GAO/AIMD-00-225R Monitoring Lockbox Operations

United States General Accounting Office

Washington, DC 20548

Accounting and Information

Management Division

B-285674

July 26, 2000

Mr. Richard L. Gregg

Commissioner

Financial Management Service

Department of the Treasury

Subject: FMS’ Monitoring of Lockbox Bank Operations: Internal Control

Weaknesses Identified and Actions Taken

Dear Mr. Gregg:

We recently reported on the U. S. government’s financial statements for fiscal year

1999.1 In connection with fulfilling our requirement to audit these statements, we

tested certain internal controls over cash receipts collected through lockbox banks

and processed by the Department of the Treasury’s Financial Management Service

(FMS) on behalf of the federal government.2 We also followed up on FMS’ actions to

implement recommendations we made last year to improve monitoring of lockbox

bank operations.

On behalf of federal agencies, FMS enters into lockbox service agreements with

commercial banks to collect certain payments made to the federal government. FMS

uses two lockbox networks: the general network for all payments except federal

taxes and the Internal Revenue Service (IRS) lockbox network for federal tax

payments.3

The banks establish post office boxes and electronic accounts to receive

payments. The banks deposit the funds they collect in Treasury Demand Deposit

Accounts until they transfer funds to the Treasury General Account at the Federal

Reserve Bank of New York. They also submit collection reports to the federal

agencies and FMS.

1

Financial Audit: 1999 Financial Report of the United States Government (GAO/AIMD-00-131,

March 31, 2000).

2

31 U.S.C. 331(e) (1994).

3

Network is the term used by FMS to describe the group of banks that provides lockbox services. FMS

had agreements with four banks to provide lockbox services during fiscal year 1999. Each of these

banks provides general and IRS lockbox services and has multiple lockbox sites. In fiscal year 1999,

there were 11 lockbox sites nationwide.
B-285674

Page 2 GAO/AIMD-00-225R Monitoring Lockbox Operations

The banks are responsible for safeguarding and processing the funds in accordance

with their agreements with FMS and the federal agencies. FMS performs on-site

reviews and requires that the banks obtain internal and external audits of their

lockbox operations to determine the effectiveness of the banks’ controls. FMS,

lockbox banks, and each of the federal agencies for which the lockbox services are

provided also establish memorandums of understanding. These three-party

agreements set forth procedures for processing collections that are designed to meet

the specific processing and reporting requirements of the individual federal agencies.

The federal agencies are also responsible for monitoring lockbox operations and

reporting any performance problems to FMS. Also, Treasury requires banks to pledge

collateral to protect federal funds collected through their lockbox operations and

deposited at the banks.4FMS initially establishes the amount of collateral each bank

must pledge based on expected average daily deposits and then adjusts the amounts

based on actual collection information obtained from the banks.

In fiscal year 1999, FMS reported total lockbox collections of about $288 billion, of

which $269 billion was federal tax payments in the IRS lockbox network and

$19 billion was nontax payments in the general lockbox network. Because funds

collected through lockbox banks go directly to the banks, FMS must ensure that the

banks adequately safeguard the collections they process. Thus, FMS’ monitoring of

lockbox banks’ operations and collateral is intended to be a key internal control for

providing reasonable assurance that funds collected through the lockbox banks are

protected against fraud, waste, and mismanagement. The purpose of this letter is to

advise you of certain internal control matters identified during our testing and to

recommend improvements.

Results in Brief

FMS has taken significant steps to strengthen its monitoring of its lockbox bank

operations but additional actions are needed to assure that federal collections are

adequately safeguarded and properly processed. Last year, we reported on

weaknesses in, and recommended improvements to, FMS’ monitoring of lockbox

operations related to on-site reviews and lockbox bank audits.5 FMS has addressed

our concerns related to on-site reviews. In addition, FMS acted on our

recommendations related to requiring and providing guidance for lockbox bank

audits. However, due to the timing of the bank audits, FMS had not obtained the

results of such audits as of the end of our fieldwork. Thus, it was too early to assess

the effectiveness of FMS’ enforcement of the audit requirement, review of the audit

results, and follow-up on weaknesses identified, if any, in lockbox operations, as we

recommended.

4

Title 31, Code of Federal Regulations, Part 202, requires lockbox banks to pledge collateral security in

an amount required by the Secretary of the Treasury prior to receiving federal deposits.

5

Internal Controls: FMS’ Monitoring of Lockbox Bank Operations Needs Improvement (GAO/

AIMD-99-219, August 20,1999).
B-285674

Page 3 GAO/AIMD-00-225R Monitoring Lockbox Operations

In performing the fiscal year 1999 testing, we found that additional actions are

needed to (1) follow up on problems at lockbox banks identified by the federal

agencies for which the lockbox services are provided and (2) ensure the sufficiency

of collateral pledged by the lockbox banks. Specifically, we found that while FMS

performed some procedures to investigate thefts identified by one agency at its

general lockbox bank site, FMS’ actions did not include determining what

deficiencies at the bank allowed such thefts to occur. Therefore, FMS was unable to

assess whether the corrective actions taken by the bank were adequate to prevent

such thefts from occurring in the future. Once we brought this matter to FMS’

attention, FMS investigated the thefts further and found that additional controls were

needed at the bank to adequately safeguard the collections. Also, we found that FMS

had not monitored the sufficiency of the collateral pledged by the lockbox banks

since 1995 when it entered into lockbox service agreements with the banks, even

though its internal procedures require that reassessments be performed every 2

years. After we identified this problem, FMS reassessed the collateral pledged by the

banks and found that three of the four lockbox banks were significantly

undercollateralized. For example, at one bank, about half of its average daily

collected balances of approximately $150 million during the peak tax collection

periods were not covered by collateral. After its reassessment, FMS instructed the

banks to pledge the additional collateral needed to cover the deficiencies and protect

the government’s collections.

Although the internal control matters discussed in this letter are not material in

relation to the federal government’s fiscal year 1999 financial statements, we believe

they warrant your attention. Without effectively monitoring banks’ lockbox

operations, FMS does not know whether the banks are adequately safeguarding and

properly processing billions of dollars of federal collections. To assist FMS

management in addressing the matters we identified, this letter contains two detailed

recommendations. In commenting on a draft of this letter, FMS informed us that it

concurred with our findings and that it has actions in process to correct the matters

we identified.

Scope and Methodology

To meet our objective of evaluating the effectiveness of FMS’ internal controls over

lockbox operations, we reviewed FMS’ policies and procedures for performing onsite reviews and audits of lockbox bank operations. This included reviewing the

guidelines and checklists used by FMS in performing on-site reviews and the

guidance and instructions FMS issued to lockbox banks on internal and external

audits of lockbox operations. We also observed physical safeguards over receipts and

related taxpayer data at two IRS lockbox sites. We interviewed FMS officials,

including the Assistant Commissioner for Federal Finance, Director of FMS’ Cash

Management Directorate, Director of FMS’ Financial Services Division (FSD), and

FSD’s Bank Management Team Leader to determine the status of FMS’ actions to

correct problems identified in our prior year audit. We also reviewed FMS’ corrective

action plan for resolving the weaknesses we reported last year and status reports on

actions taken. In addition, we reviewed the federal regulations that require lockbox

banks to pledge collateral to cover collections deposited in Demand Deposit
B-285674

Page 4 GAO/AIMD-00-225R Monitoring Lockbox Operations

Accounts and FMS’ internal procedures for establishing collateral levels and

monitoring the sufficiency of collateral pledged by the banks. Our work did not

include evaluating FMS’ methodology for reassessing banks’ collateral levels or

valuing the collateral pledged by the banks. We conducted our work from December

1999 through March 2000 in accordance with generally accepted government auditing

standards. We requested comments on a draft of this letter from the Commissioner of

FMS. The Commissioner’s comments are discussed in the “Agency Comments”

section of this letter and included in the enclosure.

Additional Actions Are Needed to Strengthen

FMS’ Monitoring of Lockbox Bank Operations

As in last year’s audit, we identified weaknesses in FMS’ monitoring of lockbox

operations. The Comptroller General’s Standards for Internal Control in the Federal

Government6requires that management establish policies and procedures to provide

reasonable assurance that assets are safeguarded against loss from unauthorized use

or disposition and transactions are executed accurately and timely in accordance

with management directives. Although FMS has taken steps to address the

weaknesses we reported last year, we found during our fiscal year 1999 audit that

additional actions are needed to (1) follow up on problems at lockbox banks

identified by the federal agencies for which the lockbox services are provided and

(2) ensure the sufficiency of collateral pledged by the lockbox banks.

Follow-up on Identified Problems

Thorough follow-up on identified problems at lockbox banks is necessary to provide

assurance that problems are corrected in a timely manner and that corrective actions

are adequate to prevent similar problems from occurring in the future. However, we

found that FMS did not perform thorough follow-up on thefts identified by one of the

federal agencies at a general lockbox bank.

FMS officials told us that five instances of employee theft were identified at one of

the general lockbox sites during fiscal year 1999. According to FMS officials, one of

the bank’s employees had stolen five checks that were sent to the bank with the

agency payee line left blank. In this case, the agency discovered the problem and

notified the bank after the agency was contacted by one of the remitters of the stolen

checks. In a letter to FMS, while not describing the deficiencies that existed, the bank

stated that it thoroughly reviewed its existing security procedures and had taken

steps to improve its controls, such as enhancing mail opening procedures and using a

stamp to complete the agency payee line. However, we found that FMS’ original

follow-up did not include determining what deficiencies at the bank allowed such

thefts to occur and thereby assessing whether the actions taken by the bank, as

stipulated in its letter, were adequate to safeguard collections against such thefts in

the future.

6

GAO/AIMD-00-21.3.1, November 1999.
B-285674

Page 5 GAO/AIMD-00-225R Monitoring Lockbox Operations

After we brought this issue to FMS’ attention, FMS obtained additional information

from the bank on the circumstances surrounding the thefts and determined that other

control procedures were needed. For example, FMS found that the bank did not log

incoming blank payee checks, a standard mailroom procedure to help ensure that

checks are not lost or stolen. Also, the bank did not include blank payee checks in its

“seeding” program--a control technique used by banks that involves submitting

dummy or false transactions that include cash and other negotiable instruments, and

tracking the results to determine whether staff are processing transactions in

accordance with established procedures. FMS notified the bank that these

procedures should be implemented immediately. FMS officials told us that they plan

to verify that these controls are in place during the next on-site visit tentatively

scheduled for summer 2000. FMS officials also said that they plan to include a

requirement for “seeding” checks with blank payee lines in all lockbox bank

agreements when such agreements are renewed in 2001.

Monitoring of Collateral Pledged by Lockbox Banks

FMS is responsible for determining the amounts and types of securities lockbox

banks pledge as collateral to cover deposits in their lockbox Treasury Demand

Deposit Accounts during peak and nonpeak tax collection periods.7

FMS’ internal

procedures require that every 2 years, it reassess the sufficiency of the banks’

collateral to cover these accounts. However, we found that FMS had not periodically

reassessed the sufficiency of the banks’ collateral, in accordance with its procedures,

since 1995 when it initially entered into lockbox service agreements with the banks.

After we brought this issue to FMS’ attention, it reassessed the amount of collateral

the banks had pledged to cover lockbox funds deposited in their Demand Deposit

Accounts and found collateral deficiencies ranging from 30 percent to 97 percent at

three of the four lockbox banks. All three banks had collateral deficiencies for

nonpeak tax collection periods. One of the banks had an average daily collected

balance during the nonpeak collection period of $3.5 million and only had pledged

collateral valued at $103,500--a 97 percent collateral deficiency. Another bank had a

$79 million, or 52 percent, collateral deficiency for its peak tax collection periods in

addition to a nonpeak deficiency. This bank had pledged collateral valued at about

$71 million when it needed $150 million to cover its average daily collection balances.

Based on the results of these recent reassessments, FMS required the three banks to

pledge additional collateral to cover their Demand Deposit Accounts sufficiently

during both peak and nonpeak collection periods. FMS’ Bank Management Team

Leader also told us that he assigned a staff analyst to serve as the focal point for

monitoring all lockbox banks’ collateral.

7

FMS establishes two levels of collateral (referred to as peak and nonpeak levels) for the banks

because of significant fluctuations in the amount of lockbox deposits during the year. Peak collateral

levels are set to cover lockbox collections during the peak tax collection months of January, April,

June, and September, and nonpeak levels are set to cover collections during the other 8 months.
B-285674

Page 6 GAO/AIMD-00-225R Monitoring Lockbox Operations

Actions Taken by FMS to Improve Its Monitoring

of Lockbox Bank Operations

Last year, we reported on weaknesses in FMS’ monitoring of lockbox bank

operations related to on-site reviews and bank audits and made recommendations for

improvements. FMS developed a plan to address all of our recommendations and has

already implemented our recommendation to perform on-site reviews of general

lockbox bank operations. FMS has also taken steps to address our concerns related

to bank audits.

Specifically, FMS established a requirement for the banks to obtain semiannual

internal and biannual external audits of their IRS lockbox operations; provided the

banks specific guidance on the scope and type of external audits or other services;

and required the banks to deliver to FMS, by December 31 of each year, a schedule of

the internal and external audits to be performed at its IRS and general lockbox

operations. FMS also developed and implemented a policy that requires banks to

provide it with copies of audit reports on the banks’ lockbox operations and calls for

FMS staff to review the audit results and follow up on any weaknesses identified by

the auditors. According to FMS officials, the banks had scheduled internal audits

beginning in January 2000 and the majority of external audits were scheduled for

2001. Due to the timing of the bank audits, FMS had not received the results of the

audits as of the end of our fieldwork. Therefore, we were unable to assess the

effectiveness of FMS’ (1) enforcement of the audit requirement, (2) review of the

audit results, and (3) follow-up to ensure that any weaknesses identified were

corrected.

However, subsequent to our audit fieldwork, FMS advised us that it had received the

internal audit reports of two lockbox banks. For one of the banks, the auditors

reported instances of noncompliance and internal control weaknesses at its IRS and

general lockbox operations. For example, the auditor found that cash remittances at

one of the bank’s general lockbox sites were not properly secured in safes before

being deposited. The auditor also reported that a cash seeding program had not been

established at the bank’s general lockbox operation sites. FMS officials stated that as

part of the next on-site review of this bank’s lockbox operations, they will follow up

with the bank to ensure that corrective actions are taken. The weaknesses identified

in this audit further emphasize the importance of FMS’ monitoring of required bank

audits.

Conclusion

Without effective monitoring of lockbox bank operations through thorough follow-up

on problems agencies identify at the banks, such as the thefts that occurred at one of

the general lockbox banks, and periodic monitoring of the sufficiency of the

collateral pledged by the banks, FMS does not have assurance that the banks are

adequately safeguarding federal collections against loss or theft and processing

collections in accordance with the terms of the lockbox agreements.
B-285674

Page 7 GAO/AIMD-00-225R Monitoring Lockbox Operations

Because of the timing of the internal and external audits of the lockbox banks’

operations, it was too early to assess the effectiveness of FMS’ enforcement and

review of the audits. We will continue to monitor FMS’ efforts in this area. It is

important that FMS continue with its plans to obtain and review the results of the

bank audits and follow up with the banks and agencies to ensure that any

weaknesses identified are corrected.

Recommendations

To correct the new weaknesses we identified in FMS’ monitoring of lockbox

operations, we recommend that the Commissioner of FMS direct the Assistant

Commissioner for Federal Finance to ensure that the Financial Services Division

(1) establishes procedures to thoroughly follow up on problems agencies identify at

lockbox banks, such as the thefts identified at one of the general lockbox banks, to

ensure that problems are corrected in a timely manner and that adequate corrective

actions are taken to prevent similar problems from occurring in the future and

(2) performs periodic reassessments of collateral pledged by lockbox banks, as

prescribed in FMS’ internal policies and procedures.

Agency Comments

In commenting on a draft of this letter, FMS concurred with our findings and

recommendations. The Commissioner of FMS indicated that FMS will continue to

strive for additional improvements to assure that federal collections are adequately

safeguarded and properly processed. The Commissioner also stated that FMS is

already taking actions to address the internal control matters that we identified and

plans to have them completed by September 30, 2000. We plan to follow up on these

matters during our audit of the federal government’s fiscal year 2000 financial

statements.

-----

This letter contains recommendations to you. The head of a federal agency is

required by 31 U.S.C. 720 to submit a written statement on actions taken on our

recommendations. You should send your statement to the Senate Committee on

Governmental Affairs and the House Committee on Government Reform within 60

days of the date of this letter. You must also send a written statement to the House

and Senate Committees on Appropriations with the agency’s first request for

appropriations made over 60 days after the date of this letter.

We are sending copies of this letter to Senator Fred Thompson, Chairman, and

Senator Joseph Lieberman, Ranking Minority Member, Senate Committee on

Governmental Affairs; Representative Dan Burton, Chairman, and Representative

Henry Waxman, Ranking Minority Member, House Committee on Government

Reform; other interested congressional parties; the Honorable Lawrence Summers,

Secretary of the Treasury; Donald Hammond, Fiscal Assistant Secretary, Department

of the Treasury; the Honorable Jeffrey Rush, Jr., Inspector General, Department of
B-285674

Page 8 GAO/AIMD-00-225R Monitoring Lockbox Operations

the Treasury; and the Honorable Jacob J. Lew, Director, Office of Management and

Budget. Copies will be made available to others upon request.

If you have any questions regarding this letter, please contact me at (202) 512-3406.

Key contributors to this assignment were Christine Robertson, Suzanne Murphy, and

Jerry Marvin.

Sincerely yours,

Gary T. Engel

Associate Director

Governmentwide Accounting and

Financial Management Issues

Enclosure
Enclosure

Page 9 GAO/AIMD-00-225R Monitoring Lockbox Operations

Comments From the Financial Management Service
Enclosure

Page 10 GAO/AIMD-00-225R Monitoring Lockbox Operations

(919513)