ESTABLISHMENT OF TRANSIT SUBSIDY PROGRAM CONTROLS

The FDIC has established policy for the transit subsidy program through Circular 3440.1. This Circular provides relevant definitions for the program, employee eligibility requirements, program office and employee responsibilities under the program, and procedures for employees to follow when participating in the program. This policy addresses most of the controls suggested by GAO and OMB to ensure that qualified employees receive the correct subsidy amount. However, the policy does not include, nor did we identify, sufficient operating procedures for the headquarters or Dallas transit subsidy programs.

In April 2007, GAO reported that weaknesses in program controls may have contributed to fraud and abuse of the transit benefit program at federal agencies.¹ GAO identified 10 critical program control elements and reviewed transit benefit program policies and procedures at selected federal agencies for evidence of those control elements. OMB included the same internal controls in its May 2007 memorandum, Federal Transit Benefits Program (M-07-15), and asked agencies to assert that the 10 controls were in place. We reviewed FDIC Circular 3440.1 and found that the Circular addressed most of the internal control areas, as shown in Table 2.

The Circular requires operational procedures for each regional office, accordingly, we recommend that the Director, DOA:

1. Strengthen operational procedures to guide headquarters and Dallas transit subsidy coordinators in carrying out their program responsibilities.

IMPLEMENTATON OF TRANSIT SUBSIDY PROGRAM CONTROLS

The FDIC has implemented program controls that help to ensure that employees comply with procedures. Our evaluation testing identified no instances of employee abuse of the transit subsidy program. However, we identified several areas where DOA could strengthen program controls for the headquarters and Dallas transit subsidy programs. We also concluded that employees participating in the program could do more to meet their program responsibilities. Notably, DOA has recently announced or implemented several enhancements to the headquarters transit subsidy program that strengthen program controls and address several of our observations.

Results of Testing for Program Abuse by FDIC Employees

As part of our evaluation, we performed independent tests to confirm that program controls were working as intended and to ensure that employees were not abusing the transit subsidy program. Our tests included reviewing Web sites such as E-Bay and Craig’s List to ensure FDIC employees were not transferring or selling fare card media to unauthorized recipients.² We also examined a list of participants in the FDIC’s parking program and compared it with a list of transit subsidy program participants to ensure that no FDIC employees were receiving duplicate benefits from the two programs. Finally, we recalculated transit subsidy amounts for a sample of 60 headquarters employees to ensure that they were receiving the correct amount. Based on our testing, no instances came to our attention to suggest that these employees were:

• Transferring or selling fare card media to unauthorized recipients,
• Participating in both the transit subsidy and FDIC parking programs,
• Claiming or receiving inflated or unsupported subsidy amounts, or
• Receiving transit benefits in excess of Internal Revenue Service tax-free limits.³

GAO’s Standards for Internal Control in the Federal Government provides a framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse and mismanagement. The Standards note that control activities, which include approvals and authorizations, verifications, the creation and maintenance of related records and adequate documentation, help to ensure management’s directives are carried out.

We determined that DOA headquarters could strengthen program control activities as follows:

• Independent verification of employee address: SEPS does not currently verify transit subsidy applicants’ home addresses with Corporate Human Resources Information System (CHRIS) data at the time an application is processed and reviewed. This verification is a standard control that is recommended by GAO and OMB and would provide assurance that the subsidy amount is based on the correct commuting distance. A SEPS official indicated that in the future SEPS would develop a process with the FDIC’s Human Resources Branch to verify addresses of transit subsidy program participants.
• Approval of applications to evidence review and authorization: Eight of the 60 application forms that we reviewed had not been signed by the TSC. Although this condition may be an administrative oversight, all forms should be signed indicating approval of the application. We did see indications that the TSC recalculated the transit subsidy amount to ensure accuracy and that the TSC verified an applicant’s work schedule by contacting the applicant’s supervisor by e-mail.
• Maintenance of transit subsidy participant files: DOA personnel could not locate files for 11 of the 60 program participants that we sampled (18 percent). Most of the missing files were for participants who had left the FDIC; however, 4 of the 11 missing files were for employees currently enrolled in the transit program.
• Periodic recertification of program participant information: A number of files that we reviewed (26 percent, 13 files of the sample files that were available for review) contained applications for transit subsidy that were dated 2003 or earlier and lacked evidence of periodic applicant recertification. DOA also acknowledged that it had not performed a complete recertification of transit program participants since 2003. DOA automated the Application for Transit Subsidy and required program participants to recertify their eligibility and commuting cost information during October and November 2007. These actions will enhance controls over the program.
• Reiterating to employees the need to notify DOA of personal or scheduling changes: As discussed later, Circular 3440.1 includes a number of employee program responsibilities, such as informing the TSC of changes in employee address or commuting costs. As discussed later, our evaluation testing indicated that employees could do more to meet their program responsibilities. These findings could be indicative of a lack of employee awareness, and it may be prudent for DOA to periodically reiterate to FDIC employees their responsibilities under the transit subsidy program.

Employee Transit Subsidy Responsibilities

Return of unused media due to vacation, leave, or travel or withdrawal from the program: We reviewed 20 of our 60 sampled files to ensure that employees were adjusting transit subsidy amounts when extensive leave or travel was taken in a quarter, as required by FDIC Circular 3440.1.⁴ To perform this analysis, we reviewed leave and travel records for the sampled program participants. We determined that FDIC employees were not always adjusting transit benefits when extended leave was taken. Three of the 20 participants in our sample took leave in excess of 20 days during the year in review. In one case, a participant had 65 days of leave during a year (i.e., 65 days equates to roughly 3 months of transit subsidy, or about $330). The TSPM indicated that he was only aware of one FDIC employee that actually reduced the subsidy amounts to reflect extended leave or travel in a particular quarter.

In addition, we found that 1 of the 11 applicants relocated and withdrew from the transit program but still had over $200 in transit benefits that was never returned to the FDIC. We discussed this matter with the FDIC’s TSPM, and the problem was resolved and reimbursement by the employee was arranged.

Other employee-related issues: We also compared DOT records of transit benefits distributed to FDIC employees during 2006 to the FDIC’s current employee list in CHRIS and identified two individuals that were not on the FDIC’s current employee list. One individual changed his name without notifying SEPS of the change.

The second individual was from a foreign country and had been assigned to work at the FDIC for a period of 2 years beginning in February 2005. The individual was paid transit subsidy benefits totaling $1,584 from 2005 through 2006. Circular 3440.1 states that federal employees detailed to the FDIC and independent contractors are ineligible to participate in the FDIC Transit Subsidy Program. The TSPM stated he had no way of knowing the international status of this individual because it was never brought to his attention. The TSPM also stated that the transit subsidy application submitted indicated that the individual was an FDIC employee. The TSC also verified the individual’s work schedule through a supervisor. Verification of the applicant’s home address with CHRIS would have likely revealed that the applicant was ineligible for a transit benefit.

DOA Planned Program Enhancements

During our review, DOA informed us of several planned enhancements to the headquarters transit subsidy program. In October 2007, DOA announced headquarters program changes related to requiring the use of SmarTrip® Cards and requiring an annual program recertification.

Mandatory SmartBenefits® Program use: Effective January 1, 2008, all employees receiving transit benefits and using Metrorail, Metrobus, Virginia Rail Express, or a registered vanpool are required to have their transit benefit downloaded to a registered SmarTrip® Card. The use of SmarTrip® cards offers several control enhancements over paper fare media, including the following:

• the SmarTrip® Card is registered to the owner and not easily transferred to unauthorized users;
• a maximum of $300 may be stored on the card, which should prevent participants from stockpiling unused fare media;
• registered SmarTrip® Cards are insured against loss or theft; and
• the mandatory use of SmarTrip® Cards will allow the FDIC to discontinue quarterly distribution of fare media by DOT and eliminate, or greatly reduce, the amount of fare media that the TSC has to safeguard.

On-line Application for Transit Subsidy and annual recertification: Beginning in October 2007, all FDIC transit benefit participants in the National Capital Region are also required to annually electronically recertify their eligibility to participate in the SmartBenefits® Program and the regular transit subsidy program. The recertification process was open for a 4-week period during October and November 2007. DOA also replaced the use of participants’ last four social security number digits with the last six digits of the participants’ employee identification number in order to protect personally identifiable information.

Collectively, these measures should strengthen program controls and address several of our observations discussed in this report.

Dallas Transit Subsidy Program Controls

We also found that DOA had implemented a number of internal controls over the Dallas transit subsidy program; such as:

• Receiving, reviewing, and approving transit subsidy applications;
• Periodically verifying that transit subsidy program participants were not participating in the FDIC parking program; and
• Safeguarding unused fare media.

However, we did identify opportunities to improve separation of duties, recordkeeping, and communication of program information to DOT, as discussed below.

DART offers significantly discounted fare media for organizations that agree to purchase transit passes for 100 percent of their employees. The Dallas Transit Subsidy Coordinator (DTSC) performs a cost analysis annually to determine whether it is more economical to buy transit passes for all Dallas employees or to buy transit passes only for those employees participating in the Dallas transit subsidy program. The DTSC sends the cost analysis to the headquarters TSPM for approval. During 2006 and 2007, the FDIC purchased passes for all FDIC Dallas employees (but only distributed passes to employees participating in the transit subsidy program). Table 3 presents information from the 2006 cost analysis.

Because the DTSC purchases significantly more passes than are distributed, it is important that the DTSC have strong controls over pass distribution and that excess passes are controlled and safeguarded. In this regard, we identified the following areas where program controls could be improved.

Segregation of duties: GAO identifies segregation of duties as a control activity to guard against one individual controlling all key aspects of a transaction or event. Currently, the DTSC controls all aspects of the transit subsidy program transaction to include receiving and distributing transit passes, keeping related records, and maintaining custody of all transit passes that have not been issued in a locked drawer in his office to which only he has access. We concluded that segregation of duties over the Dallas transit subsidy program could be improved and that DOA needs to identify ways to mitigate this control risk. For example, DOA could have another employee maintain custody of the un-issued passes. Alternatively, DOA could have an independent party periodically inventory the issued and un-issued passes.

Accurate and timely recording of transactions and events: GAO notes that transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. To ensure all passes were properly accounted for, we reconciled all issued and un-issued passes for 2006 and 2007. As shown in Table 4, our review identified discrepancies between the DTSC list of transit passes issued, un-issued passes, and the total number of passes purchased.

Although we identified discrepancies of 13 and 11 passes for 2006 and 2007, respectively, the DTSC provided application forms (3440/01) to support issuance of 8 of the 13 passes for 2006 and 10 of the 11 passes for 2007. Thus, we concluded that most of the discrepancies were due to errors in the listing of transit passes issued. For the remaining six missing transit passes we were able to confirm with three transit subsidy participants that they received the transit passes in question. We could not determine the status of the remaining three missing transit passes.

Historical data of transit subsidy activity: GAO notes that accurate transaction recording applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. GAO also notes that transactions should be clearly documented, and the documentation should be readily available for examination. The DTSC maintains a spreadsheet for its Dallas employees who participate in the Dallas transit subsidy program and parking program. The master spreadsheet lists the participating employee names and identifies the transit or parking pass issued to each employee and transit subsidy passes that are returned or deactivated. In our review of the spreadsheet, we noted that the spreadsheet does not always identify a date of when the employee receives the parking and transit passes, or the date when the passes are returned or deactivated. The spreadsheet is also continuously updated without saving and maintaining a record of activity for a given calendar year. Therefore, no permanent record was available to enable us to review all transit activity that occurred in 2006.

Discrepancies between FDIC, DOT, and DART transit subsidy participant data: We found significant discrepancies between listings of program participants maintained by the FDIC, DOT, and DART. For example, DOT’s participant list for 2006 included 185 participants of whom 59 had either terminated employment or retired from the FDIC in 2004 and 2005. Additionally, DOT’s records reflected a $419 transit cost per employee when, in fact, the actual cost was $190 per employee. A DOT representative informed us that DOT records were based on information provided by the FDIC and it is the responsibility of the FDIC to keep DOT informed of any changes related to participants receiving transit benefits. The representative added that if changes are not provided to DOT, the employee participation list is not revised by DOT.

Although DOT records were inaccurate, we verified that the FDIC did not pay excessive costs for transit benefits during 2006. DOT computed the transit media cost per employee by dividing the total transit cost for 2006 of $77,520 by the 185 Dallas employees on their list. The FDIC actually paid $77,520, which represented the actual cost of purchasing a $190 transit pass multiplied by the entire Dallas workforce of 408 employees. The DOA records showed that 124 Dallas employees participated in the program in January 2006, and 12 additional employees participated at varying times during 2006. We identified no instances of transit benefits being provided to unauthorized recipients.

In addition, our review of the current DART database contained FDIC employees that were no longer participating in the Dallas transit subsidy program. We advised the DTSC that DART’s database was inaccurate and needed to be updated prior to issuance of the 2008 transit subsidy passes. The DTSC is currently working with a DART representative to ensure that DART’s database includes only FDIC employee names that are participating in the Dallas transit subsidy program.

Although these discrepancies do not appear to have any monetary effect on the program, it is important that DOA ensures that accurate information is provided to DOT and DART to ensure the integrity of the federal transit benefits program.

Local standard operating procedures: As discussed earlier in this report, we are recommending that DOA establish operating procedures for its headquarters and Dallas transit subsidy programs. Circular 3440.1 requires the Regional TSCs to establish local standard operating procedures based on guidance from the TSPM. Neither DOA headquarters nor the Dallas Regional Office has guidance, specific operating instructions, or standard operating procedures for their respective transit subsidy programs. We noted that the Atlanta DOA office established in 2002, and revised in 2004, a standard operating procedure for its regional transit subsidy program. Local operating procedures would improve internal controls over the regional transit subsidy programs.

Recommendations

We recommend that the Director, DOA:

2. Establish and implement a procedure for routinely verifying transit subsidy program applicants’ home addresses against an official source of employee information, such as CHRIS.
3. Conduct a follow-up internal review to ensure that recently implemented enhancements to the program (on-line application and annual recertification) address observations that we identified in this report related to TSC review and authorization of the Application for Transit Subsidy and transit subsidy file maintenance issues.
4. Increase employee awareness by periodically issuing communications to employees reminding them of their responsibilities under the program. Such reminders could be coordinated with the annual employee recertification process and should include:
   • Notifying TSCs of changes in name, address, commuting cost, or work schedule; and
   • Returning unused fare media resulting from extended leave or travel or withdrawal from the program.
5. Improve segregation of duties over the Dallas transit subsidy program or implement mitigating program controls such as independent inventories of issued and un-issued fare media.
6. Improve recordkeeping of Dallas transit subsidy program activity to properly account for all purchased fare media and to provide for a permanent record of transit subsidy activity.
7. Resolve discrepancies between Dallas transit subsidy program participant listings maintained by the Dallas TSC, DOT, and DART and implement controls to ensure that future listings are consistent.

CORPORATION COMMENTS AND OIG EVALUATION

On December 18, 2007, the DOA Director provided a written response to the draft report dated December 12, 2007. The response is presented in Appendix II to this report. In its response, DOA management concurred with all of our recommendations and plans to have responsive corrective actions implemented between January and March 2008. These recommendations are considered resolved but will remain open until we have determined that agreed-to corrective actions have been completed and are effective. A summary of management’s response and corrective actions is presented in Appendix III.

This table presents the management response on the recommendations in our report and the status of the recommendations as of the date of report issuance.