TITLE:  Transportation Security Administration's Proposed Time and, B-291001, December 23, 2002
BNUMBER:  B-291001
DATE:  December 23, 2002
**********************************************************************
Transportation Security Administration's Proposed Time and, B-291001, December
23, 2002

   Decision
    
    
Matter of:   Transportation Security Administration's Proposed Time and
Attendance System
    
File:            B-291001
    
Date:           December 23, 2002
    
DIGEST  
    
Transportation Security Administration (TSA) certifying officers expressed
three concerns with TSA's new Time and Attendance (T&A) approval system. 
In their view,  (1) approval is not occurring at the appropriate level,
(2) data will not be checked against independent sources, and (3) the
proposed rounding of an employee's start/stop time minutes will not
provide a complete and accurate agency record.  Based on our discussions
with TSA officials, we determined that, in accordance with Title 6 of
GAO's Policy and Procedures Manual for Guidance of Federal Agencies,
first-line supervisors are approving T&A data.  These supervisors have
personal knowledge of the time worked of the employees involved;
therefore, they are not required to check the data against independent
sources.  In addition, TSA will maintain actual original entry records
along with a trail of all changes to data to support what we consider to
be the immaterial rounding of employee time in and time out data.  TSA
management, however, should build additional control-related steps into
the T&A approval system as it further develops and implements the system.
    
    
DECISION
    
Pursuant to 31 U.S.C. S: 3529(a), four certifying officers at the
Department of Transportation (DOT) asked us whether the method of
approving an employee's time and attendance (T&A) information in the T&A
system to which the Transportation Security Administration (TSA) is
transitioning meets the requirements of Title 6[1] of GAO's Policy and
Procedures Manual for Guidance of Federal Agencies (Policy and Procedures
Manual).  The certifying officers also asked whether GAO would relieve a
certifying officer pursuant to 31 U.S.C. S: 3528(b)(1)(A) if a certifying
officer certified an improper or illegal payment in reliance on the new
T&A approval system. 
    
A certifying officer's liability is strict; however, a certifying officer
may request a decision from the Comptroller General in advance of payment
when he or she is uncertain regarding his or her authority to make or
authorize particular payments.  31 U.S.C. S: 3529.  In this regard, the
certifying officers expressed three concerns with the new T&A approval
system.  In their view,  (1) approval is not occurring at the appropriate
level, (2) data will not be checked against independent sources, and
(3) the proposed rounding of an employee's start/stop time minutes will
not provide a complete and accurate agency record.  Based on our
discussions with TSA officials, we determined that, in accordance with
Title 6, first-line supervisors are approving T&A data.  Because these
supervisors will have personal knowledge of the time worked of the
employees involved, they are not required to check the data against
independent sources.  We also determined that TSA will maintain actual
original entry records along with a trail of all changes to data to
support what we consider to be the immaterial rounding of employee time in
and time out data.
    
We have identified additional control-related steps that TSA management
should build into the T&A approval system as it further develops and
implements the system.  To better support a future request for certifying
officer relief should the system, in fact, generate an improper payment,
TSA officials should implement the system as described to us, and build
into the system the control-related steps that we discuss herein.
    
Background

 

Standard for Relief

    
Certifying officers are responsible for the legality of proposed payments
and for repaying any payment that was *illegal, improper, or incorrect
because of an inaccurate or misleading certification.*  31 U.S.C. S:
3528(a).  A certifying officer's legal liability is strict and arises
automatically at the time of an illegal or improper payment.  54 Comp.
Gen. 112, 114 (1974).  A certifying officer may request a decision from
the Comptroller General in advance of payment when he or she is uncertain
regarding his or her authority to make, or authorize the making of,
particular payments.  31 U.S.C. S: 3529.  A certifying officer may rely on
this advance decision when certifying future payments.  This Office also
has authority pursuant to
31 U.S.C. S: 3528(b)(1) to relieve a certifying officer from liability
when we find that the certification was based on official records and the
official did not know, and by reasonable diligence and inquiry could not
have discovered, the correct information.  B-254385, March 22, 1994.
    
The nature of the technology used in a payment processing system does not
alter the basic concepts of accountability for certifying officers.  69
Comp. Gen. 85 (1989).   Where certifying officials rely on the integrity
of an automated payment system, such as the TSA system at issue here, the
reasonableness of a certifying officer's reliance on an automated system
to continually produce reliable and accurate information is a factor that
we consider when addressing relief of the certifying officer from
liability for illegal or improper payments.  69 Comp. Gen. 85 (1989);
B-247563, April 5, 1996.  In this regard, we look to see if the system
satisfies our Title 6 requirements, and whether the agency has provided
its certifying officers with documentation establishing that the system is
operating effectively and can be relied upon to provide accurate
information.  B-247563, April 5, 1996; GAO/FGMSD-76-82, Nov. 7, 1977. 
Pursuant to section 3.3 of Title 6 of GAO's Policy and Procedures Manual,
agencies should provide their certifying officers with documentation
establishing that management has in place internal controls that provide
reasonable assurance that (1) T&A transactions are properly authorized and
approved and (2) T&A data areis completely and accurately recorded and
retained. 
    

Proposed Transportation Security Administration T&A System

    
The Aviation and Transportation Security Act, Pub. L. No. 107-71, 115
Stat. 597 (2001), created the Transportation Security Administration under
the Department of Transportation.[2]  A large part of the TSA workforce
will be passenger and baggage screening personnel assigned to the nation's
airports.  TSA has selected a private contractor to create and provide a
new system for collecting T&A data.[3]  The contractor is introducing the
system at Baltimore-Washington International Airport and subsequently will
implement it at all commercial service airports throughout the nation. 
    
In their July 2002 request, the certifying officers provided us with the
following information.  DOT's current system of record for time and
attendance for DOT personnel is called the Integrated Personnel and
Payroll System (IPPS).  DOT, through its Consolidated Uniform Payroll
System (CUPS), calculates salary payments biweekly using T&A data from 
IPPS.  CUPS will be used as well, drawing on IPPS data, to calculate
biweekly salary payments for TSA screening personnel.  It is the proposed
T&A data approval system, and the reliability of the TSA T&A data that
will be entered into IPPS from that system, that concerns the four
certifying officers.  
    
The TSA T&A collection system will use individual identification cards,
issued to each screener, which he/she will swipe through a time recording
device and record his/her start and stop times.  The certifying officers
explained that the collected data will be *rounded up or down based upon a
7-minute grace period from the scheduled start/stop times, and provided to
the supervisor to record any leave taken by the employee.*  At the end of
the pay period, *a supervisor will validate (sometimes referred to as a
pre-approval) that the T&A data in this new system is ready to be
interfaced into IPPS.*  At this point, the supervisor is able to see a
column summary of base hours worked and leave hours taken by the
employee.  The supervisor approves the data for transmission to the IPPS,
where it passes through IPPS' edits and is provided to the IPPS approving
official.  The certifying officials stated that *[i]t is anticipated that
the approving official in IPPS will be a high level supervisor (not
necessarily the supervisor who has knowledge of time worked and absences
of the employees) at each airport or facility.  This IPPS approver will
then approve all T&As for a particular airport or facility, which could
include several hundred or possibly 1,000 T&As.*  
    
The certifying officers expressed three concerns about this proposed T&A
collection system:
    
(1)  The IPPS approving official will approve a large number of T&As for
employees he/she does not directly supervise.   
    
(2)  The data will not be checked against other independent sources.  The
supervisor who *pre-approves* the data will not be able to check the data
against the records maintained in the IPPS, and it is not clear that the
IPPS approving official will be able to reference the records maintained
in IPPS back to the T&A data in the new system.
    
(3)  The rounding of an employees start/stop time minutes will not provide
a complete and accurate agency record.
    
Analysis
    
This decision addresses only the three specific concerns raised by the TSA
certifying officers.  We did not audit the system, otherwise, to determine
whether the system contains flaws that might implicate the certifying
officers' liability in other ways.  To assist us in addressing the
certifying officers' three concerns, we discussed the new T&A system and
related controls over T&A information with TSA officials.  Our conclusions
about the operation of the new T&A approval system are based on a
conceptual understanding of the system design, and we did not assess
whether the current or proposed T&A system meets all of the requirements
of Title 6.  Based on our understanding of the proposed system, our
responses to the certifying officers' specific concerns are as follows. 
Because both the first and second concerns relate to the approval of the
data in the new system, we address these two concerns together.
    
The IPPS Official Does Not Approve TSA Employee T&As
    
The TSA certifying officers expressed concern that the IPPS official will
approve a large number of T&As for employees he or she does not directly
supervise.  It is not our understanding, however, that the IPPS official
will be *approving* T&As for employees he or she does not supervise.  We
understand, instead, that it will be the employees' first--line
supervisors who will approve T&As for their employees and submit the data
for input into IPPS. 
    
The IPPS official will verify that the data in IPPS is the same as that
entered by the first-line supervisors and that the data cleared the
system's internal controls, including automated data edit checks.  This is
an important distinction.  The IPPS official is not an approving official;
therefore, he is not required to have first-hand knowledge of the
employees' time worked.  GAO Policy and Procedures Manual, Title 6 S:
3.6E.  Instead, the IPPS official may rely upon the proper functioning of
internal controls that provide reasonable assurance the T&A system, as
well as other systems supporting payroll processing, are operating
properly and payments are valid.  69 Comp. Gen. 85 (1989).
    
One of the key controls the IPPS approving official will rely upon is
proper supervisory review.  Section 3.6E of Title 6 of the GAO Policy and
Procedures Manual, entitled *Approval of T&A Reports and Related Records,*
states, *All T&A reports and related supporting documents *must be
reviewed and approved by an authorized official.  Review and approval
should be made by the official, normally the immediate supervisor, most
knowledgeable of the time worked and absence of the employees
involved.*   
    
According to TSA finance office staff, the new T&A approval system will
require generally that checkpoint supervisors or screening managers
approve a screener's T&A information before it is recorded in IPPS.[4] 
TSA finance officers told us that these first-line supervisors (i.e., the
supervisors, according to the TSA certifying officers, who *pre-approve*
the data) best meet the criterion in Title 6 section 3.6, which requires
that the official most knowledgeable about an employee's time worked and
absences be authorized to review and approve employee time and attendance
information.  These first-line approvers will be required to work in close
proximity to the workforce so that they will be able to attest that the
employee time records are complete and accurate.  This will entail
validating that the employee actually worked the hours recorded and had
proper approval for any leave taken. 
    
Much of the data in the new system will be available in near real time
once the employee *swipes* his or her identification badge; therefore, the
supervisor will have near real-time information about who is at work,
arrival and departure times, and organizational or project codes being
charged.  By approving the T&A information, the official agrees, ratifies,
or concurs that to the best of his or her knowledge the T&A information
being approved is true, correct, and accurate and in accordance with laws,
regulations and legal decisions.  For that reason, unlike the certifying
officers, we are not concerned that the first-line supervisor will not be
able to check the data against the records maintained in IPPS, and that
the IPPS official will not be able reference the records maintained in
IPPS back to the T&A data in the new system.  Pursuant to Title 6, if the
first-line supervisor's approval is based on personal knowledge,
additional independent checks are not required.  GAO Policy and Procedures
Manual, Title 6 S: 3.6E. 

 

Because the first-line supervisor is a critical control and must approve
specific T&A information under Title 6, TSA should ensure that its guidance
documents the specific roles and responsibilities of the first-line supervisor
and the steps first-line supervisors should take to ensure T&A information is
proper in as much detail as practical.

    
TSA officials should coordinate with DOT officials as necessary to ensure
that any risks to the achievement of Title 6 objectives resulting from the
integration of the new T&A system and supporting controls into the
existing control environment are understood and addressed.   If this
occurs, and the current payroll processing controls are working properly,
the IPPS official should have a reasonable basis on which to verify the
T&A data.
    
Rounded Start and Stop Times Can Provide a Complete and Accurate Record
    
With regard to the third concern, we have no objection to TSA's use of
immaterial rounding of employee actual time in and out data by TSA for
purposes of recording T&A information.  We consider the proposed 7-minute
grace period from the scheduled starting/stopping times to be immaterial,
and TSA proposes to retain actual time in and out data. 
    
The certifying officers' concern stems from a Title 6 requirement that a
complete and accurate record of the hours or fractions of an hour that an
employee works be retained, which they fear would not be possible with the
rounding of start and stop times on an employee's T&A.  According to TSA
finance office staff, however, TSA will maintain actual original entry
records, along with a trail of all changes to data.  We have no objection
to the use of rounding if actual recorded time in and time out data are
retained by TSA in a form that can be subjected to testing, and if TSA,
indeed, tests the controls over this data.  TSA also should take
reasonable steps to ensure that its time rounding rules are consistently
applied and communicated to affected staff.
    

Other Control-Related Steps

    
As previously stated, the reasonableness of a certifying officer's
reliance on an automated system to produce reliable and accurate
information is a factor that we consider when addressing relief of the
certifying officer from liability.  69 Comp. Gen. 85 (1989); B-247563,
April 5, 1996.  In this regard, one of the things we look for is whether
the agency has provided its certifying officers with documentation
establishing that the system on which they rely is operating effectively
and can be relied upon to provide accurate and reliable information. 
B-247563, April 5, 1996; GAO/FGMSD-76-82, Nov. 7, 1977.  Therefore, it is
important that implementation of the proposed system be monitored closely
to ensure that it is operating effectively.  Since the 1982 enactment of
the Federal Managers' Financial Integrity Act (FMFIA), all executive
branch agencies have been required to annually review their systems of
internal control and to report material weaknesses.  Especially during the
initial period and the first full year of the proposed system' s
implementation, TSA should include in this review testing of the new
system to ensure it is working as designed and that the accuracy of the
T&A data is maintained.
    
Conclusion
    
In accordance with Title 6, first-line supervisors will approve TSA
screeners' T&A data.  Because these supervisors will have personal
knowledge of the time worked of the employees involved, they are not
required to check the data against independent sources.  In addition, we
do not object to what we consider to be an immaterial rounding of employee
time in and time out data that is supported by the original entry records
and a trail of all changes to data.  We have, however, identified
additional control-related steps that TSA management should build into the
T&A approval system as it further develops and implements the T&A system. 
To better support a future request for certifying officer relief should
the T&A system, in fact, generate an improper payment, TSA officials
should implement the T&A approval system as described to us and build the
following control-related steps into the T&A approval system:  (1) conduct
Federal Managers' Financial Integrity Act reviews with a focus on ensuring
that the new system is working as designed, the accuracy of the T&A data
is maintained, and certifying officers are provided with assurances to
this effect, (2) specify in detail in TSA guidance the specific roles and
responsibilities of first-line supervisors, (3) communicate rounding rules
for T&A time data to all affected staff, (4) ensure the rounding rules for
T&A time data are consistently applied, and (5) ensure that rounded and
actual T&A time data can be compared and tested once the T&A system is
fully implemented.
    
If you have any questions, please contact Susan A. Poling, Managing
Associate General Counsel, or Hannah R. Laufe, General Attorney, at
202-512-5644.
    
Anthony H. Gamboa
General Counsel
    

   ------------------------

   [1] Title 6 of GAO's Policy and Procedures Manual addresses Pay, Leave,
and Allowances; chapter 3 specifically addresses Time and Attendance. 
Although GAO plans to issue updated Time and Attendance guidance in early
2003, GAO plans no revision of the requirements applied in this decision.
[2] Pursuant to the Homeland Security Act of 2002, Pub. L. No. 107-296,
116 Stat. 2135, TSA will be transferred to the Department of Homeland
Security and retained as a distinct entity.  We do not address in this
decision what effect this move may have, if any, on the new TSA T&A
system.
[3] Staff in the office of the TSA Chief Financial Officer told us that
the proposed T&A system initially will cover baggage and passenger
screeners but will eventually cover other employees as well. 
[4] TSA staff told us that each individual airport Federal Security
Director (the senior TSA official at the airport) will have authority to
designate an approval structure to fit the airport, and delegate approval
responsibilities accordingly.