Employees' Travel Claims (USIA) (Correspondence, 05/19/95,
GAO/AIMD-95-138R).
Pursuant to an agency request, GAO reviewed whether the U.S. Information
Agency's (USIA) proposed travel claims processing system conforms with
the requirements of the GAO Policy and Procedures Manual. GAO noted
that: (1) certifying officials will have sufficient support to routinely
approve and certify travel vouchers without documentation and to ensure
that electronic signatures are sufficient to maintain data integrity;
(2) the proposal should highlight the certifying officer's
responsibility to require supporting documentation before certification,
evaluate the electronic signature generation and validation process, and
annually review the system's internal controls; and (3) it has no
objections to the system's implementation provided certain procedures
are effectively implemented to alleviate internal control concerns.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-95-138R
TITLE: Employees' Travel Claims (USIA)
DATE: 05/19/95
SUBJECT: Federal employees
Travel costs
Transportation expense claims
Claims processing
Data integrity
Documentation
Certifying officers
Travel allowances
Internal controls
Computer software verification and validation
IDENTIFIER: Joint Financial Management Improvement Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
May 1995
GAO/AIMD-95-138R
Employees' Travel Claims (USIA)
(922215)
Abbreviations
=============================================================== ABBREV
FIPS - Federal Information Processing Standard
GSA - General Services Administration
JFMIP - Joint Financial Management Improvement Program
NIST - National Institute of Standards and Technology
NPR - National Performance Review
USIA - United States Information Agency
Letter
=============================================================== LETTER
B-260570
May 19, 1995
Mr. Henry Howard, Jr.
Associate Director for Management
United States Information Agency
Dear Mr. Howard:
This letter responds to your January 9, 1995, request that we provide
our views on whether your proposed system of processing employee
travel claims conforms to the requirements in Title 2, "Accounting,"
and Title 7, "Fiscal Procedures," of GAO's Policy and Procedures
Manual for Guidance of Federal Agencies. In your request, you
mentioned that the General Services Administration (GSA)\1 waived
several items in your proposal related to GSA requirements, provided
your proposal did not conflict with the requirements of the GAO
Policy and Procedures Manual.
As we understand it, this new system is part of the United States
Information Agency's (USIA) effort to streamline its processing of
employee travel claims in response to the National Performance Review
(NPR) initiative to simplify administrative processes. As you know,
in line with the NPR initiative, the Joint Financial Management
Improvement Program (JFMIP) is examining governmentwide travel
procedures in an effort to streamline the processes. As it
progresses, the JFMIP project should provide useful information to
consider regarding your proposed system.
To more fully understand your request, we contacted your staff to
discuss the proposal in more detail. However, we did not perform any
tests of your current or proposed systems and, consequently, our
response only addresses your proposal conceptually.
As discussed in this letter, we identified two concerns regarding
your proposal and offer three control procedures to alleviate the
concerns. Based on our understanding of your proposal, we have no
objection to its implementation provided that the three controls we
suggest are effectively implemented.
--------------------
\1 GSA is responsible for issuing employee travel regulations, which
are published in its manual entitled Federal Travel Regulations.
USIA'S PROPOSAL
------------------------------------------------------------ Letter :1
Your proposal eliminates the need for employees to forward receipts
with travel vouchers for certification of all lodging,
transportation, and other expenses. Instead, the receipts and
related documents would be retained at the traveler's duty station
for the applicable records retention period. Also, the proposal
calls for employees to be reimbursed for (1) lodging at the actual
amount up to the specified maximum for the travel location and (2)
meals and related incidental expenses at the maximum flat-rate for
the travel location.
You also propose to automate your travel system.\2 USIA would adopt,
with modifications, the commercially available software, "Travel
Manager Plus." In this system, employees would submit their travel
vouchers electronically for approval and certification without any
supporting documents. Employees would attest to the claims with an
electronic signature. As we understand it, the lodging expense
amounts would be listed separately on the voucher while meals and
related incidental expenses would be listed at the maximum flat-rate,
and all other expenses under $75 would be summarized under seven
categories appearing on the electronic screen for approval. Your
staff stated that the detailed data regarding expenses under $75 in
each of the seven categories would also be maintained in the
electronic system and could be retrieved from the system for review
by the person approving or certifying the voucher. These detailed
data would be maintained in an electronic file with the voucher for
the same period.
We were told that, under the new system, each travel voucher would be
examined and approved by the traveler's supervisor or equivalent
official, usually assigned to the traveler's duty station. That
official would have access to the documentary support if he or she
wished to see it. The official's approval, provided electronically,
would indicate that the (1) travel had actually been taken and was
for official business and (2) charges seem reasonable. Your staff
further explained that the vouchers and related details would be
forwarded electronically to the certifying officer. Each voucher
would be certified electronically based on propriety, correctness,
and accuracy.
A sample of claims submitted would be selected monthly, prior to
payment, to test the validity of the travel claims. Your staff
stated that statistical samples would be drawn at headquarters, prior
to payment, and would conform to the requirements of Title 7 of the
GAO Policy and Procedures Manual. Your staff explained that for each
voucher in the sample, the traveler's duty station would be required
to forward all relevant documents. Once headquarters received the
documents, the voucher would be fully examined for propriety and
accuracy.
Your staff also explained that a substantial training effort will be
undertaken to ensure that USIA staff effectively implement the
proposal. Part of the training, they explained, will be devoted to
staff at each duty station who retain the travel receipts and related
documents. The training will focus on document retention and storage
procedures and will specify the applicable requirements contained in
Title 8, "Records Retention," of the GAO Policy and Procedures Manual
and the General Services Administration's "General Records
Schedules."
--------------------
\2 USIA proposes to fully implement the system domestically and,
after about a year, implement it in all of its overseas offices.
GAO'S ASSESSMENT OF THE
PROPOSAL
------------------------------------------------------------ Letter :2
Regarding Titles 2 and 7, your request raises two issues: (1)
whether designated officials will have sufficient detail and support
needed to routinely approve and certify travel vouchers if the hard
copy supporting documentary evidence, such as receipts, is not
forwarded to them, and (2) whether the electronic signatures used by
the traveler and in the approval and certification functions contain
the necessary controls to ensure data integrity.
APPROVING AND CERTIFYING
PAYMENT
---------------------------------------------------------- Letter :2.1
Title 7 requires that approval and certification of payments be based
on sufficient evidence to establish the validity of a claim.
Traditionally, approval and certification of payment on travel
vouchers has been based on review of the supporting documents that
accompany the voucher.
As we have previously reported,\3 Title 7 does not require that
supporting documentation be forwarded along with requests for
approval or certification of travel vouchers if adequate controls
compensate for the absence of attached documentation. Your proposal
provides for several compensating controls. The approving official,
who usually would be the traveler's supervisor, should know that the
travel actually occurred and the purpose of it, and will review the
charges for reasonableness. He or she will have access to the
supporting documentary receipts if needed for review. Also, a
prepayment statistical sampling procedure would be conducted to test
vouchers for accuracy, propriety, and sufficiency of underlying
documentation. If these controls are effectively implemented,
management should have reasonable assurances that the approval and
certification functions are operating properly.
Because of his or her responsibility, a certifying officer may
require the supporting documentation to be provided prior to
certification, even if the travel claim being reviewed is not
selected in the sample for which all supporting documents would be
reviewed. We believe the certifying officer's responsibility for
ensuring proper payment should be made clear to USIA's staff so that
they are aware that such a request could be made.
--------------------
\3 Employees' Travel Claims (GAO/AIMD-95-71R, February 6, 1995).
ELECTRONIC SIGNATURES
---------------------------------------------------------- Letter :2.2
Electronic signatures generated by and validated in data processing
systems should provide necessary data integrity by helping to ensure
against system errors and irregularities. Electronic signatures that
are (1) unique to the signer, (2) under the signer's sole control,
(3) capable of being verified, and (4) linked to the data in such a
way that if the data are changed the signature is invalidated\4 can
provide such integrity. The National Institute of Standards and
Technology\5 (NIST) has established procedures for the evaluation and
approval of certain electronic signature techniques to ensure that
they satisfy those four criteria.
We have not reviewed any systems currently in operation at USIA or
the methodology used to generate and validate the electronic
signatures in your automated accounting system. However, as we
understand the Travel Manager Plus software,\6
it does not incorporate some of the key control features just
itemized for effective signatures, even though the vendor is
currently working on modifying the software so that it will contain
these features. For example, our understanding is that the
signatures are not generated in accordance with the procedures in the
applicable Federal Information Processing Standard (FIPS) promulgated
by NIST. Also, certain techniques necessary for effective control
are not used in the signature verification process. Your staff
stated that USIA will be working with the vendor of the Travel
Manager Plus software to move towards implementing valid electronic
signatures achieving the four previously mentioned criteria.
--------------------
\4 See 71 Comp. Gen. 109 (1991).
\5 Under the requirements of the Computer Security Act, NIST is
responsible for establishing standards for federal computer systems
that process sensitive but unclassified information.
\6 Air Force Automated Travel System (GAO/AIMD-95-74R, February 14,
1995).
CERTAIN PROCEDURES WOULD
ALLEVIATE INTERNAL CONTROL
CONCERNS
---------------------------------------------------------- Letter :2.3
We support initiatives to create a government that works better and
costs less. At the same time, we believe that agencies have the
responsibility to protect the government's interest. Improvements to
streamline the employee travel payment process should be made only
within a framework of adequate controls that reasonably ensure that
payment transactions are properly authorized and sufficient records
of these transactions are maintained. Although Titles 2 and 7 allow
flexibility to permit agencies to implement payment systems that best
suit their needs, the preceding discussion has identified two
potential problems that could arise under your proposal.
To address these potential problems, and to minimize the risk of
irregularities and errors, your proposal should include the following
three procedures or controls.
-- A segment of the planned training should highlight the
certifying officer's responsibility and the fact that he or she,
upon review of a voucher, may require that the supporting
documentation be provided before certification.
-- The electronic signature generation and validation process, upon
completion of your staff's work with the vendor, should comply
with FIPS and satisfy the four previously mentioned criteria for
the signatures of the traveler, approving official, and the
certifying officer.
-- The first year the system is operational, you should especially
emphasize its review during the annual review of internal
controls under the Federal Managers' Financial Integrity Act.
In future years, you should emphasize determining if the central
locations at each office are maintaining supporting travel
documentation for the applicable records retention period.
---------------------------------------------------------- Letter :2.4
We discussed our position with Mr. Michael Carroll of your staff. I
hope our comments are helpful as you look for ways to streamline your
administrative processes and reduce the cost of government.
If you have any questions or would like to discuss these matters
further, please contact Bruce Michelson, Assistant Director, at (202)
512-9366.
Sincerely yours,
John W. Hill, Jr.
Director, Financial Management
Policies and Issues
*** End of document. ***