Internal Controls

GAO reviewed the Financial Management Service's (FMS) Automated Standard Application for Payment (ASAP) system, focusing on: (1) the lack of supervision of certain ASAP system staff's work at two regional financial centers that administer the ASAP system; (2) inconsistent documentation by one of the centers of its review of enrollment forms from federal agencies and organizations that want to participate in the ASAP system; and (3) inappropriate access to the ASAP system's disbursement and return payment processing functions.

GAO noted that: (1) the Comptroller General's Standards for Internal Controls in the Federal Government requires supervisors to systematically review staff's work to the extent necessary and approve it at critical points to ensure that management objectives are met and errors or misunderstandings of procedures are detected; (2) however, at the Philadelphia and San Francisco Centers, GAO found that the ASAP system staff's work was not reviewed and approved by a supervisor; (3) according to the Comptroller General's Standards for Internal Controls in the Federal Government, all pertinent aspects of transactions and other significant events are to be clearly documented; (4) however, GAO found that staff at the San Francisco Center did not always document their review of users' enrollment forms by completing a tracking form; (5) the tracking form, required by FMS enrollment procedures, is designed to aid staff in reviewing, tracking, and accepting the various enrollment forms that users must submit to the center to participate in the ASAP system; (6) according to the Comptroller General's Standards for Internal Controls in the Federal Government, key duties and responsibilities in authorizing, processing, recording, and reviewing transactions should be separated among individuals; (7) in connection with its review of electronic data processing general controls, GAO identified 58 user identifications that grant staff inappropriate access to the ASAP system's disbursement and return payments processing functions; (8) FMS is not restricting access to these functions to only appropriate staff; and (9) as a result, the Federal Reserve Bank of Richmond Center and federal participating agencies staff were not adequately segregated from incompatible duties and there is an increased risk that invalid disbursements could occur.