Employee Travel Claims (EPA) (Correspondence, 07/02/96,
GAO/AIMD-96-124R).
An Environmental Protection Agency (EPA) official requested that GAO
give its opinion on whether EPA could eliminate supervisor approval of
staff travel vouchers if alternative controls that provide the same
level of assurance were implemented. GAO noted that: (1) the new EPA
travel system would replace the supervisor's approval for travel
authorization, ensure that the trip was necessary, and limit the expense
amounts claimed; (2) under the new system, each travel voucher will be
checked to determine whether the amounts claimed are reasonable and any
regulation has been violated, and if irregularities are encountered the
system would stop further processing of that voucher; (4) the proposed
system would also check to ensure that it was functioning properly, that
claims were adequately supported by documentation, and that the travel
actually took place; (5) the new system's electronic signature system
does not comply with National Institute of Standards and Technology
standards to ensure data integrity; and (6) EPA could minimize the risk
of irregularities and errors in the new system by verifying that
authorized trips were actually taken prior to payment, implementing an
effective electronic signature generation and validation process, and
reviewing the system during annual internal control reviews under the
Federal Managers' Financial Integrity Act.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-96-124R
TITLE: Employee Travel Claims (EPA)
DATE: 07/02/96
SUBJECT: Travel
Documentation
Internal controls
Federal agency accounting systems
Expense claims
Travel costs
Claims processing
Data integrity
IDENTIFIER: Joint Financial Management Improvement Program
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
July 1996
GAO/AIMD-96-124R
Employee Travel Claims (EPA)
(922227)
Abbreviations
=============================================================== ABBREV
EPA - Environmental Protection Agency
GSA - General Services Administration
JFMIP - Joint Financial Management Improvement Program
NIST - National Institute of Standards and Technology
TDY - temporary duty travel
Letter
=============================================================== LETTER
B-271913
July 2, 1996
Mr. Jack Shipley
Director, Financial Management Division
Environmental Protection Agency
Dear Mr. Shipley:
This letter responds to your February 9, 1996, request for an
interpretation of the statement in Title 7, "Fiscal Procedures," of
GAO's Policy and Procedures Manual for Guidance of Federal Agencies
requiring certain supervisory/administrative approvals when
processing vouchers for payment. Specifically, you asked if it would
be permissible to eliminate supervisor approval of staff travel
vouchers if alternative controls that provide the same level of
assurance are implemented. As described in your letter, the
Environmental Protection Agency (EPA) is replacing its existing
temporary duty travel (TDY) system with a new, fully automated one to
streamline operations and reduce the cost of government.\1 We support
initiatives to create a government that works better and costs less.
At the same time, we believe that agencies have the responsibility to
protect the government's interest.
In your letter, you mentioned that you had requested a waiver from
the General Services Administration's (GSA) requirement\2 that a
supervisory or administrative review of travel vouchers take place
prior to payment. Your staff informed us that GSA subsequently
granted a conditional waiver subject to our concurrence.
To supplement the information in your letter, we contacted your staff
to discuss the proposal in more detail. However, we did not test
your current system or the new one being designed and implemented.
Consequently, our response only addresses your proposal conceptually.
As discussed in the following sections, we identified concerns
regarding your proposal and offer three control procedures to
alleviate the concerns. Based on our understanding of your proposal,
we have no objection to its implementation provided the three
controls we suggest are effectively implemented.
--------------------
\1 The Joint Financial Management Improvement Program (JFMIP)
established an interagency team in 1994 to address travel
reengineering. The obstacles, suggested improvements, and specific
recommendations for TDY and relocation travel are documented in
JFMIP's Improving Travel Management in Government, December 1995.
You may wish to refer to JFMIP's document as your travel system
design progresses.
\2 GSA is responsible for issuing employee travel regulations, which
are published in its manual entitled, Federal Travel Regulations.
EPA'S PROPOSAL
------------------------------------------------------------ Letter :1
As explained in your letter, the primary control in EPA's new travel
system would be the approval by a supervisor or a comparable official
of a travel authorization document. Your staff explained that the
approval would (1) affirm that the trip (including location, mode of
carrier, and duration) is necessary and (2) set the limits on the
amounts for per diem, transportation, lodging, and other related
incidentals.
After a trip, a traveler would electronically input data onto a
voucher for testing within the automated system. The system would
compare amounts claimed to related amounts authorized. if amounts
claimed in any category exceed authorized levels, the system, as
designed, would suspend processing the voucher until (1) the original
travel authorization is amended for the exceeded amounts and approved
by the supervisor and (2) the new amounts are entered into the
automated system. Your staff explained that the supporting
documentation, such as paid hotel bills, would be retained centrally
in the traveler's program office for the proper retention period.\3
If the amounts claimed on the voucher do not exceed the
authorization, the system would perform numerous edit routines
comparing the amounts on the voucher against travel regulations (such
as per diem limits for travel to certain cities) to ensure that each
voucher is valid (proper, legal, accurate, and correct). If any
regulation is not adhered to, the system would suspend further
processing of the voucher until the amounts in question are adjusted
to adhere to the regulations.
Your staff explained that after travel vouchers are fully processed
and travelers are paid, a statistical sample of the universe of all
vouchers processed would be selected for testing to help provide
assurance that the system is working as intended, the claims are
adequately supported and valid, and the travel actually took place.\4
The program office would be asked to forward the supporting receipts
for those vouchers selected in the sample to the travel office for
detailed review to ensure the claims were substantiated. Any
discrepancies would be researched and resolved by the travel office.
The results of the sample and the supporting documentation would be
retained at the travel office for the proper retention period, as
specified in Title 8 of GAO's Policy and Procedures Manual.
--------------------
\3 The retention period and the storage procedures will follow the
requirements in Title 8, "Records Retention," of GAO's Policy and
Procedures Manual.
\4 EPA is currently developing a statistical sampling plan to include
the frequency of the samples, the level of confidence to be used, and
changes in the procedures that may occur over time. The plan will
follow the requirements of Title 7, "Fiscal Procedures," of GAO's
Policy and Procedures Manual and will be implemented at the same time
as the new travel system.
GAO'S ASSESSMENT OF THE
PROPOSAL
------------------------------------------------------------ Letter :2
The supervisor's approval of travel vouchers is usually required as
part of a system of controls to help ensure that all claims are valid
when certified. Generally, the supervisor's approval of a travel
voucher serves two main purposes for the certifying officer: (1) to
indicate that the claims on the voucher seem reasonable and (2) to
verify that the travel actually took place. While the first of these
purposes would be achieved under your proposal, we are concerned that
payment would be made before verifying that travel actually took
place. We are also concerned that the electronic signature
techniques used under your proposal would not ensure data integrity.
DETERMINING THE
REASONABLENESS OF CLAIMS
---------------------------------------------------------- Letter :2.1
Indicating that the claims on the voucher seem reasonable would be
achieved under your proposal when the automated system subjected the
voucher to edit routines which would compare amounts claimed to
limits set by regulations, thereby helping to establish the validity
of all claims. if any regulations are exceeded or not adhered to,
the system would suspend processing the voucher until the
discrepancies are resolved. Only then would payment be made.
Although automated controls, provided in the edit routines in your
proposal, can play a major role in determining the validity of a
claim, they cannot determine whether the claim is properly
documented. Nor can they fully replace the role of a human reviewer.
In order to supplement the automated controls, the statistical
sampling you propose will help to further ensure that the claims are
properly documented and that the system procedures and controls are
operating as intended.
If detailed automated edits of the voucher against all regulations
were effectively implemented, supplemented by an effective
statistical sampling methodology as you propose, the supervisor would
not be required to determine the reasonableness of the claims. Such
detailed edits and sampling methodology would alleviate the need for
a "reasonableness" verification by the supervisor.
VERIFYING THAT THE TRAVEL
ACTUALLY TOOK PLACE
---------------------------------------------------------- Letter :2.2
As explained by your staff, a statistical sample of vouchers planned
under your proposal would help verify that the travel actually took
place. Your staff stated that the statistical samples would include
a review of all receipts for the selected vouchers including hotel
receipts, which would be used to help validate that the travel
actually occurred. We believe, however, that it is important to
verify that the travel actually took place on each voucher prior to
payment.
Several alternative procedures could be implemented to verify that
travel actually took place without requiring a supervisory approval.
For example, employees could be required to use the agency designated
charge card for hotel and rental car costs. When the travel voucher
is being processed, the automated system could compare the
information on the actual charges processed by the charge card
company to those claimed on the voucher. When a "match" occurs, a
verification of the actual trip would be made. Where no such match
is found, the travel office could request the hotel receipts to
verify out-of-town lodging costs. Properly implemented, this
approach provides reasonable assurance that a trip occurred.
According to your staff, the cost- effectiveness of various
procedures to verify that travel actually occurred before payment is
processed will be assessed as the design progresses with a view
toward implementing one before the system is fully operational.
ENSURING DATA INTEGRITY
---------------------------------------------------------- Letter :2.3
Since your new travel system would be fully automated when
implemented, many important records would be maintained in electronic
format. As we previously reported,\5 any system, regardless of the
technology used, must incorporate adequate controls to ensure data
integrity. Your proposed system would require electronic signature
for the traveler, supervisor (when approving the travel
authorization), and the certifying officer to ensure data integrity
for all the information approved. We believe that proper electronic
signatures\6 --which follow the National Institute of Standards and
Technology's (NIST) requirements\7 and are effectively
implemented--would ensure data integrity for electronic records.
As explained by your staff, your system design would incorporate a
commercial system containing a signature module. This commercial
system is similar to ones we have assessed in other agencies under
similar requests. Based on our experience with these systems,\8 the
electronic signatures do not fully comply with the criteria contained
in 71 Comp. Gen. 109 (1991) or NIST's requirements. Specifically,
the electronic signature generation and validation processes do not
incorporate the algorithm, validation techniques, and implementation
guidance set forth in NIST's requirements.
As we have discussed with your staff, we have not sanctioned
electronic signature modules using algorithms and techniques not
meeting the requirements of NIST.\9 We have explained to your staff
some improvements--including compliance with NIST standards and
signature verification techniques--that we believe are needed in the
electronic signature module of your system to ensure data integrity.
--------------------
\5 Electronic Imaging (GAO/AIMD-95-26R, November 10, 1994).
\6 To ensure data integrity, an electronic signature must be (1)
unique to the signer, (2) under the signer's sole control, (3)
capable of verification, and (4) linked to the data covered by the
signature in such a manner that if the data are changed, the
signature is invalidated. (See generally 71 Comp. Gen. 109
(1991).)
\7 Under the requirements of the Computer Security Act (15 U.S.C.
278g-3), NIST is responsible for establishing standards for federal
computer systems that process sensitive but unclassified information.
\8 Three examples are DOD's Reengineered Travel System Efforts
(GAO/AIMD-96-62R, March 8, 1996); Air Force Automated Travel System
(GAO/AIMD-95-74R February 14, 1995); and Employees' Travel Claims
(GAO/AIMD-95-71R, February 6, 1995).
\9 RCAS Authentication (GAO/AFMD-93-70R, May 4, 1993).
CERTAIN PROCEDURES WOULD
ALLEVIATE INTERNAL CONTROL
CONCERNS
---------------------------------------------------------- Letter :2.4
Although Title 7 gives agencies flexibility to implement payment
systems that best suit their needs, the two potential problems we
have identified could arise under your proposal. Including the
following three procedures or controls in your new system would
address these problems and minimize the risk of irregularities and
errors:
-- when the new system is fully designed and implemented, verifying
that authorized trips were actually taken by employees prior to
payment on travel vouchers;
-- implementing an effective electronic signature generation and
validation process that complies with NIST requirements and
satisfies the previously mentioned criteria for the signature of
the traveler, approving official, and certifying officer; and
-- for the first year the system is operational, emphasizing its
review during the annual internal control reviews under the
Federal Managers' Financial Integrity Act.
---------------------------------------------------------- Letter :2.5
The contents of this letter were discussed with Joe Dillon and Krista
Wright of your staff. If you have any questions or would like to
discuss these matters further, please contact Bruce Michelson,
Assistant Director, at (202) 512-9366.
Sincerely yours,
Robert W. Gramling
Director, Corporate Audit and Standards
*** End of document. ***