Air Force Automated Travel System (Correspondence, 02/14/95,
GAO/AIMD-95-74R).
Pursuant to an Air Force request, GAO reviewed the operation of the
automated travel system (FASTravel) at Langley Air Force Base and the
Pentagon, focusing on: (1) the acceptability of electronic travel
records in lieu of paper travel records; (2) whether the Defense Finance
and Accounting Service (DFAS) could rely on externally-generated
electronic records to record obligations and generate disbursements; and
(3) how the system would affect GAO travel record retention
requirements. GAO noted that: (1) the Air Force could conduct a limited
test of its FASTravel system; (2) although electronic records and
signatures can replace paper documents, the system contains several
internal control weaknesses in its electronic signature techniques; (3)
the system's electronic signature validation processes are inadequate;
(4) DFAS could rely on electronic travel records if adequate internal
controls are implemented; (5) the FASTravel system would require
individual travelers to retain travel receipts at their place of
employment for a specific period of time; and (6) Air Force travelers
will need detailed guidance on the new record retention policies and
training on their record retention responsibilities.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-95-74R
TITLE: Air Force Automated Travel System
DATE: 02/14/95
SUBJECT: Air Force procurement
Internal controls
Testing
Computer software verification and validation
Computerized information systems
Electronic equipment
Electronic forms
Records retention
Transportation expense claims
Travel allowances
IDENTIFIER: Air Force FASTravel System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
February 1996
GAO/AIMD-95-74R
Air Force Automated Travel System
(511475)
Abbreviations
=============================================================== ABBREV
DFAS - Defense Finance and Accounting Service
FASTravel - Air Force's automated travel system
NIST - National Institute of Standards and Technology
Letter
=============================================================== LETTER
B-259558
February 14, 1995
Mr. George V. Cava
Comptroller
11th Support Wing
Financial Management and Comptroller
Department of Air Force
Dear Mr. Cava:
This letter responds to your January 26, 1995, request that we
sanction the operation of your automated travel system (FASTravel) at
Langley Air Force Base and the Pentagon for a 1-year test. You
requested our views on whether (1) electronic travel records can
replace paper travel orders and travel vouchers, (2) a Defense
Finance and Accounting Service (DFAS) disbursing officer can rely on
electronic records generated outside of his/her control to record
obligations and generate disbursements, and (3) GAO requires that
travel receipts be retained by a disbursing officer or an Air Force
Finance Office.
We reviewed the material attached to your letter and other
information provided by your staff and believe that a limited test is
warranted. We did not test your current or proposed system, and,
consequently, our response only addresses your proposal conceptually.
The following discusses our views on these issues in more detail.
ELECTRONIC RECORDS AND
SIGNATURES CAN REPLACE PAPER
DOCUMENTS
------------------------------------------------------------ Letter :1
GAO has long recognized that agency records need not be maintained in
their original paper form. For example, we have found microfilm and
similar technologies to be acceptable for storing the data on paper
documents. A 1991 Comptroller General decision, 71 Comp. Gen. 109
(1991), addressed whether government contracts generated and stored
electronically rather than on paper satisfied a statutory requirement
that the contract be "in writing." In this decision, we stated that
electronic technology that allows the data "to be examined in human
readable form, as on a monitor, stored on electronic media, recalled
from storage and reviewed in human readable form," can provide data
integrity that is equal to that of a paper document. We also noted
that although electronic documents are stored in a different manner
than paper documents, they ultimately take the form of visual
symbols.
As stated in that decision, we believe that it is sensible to
interpret federal law in a manner to accommodate technological
advancements unless the law by its own terms expressly precludes such
an interpretation, or sound public policy reasons exist to do
otherwise. We are not aware of any law or public policy that
generally requires travel records such as yours to be retained in
paper form.
As we noted in a November 1994 letter to DFAS,\1 any system,
regardless of the technology used, must incorporate adequate controls
to ensure the integrity of the data. Your proposed system would use
electronic signature techniques for the necessary data integrity.
However, based on the information provided and discussions with your
staff, FASTravel has weaknesses in the electronic signature
techniques used. These weaknesses, as we will discuss, are
significant enough to preclude the widespread use of your system and
prevent your system from meeting the electronic signature criteria
contained in 71 Comp. Gen. 109 (1991). We can support a limited
test because you have adopted special techniques and other controls
that should reduce your risks to an acceptable level. We were also
assured that the controls discussed in this letter and those
described to us will be implemented properly and that additional
control improvements will be incorporated as experience is gained.
Our concerns with the electronic signature techniques involve the
signature generation and validation process. For example, the
electronic signatures are not generated in accord with the procedures
outlined in the applicable Federal Information Processing Standard
published by the National Institute of Standards and Technology
(NIST),\2 and the signature validation techniques are inadequate. We
do not sanction electronic signature systems that use algorithms and
techniques not approved by NIST.\3 We have discussed with your staff
some of the improvements, including compliance with NIST standards
and signature verification techniques, that we believe are needed in
your electronic signature system before widespread implementation and
were promised that such improvements would be made. As agreed, we
will continue to work with you and your staff on identifying the
specific changes that are needed.
--------------------
\1 Electronic Imaging (GAO/AIMD-95-26R, November 10, 1994).
\2 This standard provides the algorithm and implementation guidance
for the electronic signature methodology used in FASTravel. Under
the requirements of the Computer Security Act (15 USC 278g-3(a)(3)),
NIST is responsible for establishing standards for federal computer
systems that process sensitive but unclassified information.
\3 RCAS Authentication (GAO/AFMD-93-70R, May 4, 1993).
A DISBURSING OFFICER CAN RELY
ON ELECTRONIC RECORDS WHEN
ADEQUATE CONTROLS HAVE BEEN
IMPLEMENTED
------------------------------------------------------------ Letter :2
An agency is required by 31 U.S.C. 3512(c)(1) to establish and
maintain a system of adequate internal controls to safeguard
government resources. Appendix II of GAO's Title 2,\4 also directs
each agency to have an effective system to monitor the implementation
of and ensure the adequacy of its internal control structure. This
includes a requirement that agencies test their controls in
sufficient scope, depth, and frequency to provide reasonable
assurance that key processing procedures are working and reliable.
As noted in GAO's Title 7,\5 disbursing officers must ensure the (1)
propriety of the voucher, (2) legality of disbursements, (3)
correctness of computations, and (4) accuracy of the facts stated on
the vouchers and supporting records.
In the current paper-based process, the disbursing officer satisfies
these requirements by obtaining and reviewing a signed paper document
along with any necessary supporting documentation, such as rental car
and hotel receipts. All the information and documentation needed to
accomplish the disbursing officer's responsibilities are maintained
and processed by DFAS's systems.
FASTravel would radically change this traditional approach. The
disbursing officer would routinely rely on electronic information
generated at the travel locations and would not have the paper
documentation.\6 For example, the detailed travel information would
be maintained and audited for compliance at an Air Force travel
office and not by the DFAS disbursing officer.
You asked our views on whether a DFAS disbursing officer could rely
on FASTravel electronic records and the associated system of internal
controls or whether, in this case, a disbursing officer would be
needed at the Air Force location to verify the data for the DFAS
disbursing officer. (Enclosure I describes our understanding of how
you plan to use FASTravel and your proposed internal control
structure.)
When a disbursing officer is confronted with a high volume of
transactions and geographic dispersion of activities, it may be
impractical for the disbursing officer to examine personally each
individual transaction. GAO has recognized that to fulfill their
responsibilities, disbursing officers will need to rely on a system's
internal controls and personnel who process transactions. Title 7
discusses this concept and the disbursing officer's responsibilities
to ensure that an adequate internal control system is used and the
system is reasonable. We believe the proposed approach, if properly
implemented, will permit the DFAS disbursing officer to meet these
requirements. Therefore, disbursing officers would not be needed at
other locations.
--------------------
\4 "Accounting," GAO's Policy and Procedures Manual for Guidance of
Federal Agencies.
\5 "Fiscal Guidance," GAO's Policy and Procedures Manual for Guidance
of Federal Agencies.
\6 When necessary, the proposed system would allow disbursing
officers to obtain the paper records or any other information they
need to support a payment.
MOST RECEIPTS MAY BE RETAINED
BY TRAVELERS
------------------------------------------------------------ Letter :3
Currently, travelers submit receipts for audit and retention to DFAS.
Title 7 recognizes that alternatives may be used when the
government's interests are protected. For example, in a recent
letter to the Department of State, we approved a similar proposal to
allow travelers to retain their receipts.\7 Under FASTravel, the
traveler would be required to maintain the necessary receipts at his
or her place of employment\8 for the period specified by your current
records retention requirements. A statistical sampling methodology,
in accordance with GAO's Title 7 requirements and approved by DFAS,
would then be used to select vouchers for audit by an Air Force
finance official at the FASTravel location.
When a voucher has been selected for audit, the employee would be
required to submit the necessary receipts, and the voucher would be
audited using procedures that have been approved by the FASTravel
location and DFAS. These records would then be retained at the local
FASTravel Finance Office in accordance with current records retention
requirements. Enclosure II outlines our understanding of the
sampling and records retention concepts that you plan to use.
Your staff believe that the sample results help assure both the
FASTravel location and the disbursing officer that the controls are
working as designed and that claims are properly documented. They
also noted that processing and storing unneeded paper is costly and
unproductive.
We note that your proposal appears to require a significant change in
culture. As a result, Air Force travelers will need detailed
guidance and training on their record retention responsibilities.
Properly implementing the proposed approach provides an acceptable
alternative to reduce the amount of paper that must be retained and
processed by management while providing reasonable assurance to the
disbursing officer that sufficient evidence exists to validate a
claim.
--------------------
\7 Employees' Travel Claims (GAO/AIMD-95-71R, February 6, 1995).
\8 If an employee separates from the location where the travel
voucher is processed before 120 days has elapsed, then the receipts
would be provided to the Finance Office and retained in accord with
the current records retention requirements.
---------------------------------------------------------- Letter :3.1
We are pleased to sanction the operation of FASTravel, on a test
basis involving Langley Air Force Base and the Pentagon, for a 1-year
period to begin in February 1995. This letter does not constitute
GAO approval of your financial management system, as defined by 31
U.S.C. 3512(f)(2).
We recognize the challenges that your agency faces in automating its
administrative systems and appreciate the opportunity to comment on
your travel system. We hope that our comments will assist your
efforts. Should you have any questions, please contact Chris Martin,
Assistant Director, at (202) 512-9481.
Sincerely yours,
Rona B. Stillman
Chief Scientist for Computers
and Communications
Enclosures - 2
GAO'S UNDERSTANDING OF HOW THE AIR
FORCE'S APPROACH WILL HELP
DISBURSING OFFICERS PROPERLY
DISCHARGE THEIR RESPONSIBILITIES
=========================================================== Appendix I
This documents GAO's understanding, based on discussions with Air
Force and DFAS staff, of how the FASTravel system would satisfy the
Title 7 responsibilities for disbursing officers. We did not perform
any tests of the current or proposed system and, consequently, our
response only addresses the proposal conceptually.
PROPRIETY OF THE VOUCHER
--------------------------------------------------------- Appendix I:1
In the current system, a paper voucher, approved by DFAS and the
Department of the Treasury, is used to document a travel claim.
Since electronically stored data cannot be understood by a human
without taking the form of visual symbols, FASTravel must be able to
convert the data stored electronically into a human readable form and
generate it in a format that is acceptable to DFAS and Treasury. We
understand that DFAS will review and approve the FASTravel report
formats that are considered official representations of the travel
data.
LEGALITY OF DISBURSEMENTS
--------------------------------------------------------- Appendix I:2
A disbursing officer is required to ensure that a disbursement is in
accord with an appropriation's purpose, amount, and time the
appropriation is available for expenditure. Each of these is
discussed below.
APPROPRIATION PURPOSE
------------------------------------------------------- Appendix I:2.1
A disbursement can be made only against an appropriation for purposes
authorized by law. For example, if an appropriation is not available
for travel, then the disbursing officer cannot disburse funds for
travel costs against that appropriation. Your proposal uses three
control methods to ensure compliance with purpose
restrictions--automated edits, approving officials, and statistical
sampling--before a disbursement is generated.
First, as we understand your proposal, DFAS would identify the
funding accounts available to pay travel costs. Then, the location
implementing FASTravel would ensure that FASTravel uses only accounts
approved by DFAS.\1 Next, automated edits would ensure that travel
data are charged only to approved accounts. In addition, when the
data are received from the FASTravel location, the disbursing officer
would use automated edits to verify that travel is only charged to
approved accounts.
As noted elsewhere in this letter, approving officials and
statistical sampling are also to be used to assure the disbursing
officer that the travel is in accord with an appropriation's purpose.
For example, we understand an approving official would verify that
the purpose of the trip is for the stated reason. The vouchers
selected by statistical sampling would then be audited to ensure that
this control has been effectively implemented.
--------------------
\1 A location may decide that it does not want travel charged to
specific accounts allowed by DFAS and could restrict such charges.
However, it cannot add accounts that have not been approved by DFAS.
APPROPRIATION AMOUNT
------------------------------------------------------- Appendix I:2.2
A disbursing officer is not allowed to disburse amounts that exceed
the amount appropriated by law and the corresponding apportionments
and allotments. FASTravel and DFAS would use automated edits to
prevent this occurrence. For example, as we understand it, FASTravel
would verify that funds are available before allowing the approval of
a travel order and before a disbursement request is sent to DFAS. It
is our understanding, that when DFAS receives the data, it also would
perform automated funds availability checks.
TIME AVAILABILITY OF AN
APPROPRIATION
------------------------------------------------------- Appendix I:2.3
Obligations can be incurred and disbursements charged against an
appropriation and the corresponding apportionments and allotments
only for the time period specified by the appropriations law during
the time the appropriation is available. We also understand that the
FASTravel and DFAS systems would have edits to ensure that these
requirements are met.
CORRECTNESS OF COMPUTATIONS
--------------------------------------------------------- Appendix I:3
Your staff explained that FASTravel would use automated methods to
compute travel claims and ensure that the resulting computations
comply with DFAS requirements. For example, FASTravel would compute
the per diem due an employee by multiplying the rate approved by DFAS
for the travel location by the time spent at that location. Since
the disbursing officer would be expected to rely on the computation
methologies in FASTravel, we understand that DFAS would be
responsible for determining whether FASTravel's rates and
computations are correct. In addition, the location implementing
FASTravel is responsible for ensuring that FASTravel only uses rates
approved by DFAS and that any changes in computation methods are
approved by DFAS. Further, to ensure that the system has not been
improperly modified, we were told DFAS and the operating location
would periodically review selected FASTravel systems to ensure that
the proper rates and computation methodologies are being used.
ACCURACY OF THE DATA ON THE
VOUCHERS AND SUPPORTING RECORDS
--------------------------------------------------------- Appendix I:4
As explained to us, FASTravel also would use approving officials,
automated edits, and statistical sampling to ensure that the
information contained on a voucher is accurate and properly
supported. Your staff believes, and we concur, that this approach
can satisfy the requirement that disbursements are based on properly
supported vouchers containing accurate information.
ROLE OF APPROVING OFFICIALS
------------------------------------------------------- Appendix I:4.1
The Air Force proposal would use an approving official (normally an
employee's supervisor) who has knowledge of the employee's travel to
help the disbursing officer\2 assess whether the information
contained on a voucher is reasonable. For example, the approving
official should know that departure and arrival times and charges
incurred for phone calls are reasonable.
The Air Force proposal also would define explicitly the
responsibilities of approving officials and disbursing officers and
ensure that these individuals, through training sessions and other
methods, understand them. We understand that these responsibilities
would be formally documented and approved by DFAS. In addition, DFAS
and the FASTravel locations would conduct periodic tests to determine
whether the approving officials understand, and are fulfilling, their
responsibilities.
--------------------
\2 An approving official is not a disbursing officer.
AUTOMATED EDITS AND
STATISTICAL SAMPLING
------------------------------------------------------- Appendix I:4.2
Although the approval process is a critical control, it will not
ensure by itself that the claims shown on a travel voucher are
properly documented or are in accord with DFAS requirements. For
example, the approving official is not required to verify that the
amount shown on the voucher for lodging (1) agrees with the receipt
obtained by the traveler and (2) is in accordance with DFAS
requirements. However, FASTravel would address this requirement by
using automated edits and statistical sampling.
We understand that FASTravel would have numerous edits to assist the
disbursing officer and others in assuring the accuracy of a claim.
As it was explained to us, DFAS would be responsible for specifying
the edits that must be implemented at all FASTravel locations and how
exceptions should be handled. The Air Force location implementing
FASTravel would be responsible for ensuring that the DFAS edits are
properly implemented. This would include ensuring that exceptions
are handled in accord with DFAS approved procedures. Each location
also could add or modify edits to improve the integrity of the
process. For example, DFAS may require that vouchers claiming more
than $50 in phone calls be reviewed by an appropriate official. The
location operating FASTravel may decide to use more stringent
criteria such as reviewing any voucher claiming over $10 in phone
calls. We were told that periodically, DFAS and the operating
location would review selected FASTravel systems to ensure that the
proper edits have been implemented.
We note that FASTravel would use automated edits and computations to
ensure that the travel claims comply with DFAS requirements. For
example, DFAS may require that per diem costs to a particular city
not exceed $75 per day. FASTravel would take the data entered by the
traveler and ensure that this limit has been not been exceeded. It
also would compute the amount due the traveler. It is our
understanding that DFAS would review the FASTravel system to
determine that it has implemented the proper edits and computation
methodologies. Although automated edits assist in determining the
validity of a claim, they cannot determine whether the claim is
properly documented nor can they fully replace the role of a human
reviewer. As noted in the above letter, you plan to use statistical
sampling to provide additional assurances. Also, the results of your
1-year test should help DFAS formulate effective approaches to ensure
the integrity of all FASTravel software.
FASTRAVEL SAMPLING AND RECORDS
RETENTION CONCEPTS
========================================================== Appendix II
The following outlines our understanding of the sampling concepts
that are planned for FASTravel.
-- All vouchers that exceed $2,500 would be audited.
-- During the first 3 months, the finance office at each FASTravel
location would select 50 percent of the payment vouchers
submitted for audit. They will be audited in accord with local
procedures which will incorporate applicable DFAS requirements.
-- The sample results for the first 3 months will be evaluated to
determine the electronic records' accuracy. If these sample
results provide reasonable assurance that the claims are
accurate and properly supported, then a monthly statistical
sampling\1 approach would be adopted. These samples should
provide reasonable assurance that the electronic data accurately
represent the underlying supporting data and identify any needed
corrective actions. DFAS would approve the sampling methodology
used.
-- Employees would receive training and other information on their
responsibilities for maintaining supporting documentation before
being allowed to use FASTravel.
-- Procedures would be implemented to ensure that departing
employees provide to the finance office the receipts for any
travel during the prior 120 days before FASTravel begins
operation. These procedures include formally notifying
departing employees of their responsibilities--and how long--to
maintain their travel receipts. Also, the receipts obtained by
the finance office would be maintained in accord with current
records retention requirements.
-- The results and documentation for all samples would be
maintained at the FASTravel location's finance office. The
results would also be forwarded to the appropriate disbursing
officer and DFAS would periodically review selected samples and
the methodology employed at selected FASTravel locations to
ensure that they comply with DFAS guidelines.
-- All sample results and associated documentation would be
maintained in accord with current record retention guidelines
for travel records.
--------------------
\1 All statistical samples would employ a methodology that
conforms to GAO's Title 7 requirements.
*** End of document. ***