Transmittal of Comptroller General Decision on the Transportation Security Administration's Time and Attendance Approval System
Gao ID: GAO-03-532R March 11, 2003This letter is to highlight internal control advice we offered in our December 2002 decision to four certifying officers of the Department of Transportation (DOT). Their July 24, 2002 letter had requested a Comptroller General decision related to certifying payroll payments. Pursuant to 31 U.S.C. 3529, the four certifying officers asked us whether the method of approving an employee's time and attendance (T&A) information in the T&A system, to which the Transportation Security Administration (TSA) is transitioning, meets the requirements of Title 6 of GAO's Policy and Procedures Manual for Guidance of Federal Agencies.
Based on our discussions with TSA officials, we determined that, in accordance with Title 6, first-line supervisors are approving T&A data. Because these supervisors will have personal knowledge of the time worked by the employees involved, they are not required to check the data against independent sources. We also determined that TSA will maintain actual original entry records along with a trail of all changes to data to support what we consider to be the immaterial rounding of employee time in and time out data.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: McCoy Williams Team: Government Accountability Office: Financial Management and Assurance Phone: (202) 512-6906GAO-03-532R, Transmittal of Comptroller General Decision on the Transportation Security Administration's Time and Attendance Approval System
This is the accessible text file for GAO report number GAO-03-532R
entitled 'Transmittal of Comptroller General Decision on the
Transportation Security Administration's Time and Attendance Approval
System' which was released on March 11, 2003.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products‘ accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
March 11, 2003:
Mr. Robert Gardner:
Assistant Administrator/CFO for Finance and Administration:
Transportation Security Administration:
701 South 12TH Street, Suite 518N:
Arlington, VA 22202:
Subject: Transmittal of Comptroller General Decision on the
Transportation Security Administration‘s Time and Attendance Approval
System:
Dear Mr. Gardner:
This letter is to highlight for your attention and action internal
control advice we offered in our December 2002 decision[Footnote 1] to
four certifying officers of the Department of Transportation (DOT).
Their July 24, 2002 letter had requested a Comptroller General decision
related to certifying payroll payments.[Footnote 2] A copy of the
decision is enclosed. Pursuant to 31 U.S.C. § 3529(a), the four
certifying officers asked us whether the method of approving an
employee‘s time and attendance (T&A) information in the T&A system, to
which the Transportation Security Administration (TSA) is
transitioning, meets the requirements of Title 6 of GAO‘s Policy and
Procedures Manual for Guidance of Federal Agencies (Policy and
Procedures Manual). To assist you in implementing our internal control
advice, we are enclosing a copy of our recently issued guidance
Maintaining Effective Control Over Employee Time and Attendance
Reporting, GAO-03-352G (Washington, D.C.: January 2003).[Footnote 3]
The certifying officers expressed three concerns with the new T&A
approval system. In their view, (1) approval is not occurring at the
appropriate level, (2) data will not be checked against independent
sources, and (3) the proposed rounding of an employee‘s start/stop time
minutes will not provide a complete and accurate agency record. The
certifying officers also asked whether GAO would relieve a certifying
officer pursuant to 31 U.S.C. § 3528(b)(1)(A) if a certifying officer
certified an improper or illegal payment in reliance on the new T&A
approval system.
To assist us in addressing the certifying officers‘ three concerns, we
discussed the new T&A system and related controls over T&A information
with TSA officials. The enclosed Comptroller General decision addresses
only the three specific concerns raised by the DOT certifying officers.
We did not audit the system, otherwise, to determine whether the system
contains flaws that might implicate the certifying officers‘ liability
in other ways.
Based on our discussions with TSA officials, we determined that, in
accordance with Title 6, first-line supervisors are approving T&A data.
Because these supervisors will have personal knowledge of the time
worked by the employees involved, they are not required to check the
data against independent sources. We also determined that TSA will
maintain actual original entry records along with a trail of all
changes to data to support what we consider to be the immaterial
rounding of employee time in and time out data.
We have, however, identified additional control-related steps that TSA
management should build into the T&A approval system as it further
develops and implements it. To better support a future request for
certifying officer relief should the T&A system, in fact, generate an
improper payment, TSA officials should implement the T&A approval
system as described to us and build the following control-related steps
into it:
Conduct Federal Managers‘ Financial Integrity Act reviews with a focus
on ensuring that the new system is working as designed, the accuracy of
the T&A data is maintained, and certifying officers are provided with
assurances to this effect.
Specify in detail in TSA guidance the specific roles and
responsibilities of first-line supervisors.
Communicate rounding rules for T&A time data to all affected staff.
Ensure the rounding rules for T&A time data are consistently applied.
Ensure that rounded and actual T&A data can be compared and tested once
the T&A system is fully implemented.
We have discussed the contents of this letter with Jeffrey Bobich, of
your staff, and he has informed us that TSA will build these steps into
its T&A process. If you or your staff have any questions, please
contact me at (202) 512-6906 or Mary Mohiyuddin, Assistant Director, at
(202) 512-3087.
Sincerely yours,
McCoy Williams:
Director:
Financial Management and Assurance:
Decision:
Matter of: Transportation Security Administration‘s Proposed Time and
Attendance System:
File: B-291001:
Date: December 23, 2002:
DIGEST:
Transportation Security Administration (TSA) certifying officers
expressed three concerns with TSA‘s new Time and Attendance (T&A)
approval system. In their view, (1) approval is not occurring at the
appropriate level, (2) data will not be checked against independent
sources, and (3) the proposed rounding of an employee‘s start/stop time
minutes will not provide a complete and accurate agency record. Based
on our discussions with TSA officials, we determined that, in
accordance with Title 6 of GAO‘s Policy and Procedures Manual for
Guidance of Federal Agencies, first-line supervisors are approving T&A
data. These supervisors have personal knowledge of the time worked of
the employees involved; therefore, they are not required to check the
data against independent sources. In addition, TSA will maintain actual
original entry records along with a trail of all changes to data to
support what we consider to be the immaterial rounding of employee time
in and time out data. TSA management, however, should build additional
control-related steps into the T&A approval system as it further
develops and implements the system.
DECISION:
Pursuant to 31 U.S.C. § 3529(a), four certifying officers at the
Department of Transportation (DOT) asked us whether the method of
approving an employee‘s time and attendance (T&A) information in the
T&A system to which the Transportation Security Administration (TSA) is
transitioning meets the requirements of Title 6(1) of
GAO‘s Policy and Procedures Manual for Guidance of Federal Agencies
(Policy and Procedures Manual). The certifying officers also asked
whether GAO would relieve a certifying officer pursuant to 31 U.S.C. §
3528(b)(1)(A) if a certifying officer certified an improper or illegal
payment in reliance on the new T&A approval system.
A certifying officer‘s liability is strict; however, a certifying
officer may request a decision from the Comptroller General in advance
of payment when he or she is uncertain regarding his or her authority
to make or authorize particular payments. 31 U.S.C. § 3529. In this
regard, the certifying officers expressed three concerns with the new
T&A approval system. In their view, (1) approval is not occurring at
the appropriate level, (2) data will not be checked against independent
sources, and
(3) the proposed rounding of an employee‘s start/stop time minutes will
not provide a complete and accurate agency record. Based on our
discussions with TSA officials, we determined that, in accordance with
Title 6, first-line supervisors are approving T&A data. Because these
supervisors will have personal knowledge of the time worked of the
employees involved, they are not required to check the data against
independent sources. We also determined that TSA will maintain actual
original entry records along with a trail of all changes to data to
support what we consider to be the immaterial rounding of employee time
in and time out data.
We have identified additional control-related steps that TSA management
should build into the T&A approval system as it further develops and
implements the system. To better support a future request for
certifying officer relief should the system, in fact, generate an
improper payment, TSA officials should implement the system as
described to us, and build into the system the control-related steps
that we discuss herein.
Background:
Standard for Relief:
Certifying officers are responsible for the legality of proposed
payments and for repaying any payment that was ’illegal, improper, or
incorrect because of an inaccurate or misleading certification.“ 31
U.S.C. § 3528(a). A certifying officer‘s legal liability is strict and
arises automatically at the time of an illegal or improper payment. 54
Comp. Gen. 112, 114 (1974). A certifying officer may request a decision
from the Comptroller General in advance of payment when he or she is
uncertain regarding his or her authority to make, or authorize the
making of, particular payments. 31 U.S.C. § 3529. A certifying officer
may rely on this advance decision when certifying future payments. This
Office also has authority pursuant to
31 U.S.C. § 3528(b)(1) to relieve a certifying officer from liability
when we find that the certification was based on official records and
the official did not know, and by reasonable diligence and inquiry
could not have discovered, the correct information. B-254385, March 22,
1994.
The nature of the technology used in a payment processing system does
not alter the basic concepts of accountability for certifying officers.
69 Comp. Gen. 85 (1989). Where certifying officials rely on the
integrity of an automated payment system, such as the TSA system at
issue here, the reasonableness of a certifying officer‘s reliance on an
automated system to continually produce reliable and accurate
information is a factor that we consider when addressing relief of the
certifying officer from liability for illegal or improper payments. 69
Comp. Gen. 85 (1989); B-247563, April 5, 1996. In this regard, we look
to see if the system satisfies our Title 6 requirements, and whether
the agency has provided its certifying officers with documentation
establishing that the system is operating effectively and can be relied
upon to provide accurate information. B-247563, April 5, 1996; GAO/
FGMSD-76-82, Nov. 7, 1977. Pursuant to section 3.3 of Title 6 of GAO‘s
Policy and Procedures Manual, agencies should provide their certifying
officers with documentation establishing that management has in place
internal controls that provide reasonable assurance that (1) T&A
transactions are properly authorized and approved and (2) T&A data are
completely and accurately recorded and retained.
Proposed Transportation Security Administration T&A Svstem:
The Aviation and Transportation Security Act, Pub. L. No. 107-71, 115
Stat. 597 (2001), created the Transportation Security Administration
under the Department of Transportation(2) A large part of the TSA
workforce will be passenger and baggage screening personnel assigned to
the nation‘s airports. TSA has selected a private contractor to create
and provide a new system for collecting T&A data.“ The contractor is
introducing the system at Baltimore-Washington International Airport
and subsequently will implement it at all commercial service airports
throughout the nation.
In their July 2002 request, the certifying officers provided us with
the following information. DOT‘s current system of record for time and
attendance for DOT
personnel is called the Integrated Personnel and Payroll System (IPPS).
DOT, through its Consolidated Uniform Payroll System (CUPS), calculates
salary payments biweekly using T&A data from IPPS. CUPS will be used as
well, drawing on IPPS data, to calculate biweekly salary payments for
TSA screening personnel. It is the proposed T&A data approval system,
and the reliability of the TSA T&A data that will be entered into IPPS
from that system, that concerns the four certifying officers.
The TSA T&A collection system will use individual identification cards,
issued to each screener, which he/she will swipe through a time
recording device and record his/her start and stop times. The
certifying officers explained that the collected data will be ’rounded
up or down based upon a 7-minute grace period from the scheduled start/
stop times, and provided to the supervisor to record any leave taken by
the employee.“ At the end of the pay period, ’a supervisor will
validate (sometimes referred to as a pre-approval) that the T&A data in
this new system is ready to be interfaced into IPPS.“ At this point,
the supervisor is able to see a column summary of base hours worked and
leave hours taken by the employee. The supervisor approves the data for
transmission to the IPPS, where it passes through IPPS‘ edits and is
provided to the IPPS approving official. The certifying officials
stated that ’[i]t is anticipated that the approving official in IPPS
will be a high level supervisor (not necessarily the supervisor who has
knowledge of time worked and absences of the employees) at each airport
or facility. This IPPS approver will then approve all T&As for a
particular airport or facility, which could include several hundred or
possibly 1,000 T&As.“:
The certifying officers expressed three concerns about this proposed
T&A collection system:
(1) The IPPS approving official will approve a large number of T&As for
employees he/she does not directly supervise.
(2) The data will not be checked against other independent sources. The
supervisor who ’pre-approves“ the data will not be able to check the
data against the records maintained in the IPPS, and it is not clear
that the IPPS approving official will be able to reference the records
maintained in IPPS back to the T&A data in the new system.
(3) The rounding of an employees start/stop time minutes will not
provide a complete and accurate agency record.
Analysis:
This decision addresses only the three specific concerns raised by the
TSA certifying officers. We did not audit the system, otherwise, to
determine whether the system contains flaws that might implicate the
certifying officers‘ liability in other ways. To assist us in
addressing the certifying officers‘ three concerns, we discussed the
new T&A system and related controls over T&A information with TSA
officials. Our conclusions about the operation of the new T&A approval
system are based on a conceptual understanding of the system design,
and we did not assess whether the current or proposed T&A system meets
all of the requirements of Title 6. Based on our understanding of the
proposed system, our responses to the certifying officers‘ specific
concerns are as follows. Because both the first and second concerns
relate to the approval of the data in the new system, we address these
two concerns together.
The IPPS Official Does Not Approve TSA Employee T&As:
The TSA certifying officers expressed concern that the IPPS official
will approve a large number of T&As for employees he or she does not
directly supervise. It is not our understanding, however, that the IPPS
official will be ’approving“ T&As for employees he or she does not
supervise. We understand, instead, that it will be the employees‘
first--line supervisors who will approve T&As for their employees and
submit the data for input into IPPS.
The IPPS official will verify that the data in IPPS is the same as that
entered by the first-line supervisors and that the data cleared the
system‘s internal controls, including automated data edit checks. This
is an important distinction. The IPPS official is not an approving
official; therefore, lie is not required to have first-band knowledge
of the employees‘ time worked. GAO Policy and Procedures Manual, Title
6§ 3.6E. Instead, the IPPS official may rely upon the proper
functioning of internal controls that provide reasonable assurance the
T&A system, as well as other systems supporting payroll processing, are
operating properly and payments are valid. 69 Comp. Gen. 85 (1989).
One of the key controls the IPPS approving official will rely upon is
proper supervisory review. Section 3.6E of Title 6 of the GAO Policy
and Procedures Manual, entitled ’Approval of T&A Reports and Related
Records,“ states, ’All T&A reports and related supporting documents
...must be reviewed and approved by an authorized official. Review and
approval should be made by the official, normally the immediate
supervisor, most knowledgeable of the time worked and absence of the
employees involved.“
According to TSA finance office staff, the new T&A approval system will
require generally that checkpoint supervisors or screening managers
approve a screener‘s T&A information before it is recorded in IPPS‘ TSA
finance officers told us that these first-line supervisors (i.e., the
supervisors, according to the TSA certifying
officers, who ’pre-approve“ the data) best meet the criterion in Title
6 section 3.6, which requires that the official most knowledgeable
about an employee‘s time worked and absences be authorized to review
and approve employee time and attendance information. These first-line
approvers will be required to work in close proximity to the workforce
so that they will be able to attest that the employee time records are
complete and accurate. This will entail validating that the employee
actually worked the hours recorded and had proper approval for any
leave taken.
Much of the data in the new system will be available in near real time
once the employee ’swipes“ his or her identification badge; therefore,
the supervisor will have near real-time information about who is at
work, arrival and departure times, and organizational or project codes
being charged. By approving the T&A information, the official agrees,
ratifies, or concurs that to the best of his or her knowledge the T&A
information being approved is true, correct, and accurate and in
accordance with laws, regulations and legal decisions. For that reason,
unlike the certifying officers, we are not concerned that the first-
line supervisor will not be able to check the data against the records
maintained in IPPS, and that the IPPS official will not be able
reference the records maintained in IPPS back to the T&A data in the
new system. Pursuant to Title 6, if the first-line supervisor‘s
approval is based on personal knowledge, additional independent checks
are not required. GAO Policy and Procedures Manual, Title 6 § 3.6E.
Because the first-line supervisor is a critical control and must
approve specific T&A infornation under Title 6, TSA should ensure that
its guidance documents the specific roles and responsibilities of the
first-line supervisor and the steps first-line supervisors should take
to ensure T&A information is proper in as much detail as practical.
TSA officials should coordinate with DOT officials as necessary to
ensure that any risks to the achievement of Title 6 objectives
resulting from the integration of the new T&A system and supporting
controls into the existing control environment are understood and
addressed. If this occurs, and the current payroll processing controls
are working properly, the IPPS official should have a reasonable basis
on which to verify the T&A data.
Pounded Start and Stop Tunes Can Provide a Complete and Accurate
Record:
With regard to the third concern, we have no objection to TSA‘s use of
immaterial rounding of employee actual time in and out data by TSA for
purposes of recording T&A information. We consider the proposed 7-
minute grace period from the scheduled starting/stopping times to be
immaterial, and TSA proposes to retain actual time in and out data:
The certifying officers‘ concern stems from a Title 6 requirement that
a complete and accurate record of the hours or fractions of an hour
that an employee works be retained, which they fear would not be
possible with the rounding of start and stop
times on an employee‘s T&A. According to TSA finance office staff,
however, TSA will maintain actual original entry records, along with a
trail of all changes to data. We have no objection to the use of
rounding if actual recorded time in and time out data are retained by
TSA in a form that can be subjected to testing, and if TSA, indeed,
tests the controls over this data. TSA also should take reasonable
steps to ensure that its time rounding rules are consistently applied
and communicated to affected staff.
Other Control-Related Steps:
As previously stated, the reasonableness of a certifying officer‘s
reliance on an automated system to produce reliable and accurate
information is a factor that we consider when addressing relief of the
certifying officer from liability. 69 Comp. Gen. 85 (1989); B-247563,
April 5, 1996. In this regard, one of the things we look for is whether
the agency has provided its certifying officers with documentation
establishing that the system on which they rely is operating
effectively and can be relied upon to provide accurate and reliable
information. B-247563, April 5, 1996; GAO/FGMSD-76-82, Nov. 7, 1977.
Therefore, it is important that implementation of the proposed system
be monitored closely to ensure that it is operating effectively. Since
the 1982 enactment of the Federal Managers‘ Financial Integrity Act
(FMFIA), all executive branch agencies have been required to annually
review their systems of internal control and to report material
weaknesses. Especially during the initial period and the first full
year of the proposed system‘ s implementation, TSA should include in
this review testing of the new system to ensure it is working as
designed and that the accuracy of the T&A data is maintained.
Conclusion:
In accordance with Title 6, first-line supervisors will approve TSA
screeners‘ T&A data. Because these supervisors will have personal
knowledge of the time worked of the employees involved, they are not
required to check the data against independent sources. In addition, we
do not object to what we consider to be an immaterial rounding of
employee time in and time out data that is supported by the original
entry records and a trail of all changes to data. We have, however,
identified additional control-related steps that TSA management should
build into the T&A approval system as it further develops and
implements the T&A system. To better support a future request for
certifying officer relief should the T&A system, in fact, generate an
improper payment, TSA officials should implement the T&A approval
system as described to us and build the following control-related steps
into the T&A approval system: (1) conduct Federal Managers‘ Financial
Integrity Act reviews with a focus on ensuring that the new system is
working as designed, the accuracy of the T&A data is maintained, and
certifying officers are provided with assurances to this effect, (2)
specify in detail in TSA guidance the specific roles and
responsibilities of first-line supervisors, (3) communicate rounding
rules for T&A time data to all affected staff, (4) ensure the rounding
rules for T&A time data are consistently
applied, and (5) ensure that rounded and actual T&A time data can be
compared and tested once the T&A system is fully implemented.
If you have any questions, please contact Susan A. Poling, Managing
Associate General Counsel, or Hannah P. Laufe, General Attorney, at
202-512-5644.
Anthony H. Gamboa
General Counsel:
FOOTNOTES for DECISION:
[1] Title 6 of GAO‘s Policy and Procedures Manual addresses Pay, Leave,
and Allowances; chapter 3 specifically addresses Time and Attendance.
Although plans to issue updated Time and Attendance guidance in early
2003, GAO
plans no revision of the requirements applied in this decision.
[2] Pursuant to the Homeland Security Act of 2002, Pub. L. No. 107-
296, 116 Stat. 2135, TSA will be transferred to the Department of
Homeland Security and retained as a distinct entity. We do not address
in this decision what effect this move may have, if any, on the new TSA
T&A system.
[3] Staff in the office of the TSA Chief Financial Officer told us that
the
proposed T&A system initially will cover baggage and passenger
screeners but will eventually cover other employees as well.
[4] TSA staff told us that each individual airport Federal Security
Director (the senior TSA official at the airport) will have authority
to designate an approval structure to fit the airport, and delegate
approval responsibilities accordingly.
[End of section]
(195003):
FOOTNOTES
[1] See Comptroller General Decision B-291001 (Dec. 23, 2002).
[2] Pursuant to 31 U.S.C. § 3529, disbursing or certifying officers or
the head of an agency may request a decision from the Comptroller
General in advance of payment when uncertain regarding authority to
make or authorize particular payments.
[3] This guidance replaces the 1996 revision to Title 6, ’Pay, Leave,
and Allowances“ of GAO‘s Policy and Procedures Manual. The requirements
applied in the enclosed decision, which are from chapter 3, ’Time and
Attendance,“ were not changed by this guidance.
