Transit fringe benefits—employer-provided benefits designed to encourage public and private employees to use mass transit for their home-to-work commute—date back to the early 1990s. The Energy Policy Act of 1992 created a new category of qualified fringe benefits— the “qualified transportation fringe”—that is excludible from gross income. Executive Order 13150, dated April 26, 2000, required the implementation of a transportation-fringe-benefit program for qualified federal employees, in which federal agencies offer to employees transit benefits excludable from gross income. This benefit includes transit vouchers and passes for public transportation, to be used exclusively to cover actual out-of-pocket commuting expenses, not to exceed a maximum monthly allowable dollar limit set by law, which has been adjusted for inflation over the years and currently is $130. Federal agencies can either distribute transit benefits directly to employees, enter into an interagency agreement with another agency, such as DOT, or contract with a private company for distribution. DOT’s transit benefit program is administered by TRANServe, located within the Office of the Assistant Secretary for Administration. In 1998, TRANServe began offering transit benefit distribution services to other federal entities participating in the federal government’s transit benefit program. Over time, TRANServe has distributed transit benefits in a variety of forms. Prior to 2011, TRANServe had distributed the benefits to participating federal employees via paper fare media—i.e., paper vouchers and paper transit passes (e.g., Metro transit vouchers in the District of Columbia)— and smart cards (e.g., electronic transit cards). In March 2011 and April 2012, DOT published notices for public comment of its intention to adopt a new distribution methodology for transit benefits. Specifically, DOT proposed implementing electronic fare media—a debit card—in place of paper vouchers where electronic fare media is accepted by transit authorities. In its notice, DOT indicated that the move toward debit cards was the result of a growing number of state and local transit authorities transitioning to electronic fare media and rising paper voucher program costs. TRANServe indicated that electronic fare media provides a way to tighten internal controls and support the green government movement, which entails implementing more environmentally-friendly practices. Since 2011, the portion of transit benefits distributed via debit cards has increased while the portion distributed as paper vouchers has declined (see fig. 1). In fiscal year 2014, TRANServe distributed over $210 million dollars in cash equivalent fare media to over 202,000 transit-benefit participants employed by 106 federal entities (referred to as client agencies) nationwide, mostly through the TRANServe debit card. TRANServe administers transit benefits for more federal entities than any other program administrator in the federal sector.percent of the 202,000 TRANServe participants were using the debit card. As discussed in the Standards for Internal Control in the Federal Government, internal control comprises the plans, methods, and procedures used by entities to meet their missions, goals, and objectives. The phrase “internal control” does not refer to a single event, but rather a series of actions and activities that occur throughout an entity’s operations on an ongoing basis and that serve as the first line of defense in safeguarding assets and preventing and detecting errors and fraud.Moreover, internal controls should be designed to provide reasonable assurance that unauthorized acquisition, use, or disposition of an entity’s assets will be promptly detected. Lastly, internal control systems help government program managers achieve desired results through effective stewardship of public resources. In 2007, the Office of Management and Budget (OMB) provided guidance for federal agencies to use in establishing and implementing internal controls over their respective transit benefit programs to help managers reduce the opportunity for fraud, waste, and abuse. its guidance was in response to our 2007 testimony that confirmed allegations that federal employees in the National Capital Region committed fraud by deliberately requesting benefits they were not entitled to and then selling or using these benefits for personal gain. As a result of our investigation and testimony, OMB required all federal agencies to implement several internal controls in order to maintain the integrity of the transit benefit program. OMB issued a memorandum, Federal Transit Benefit Program, M-07-15 (May 14, 2007), to the executive departments and agencies requiring all agencies with transit benefit programs to implement several internal controls designed to deter fraud, waste, and abuse. used at merchants that have been assigned a code indicating they sell fare media. IRS described two other scenarios, one involving a smart card and another involving a debit card where employees do not substantiate their transit fare expenses, scenarios that we did not describe. the electronic media. Subsequently, IRS sent out a notice for public comment on this revenue rule and modified it in 2014. DOT’s TRANServe debit-card program includes activities that correspond to the five internal control standards—(1) control environment, (2) risk assessment, (3) control activities, (4) monitoring, and (5) information and communication. In combination, these activities would be expected to provide reasonable assurance that non-transit-related purchases can be identified and denied. Based on our review of the design of TRANServe’s internal controls for the TRANServe debit-card program, we found that those internal controls align with GAO’s Standards for Internal Control in the Federal Government. However, certain weaknesses could exist as we did not independently test DOT’s internal controls to determine whether they mitigate all possible risks and are operating as intended. TRANServe’s activities for establishing a control environment—a disciplined work environment and ethical culture—amongst management and staff were generally consistent with internal control standards. The Standards for Internal Control in the Federal Government states that management and employees should establish and maintain an environment that sets a positive and supportive attitude toward internal control and conscientious management. A positive control environment is the foundation for all other standards, a foundation that provides discipline and structure as well as the climate that influences the quality of internal control. Several key factors affect the control environment, e.g., the integrity and ethical values maintained and demonstrated by management and staff. TRANServe has established a control environment framework for the debit-card program through the following: A primary goal for the debit-card program: TRANServe has set a primary goal for the debit-card program of offering enhanced internal controls to preserve transit benefits by deterring waste, fraud, and abuse. Internal controls officer: TRANServe created an internal controls officer position in April 2007, which according to officials, has been staffed since 2007 without vacancies. According to the program’s policy and guidance, this position heightens review of the program’s internal controls. The internal controls officer is responsible for maintenance and testing of internal controls, through a combination of inquiry, inspection, and observation. Also, the internal controls officer is responsible for designing training classes for TRANServe employees and DOT’s transit benefit participants. Training: DOT requires all staff who are participants in the transit benefit program, to complete mandatory Transit Benefit Integrity Awareness Training on an annual basis. This is a mandatory electronic course that clarifies transit benefit requirements and emphasizes the internal controls in place to minimize fraud and address ramifications of noncompliance. Additionally, according to TRANServe officials, the training is available on its website for client agencies. Moreover, if requested, the TRANServe staff are available to assist or conduct the training. Online resources: Finally, TRANServe has a number of resources available for internal and external participants and client agency points of contacts. The TRANServe website houses information such as, among others, best practices for internal controls, policies and procedures, and training. This helps to improve agency-level internal controls, thereby strengthening the combined level of internal controls. TRANServe’s activities for assessing and identifying relevant risks, and determining how those risks should be managed, were generally consistent with internal control standards. The Standards for Internal Control in the Federal Government states that internal control should provide for an assessment of the risks the agency faces from both internal and external sources. Risk assessment is the identification and analysis of relevant risks associated with achieving agency objectives. According to TRANserve officials, a formal risk assessment for the TRANServe program has not been conducted; however, this standard states that risk identification methods may include, among others, consideration of findings from other assessments, such as the Federal Managers Financial Integrity Act of 1982 (FMFIA) annual assessment.The following TRANServe activities are related to assessing risk. Internal controls officer: According to the program’s policy and guidance, the internal controls officer is responsible for examining current internal control activities and, identifying potential program vulnerabilities, through testing of controls related to the debit card. Monitoring: According to TRANServe’s standard operating procedure (SOP), monitoring debit card transactions identifies those transit benefit participants who are possibly misusing the debit card. As stated in the SOP, monitoring debit card transactions is performed on a weekly basis; this frequency is necessary to maintain program integrity and prevent the misuse of debit cards for non-acceptable transaction activity. Monitoring activities will be discussed in greater detail later under the monitoring standard. FMFIA annual assessment: DOT’s annual assessment of its internal control and financial-management systems, as required by the FMFIA, is intended to provide reasonable assurance that objectives are being met. Those objectives include whether (1) financial and other resources are safeguarded from unauthorized use or disposition; (2) transactions are executed in accordance with authorizations; (3) records and reports are reliable; (4) applicable laws, regulations and policies are observed; and (5) financial systems conform to government-wide standards. For fiscal year 2014, DOT’s Agency Financial Report stated that DOT utilized its standardized FMFIA internal control program approach for managing internal control and compliance activities. This approach included using the five standards of internal controls to identify, assess, document, and communicate key programmatic internal controls and related risks or weaknesses. For its part, the Office of Financial Management and Transit Benefits, which includes the TRANServe program, completes an annual assessment of the program’s management controls and financial-management systems. In fiscal year 2014, TRANServe reported on a number of activities, including testing of controls related to the debit card; reviewing all SOPs to incorporate best practices and tighten internal controls for external and internal customers; and providing monthly invoices with detailed reports to client agencies on employee participation in the transit benefit program. DOT reported no internal-control material weaknesses in the TRANServe program in its FMFIA assessments and audited consolidated financial statements for fiscal years 2011 through 2014. TRANServe’s activities for managing its internal control system are generally designed to be consistent with internal controls. The Standards for Internal Control in the Federal Government notes that control activities should be efficient and effective in accomplishing the agency’s control objectives, and should occur at all levels of the agency. The standards also note that the responsibility for good internal control rests with managers. Management sets the objectives, puts the control mechanisms in place, and monitors and evaluates the controls. Control activities are policies, procedures, techniques, and mechanisms that help ensure an agency’s objectives are met. The following describes the TRANServe program’s control activities. Standard operating procedures. TRANServe has established SOPs for the following program activities. These SOPs include: Conducting debit card transaction data mining:provides the guidelines for weekly data mining, which includes reviews of debit card transactions to identify potential misuse or irregular activity, such as the purchase of non-transit items. Sending “anomaly letters” (letters detailing misuse of the debit card) to client agencies: This SOP outlines procedures to use in transmitting anomaly letters to an agency once notification has been received that a potential misuse has occurred. Potential misuse, among other things, may involve retail merchants, or irregular transaction amounts. Providing debit card transaction anomaly reporting to the financial agent bank (J. P. Morgan): Specifically, the financial agent provides debit card services to electronically deliver transit benefits to federal employees of the client agencies serviced by TRANServe. The SOP outlines procedures that are to be taken once an anomaly notice is received indicating non-acceptable transaction activity. Internal controls officer: The internal controls officer is responsible for (1) examining current internal-control activities, including identifying potential program vulnerabilities; (2) developing solutions for identified vulnerabilities; (3) having knowledge of existing rules and regulations concerning internal controls; and (4) keeping abreast of new developments for best practices in internal controls. Inherent features of the debit card: According to TRANServe officials, ensuring that transit beneficiaries do not make non-transit-related purchases is an inherent feature in the design of the debit card TRANServe has implemented through Treasury and J.P. Morgan. The debit card is designed so that it can only be used to purchase transit fare media through transit providers that are identified through a limited list of MCCs approved by DOT. However, in situations when a merchant with an approved MCC is found to be allowing purchases for non-transit items on the debit cards or where a merchant repeatedly forces a card transaction when a purchase is declined, TRANServe has the option of working with J.P. Morgan to further restrict the debit card. This additional restriction—called a merchant identification (MID) block—involves blocking attempted transactions made by TRANServe debit cardholders at a specific merchant location. As a result, the MID block prevents all future transaction activity at that particular merchant even though it has an approved MCC. The MID block mechanism allows TRANServe to maintain the integrity of the MCC while selectively blocking noncompliant points of sale. TRANServe’s activities for continuous monitoring and evaluating the effectiveness of the internal control design were generally consistent with internal control standards. The Standards for Internal Control in the Federal Government states that internal control monitoring should assess the quality of performance over time and assure that ongoing monitoring occurs in the course of normal operations. The internal controls officer manages monitoring activities, which include maintenance and testing of internal controls. Consistent with federal internal control standards that call for ongoing and continual monitoring, TRANServe’s monitoring activities include debit card transaction data mining. According to SOPs, debit card transaction data mining includes monitoring debit card transactions on a weekly basis. Moreover, staff identify potential misuse by reviewing debit card transaction details for retail merchants, non-compliant MCCs, irregular transaction amounts, rejected transactions, and purchases of consumer items (i.e., non-transit-related items) under a compliant MCC. When misuse of a debit card is discovered, according to TRANServe, it will send a report and a letter to the agency of the violator notifying the agency of the potential violation. TRANServe officials said that once the agency receives notification of the violator, the client agency is responsible for taking appropriate action for those found to be violating program requirements—TRANServe has no contact with the violator. TRANServe will also, if necessary, contact J.P. Morgan to implement an MID block or to recoup payment. The data-mining process has three levels of review based on SOP. Data-Mining First Level Review: This level review of debit card transactions involves querying the MCCs. MCCs are routinely reviewed for compliance and any violations identified and followed up on with agency anomaly letters and chargebacks. The process for transmitting anomaly letters is a five-step process (see table 2). From fiscal years 2011 through 2014, TRANServe sent a total of 237 anomaly letters to agencies notifying them of potential misuse of the debit card (see table 3). The amounts of the questionable charges made by cardholders for this time period ranged from $1.10 to $1,557.00.According to TRANServe officials, the majority of the questionable charges was at or below the transit benefit’s statutory limit of $130 per month. In fiscal year 2014, J. P. Morgan processed over 1.5 million total purchase transactions for all TRANServe debit cards. In the same year, three charges exceeded the statutory limit. Table 3 shows the number of anomaly letters sent to agencies and the number of purchase transactions for fiscal years 2011 through 2014. Data Mining Second Level Review: This level of review involves querying the merchant name. This review involves performing key word searches. According to SOP, the key words in merchant names that will trigger an alert are parking, news, deli, cash, liquor, and coffee, among others. Data Mining Third Level Review: This level of review involves querying the transaction amount for irregular transaction, including those exceeding the statutory limit are identified, and contacting the merchant to determine the type of good or service purchased. When applicable, violations identified result in agency anomaly letters, MID blocks, and chargebacks. TRANServe provided several examples of its data mining of purchase transaction documentation that identified potential misuse of debit cards. For example, one debit card transaction was processed using a non- approved MCC. The participant used the debit card to make a purchase of $53 at a drugstore in April 2014. The internal controls officer notified the client agency of this potential misuse of the debit card and subsequently received confirmation of misuse from the client agency. TRANServe officials said that the internal controls officer typically notifies the client agencies of possible misuse within 5 to 10 days of receiving and completing the review of the data mining information. Additionally, for this transaction, TRANServe requested that J. P. Morgan reimburse the program for this amount, given that the merchant forced this transaction. TRANServe activities for collecting reliable information and providing timely communications to client agencies for relevant events were generally consistent with internal control standards. The Standards for Internal Control in the Federal Government states that for an entity to run and control its operations, it must have relevant, reliable, and timely communications relating to internal as well as external events. Information is needed throughout the agency to achieve all of its objectives. Information should be recorded and communicated to management and others within the entity who need the information and in a form and within a time frame that enables them to carry out their internal control and other responsibilities. Additionally, according to these federal internal-control standards, management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders since such information may have a significant impact on the agency achieving its goals. The following TRANServe activities align with the standard for information and communication: Transit benefit program partnership agreement: This agreement, which TRANServe has with its client agencies, states that TRANServe will maintain a database that will identify, among other things, the following: (1) all participants in the program that are currently deemed eligible by the client agency; (2) the original effective date of program participation; and (3) the value of fare media provided and the effective date of termination, as appropriate. The agreement also states that TRANServe will make other reports from its program database available upon agency request. However, as part of the partnership agreement, TRANServe states that it does not assume responsibility for ensuring client agencies’ internal controls over the program nor recipient integrity with regard to the program. It is the responsibility of the client agency to ensure that its employees are fully aware of their responsibilities for participation in the program. Sending anomaly letters: As previously described, TRANServe has established a process for sending debit-card anomaly letters to client agencies when consumer purchases are detected through the data mining process. Depending on the type of anomaly identified, an email with anomaly letter attached is sent to the agency for further agency action. The TRANServe program website: The website includes information about what client agencies need to do to prevent non-transit-related purchases, such as internal control best practices, as well as warnings to users about using debit cards for non-transit-related purchases. Additionally, TRANServe debit cards have a warning indicating that participants are legally bound to abide by the terms of the Transit Benefit Program and that use of the debit cards is personal certification that they will be used by cardholders as the transit benefit for their regular home-to-work transportation (see fig. 3). FMFIA annual assessments: DOT communicates its compliance with the FMFIA through the annual letters it sends to client agencies reporting that DOT’s system fully complies with federal and agency guidance. FMFIA requires agency managers to establish internal control systems that provide reasonable assurance regarding the agency’s proper use of funds and resources, compliance with statutes and regulations, and preparation of reliable financial reports. TRANServe worked with IRS to demonstrate that its debit-card program was in compliance with relevant statutes, Treasury regulations, and IRS administrative rules—specifically that the debit card qualified as a “transit pass” as defined in section 132(f)—for the purposes of qualifying as a transportation fringe benefit and being excludable from gross income. According to IRS, TRANServe demonstrated that the debit card was a “transit pass” because the card restrictions effectively permit recipients of the cards to use them only to purchase fare media on mass transit In May 2011, TRANServe first tested the use of a debit card systems. in the New York metropolitan area and based on the information from its preliminary testing, obtained a letter from IRS concluding that for the New York metropolitan area the TRANServe debit card, subject to any changes, was a “transit pass” for purposes of section 132(f) of the Code and as such was a qualified transportation fringe benefit. IRS’s conclusion was based on the fact that TRANServe had demonstrated that the debit card restrictions as tested (i.e., specifically the MCC restriction with MID blocking capability) effectively permit cardholders to use the debit cards to only purchase fare media on mass transit systems. In addition, IRS took into consideration TRANServe’s assurance that it would complete monthly reviews of employees’ TRANServe debit card accounts (i.e., anomaly monitoring) in order to identify transactions that might involve non-transit-related purchases and other anomalies. IRS further concluded that the debit card also would constitute a bona fide cash reimbursement program (with respect to systems or areas where no transit pass is readily available) for purposes of section 132(f) because the program contained the features described in Revenue Ruling 2006-57 (e.g., initial payment of transit fare with after-tax amounts for at least the first month, annual employee recertification that the debit card was used only to purchase transit fare media, among other things). Based on its experience in the New York metropolitan area, TRANServe then developed a plan to field test the debit cards in the eight service areas—geographic divisions that contain proximate states—where TRANServe had previously distributed transit paper vouchers. From 2011 to 2013, TRANServe implemented its field test, which included: researching the transit usage in the region, identifying target areas where the transit authorities are located, selecting point-of-sale locations where transit media are sold and as well as non-transit-related sales locations, distributing debit cards that already contained the MCC restrictions to testers, sending testers to the predetermined sales locations to purchase either transit fare media or non-transit-related items, assigning some testers to make debit-card purchases on-line or via telephone depending on the number of ways transit media were sold, and contacting J. P. Morgan to obtain transaction records during the field testing phase. Figure 4 shows how TRANServe implemented its field tests of the debit cards in each of the eight service areas. According to TRANServe officials, TRANServe staff reviewed the test results for each service area to determine whether the debit card restrictions were effective. The testers compiled information about their purchases and obtained transaction reports from J. P. Morgan. TRANServe reviewed this information in order to verify that the debit card restriction held and that the card was used only for authorized purchases. In some instances, TRANServe subsequently worked with J. P. Morgan to implement MID blocks. In other situations, TRANServe worked with the respective transit authorities to ensure proper usage of the debit card. Following each of the field tests, TRANServe shared the results with IRS and obtained IRS’s comments or questions about the tests and results. Once IRS was satisfied with the final results in a service area, IRS sent TRANServe an email correspondence to confirm its understanding of the test results and that based on such test results, the debit card constitutes a transit pass and qualifies as a transportation fringe benefit. TRANServe substantially completed the roll out of the debit-card program by the end of fiscal year 2014. In each service area, TRANServe completed a number of debit card transactions, to test whether the debit card was sufficiently restricted. Service area 1: TRANServe began field tests in the area between July and September 2011. Testers completed 103 point-of-sale tests, of which 87 of the transactions passed (i.e., the card restrictions held so that it could only be used to purchase transit media), 10 failed, and 6 were not completed for reasons such as the merchant did not have the item in stock. Seven of the 10 failed transactions resulted from one merchant’s overriding declined payments, and the remaining 3 purchases were at parking garages that used an accepted MCC. According to TRANServe officials, TRANServe worked with its financial agent to stop this merchant from overriding transactions and planned to use anomaly testing to further detect parking garage transactions. In November 2011, based on the test results, IRS officials confirmed to TRANServe that based on the test results the debit card constitutes a transit pass in the Norfolk and Baltimore metropolitan regions. In the National Capital Region, the debit card satisfied the requirements for a bona fide cash reimbursement program for purposes of transit systems that do not accept the local smart card (i.e., Washington Metropolitan Area Transit Authority SmarTrip® card), which is a transit pass. Service area 2: TRANServe began field tests in the area between July and September 2011. Testers completed 130 point-of-sale tests, of which 122 of the transactions passed and 8 transactions failed. The failed transactions resulted from merchants’ overriding declined payments and approving transactions at certain parking garages. TRANServe indicated it would work with its financial agent to stop the merchants from overriding transactions and it would continue to monitor the parking garage activities through anomaly testing. In January 2012, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in the service area. Service area 3: TRANServe began field tests in the area between January and March 2012, but excluded one potential target area, Milwaukee, because research on transit in the city indicated too few locations to purchase fare media with credit or debit cards. Testers completed 175 point-of-sale tests, of which 174 of the transactions passed and one transaction failed. This transaction involved the tester’s making a purchase of a non-transit-related item at a transit store location that offered consumer merchandise. According to TRANServe, it worked with the transit authority to change its procedures so that only transit fare media can be purchased with the debit card. In March 2012, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in the service area. Service area 4: TRANServe began field tests in the area between July and September 2012. Testers completed 80 point-of-sale tests, of which all of the transactions passed. In May 2013, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in certain parts of the service area (specifically, in Portland and in Seattle—although the pass is limited to use at national van pool companies in Seattle). Service area 5: TRANServe began field tests in the area between April and June 2012. Testers completed 52 point-of-sale tests, of which all of the transactions passed. In December 2012, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in certain parts of the service area (specifically, Boston and Newark). At that time, IRS was still evaluating TRANServe information provided for Buffalo, Philadelphia, and Pittsburgh. TRANServe subsequently completed additional tests in these locations. The tests demonstrated the effectiveness of the card restrictions, and IRS officials agreed later in December 2012 and March 2013 that, based on the test results, the debit card qualified as a transit pass in these locations. Service area 6: TRANServe began field tests in the area between January and March 2012. Testers completed 151 point-of-sale tests, of which 149 transactions passed and 2 failed. These transactions involved the purchase of parking passes through a transit authority. TRANServe did not roll out the debit card in this segment of the service area because it could not resolve the co-mingling of transit and parking purchases. In August 2012, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in certain parts of the service area (specifically, Los Angeles, El Segundo, San Jose, San Diego, San Francisco, and Oakland). Service area 7: TRANServe began field tests in the area between April and June 2012. Testers completed 84 point-of-sale tests, of which 82 transactions passed and 2 failed because the tester was able to purchase non-transit-related items at a transit authority store and bike rental shop. TRANServe worked with J.P. Morgan to block purchases at those locations. In December 2012, IRS officials confirmed that, based on the test results, the debit card constituted a transit pass in certain parts of the service area (specifically, Salt Lake City, Ogden, Albuquerque, Denver, and Phoenix). At that time, IRS was still evaluating DOT’s information provided for Honolulu. Following additional points of sale tests by TRANServe, IRS confirmed that, based on the test results, the debit card constituted a transit pass in Honolulu for van pool and bus service. Service area 8: TRANServe began field tests in the area between April and June 2012. Testers completed 79 point-of-sale tests, of which all of the transactions passed. In May 2013, IRS officials confirmed that, based on the test results, the debit card constitutes a transit pass in certain part of the service area, specifically Dallas, Houston, San Antonio, St. Louis, and Kansas City. We provided a draft of this report to the Department of Transportation and Internal Revenue Service for review and comment. DOT and IRS provided technical comments, which we incorporated, as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees and the Secretary of the Department of Transportation and the Commissioner of the Internal Revenue Service. In addition, this report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions or would like to discuss this work, please contact me at (202) 512-2834 or wised@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Individuals making key contributions to this report are listed in appendix I. In addition to the contact named above, Vashun Cole (Assistant Director); Darryl Chang; Dwayne Curry; Paul Kinney; Gail Marnik; SaraAnn Moessbauer; Susan E. Murphy; Cheryl Peterson; Neil A. Pinney; and Amy Rosewarne made key contributions to this report.

Summary: In 1992, Congress created a transportation fringe benefit that allowed public and private employers to offer employees transit benefits, excludable from gross income, to cover out-of-pocket public transportation commuting costs. Federal agencies may distribute these transit benefits directly or enter into an agreement with another agency, such as DOT, to distribute the benefits on a fee-for-service basis. In 2011, DOT's TRANServe began using debit cards to distribute transit benefits. IRS has established rules to help employers ensure their debit card programs qualify as allowable fringe benefits. Members of Congress have questioned whether the debit card restrictions prevent non-transit-related purchases and whether DOT's program complied with IRS rules. This report describes the extent to which DOT has (1) designed internal controls to provide reasonable assurance that employees do not use the debit card to make non-transit-related purchases and (2) worked with IRS to ensure its debit card program complies with IRS's rules. GAO reviewed the design of TRANServe's internal control system for preventing non-transit purchases, but testing the system was not within the scope of the work; compared federal standards and TRANServe's practices; reviewed IRS rules on fringe benefits; and obtained TRANServe documentation of the steps taken to demonstrate that its debit card complied with the rules. GAO is not making recommendations in this report. DOT and IRS provided technical comments that were incorporated as appropriate. The Department of Transportation's (DOT) Office of Transportation Services (TRANServe) has included multiple internal control activities in the design of the TRANServe debit card program. These controls are intended to prevent federal employees from using their debit card for non-transit-related purchases, and as designed, would be expected to provide reasonable assurance that non-transit-related purchases can be identified and denied. The phrase “internal control” does not refer to a single event, but rather a series of actions that occur throughout an entity's operations on an ongoing basis for safeguarding assets and preventing and detecting errors and fraud. DOT provided evidence that the design of its TRANServe debit card program aligns with each of the five internal control standards as identified in GAO's Standards for Internal Control in the Federal Government and as described below. Control environment : DOT has established a control environment framework for the TRANServe debit card program by, among other things, setting the program's primary goal as enhancing internal controls to deter waste, fraud, and abuse of transit benefits. Risk assessment : DOT established the position of internal controls officer, in 2007, to examine control activities and identify potential program vulnerabilities through the testing of debit card controls. Control activities : TRANServe has established mechanisms for controlling the use of the debit card. For example, the debit card is restricted so it can only be used to purchase transit fare from transit providers that are identified by merchant category codes that have been approved by DOT. The codes are used to classify a business by type of goods or services it provides. Monitoring : TRANServe conducts weekly data mining, which includes reviewing debit card transactions to identify potential misuse and irregularities. Information and communication . TRANServe sends “anomaly letters” (letters detailing potential misuse of the debit card) to agencies when non-transit purchases are detected. TRANServe worked with the Internal Revenue Service (IRS) to demonstrate that the debit card program is in compliance with IRS's rules for qualified transportation fringe benefits and that in particular, it was a transit pass and effectively prevented non-transit-related purchases. From 2011 to 2013, TRANServe staff tested the debit card with transit agencies in eight areas across the country, making dozens of purchases of both transit-related and consumer-related products. In most cases the purchase restriction succeeded in preventing the debit card from purchasing non-transit-related products. In the few cases where the restriction failed, TRANServe took steps to have additional restrictions placed on the debit cards. Once it completed the tests in each region, TRANServe sent the test results to IRS, and once IRS was satisfied with the final results, IRS officials sent DOT an e-mail confirming that the debit card qualified as a transportation fringe benefit in that area. TRANServe then completed the roll out of the debit card program by the end of fiscal year 2014.