B-261647 June 26, 1995

B-261647 June 26, 1995

Mr. John J. Hamre Comptroller Department of Defense

Dear Mr. Hamre:

Your March 21, 1995, letter asked that we provide our views on whether your proposed new system for processing employee travel claims conforms to the requirements in Title 2, "Accounting" and Title 7, "Fiscal Guidance," of GAO's Policy and Procedures Manual for Guidance of Federal Agencies. In your letter, you mentioned that you requested waivers of several employee travel requirements from the General Services Administration (GSA). /1/ While this response is independent of any decision made by GSA, your request to raise the receipt threshold to $75 is pertinent to discussions that follow.

As we understand it, this new system is part of the Department of Defense's (DOD) effort to streamline its processing of employee travel claims to make it less costly and more oriented towards mission accomplishment. The National Performance Review's initiative to foster better government that costs less and the current move to downsize government has intensified efforts to streamline operations and simplify administrative processes through greater use of available computer technology. Such technology is reducing the paper generation and document flow, as well as the associated costs, that have traditionally existed.

As you know, the Air Force recently began testing a new automated travel system similar to the system envisioned in your request. The Air Force requested and received a sanction from us to test its system at Langley Air Force Base and the Pentagon for a year. /2/ Also, the Joint Financial Management Improvement Program (JFMIP) is examining governmentwide travel procedures with a view towards streamlining the processes. As it progresses, the JFMIP effort should provide useful information to consider regarding your proposed system.

To more fully understand your new system, we contacted your staff to discuss the proposal in more detail. However, we did not perform any tests of your current or proposed system and, consequently, our response only addresses your proposal conceptually.

As discussed in this letter, we identify three issues regarding your proposal and offer four control procedures to address these issues. Based on our understanding of your proposal, we have no objection to its implementation provided that the four controls we suggest are effectively implemented.

DOD'S PROPOSAL

Under your proposal, employees will continue to be reimbursed for actual lodging costs up to the maximum allowed and would receive a "flat-rate" for meals and related incidental expenses.

A single document, called a "Trip Record," would contain all of the requisite information, claims, and approvals for a particular trip. The Trip Record would include (1) the authorization to travel and would be the basis for obligating travel funds, (2) a listing of actual expenses incurred by the traveler, and (3) the supervisor's approval for payment processing. The Trip Record would then be forwarded to the disbursing officer for certification and payment.

For travel expenses costing $75 or less, excluding lodging, you propose to eliminate the requirement for receipts, /3/ but would require that the traveler itemize all expenses on the Trip Record. The traveler would forward all remaining receipts (for lodging and other expenses over $75) with the Trip Record for administrative approval. Approval, usually by the traveler's supervisor, would indicate that the travel was actually taken and that the charges seem reasonable. After supervisory approval, the receipts would be returned to the traveler for the appropriate retention period and the Trip Record would be forwarded to the disbursing officer who would make payment based on propriety, legality, correctness, and accuracy.

In your letter, you stated that the proposed travel system would be automated at the outset. Your staff stated that the Trip Record would be created and maintained electronically and that the signature of the traveler, administrative approving official (usually the traveler's supervisor), and the disbursing officer would also be automated.

Your staff indicated that verifications to ensure validity of the payment would be done through a combination of (1) computer assisted edit checks and (2) post-payment statistical sampling. Your staff explained that the computer edit checks would be designed to be in accordance with the Defense Finance and Accounting Services's (DFAS) /4/ requirements and specifications, and serve as controls to help ensure that only proper payments are made.

Your staff also stated that the statistical sampling methods would conform to the requirements of Title 7 of the GAO Policy and Procedures Manual. Your staff explained that the samples would be selected at the disbursing offices after payment and would include stratified statistical sampling techniques. For each Trip Record statistically selected, the traveler's claim, including all receipts, will be examined. The traveler would be required to forward all receipts to the disbursing office where all amounts claimed would be reviewed for propriety, legality, correctness, and accuracy. The receipts would then be retained at the disbursing office along with the results of the sample for the appropriate records retention period.

Your staff also stated that a substantial training effort would be undertaken prior to implementation of the system. They said that part of the training would be devoted to familiarizing travelers with procedures for (1) document retention and storage, satisfying applicable requirements contained in Title 8, "Records Retention," of the GAO Policy and Procedures Manual and GSA's General Records Schedule and (2) submission of all travel receipts being held within the retention period to a responsible official when a traveler retires or leaves DOD.

GAO'S ASSESSMENT OF THE PROPOSAL

Regarding Titles 2 and 7, your request raises three issues: (1) whether the disbursing officer will have sufficient detail and support needed to routinely approve travel claims for payment if the hard copy supporting documentary evidence, such as receipts, is not forwarded to them, (2) whether it is appropriate for the traveler to retain documents supporting his or her own claims, and (3) what specific controls should exist when implementing post-payment statistical sampling. Also, we wish to highlight the necessary controls that should exist to ensure data integrity when using automated signatures.

Approving Disbursement

Title 7 requires that payments be based on sufficient evidence to establish the validity of a claim. Where agencies, such as DOD, do their own disbursing, the disbursing officers must ensure the (1) propriety of amounts claimed, (2) legality of disbursements, (3) correctness of the computations, and (4) accuracy of the facts stated on the voucher and supporting documents. Traditionally, payment on travel vouchers has been based on the disbursing officer's review of the supporting documentary receipts that accompany the voucher.

GAO recognizes that supporting documentation is not required to accompany a travel voucher for payment approval if adequate systems of controls exist in the processing of travel claims. As we have previously reported, /5/ supporting documentation is not required to accompany the travel voucher forwarded for payment approval if (1) the administrative approving official, usually the traveler's supervisor, knows that the travel actually occurred and its purpose and reviews the charges for reasonableness, (2) the administrative approving official and the disbursing officer can obtain supporting documents if deemed necessary, (3) appropriate edit checks to help determine propriety, legality, accuracy, and correctness are performed in the automated processing of the voucher prior to approval for payment, and (4) a post-payment sample is selected from all vouchers and reviewed to provide assurances that claims are adequately supported and valid.

The system design you propose includes the four previously mentioned processes. If adequate controls in each process are effectively implemented, the disbursing officer should have reasonable assurances that the payment approval function is operating properly.

Because of his or her responsibilities to ensure that claims are valid prior to payment, a disbursing officer may require the supporting documentation to be provided prior to approval for payment, even if the travel claim being reviewed is not selected in the sample for which all supporting documents would be reviewed. We believe the disbursing officer's responsibility for ensuring proper payment should be made clear to DOD staff so that they are aware that such a request could be made.

The Traveler Maintaining Supporting Documentation

Title 2 appendix 2, "Internal Control Standards," requires that all transactions be clearly documented and that the documentation be readily available for examination. Your proposal calls for traveling employees to retain relevant documents at their duty stations rather than having them submitted with the Trip Record for approval by the disbursing officer.

We have previously recognized that employees can retain travel documents supporting travel claims. /6/ The traveler can retain supporting documentation until (1) the disbursing officer requests the documents, (2) his or her claim is selected in a post-payment audit sample to be reviewed and he or she is asked to forward the documents to the disbursing center, or (3) the end of the applicable records retention period, whichever comes first. The results of the sample are documented and retained as the official documents supporting payment approval for the universe of transactions from which the sample was selected. These official documents are kept for the proper retention period.

In the Air Force's case, to help ensure that travelers retaining documents are knowledgeable of the requirements, Air Force officials intend to provide training to familiarize travelers with retention requirements and storage procedures.

Your design provides for similar requirements. Travelers would retain supporting documents until asked to forward them to disbursing centers to be examined separately or as part of post-payment review of sampled claims or the retention period expires. Also, your proposal includes planned training on proper retention and storage procedures. If your proposal is effectively implemented, management should have reasonable assurance that documents supporting travel claims are properly retained for the required periods.

Post-Pavment Statistical Sampling

Your proposal calls for the samples to be selected from the universe of paid claims to test the reliability of the system and the validity of the claims. As we have previously reported, /7/ post-payment statistical sampling must be supplemented by internal controls that test the validity of the claim prior to payment authorization. An automated travel claim processing system presents a situation in which post-payment statistical sampling techniques supplemented by automated controls is practical. The automated controls should include edit checks that help ensure claims are proper, legal, correct, and accurate. For example, per diem limits should be programmed into the software so that when travel claim information is entered, the system processing the claim would check to make sure the limits are not exceeded. Thus, if per diem costs to a particular city cannot exceed $100 per day, the automated system would ensure that the data on a claim entered into the system (involving travel to that city)-will not be processed if the claim exceeds $100. /8/ Under this situation, the post-payment statistical sampling is intended to verify that the claims are adequately supported by documentation and are valid.

We recognize that, when new systems are implemented, the risk of errors or irregularities increases, especially when changing from a manual to an automated process. To compensate for the increased risk when initially implementing post-payment sampling procedures, we believe certain sampling techniques should be given greater consideration. One possibility would be increasing the sample size to obtain a higher-than-normally required confidence level. /9/

Automated Signatures

As we understand your proposal, the system would be electronic and would include automated signatures of the traveler, approving official, and disbursing officer. Although the design and implementation of the automated aspects of the system have yet to be determined, we wish to point out certain features that should exist in the automated signature portion of the design.

Automated signatures generated and validated in data processing systems should provide safeguards to help prevent errors and irregularities. To do so the automated signature must be (1) unique to the signer, (2) under the signer's sole control, and (3) capable of being verified. /10/ Also, to help ensure data integrity, the signature must be linked to the data in such a manner that, if the data are changed, the signature is invalidated. Because of the nature of the electronic document, it is difficult to ascertain whether the data has been altered unless the signature is linked to the data in the document in such a way the signature verification process can detect data changes. Traditional passwords and user identification codes based systems usually do not meet these criteria.

The National Institute of Standards and Technology (NIST) /11/ has established procedures for the evaluation and approval of certain automated signature techniques /12/ to ensure the integrity of the data and compliance with the previously mentioned criteria. We believe the signatures should conform with requirements issued by NIST and also use algorithms and techniques approved by NIST. /13/

Certain Procedures Would Alleviate Internal Control Concerns

We support initiatives to create a government that works better and costs less. In this context, agencies have the responsibility to protect the government's interest in a cost-effective manner. Improvements to streamline the employee travel payment process should be made only within a framework of adequate, cost-effective controls that reasonably ensure that payment transactions are properly authorized and sufficient records of these transactions are maintained. Although Titles 2 and 7 allow flexibility to permit agencies to implement payment systems that best suit their needs, the preceding discussion has identified three potential problems that could arise under your proposal.

To address these potential problems, and to minimize the risk of irregularities and errors, your proposal should include the following four procedures or controls.

A segment of the planned training should highlight the traveler's, approving official's, and disbursing officer's responsibility and the fact that (1) the disbursing officer, upon review of a voucher, may require the supporting documentation to be provided prior to making payment and (2) the traveler may be required to reimburse DOD if documentation supporting a claim paid him or her cannot be provided when requested within the records retention period.

In designing and initially implementing a post-payment statistical plan, until a satisfactory level of confidence in the system is obtained, certain techniques, such as selecting a large sample of transactions, should be implemented to compensate for the additional risk inherent in implementing new procedures. (One possible approach, with several

The automated signature generation and validation process, when designed and implemented, should comply with FIPS and satisfy the data integrity requirement and the previously mentioned criteria for the signature of the traveler, approving official, and the disbursing officer.

The first year the system is operational, you should especially emphasize its review during the annual reviews of internal controls under the Federal Managers' Financial Integrity Act. In future years, special emphasis should be placed on determining if travelers are maintaining supporting travel documentation at their duty stations for the records retention period.

Our position was discussed with members of your Travel Reengineering Team. I hope our comments are helpful as you look for ways to streamline your administrative processes and reduce the cost of government. If you have any questions or would like to discuss these matters further, please contact Bruce Michelson, Assistant Director, at (202) 512-9366.

Sincerely yours,

Gene L. Dodaro Assistant Comptroller General

1. GSA is responsible for issuing employee travel regulations which are published in its manual entitled Federal Travel Regulations (FTR).

2. Air Force Automated Travel System (GAO/AIMD-95-74R, February 14, 1995).

3. GSA regulations require receipts for all expenses over $25. DOD has requested a waiver raising that threshold to $75.

4. DFAS was created pursuant to DOD's Defense Management Re port Decision 910, December 4, 1990, and is responsible for all finance and accounting matters.

5. Employees' Travel Claims (GAO/AIMD-95-71R, February 6, 1995) and Employees' Travel Claims (USIA) (GAO/AIMD-95-138R, May 23, 1995).

6. Air Force Automated Travel System (GAO/AIMD-95-74R, February 14, 1995).

7. Air Force Automated Travel System (GAO/AIMD-95-74R, February 14, 1995).

8. The system proposed is similar to the concept being tested by the Air Force. The controls necessary for effective implementation of such a system are outlined in greater detail in our report to the Air Force.

9. In testing a proposed new travel system, the Air Force's post-payment sampling techniques called for selecting monthly samples of 50 percent during the first 3 months of the test, thereby increasing the confidence level above the minimal acceptable level. (Air Force Automated Travel System (GAO/AIMD-95-74R, February 14, 1995).)

10. See 71 Comp. Gen. 109 (1991).

11. Under the requirements of the Computer Security Act, NIST is responsible for establishing standards for federal computer systems that process sensitive but unclassified information.

12. These procedures are contained in the Federal Information Processing Standard (FIPS).

13. RCAS Authentication (GAO/AFMD-93-70R, May 4, 1993). examples of such statistical sampling techniques, was outlined in our report to the Air Force.)

Ordering Information

The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent.

Orders by mail: U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015

or visit:

Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC

Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (301) 258-4097 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.