This is the accessible text file for GAO report number GAO-03-532R entitled 'Transmittal of Comptroller General Decision on the Transportation Security Administration's Time and Attendance Approval System' which was released on March 11, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products’ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. March 11, 2003: Mr. Robert Gardner: Assistant Administrator/CFO for Finance and Administration: Transportation Security Administration: 701 South 12TH Street, Suite 518N: Arlington, VA 22202: Subject: Transmittal of Comptroller General Decision on the Transportation Security Administration’s Time and Attendance Approval System: Dear Mr. Gardner: This letter is to highlight for your attention and action internal control advice we offered in our December 2002 decision[Footnote 1] to four certifying officers of the Department of Transportation (DOT). Their July 24, 2002 letter had requested a Comptroller General decision related to certifying payroll payments.[Footnote 2] A copy of the decision is enclosed. Pursuant to 31 U.S.C. § 3529(a), the four certifying officers asked us whether the method of approving an employee’s time and attendance (T&A) information in the T&A system, to which the Transportation Security Administration (TSA) is transitioning, meets the requirements of Title 6 of GAO’s Policy and Procedures Manual for Guidance of Federal Agencies (Policy and Procedures Manual). To assist you in implementing our internal control advice, we are enclosing a copy of our recently issued guidance Maintaining Effective Control Over Employee Time and Attendance Reporting, GAO-03-352G (Washington, D.C.: January 2003).[Footnote 3] The certifying officers expressed three concerns with the new T&A approval system. In their view, (1) approval is not occurring at the appropriate level, (2) data will not be checked against independent sources, and (3) the proposed rounding of an employee’s start/stop time minutes will not provide a complete and accurate agency record. The certifying officers also asked whether GAO would relieve a certifying officer pursuant to 31 U.S.C. § 3528(b)(1)(A) if a certifying officer certified an improper or illegal payment in reliance on the new T&A approval system. To assist us in addressing the certifying officers’ three concerns, we discussed the new T&A system and related controls over T&A information with TSA officials. The enclosed Comptroller General decision addresses only the three specific concerns raised by the DOT certifying officers. We did not audit the system, otherwise, to determine whether the system contains flaws that might implicate the certifying officers’ liability in other ways. Based on our discussions with TSA officials, we determined that, in accordance with Title 6, first-line supervisors are approving T&A data. Because these supervisors will have personal knowledge of the time worked by the employees involved, they are not required to check the data against independent sources. We also determined that TSA will maintain actual original entry records along with a trail of all changes to data to support what we consider to be the immaterial rounding of employee time in and time out data. We have, however, identified additional control-related steps that TSA management should build into the T&A approval system as it further develops and implements it. To better support a future request for certifying officer relief should the T&A system, in fact, generate an improper payment, TSA officials should implement the T&A approval system as described to us and build the following control-related steps into it: Conduct Federal Managers’ Financial Integrity Act reviews with a focus on ensuring that the new system is working as designed, the accuracy of the T&A data is maintained, and certifying officers are provided with assurances to this effect. Specify in detail in TSA guidance the specific roles and responsibilities of first-line supervisors. Communicate rounding rules for T&A time data to all affected staff. Ensure the rounding rules for T&A time data are consistently applied. Ensure that rounded and actual T&A data can be compared and tested once the T&A system is fully implemented. We have discussed the contents of this letter with Jeffrey Bobich, of your staff, and he has informed us that TSA will build these steps into its T&A process. If you or your staff have any questions, please contact me at (202) 512-6906 or Mary Mohiyuddin, Assistant Director, at (202) 512-3087. Sincerely yours, McCoy Williams: Director: Financial Management and Assurance: Decision: Matter of: Transportation Security Administration’s Proposed Time and Attendance System: File: B-291001: Date: December 23, 2002: DIGEST: Transportation Security Administration (TSA) certifying officers expressed three concerns with TSA’s new Time and Attendance (T&A) approval system. In their view, (1) approval is not occurring at the appropriate level, (2) data will not be checked against independent sources, and (3) the proposed rounding of an employee’s start/stop time minutes will not provide a complete and accurate agency record. Based on our discussions with TSA officials, we determined that, in accordance with Title 6 of GAO’s Policy and Procedures Manual for Guidance of Federal Agencies, first-line supervisors are approving T&A data. These supervisors have personal knowledge of the time worked of the employees involved; therefore, they are not required to check the data against independent sources. In addition, TSA will maintain actual original entry records along with a trail of all changes to data to support what we consider to be the immaterial rounding of employee time in and time out data. TSA management, however, should build additional control-related steps into the T&A approval system as it further develops and implements the system. DECISION: Pursuant to 31 U.S.C. § 3529(a), four certifying officers at the Department of Transportation (DOT) asked us whether the method of approving an employee’s time and attendance (T&A) information in the T&A system to which the Transportation Security Administration (TSA) is transitioning meets the requirements of Title 6(1) of GAO’s Policy and Procedures Manual for Guidance of Federal Agencies (Policy and Procedures Manual). The certifying officers also asked whether GAO would relieve a certifying officer pursuant to 31 U.S.C. § 3528(b)(1)(A) if a certifying officer certified an improper or illegal payment in reliance on the new T&A approval system. A certifying officer’s liability is strict; however, a certifying officer may request a decision from the Comptroller General in advance of payment when he or she is uncertain regarding his or her authority to make or authorize particular payments. 31 U.S.C. § 3529. In this regard, the certifying officers expressed three concerns with the new T&A approval system. In their view, (1) approval is not occurring at the appropriate level, (2) data will not be checked against independent sources, and (3) the proposed rounding of an employee’s start/stop time minutes will not provide a complete and accurate agency record. Based on our discussions with TSA officials, we determined that, in accordance with Title 6, first-line supervisors are approving T&A data. Because these supervisors will have personal knowledge of the time worked of the employees involved, they are not required to check the data against independent sources. We also determined that TSA will maintain actual original entry records along with a trail of all changes to data to support what we consider to be the immaterial rounding of employee time in and time out data. We have identified additional control-related steps that TSA management should build into the T&A approval system as it further develops and implements the system. To better support a future request for certifying officer relief should the system, in fact, generate an improper payment, TSA officials should implement the system as described to us, and build into the system the control-related steps that we discuss herein. Background: Standard for Relief: Certifying officers are responsible for the legality of proposed payments and for repaying any payment that was “illegal, improper, or incorrect because of an inaccurate or misleading certification.” 31 U.S.C. § 3528(a). A certifying officer’s legal liability is strict and arises automatically at the time of an illegal or improper payment. 54 Comp. Gen. 112, 114 (1974). A certifying officer may request a decision from the Comptroller General in advance of payment when he or she is uncertain regarding his or her authority to make, or authorize the making of, particular payments. 31 U.S.C. § 3529. A certifying officer may rely on this advance decision when certifying future payments. This Office also has authority pursuant to 31 U.S.C. § 3528(b)(1) to relieve a certifying officer from liability when we find that the certification was based on official records and the official did not know, and by reasonable diligence and inquiry could not have discovered, the correct information. B-254385, March 22, 1994. The nature of the technology used in a payment processing system does not alter the basic concepts of accountability for certifying officers. 69 Comp. Gen. 85 (1989). Where certifying officials rely on the integrity of an automated payment system, such as the TSA system at issue here, the reasonableness of a certifying officer’s reliance on an automated system to continually produce reliable and accurate information is a factor that we consider when addressing relief of the certifying officer from liability for illegal or improper payments. 69 Comp. Gen. 85 (1989); B-247563, April 5, 1996. In this regard, we look to see if the system satisfies our Title 6 requirements, and whether the agency has provided its certifying officers with documentation establishing that the system is operating effectively and can be relied upon to provide accurate information. B-247563, April 5, 1996; GAO/ FGMSD-76-82, Nov. 7, 1977. Pursuant to section 3.3 of Title 6 of GAO’s Policy and Procedures Manual, agencies should provide their certifying officers with documentation establishing that management has in place internal controls that provide reasonable assurance that (1) T&A transactions are properly authorized and approved and (2) T&A data are completely and accurately recorded and retained. Proposed Transportation Security Administration T&A Svstem: The Aviation and Transportation Security Act, Pub. L. No. 107-71, 115 Stat. 597 (2001), created the Transportation Security Administration under the Department of Transportation(2) A large part of the TSA workforce will be passenger and baggage screening personnel assigned to the nation’s airports. TSA has selected a private contractor to create and provide a new system for collecting T&A data.” The contractor is introducing the system at Baltimore-Washington International Airport and subsequently will implement it at all commercial service airports throughout the nation. In their July 2002 request, the certifying officers provided us with the following information. DOT’s current system of record for time and attendance for DOT personnel is called the Integrated Personnel and Payroll System (IPPS). DOT, through its Consolidated Uniform Payroll System (CUPS), calculates salary payments biweekly using T&A data from IPPS. CUPS will be used as well, drawing on IPPS data, to calculate biweekly salary payments for TSA screening personnel. It is the proposed T&A data approval system, and the reliability of the TSA T&A data that will be entered into IPPS from that system, that concerns the four certifying officers. The TSA T&A collection system will use individual identification cards, issued to each screener, which he/she will swipe through a time recording device and record his/her start and stop times. The certifying officers explained that the collected data will be “rounded up or down based upon a 7-minute grace period from the scheduled start/ stop times, and provided to the supervisor to record any leave taken by the employee.” At the end of the pay period, “a supervisor will validate (sometimes referred to as a pre-approval) that the T&A data in this new system is ready to be interfaced into IPPS.” At this point, the supervisor is able to see a column summary of base hours worked and leave hours taken by the employee. The supervisor approves the data for transmission to the IPPS, where it passes through IPPS’ edits and is provided to the IPPS approving official. The certifying officials stated that “[i]t is anticipated that the approving official in IPPS will be a high level supervisor (not necessarily the supervisor who has knowledge of time worked and absences of the employees) at each airport or facility. This IPPS approver will then approve all T&As for a particular airport or facility, which could include several hundred or possibly 1,000 T&As.”: The certifying officers expressed three concerns about this proposed T&A collection system: (1) The IPPS approving official will approve a large number of T&As for employees he/she does not directly supervise. (2) The data will not be checked against other independent sources. The supervisor who “pre-approves” the data will not be able to check the data against the records maintained in the IPPS, and it is not clear that the IPPS approving official will be able to reference the records maintained in IPPS back to the T&A data in the new system. (3) The rounding of an employees start/stop time minutes will not provide a complete and accurate agency record. Analysis: This decision addresses only the three specific concerns raised by the TSA certifying officers. We did not audit the system, otherwise, to determine whether the system contains flaws that might implicate the certifying officers’ liability in other ways. To assist us in addressing the certifying officers’ three concerns, we discussed the new T&A system and related controls over T&A information with TSA officials. Our conclusions about the operation of the new T&A approval system are based on a conceptual understanding of the system design, and we did not assess whether the current or proposed T&A system meets all of the requirements of Title 6. Based on our understanding of the proposed system, our responses to the certifying officers’ specific concerns are as follows. Because both the first and second concerns relate to the approval of the data in the new system, we address these two concerns together. The IPPS Official Does Not Approve TSA Employee T&As: The TSA certifying officers expressed concern that the IPPS official will approve a large number of T&As for employees he or she does not directly supervise. It is not our understanding, however, that the IPPS official will be “approving” T&As for employees he or she does not supervise. We understand, instead, that it will be the employees’ first--line supervisors who will approve T&As for their employees and submit the data for input into IPPS. The IPPS official will verify that the data in IPPS is the same as that entered by the first-line supervisors and that the data cleared the system’s internal controls, including automated data edit checks. This is an important distinction. The IPPS official is not an approving official; therefore, lie is not required to have first-band knowledge of the employees’ time worked. GAO Policy and Procedures Manual, Title 6§ 3.6E. Instead, the IPPS official may rely upon the proper functioning of internal controls that provide reasonable assurance the T&A system, as well as other systems supporting payroll processing, are operating properly and payments are valid. 69 Comp. Gen. 85 (1989). One of the key controls the IPPS approving official will rely upon is proper supervisory review. Section 3.6E of Title 6 of the GAO Policy and Procedures Manual, entitled “Approval of T&A Reports and Related Records,” states, “All T&A reports and related supporting documents ...must be reviewed and approved by an authorized official. Review and approval should be made by the official, normally the immediate supervisor, most knowledgeable of the time worked and absence of the employees involved.” According to TSA finance office staff, the new T&A approval system will require generally that checkpoint supervisors or screening managers approve a screener’s T&A information before it is recorded in IPPS’ TSA finance officers told us that these first-line supervisors (i.e., the supervisors, according to the TSA certifying officers, who “pre-approve” the data) best meet the criterion in Title 6 section 3.6, which requires that the official most knowledgeable about an employee’s time worked and absences be authorized to review and approve employee time and attendance information. These first-line approvers will be required to work in close proximity to the workforce so that they will be able to attest that the employee time records are complete and accurate. This will entail validating that the employee actually worked the hours recorded and had proper approval for any leave taken. Much of the data in the new system will be available in near real time once the employee “swipes” his or her identification badge; therefore, the supervisor will have near real-time information about who is at work, arrival and departure times, and organizational or project codes being charged. By approving the T&A information, the official agrees, ratifies, or concurs that to the best of his or her knowledge the T&A information being approved is true, correct, and accurate and in accordance with laws, regulations and legal decisions. For that reason, unlike the certifying officers, we are not concerned that the first- line supervisor will not be able to check the data against the records maintained in IPPS, and that the IPPS official will not be able reference the records maintained in IPPS back to the T&A data in the new system. Pursuant to Title 6, if the first-line supervisor’s approval is based on personal knowledge, additional independent checks are not required. GAO Policy and Procedures Manual, Title 6 § 3.6E. Because the first-line supervisor is a critical control and must approve specific T&A infornation under Title 6, TSA should ensure that its guidance documents the specific roles and responsibilities of the first-line supervisor and the steps first-line supervisors should take to ensure T&A information is proper in as much detail as practical. TSA officials should coordinate with DOT officials as necessary to ensure that any risks to the achievement of Title 6 objectives resulting from the integration of the new T&A system and supporting controls into the existing control environment are understood and addressed. If this occurs, and the current payroll processing controls are working properly, the IPPS official should have a reasonable basis on which to verify the T&A data. Pounded Start and Stop Tunes Can Provide a Complete and Accurate Record: With regard to the third concern, we have no objection to TSA’s use of immaterial rounding of employee actual time in and out data by TSA for purposes of recording T&A information. We consider the proposed 7- minute grace period from the scheduled starting/stopping times to be immaterial, and TSA proposes to retain actual time in and out data: The certifying officers’ concern stems from a Title 6 requirement that a complete and accurate record of the hours or fractions of an hour that an employee works be retained, which they fear would not be possible with the rounding of start and stop times on an employee’s T&A. According to TSA finance office staff, however, TSA will maintain actual original entry records, along with a trail of all changes to data. We have no objection to the use of rounding if actual recorded time in and time out data are retained by TSA in a form that can be subjected to testing, and if TSA, indeed, tests the controls over this data. TSA also should take reasonable steps to ensure that its time rounding rules are consistently applied and communicated to affected staff. Other Control-Related Steps: As previously stated, the reasonableness of a certifying officer’s reliance on an automated system to produce reliable and accurate information is a factor that we consider when addressing relief of the certifying officer from liability. 69 Comp. Gen. 85 (1989); B-247563, April 5, 1996. In this regard, one of the things we look for is whether the agency has provided its certifying officers with documentation establishing that the system on which they rely is operating effectively and can be relied upon to provide accurate and reliable information. B-247563, April 5, 1996; GAO/FGMSD-76-82, Nov. 7, 1977. Therefore, it is important that implementation of the proposed system be monitored closely to ensure that it is operating effectively. Since the 1982 enactment of the Federal Managers’ Financial Integrity Act (FMFIA), all executive branch agencies have been required to annually review their systems of internal control and to report material weaknesses. Especially during the initial period and the first full year of the proposed system’ s implementation, TSA should include in this review testing of the new system to ensure it is working as designed and that the accuracy of the T&A data is maintained. Conclusion: In accordance with Title 6, first-line supervisors will approve TSA screeners’ T&A data. Because these supervisors will have personal knowledge of the time worked of the employees involved, they are not required to check the data against independent sources. In addition, we do not object to what we consider to be an immaterial rounding of employee time in and time out data that is supported by the original entry records and a trail of all changes to data. We have, however, identified additional control-related steps that TSA management should build into the T&A approval system as it further develops and implements the T&A system. To better support a future request for certifying officer relief should the T&A system, in fact, generate an improper payment, TSA officials should implement the T&A approval system as described to us and build the following control-related steps into the T&A approval system: (1) conduct Federal Managers’ Financial Integrity Act reviews with a focus on ensuring that the new system is working as designed, the accuracy of the T&A data is maintained, and certifying officers are provided with assurances to this effect, (2) specify in detail in TSA guidance the specific roles and responsibilities of first-line supervisors, (3) communicate rounding rules for T&A time data to all affected staff, (4) ensure the rounding rules for T&A time data are consistently applied, and (5) ensure that rounded and actual T&A time data can be compared and tested once the T&A system is fully implemented. If you have any questions, please contact Susan A. Poling, Managing Associate General Counsel, or Hannah P. Laufe, General Attorney, at 202-512-5644. Anthony H. Gamboa General Counsel: FOOTNOTES for DECISION: [1] Title 6 of GAO’s Policy and Procedures Manual addresses Pay, Leave, and Allowances; chapter 3 specifically addresses Time and Attendance. Although plans to issue updated Time and Attendance guidance in early 2003, GAO plans no revision of the requirements applied in this decision. [2] Pursuant to the Homeland Security Act of 2002, Pub. L. No. 107- 296, 116 Stat. 2135, TSA will be transferred to the Department of Homeland Security and retained as a distinct entity. We do not address in this decision what effect this move may have, if any, on the new TSA T&A system. [3] Staff in the office of the TSA Chief Financial Officer told us that the proposed T&A system initially will cover baggage and passenger screeners but will eventually cover other employees as well. [4] TSA staff told us that each individual airport Federal Security Director (the senior TSA official at the airport) will have authority to designate an approval structure to fit the airport, and delegate approval responsibilities accordingly. [End of section] (195003): FOOTNOTES [1] See Comptroller General Decision B-291001 (Dec. 23, 2002). [2] Pursuant to 31 U.S.C. § 3529, disbursing or certifying officers or the head of an agency may request a decision from the Comptroller General in advance of payment when uncertain regarding authority to make or authorize particular payments. [3] This guidance replaces the 1996 revision to Title 6, “Pay, Leave, and Allowances” of GAO’s Policy and Procedures Manual. The requirements applied in the enclosed decision, which are from chapter 3, “Time and Attendance,” were not changed by this guidance.