CFPB Report: 2014-AE-C-001 January 16, 2014
Overall, our audit determined that the CFPB has been implementing internal controls for the CPF since June 2012. For example, the CFPB developed the CPF rule and internal procedures. We also found that the CFPB has made CPF information publicly available. We determined, however, that the CFPB officials can clarify the Procedures for Civil Penalty Fund Administration. Standards for internal control state that internal controls should be clearly documented. The current practice of the Fund Administrator is to obtain case-related information in writing; however, the CFPB's Procedures for Civil Penalty Fund Administration do not state that case-related information should be collected in writing. In addition, we found that the CFPB should consolidate the CPF's information at a single location on the CFPB's public website.
The Fund Administrator collects case-related information in writing. The CFPB's Procedures for Civil Penalty Fund Administration, however, does not state that the Fund Administrator should collect case-related information from the Office of Enforcement "in writing." The procedures state, "The Fund Administrator will meet with the Office of Enforcement as needed to collect any case related data that will facilitate payments to victims," such as case status, specific orders, victim classes, harm amounts, and class victim data. The Fund Administrator stated that she frequently meets with the Office of Enforcement and obtains in writing preliminary, sensitive, case-related information, and after the case settlement, she collects data to facilitate payments to victims.
GAO's Standards for Internal Control in the Federal Government states that well-written policies and procedures ensure that management's directives are carried out. Moreover, according to GAO, all transactions, internal controls, and any other significant events should be clearly documented.
The CPF rule states that if the Fund Administrator is unavailable, the CFO will perform the functions and duties or has the authority to delegate the Fund Administrator's functions and duties to another CFPB employee. Therefore, documenting in the agency's procedures that case-related information should be collected in writing will ensure that there is a procedural history as well as clear instructions for the CFPB official assigned to perform the Fund Administrator's tasks in his or her absence.
CFPB officials explained that their understanding of the statement in the procedures--"collect any case related data that will facilitate payments to victims"--is that the data are to be collected in writing, given the nature of the information. However, if the procedures do not explicitly state that the data should be collected in writing and the current practice is discontinued, internal controls could be weakened, resulting in inconsistent decisionmaking, and transparency could be reduced, resulting in a decline of accountability.
We recommend that the CFO
In management's response, included as attachment C, the CFO stated the following regarding recommendation 1:
Management concurs with this recommendation. The OIG observed that the words "in writing" were not included in an identified section of the OCFO's Procedures for Civil Penalty Fund Administration. The identified section currently states, "On an ongoing basis, the Fund Administrator will collect and track . . . information as related to CPF allocation eligibility." It is OCFO's practice to collect and track information in writing, and consider "in writing" implicit in the above statement. However, in response to the OIG's recommendation, the OCFO will add the words "in writing" to the identified section of the procedures document.
The CFPB stated that it concurs with our recommendation and is taking action to add the words "in writing" to the identified section of the Procedures for Civil Penalty Fund Administration. In our opinion, the actions described by the CFO are responsive to our recommendation. Adding the words "in writing" to the identified section of the procedures will help to ensure that the current practice is not discontinued and that decisionmaking is consistent and transparent. We plan to follow up on the CFPB's actions to ensure that the recommendation is fully addressed.
During our audit, we found that the OCFO had not consolidated CPF information on the CFPB's public website. The OCFO manages CPF funds and activities and maintains CPF information. General CPF information is located under the "Civil Penalty Fund" heading on "The CFPB budget" page, which is accessed from the homepage by hovering over "Inside the CFPB" on the navigation bar and selecting "Budget and performance." However, reporting of key financial information required by the CPF rule, such as how funds have been allocated and distributed, was not located under the "Civil Penalty Fund" heading.
We shared our experience with CFPB officials, who responded by implementing changes to address our observation. During a subsequent review of the CFPB's website on November 25, 2013, we observed that CFPB officials added links and information to a subheading section under the "Civil Penalty Fund" heading. These links provide information related to victim compensation and direct the user to the CFO quarterly reports that contain information on funds collected and an allocation summary.
