel Office, we conducted further testing and found that 48 of the 134 travel vouchers were approved 31 or more days after the Travel Office received complete vouchers. Further, we found that 3 of those 48 took more than 60 days to approve.
FTR § 301-52.18-19 requires that an approving official or agency should reimburse travelers within 30 calendar days of the submission of a proper travel claim to ensure that cardholders are able to keep accounts current and avoid delinquencies. The Travel Office stated that its goal is to approve a complete voucher within 5 business days of receipt.
In May 2013, the Office of the Chief Financial Officer implemented an expedited approval process as a temporary measure to reduce the volume of pending travel authorizations and travel vouchers in GovTrip and to expedite payment to the travelers. Approximately 1,300 actions pending approval in GovTrip were processed from May 2, 2013, through June 3, 2013. Vouchers approved under this process included conditions that vouchers were being paid without review but would be subject to a 100 percent postaudit review. While this measure temporarily reduced the backlog of travel authorizations and vouchers, as of August 5, 2013, the volume of pending actions in GovTrip had reached 1,266.
In addition, we found that for 20 of our sample of 24 past-due account balances, notifications were not sent to cardholders, their supervisors, the CFO, or the OHC as required by the Travel Card policy.12 We randomly selected a sample of 24 of the 470 cardholders from the monthly Delinquency Reports, which show past-due account balances. Specifically, we found that notifications were not sent to 3 cardholders and the CFO whose accounts were 30 days past due; to 11 cardholders, their supervisors, and the CFO for accounts that were 31–60 days past due; and to 6 cardholders, their supervisors, the CFO, and the OHC for accounts that were over 60 days past due. According to the Travel Office, the notification process was discontinued due to the backlog of travel authorizations and vouchers pending approval.
The Travel Card policy states that notifications for past-due accounts will be issued
According to the Travel Office manager, several factors account for the late approval of travel vouchers, the failure to send past-due account notifications, and the need for the temporary expedited approval process. The Travel Office manager told us that Travel Office was not able to manage the increasing volume of work during our audit period due to resource limitations. While we determined that the number of cardholders increased by 219 during our scope (to a total of 743 active cardholders as of April 30, 2013), the number of Travel Office staff members has not increased. Further, the Travel Office manager stated that travelers frequently submit vouchers in GovTrip with errors, requiring the forms to be returned to travelers for correction and causing the approval time frames to be extended. Finally, the CFPB centralized the process of approving travel authorizations and vouchers within the Travel Office, rather than delegating some of the responsibility to travelers’ supervisors. Currently, supervisors only review and approve TAFs, which do not contain enough detail to assist with the oversight of employee travel.
While the Travel Office reviews and approves cardholders’ travel authorizations and vouchers, we believe that if supervisors review and approve travel authorizations, which contain the estimated travel expenses for lodging and transportation, and travel vouchers, which contain all claimed expenses, the backlog of pending items in GovTrip can be alleviated and controls would be enhanced. Requiring cardholders’ supervisors to review and approve authorizations and vouchers can reduce the number of pending items in GovTrip, because supervisors should be more knowledgeable of their staff’s travel plans than the Travel Office and can more efficiently review and approve authorizations and travel vouchers.
A consulting company conducted an independent performance audit of the CFPB’s operations and budget and provided its report to the CFPB in November 2012.13 Regarding travel, the consulting company recommended that “the initial authorization be approved by the supervisor of the traveler and that the supervisor also approve the travel voucher before it is routed to the Travel Office for review and payment.” In response to these recommendations, the CFPB conducted benchmarking with other agencies regarding travel processes to identify best practices. The CFO stated that the CFPB’s travel volume was most similar to two of the five agencies included in its benchmarking analysis. We noted that both agencies require their managers or supervisors to review and approve cardholders’ vouchers. Based on the benchmarking results, the CFPB has proposed changes to the travel program.
We believe that delays in the approval of travel vouchers can potentially result in the cardholder having to choose between paying statement balances with personal funds to keep the account current or allowing the account to become past due or delinquent. Further, if a cardholder allows his or her account to become past due or delinquent, the available balance is reduced by the amount owed, which could prevent the cardholder from undertaking future official business travel. Consequently, delays in the approval of travel vouchers and failure to monitor delinquency reports, notify appropriate personnel regarding past-due account balances, and ensure that corrective actions are taken to prevent further occurrence may result in noncompliance with the Travel Card policy and may also result in reputational risk for the CFPB.
During our audit, we tested a random sample of 53 of the 10,832 vouchers and 120 of the 39,153 transactions processed during our scope. We found 10 occurrences in which the necessary approvals for TAFs or travel authorizations were not obtained before travel. Of the 10 instances, we noted the following:
Our review of these instances of noncompliance shows that these cardholders were eventually authorized for official travel.
The Travel Card policy states that travelers must complete and sign a TAF and a travel authorization in GovTrip in advance of their travel. In addition, the Travel Card policy states that in advance of an employee’s travel, supervisors are to either sign the TAF or approve the travel authorization in GovTrip.
According to Travel Office staff, many travel authorizations are submitted to the Travel Office with errors and have to be returned to the traveler for correction. Travel Office staff believe that employees made these errors because of inadequate training on the CFPB’s Travel Card policy as well as inadequate training on the GovTrip system. Although cardholders are required to complete online GSA training on the GTC prior to applying for a card and the Travel Office provides initial training at new employee orientation, periodic refresher training is not provided.
The Charge Card Act requires that agencies provide training on agency travel charge card policy and procedures and the use of the GTC. Without proper training, approvals and authorizations could be delayed due to errors. Such delays could result in the potential risk of increased cost for travel expenses.
While controls over the GTC issuance process were designed and operating effectively, we found that controls are not designed or operating effectively to provide reasonable assurance that cards are properly monitored and closed out. Specifically, controls for cash-advance transactions, GTC account close-outs, the travel voucher approval process, past-due notifications, and submission and approval of TAFs and travel authorizations should be strengthened. The Travel Office has not developed processes to mitigate GTC monitoring and close-out control weaknesses. Further, Travel Office controls related to voucher approvals and past-due notifications are not designed or operating effectively because of the increased workload of the Travel Office staff. Finally, the lack of refresher training contributed to CFPB staff submitting TAFs and authorizations with errors.As a result, the CFPB’s GTC program is not operating efficiently and effectively, the agency may be at increased risk of noncompliance with the requirements of the Charge Card Act, and the agency also could face reputational risk. Because our testing was performed on a selection of samples from our scope period, noncompliance may be greater than our results indicate.
We recommend that the Chief Financial Officer
The CFPB stated that it concurs with the objectives of these recommendations and is in the process of enhancing its travel program to mitigate the identified risks and promote greater accountability in the use of CFPB resources. As discussed above, these updated policies and procedures will address the recommendations above, including enhanced controls to monitor, verify, and provide notification regarding a cardholder’s account status; periodic trainings and reminders on travel card policies and procedures; and a modified travel approval process involving an open travel authorization for all employees followed by supervisor review and approval of travel vouchers. The CFPB anticipates implementing the new travel program, including the modified authorization and voucher processes, over the next several months.
The CFPB has concurred with our recommendations and is already taking actions to strengthen the internal controls for its travel card program. The CFPB will develop new or adjust existing policies and procedures, as appropriate, to incorporate our recommendations. We plan to follow up on the Office of the Chief Financial Officer’s actions to ensure that each recommendation is fully addressed.
