Established in 1967, NTSB is an independent nonregulatory agency. NTSB’s principal responsibility is to promote safety in various modes of transportation through accident investigation, special studies, and recommendations intended to prevent accidents. For the fiscal year ended September 30, 2000, NTSB was appropriated a total of $77 million for salaries and expenses with 421 full-time equivalent employees. In April 1989, NTSB began using a Rapidraft system under which designated employees were authorized to use commercial draft payment instruments similar to blank checks. Using Rapidraft, approximately 175 authorized employees could make immediate payment to vendors or reimburse employees for purchases and travel claims up to $2,500. The stated purpose of Rapidraft was to eliminate the extra paperwork and processing time required to issue checks through the traditional Department of the Treasury process. During 1999, NTSB officials began seeing evidence of misuse of Rapidrafts and concern arose about possible embezzlement. In August 1999, NTSB requested the Department of Transportation’s Inspector General (DOT IG) to conduct a review of the Rapidraft system. In September 1999, NTSB stopped using Rapidrafts. The DOT IG audit report, issued in November 1999, disclosed significant internal control weaknesses associated with the use of the Rapidraft system, including the lack of supporting documentation, poor security over unused Rapidraft instruments, and lack of review and reconciliation of processed payments. Concurrent with this review, the suspected fraud by two NTSB employees was investigated and confirmed, ultimately leading to the employees’ successful prosecution. In response to the disclosure of internal control weaknesses surrounding its use of the Rapidraft system, NTSB, in April 2000, hired PwC to further review NTSB’s past use of the Rapidraft system and to conduct a broad- based review of NTSB’s current financial management processes and related internal controls. Also in April 2000, the House Committee on the Budget’s Task Force on Housing and Infrastructure held hearings on the widespread internal control weaknesses associated with NTSB’s use of the Rapidraft system and subsequently asked us to review internal controls over other selected areas of NTSB’s financial operation. Internal control represents an important and integral part of managing an accountable organization. Internal control consists of the plans, methods, and procedures designed and implemented by an organization to achieve its mission, goals, and objectives and support performance-based management; represents an organization’s first line of defense in safeguarding assets and protecting against errors and fraud; and provides management with important assurance that an organization’s operating and administrative objectives are being achieved, namely, effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Since the enactment of FMFIA, executive branch agencies have been required to annually assess the adequacy of their internal controls in achieving established control objectives. As required by the act, the Comptroller General has established standards that agencies must use in assessing their internal control. Also, in accordance with the act and guidance issued by the Office of Management and Budget, federal agencies are required to annually assess the adequacy of their internal controls and report to the President and the Congress on the extent to which their system of internal control is achieving their intended objectives. In May 2000, following the House Budget Committee’s Task Force on Housing and Infrastructure hearing on NTSB’s use of the Rapidraft system, the committee asked us to review internal controls related to other types of NTSB financial activities. Following discussions of the potential nature and scope of our review, we agreed with the committee staff that, because PwC’s ongoing review was examining NTSB’s internal controls in place at the time of PwC’s review (April and December 2000), our review would focus on selected aspects of NTSB’s fiscal year 1999 financial operation. We also agreed to monitor and consider PwC’s ongoing work at NTSB in reporting on the adequacy of NTSB’s overall internal controls. Specifically, we agreed to determine, for selected payment types (travel, products and services, and nonroutine benefits) whether key NTSB internal controls applicable to fiscal year 1999 payments were designed effectively to provide reasonable assurance that assets were safeguarded against unauthorized use and that expenditures were made in accordance with management’s authority and applicable laws and regulations; determine, for those fiscal year 1999 transactions selected for testing, whether NTSB complied with key controls; and consider and report on results of two ongoing PwC reviews at NTSB as they related to adequacy of NTSB’s overall internal controls. To accomplish these objectives we (1) gained an understanding of applicable policy and related laws and regulations, transaction processing, and supporting documentation, (2) identified key controls related to safeguarding assets and executing expenditures in accordance with management authority and laws and regulations, (3) reviewed, for a targeted selection of transactions from each payment type, the available supporting documentation and, as necessary, followed up with NTSB officials, and (4) concluded on whether key controls were effectively designed and, for those transactions reviewed, effectively implemented by NTSB management and staff. To monitor PwC’s ongoing work at NTSB, we discussed the nature, scope, and approach of PwC’s separate reviews with NTSB officials and PwC representatives, examined PwC’s results by reviewing its written reports, and identified those PwC results that, when considered in conjunction with our results, we considered relevant to the overall adequacy of NTSB internal controls. We conducted our review from June 2000 through May 2001 in accordance with generally accepted government auditing standards. Additional information on our scope and methodology is contained in appendix I. Our review of the design and, for those transactions tested, operation of key internal controls related to NTSB’s payments for travel, products and services, and nonroutine benefits revealed weaknesses in (1) the manner and extent to which policies effectively incorporated key internal controls and (2) the implementation and monitoring of those controls that were incorporated in agency policy. For the three payment types we examined, the nature and extent of these weaknesses were indicative of insufficient and/or ineffective management attention paid to ensuring that, during the period reviewed, (1) key internal controls were effectively designed into NTSB administrative policies and procedures and (2) employees and management effectively implemented their respective internal control responsibilities when initiating and approving payment transactions. The weaknesses we identified during our review impaired NTSB’s organizational accountability over payments for travel, products and services, and nonroutine benefits and exposed NTSB’s assets to possible misuse or loss. Presented below for each of the three payment types reviewed are the results of our consideration of the design of key controls, tests of NTSB implementation of key controls, and tests of NTSB managerial review and approval functions. In addition, we present an analysis of NTSB’s recent monitoring of and reporting on the adequacy of internal controls. Key internal controls must first be clearly documented in management directives and administrative polices and procedures. Our review of NTSB’s policy guidance applicable to the three payment types, which typically consisted of Board orders, management directives, and/or office memorandums, found that provisions for certain key internal controls were not clearly and consistently incorporated into the policy guidance. We also found that certain aspects of NTSB policies reduced the opportunity for effective internal controls over payment transactions. One of NTSB’s policies, the Alternative Home Base (AHB) rule, allowed Board members to use their government travel card and contract airfare rates for travel between a “place abode,” a residence located outside the area of the traveler’s official duty station, and an official travel destination. The rule requires the traveler to submit a constructive cost analysis to show that the cost to the government would be the same or less than traveling from the traveler’s official duty station. However, the policy did not clearly establish when and under what circumstances the AHB rule could be applied. Under the Federal Travel Regulation, government travelers are prohibited from using the government travel card and contract airfares for personal travel. Thirty-four of the 103 Board member travel vouchers we reviewed involved the use of their government travel card and contract fares for trips that included, in part, travel to or from their distant place of abode, as permitted by the AHB rule. For 12 of the 34 vouchers involving the AHB rule, we noted that the government travel card and contract fares were used for mixed-purpose trips (partially business and partially personal) or for segments of trips for which no valid business purpose was evident from the supporting documentation available at the time of our review. NTSB officials advised us that the rule was not intended to provide for the use of the government travel card and contract airfares for personal commuting between a Board member’s official duty station and his or her place of abode. Rather, the rule was intended to allow a Board member to originate and/or complete official travel at his or her residence instead of his or her official duty station, if doing so did not cost the federal government more. NTSB officials also stated that it was not appropriate to use the government travel card or contract airfare for personal travel. NTSB’s policy also provides for the use of annual travel orders, giving staff broad authority for travel related to accident investigations and, for senior management and Board members, authorization to attend conferences and to visit headquarters and field offices. The annual orders provided by NTSB for our review generally authorized the traveler to travel any time during the year without specific authorization of the purpose, destination, or estimated cost of each trip. According to NTSB officials, more than 75 percent of NTSB’s staff had annual orders for fiscal year 1999. While annual travel orders are permitted under the Federal Travel Regulation and their use is justified for those traveling with limited or virtually no advance notice for accident investigations, NTSB’s widespread use of annual orders largely negated the effectiveness of pretravel authorization as a control. In addition, NTSB’s policy on annual travel orders does not ensure that the traveler obtained advance authorization required by the Federal Travel Regulation for certain travel (e.g., travel to attend a conference or involving acceptance of payment for travel expenses from a nonfederal source). This lack of up-front authorization for most travel takes on greater significance at NTSB, as discussed later in this report, because of weaknesses in the review and approval function over travel payments we reviewed. According to NTSB officials, 23 of the 25 travelers for whom we examined at least one fiscal year 1999 travel payment had annual orders, but NTSB could provide annual orders for only 13 of the 23 travelers. According to NTSB officials, 142 of the 149 vouchers we examined were authorized by annual orders. Of these 142 reviewed trips, 105 were for non-accident- related travel by 16 travelers. As a result, travel arrangements for those trips, such as the (1) trip’s purpose and destination (including attendance at conferences and foreign travel), (2) itinerary and estimated cost, (3) possible use of indirect or interrupted travel or leave while on travel, and (4) possible acceptance of payment for travel expenses by nonfederal sources, were not reviewed and authorized as part of a trip-specific travel authorization. While use of annual orders is permitted by the Federal Travel Regulation, the regulation also requires that “open” authorizations, such as NTSB annual orders, must contain, as a basis for adequate funds control, an up- front estimate of the total costs for travel being authorized. However, NTSB’s policy governing the use of annual orders did not require that the orders include the estimated costs of travel being authorized. Consistent with its policy, none of the 13 annual orders provided by NTSB contained estimates of the costs of travel covered by the annual orders, and the lack of cost estimates severely limited NTSB’s ability to exercise effective funds control over travel authorized by annual orders. NTSB policy governing the purchase of products and services required authorized officials to ensure, prior to incurring an obligation to procure products or services, that (1) funds were available and (2) specific procurement was approved. However, while NTSB’s policy provided a standard form to document these two key controls for purchases greater than $2,500, the policy did not specify a mechanism for documenting these two actions for purchases of $2,500 or less. As a result, for 21 of the 31 payments we reviewed for products and services that were $2,500 or less, the supporting documentation lacked evidence of one or more of the required advance approvals; 14 had neither evidence of funds-availability approval nor procurement approval, 6 had no evidence of funds- availability approval, and 1 lacked evidence of the advance procurement approval. Purchases made without the approvals required prior to incurring the obligation exposed the agency to possible expenditure of funds in excess of appropriated amounts and inappropriate acquisition of goods and services. OPM performance award regulations require that awards based on a percentage of pay be computed only on a percentage of base pay and exclude the employees’ locality pay. We found that NTSB’s policy applicable to fiscal year 1998 and 1999 performance awards directly contributed to individual performance award determinations being based on a percentage of the employee’s adjusted base pay, which consists of base and locality pay. In discussing the incorrect use of adjusted base pay, NTSB officials acknowledged the error in their guidance and advised us that the guidance had been corrected for the fiscal year 2000 award cycle. Also, during fiscal year 1999, NTSB, under certain circumstances, provided employees with advances and paid the employer and employee portions of federal health insurance premiums for student employees employed by NTSB while they were on leave without pay (LWOP) and attending school. NTSB had no policy guidance or operating procedures to require that the resulting amounts due back to NTSB be recognized as accounts receivable, controlled, and collected. Essential to effectively safeguarding NTSB assets is the need to recognize, control, and seek recovery of such advances. Details on the types of situations requiring recovery follow. Our review of 15 advances to employees totaling more than $15,000 paid out in fiscal year 1999 found little or no evidence that NTSB had taken any direct action to record, control, or collect the advances. At the time we began our inquiries into these amounts, 7 of the 15 had not been fully repaid, representing an unrecovered balance of more than $3,000. NTSB staff advised us that, with respect to the repayments that had occurred, employees were under the honor system. In reviewing NTSB records, we identified a student employee in LWOP status for a continuous 29-month period. According to NTSB staff, the agency paid the employee and employer shares of health insurance premiums for the entire period and made no attempt, prior to our review, to recover more than $650 owed by the student for the employee’s share of 12 months’ premiums. The amount owed by the student was limited to the employee’s share of premiums for 12 months because the student became ineligible for the coverage after 12 continuous months in LWOP status. NTSB continued paying for coverage after the student’s eligibility ended, resulting in improper payments of more than $4,800 in health insurance premiums during the student’s remaining 17 months in LWOP status. According to NTSB staff, NTSB had no policies or procedures related to monitoring the status of health insurance premiums paid by NTSB on behalf of student employees in LWOP status; halting premium payments after 12 months in LWOP status; or tracking, controlling, and recovering any related amounts owed to NTSB. According to an NTSB official, the student recently indicated that she was unaware that the benefit coverage continued during her LWOP status and did not use it. NTSB also plans to request a return of premium from the insurance provider for the student’s period of ineligibility. Without adequately designed internal controls that are clearly and unambiguously documented in management directives, the effectiveness of the entire control system is impaired and accountability is reduced. In addition, management is limited in its ability to assure that control objectives—effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations—are being achieved. To compensate for design weaknesses that reduce the opportunity for control effectiveness, other internal controls related to the execution, review, and approval of transactions must play a greater role in assuring that funds are used in accordance with management’s authority and applicable laws and regulations. However, as discussed in the following sections, these other important controls were often ineffective for the transactions we reviewed. Key internal controls that have been incorporated into agency policy guidance must be followed consistently to be effective. For those transactions selected for testing from the three payment types, we found many instances in which key controls that were a part of NTSB’s established policies were not followed. The key control most commonly not followed was the development and maintenance of required supporting documentation. As a key control, supporting documentation provides evidence of transactions and compliance with related internal controls, and should be readily available for examination. For those transactions tested, we found that the supporting documentation required by NTSB policies was often missing or inadequate. We noted the following instances in which the supporting documentation, or lack thereof, provided evidence of noncompliance with key internal controls for transactions related to travel, purchase of products and services, and nonroutine benefits. Thirty-two of the 149 travel payments we reviewed involved foreign travel. NTSB’s travel policy guidance requires written evidence of advance authorization for foreign travel. However, NTSB was unable to provide evidence of the required advance approval for 28 of the 32 foreign trips. Forty-one of the 149 travel payments we reviewed claimed reimbursement for actual subsistence expenses in lieu of per diem, which, according to NTSB’s policy, required the approval of NTSB’s Chief Financial Officer. However, 5 of the 41 travel payments lacked evidence of the required CFO approval. Eight of the 149 travel vouchers that were reviewed and approved for payment lacked an airfare, hotel, or car rental receipt, which was required by NTSB policy. NTSB policy requires NTSB staff to specifically acknowledge the receipt of products or services prior to payment. Our review of the supporting documentation related to 54 applicable purchases found that 45 of the 54 had no clear indication of the required acknowledgment by NTSB staff that the products or services had been received. NTSB policy requires that for purchases greater than $2,500, a Form 4400.1, Requisition for Supplies, Services and Shipments, be completed to support the prepurchase determination of funds availability and approval to use available funds for the purchase. Thirty of the 86 total payments we reviewed represented purchases of products and services for amounts greater than $2,500. For 6 of the 30 payments NTSB was unable to provide the Form 4400.1 or other evidence that the required approvals had occurred. In addition, for the 24 that had the required form, 2 lacked evidence of the required determination of funds availability and another 3 lacked evidence of the advance approval to use funds for the intended purpose. NTSB property management policies required the creation and maintenance of a central inventory control record for property that cost more than $200 and can be easily removed from the agency premises and an Individual Property Receipt form, which identified the employee responsible for custody of the inventoried item. For each of the four property items purchased during fiscal year 1999 that we tested for compliance with these requirements, no central inventory control record or individual property receipt could be located by NTSB. Each of the items—three laptop computers and one television set—was eventually located following an extended 2-month-long, agencywide search. NTSB officials blamed the lack of inventory records and property receipts on the fact that the required records were not maintained for property purchased by agency offices other than NTSB’s Contracting Office. NTSB’s policy related to performance and special act awards paid in fiscal year 1999 required managers to forward applicable supporting documentation (including, as appropriate, nomination memos or award recommendation forms, performance appraisals or award justifications, as well as evidence of review and approval of the awards) to NTSB’s Human Resources Division prior to paying the awards. During our testing of performance and special act award transactions, we requested supporting documentation for 40 performance awards and 41 special act awards paid to 26 and 24 employees, respectively, during fiscal year 1999. After reviewing official personnel files and conducting a search for the supporting documentation, NTSB was unable to provide sufficient documentation to support payment of 16 of the 40 performance awards and 6 of the 41 special act awards that we tested. For each of the four 1999 payments for Senior Executive Service bonuses (for 1998 performance) we reviewed, NTSB could not produce supporting documentation required by NTSB policy and OPM regulations to justify or provide basis for the bonuses. Statute and OPM regulations related to the payment of awards, bonuses, and retention allowances generally require that amounts not be paid to an employee if (or to the extent that) the payment would cause the employee’s estimated aggregate compensation for a calendar year to exceed the Executive Level I compensation ceiling, which, for 1999, was $151,800. While NTSB policies do not provide specific guidance on how to apply the aggregate annual compensation limitation in determining the respective amounts that can be paid for awards, bonuses, and allowances, NTSB officials told us that they followed OPM regulations in applying the limitations to applicable NTSB employees. We used compensation data provided by NTSB to identify three employees (from the 36 employees for whom we reviewed nonroutine benefits) whose total compensation would have approached or possibly exceeded the Executive Level I compensation ceiling. Our test found that for each of the three, NTSB improperly projected the employee’s aggregate annual compensation, resulting in incorrect compensation payments and/or incorrect deferred award amounts. For one employee, our tests found a mathematical error in the computation of the employee’s estimated aggregate compensation for calendar year 1999 that resulted in the employee receiving paid compensation that exceeded the Executive Level I compensation ceiling for calendar year 1999 by $1,100. For the second employee, NTSB improperly authorized a retention allowance that was $14,226 higher than it should have been under applicable OPM regulations because it incorrectly excluded from the estimate of aggregate compensation, award amounts known to be payable during 1999. For the third employee, we noted that, although NTSB properly applied OPM regulations in projecting the employee’s calendar year 1999 aggregate annual compensation, NTSB improperly authorized, early in calendar year 2000, a retention allowance that was $9,696 higher than it should have been under applicable OPM regulations because it incorrectly excluded award amounts known to be payable during 2000 from the estimate of aggregate compensation for 2000. In addition to weaknesses in the design of key internal controls, NTSB’s failure to comply with established key internal controls further compromised the effectiveness of NTSB’s internal control environment and its financial accountability over resources. Managerial review and approval is an important key control–one that is intended to provide oversight of control activities and detect and address problems with individual transactions. By its nature, managerial review and approval represents the last and best opportunity to detect and address inadequate supporting documentation and other control deficiencies. In addition to failing to identify and resolve the various instances of missing or inadequate documentation noted earlier, we found instances in which the managerial review and approval process failed to detect, in each of the payment types we tested, other inadequacies and deficiencies. Under NTSB’s travel policy, claims for reimbursement involving the Alternative Home Base rule or indirect travel must be accompanied by a constructive cost analysis. The analysis is intended to demonstrate that the reimbursement claimed for trips involving an alternative home base or indirect travel location was the same or less than the cost of traveling from or to the employee’s official duty station. However, of the 37 paid vouchers we reviewed involving either alternative home base or indirect travel trips, 25 of the vouchers approved for payment lacked the required constructive cost analysis to show that the government had not incurred any excessive costs. Our review of available documents identified several trips that might have had excess costs reimbursed. Under NTSB travel policy, signatures of the traveler, approving official, and certifying officer are required for the payment of a travel reimbursement claim. However, 41 of the 149 vouchers we examined lacked one or more of the three required signatures. Of the 41 paid vouchers that lacked required signatures, 2 vouchers did not have any of the three required signatures, 9 lacked two of the three required signatures, and 30 lacked signatures of either the approving official or the certifying officer. One of the basic determinations that should be made during the voucher approval and certification process for a travel reimbursement claim is that the amount claimed is correct. However, the amounts approved and paid for 22 of the 149 vouchers we examined were incorrect. Of the 22, 16 were based on a per diem amount that exceeded the applicable General Services Administration (GSA) rates, 3 were totaled incorrectly, and 3 were based on per diem amounts that exceeded the applicable GSA rates and were totaled incorrectly. An official who was not authorized to certify payments signed as certifying officer on 52 of the 149 paid travel vouchers. NTSB policy stipulated that the Managing Director approve all purchases over $10,000 in advance for purchases not related to accident investigations and after the fact for purchases related to on-scene accident investigations. Of the 86 purchase payments we reviewed, 18 were greater than $10,000 and required the Managing Director’s approval, either in advance or after the fact. Of these 18, 11 lacked evidence of the Managing Director’s required approval. NTSB policy required that invoices or other appropriate supporting documentation accompany the approved voucher for the payment of products and services. Of the 86 payments for products and services we reviewed, 6 lacked adequate evidence of an invoice or other appropriate supporting documentation. For example, one of the six was a payment of more than $70,000 supported by an office purchase card billing statement showing only monthly totals for unpaid charges dating back to July 1996, as well as estimated interest and penalties of more than $6,000. For another one of the six, NTSB could not provide any supporting documentation. Eleven of the 86 payments for products and services represented claims for reimbursement of amounts paid initially by employees. Three of the 11 were approved for payment without the employee’s signature on the requests for reimbursement. As part of our review of special act awards for fiscal year 1999, we were given access to the official personnel files for recipients of 41 special act awards. In reviewing the files for one employee’s fiscal year 1999 special act award that had evidence of proper review and approval, we noted a breakdown in the review and approval of a subsequent special act award provided to the employee in January 2000. Following the Chairman’s approval of a $19,000 special act award, NTSB initiated a personnel action to process the award. However, NTSB’s system rejected the action because awards greater than $10,000 require specific review and approval by OPM. Instead of forwarding an award to OPM for approval, NTSB changed the personnel records that documented the $19,000 award by awarding two special act awards (for $9,500 each) and separately justifying the two awards by separating the special actions that had been used to support the original $19,000 award into two award justifications. In doing so, NTSB avoided the OPM-required review and approval for special act awards greater than $10,000. OPM regulations and NTSB policy for relocation bonuses generally provide that NTSB, in advance of the selection, must consider various recruitment-related factors and justify in writing that, without the bonus, it would be difficult for NTSB to fill the position with a highly qualified candidate. Our review of the one relocation bonus in our test of transactions showed that NTSB’s review and approval of the bonus was inadequate because the supporting documentation for the $10,000 relocation bonus did not address any of the factors or determinations required by the applicable policy. The memo supporting the bonus, which was approved by NTSB officials, justified the bonus solely on the basis that the relocated employee, who had accepted the position 12 months earlier, moved himself instead of requesting reimbursement for a permanent duty change of station. OPM regulations and NTSB’s policy on granting retention allowances require an annual recertification. Our review of 11 retention allowances found that two employees continued to be paid retention allowances without being recertified and approved on or before their respective annual recertification dates. As evidenced by the various problems of inadequate supporting documentation and ineffective review of transactions and compliance with agency control policies, NTSB’s managerial review and approval—an important detective control—was inadequate for many of the transactions we reviewed. Ineffective managerial review and approval impaired NTSB’s internal control environment and placed at risk management’s ability to assess compliance with key controls and to properly account for the financial activities of the agency. In addition, ineffective managerial review and approval can lead staff involved in executing transactions to think that no one is holding them accountable for complying with established policies and procedures. Given the internal control weaknesses associated with fiscal year 1999 payments, we inquired into NTSB’s recent efforts to assess and report on internal control effectiveness, which are required by OMB Circular A-123, Management Accountability and Control and FMFIA (31 U.S.C. §3512). Under A-123, agencies must systematically and proactively develop and implement controls, monitor and assess control adequacy, correct identified deficiencies, and report annually on the extent to which control objectives as of the close of the fiscal year were being achieved and on the existence of material weaknesses in agency controls. On the basis of responses to our inquiries and related supporting documentation provided by NTSB officials, we determined that the last assessment and reporting under FMFIA covered fiscal year 1998 and no assessment of and reporting on the adequacy of internal controls took place for fiscal year 1999. The only explanations offered for why management did not assess and report on the adequacy of fiscal year 1999 internal control were that (1) NTSB staff who had been involved in overseeing past efforts had been reassigned and (2) the Department of Transportation’s Inspector General 1999 review of problems with the Rapidraft system represented a review of internal controls. With respect to the adequacy of internal controls in fiscal year 1998, NTSB reported that its self-evaluation process included senior manager meetings with staff to review operations and identify potential vulnerabilities to waste, fraud, or mismanagement. NTSB’s senior management later evaluated the results of the staff reviews. This process culminated in the NTSB Chairman’s letter to the President (dated February 11, 1999) that stated that NTSB’s internal controls provided reasonable assurance that programs and resources were protected from waste, fraud, or mismanagement. In addition, the Chairman noted that because of the Board’s proactive approach to identifying and solving problems, he believed that NTSB had adequate accountability over the resources entrusted to NTSB’s care. With respect to fiscal year 2000, NTSB’s response to FMFIA’s assessment and reporting requirements was limited to the Chairman’s December 28, 2000, letter to the President, which noted that PwC was conducting a complete independent evaluation of NTSB’s financial controls and that they expected a final report early in 2001. The Chairman observed that, as a result, a management assessment of controls required by the act would be premature and also referred to the recent enactment of legislation, discussed later in this report, designed to strengthen NTSB’s financial accountability. However, as of August 13, 2001, NTSB management had not reported on its assessment of the adequacy of its fiscal year 2000 internal controls as required by FMFIA. Without a reliable and comprehensive process for monitoring and reviewing internal control adequacy, management does not have the information needed to assess and report on the extent to which control objectives are being achieved and whether there is proper accountability over the resources of the agency and compliance with laws and regulations. The results of two recent PwC reviews, involving different aspects of NTSB’s financial operations and related internal controls (1) confirmed many of the control weaknesses associated with NTSB’s Rapidraft use that were previously reported by the DOT IG and (2) disclosed wide-ranging internal control weaknesses associated with NTSB’s 2000 financial activity. While PwC’s report on the results of its review of NTSB’s fiscal year 2000 internal controls acknowledged that–in the aftermath of the serious Rapidraft problems–NTSB management has taken certain action to demonstrate an attention to internal control, it also points out that successfully establishing effective internal control depends on senior management’s visible leadership and endorsement and their willingness to hold all employees accountable for failure to follow established internal control policies and procedures. In this regard, PwC’s report noted that changing the control atmosphere at NTSB will be difficult and that to do so successfully, senior management must set the tone for change—one that acknowledges the need for strong financial controls throughout the agency. In light of the documented instances of fraud related to Rapidraft abuses, NTSB engaged PwC to perform a “forensic accounting investigation” to determine if similar instances of inappropriate payment activity had occurred prior to NTSB’s termination of the Rapidraft system in September 1999. At NTSB’s request, the investigative procedures applied by PwC were designed to identify transactions, from a review of available documentation, that appeared questionable and in need of follow-up by appropriate authorities. PwC’s review methodology was based on an examination of documents retained in NTSB’s Office of the Chief Financial Officer. To facilitate its review, PwC obtained available supporting documentation and had the relevant information entered into an automated database that it analyzed for indications of questionable transactions. In all, PwC’s investigative procedures were applied to more than 10,600 Rapidrafts, totaling more than $5.2 million, that were written by NTSB employees from July 1998 through October 1999. PwC reported that, based on the procedures it performed, it did not identify any specific (additional) instances of questionable transactions. However, PwC recommended that NTSB review various transactions for which PwC could not determine the validity. More specifically, following its initial review and data entry procedures, PwC identified 688 additionalpayment transactions for which there was no supporting documentation on file. PwC reported that following an agencywide search, in March 2001, NTSB located missing files for 630 of the 688, leaving 58 payment transactions issued by 21 individuals for which no documentation could be located. Accordingly, because PwC’s scope consisted of a review and analysis of supporting documentation available from NTSB, PwC reported that it could not determine the appropriateness of the 58 payments and recommended that NTSB follow up with the employees involved. In addition to the payments with no supporting documentation on file, PwC identified other transactions for which there were gaps in the supporting documentation. PwC reported that, in some of these cases, it was able to reasonably determine the propriety of the payment transactions with the documentation that was available. With respect to transactions for which NTSB could not locate some or all of the supporting documentation during PwC’s investigation, PwC recommended that NTSB continue its attempt to locate as many of the missing documents as possible. For those transactions for which the documentation cannot be located, PwC’s report noted that a discussion by NTSB with the check writer and/or the payee might be necessary to determine the legitimacy of the disbursement. PwC also made 17 additional recommendations related to specific transactions for which NTSB should conduct additional follow-up. With respect to the lack of internal controls applicable to NTSB’s use of Rapidrafts, PwC’s work found many of the previously disclosed weaknesses associated with the Rapidraft system including (1) inadequate safeguarding and access controls related to physical custody of blank Rapidraft instruments, (2) lack of managerial reviews and approvals for a large number of payments, and (3) lack of supporting documentation. Concurrent with its review of NTSB Rapidraft transactions, PwC was engaged to conduct a broad-based review of NTSB’s internal controls applicable to the financial management processes it had in place during 2000. The review is discussed below. In April 2000, NTSB management engaged PwC to perform a comprehensive review of NTSB’s internal controls applicable to its current financial management processes. PwC’s January 2001 report on the results of its review disclosed a wide range of internal control weaknesses. Specifically, PwC identified weaknesses related to the completeness and clarity of financial policies, recording and reviewing transactions, segregation of duties, and reporting on budget execution. In light of the weaknesses identified, PwC concluded that NTSB is “exposed to significant risk of financial loss.” PwC conducted its review by applying the Committee of Sponsoring Organization’s framework for evaluating internal controls, Internal Control–Integrated Framework. Specifically, PwC reviewed NTSB existing policies and procedures, activities and records, interviewed NTSB managers and staff, and reviewed selected transactions. The review, conducted from April through December 2000, covered NTSB financial activities associated with procurements, disbursements, payroll, asset and receipts management, budget planning and execution, and financial reporting and systems. In making more that 50 recommendations in response to the control weaknesses identified, PwC noted several cross-cutting themes associated with the need to improve NTSB internal controls, including those noted below. Greater Attention to and Awareness of Financial Policies. PwC concluded that NTSB needed to establish policies governing various financial activities including accounting for and controlling fixed assets and various types of receipts owed to NTSB and to update and clarify existing policies including procurement and use of agency credit cards. PwC also noted that once the financial policies are updated and clarified, NTSB staff need training on their application and enforcement. Finally, PwC noted that NTSB management must demonstrate, through review of activities and compliance audits, that the financial policies will be enforced. Improved Recording of Transactions. PwC concluded that NTSB needs to record selected transactions when the financial information needed to record and track the transactions becomes known to NTSB. PwC based this conclusion, in part, on the fact that NTSB had not been recording certain types of transactions (including amounts owed by others to NTSB and automatic charges, known as OPAC charges, made by other agencies against NTSB’s funds) until well after the transactions or their underlying economic events have occurred. In addition, PwC noted that NTSB needs to improve controls over the tracking of invoices pending approval and the payment of approved invoices to help ensure that all invoices are paid in a timely manner. Finally, PwC noted that NTSB needs to strengthen procedures to better identify and more timely record the purchase of fixed assets. Proper Review of Transactions. PwC concluded that NTSB needs to establish new and strengthen existing processes for managerial review of transactions involving training requests and the use of travel and office purchase cards. Also, controls should be strengthened over the approval of requisitions and the processing of disbursements. PwC observed that a separate review of selected travel vouchers from the first half of fiscal year 2000, conducted at NTSB’s request by another organization, found policy noncompliance on approximately 40 percent of the vouchers reviewed involving 10 percent of the amounts claimed evidencing a serious lack of managerial review, understanding, and enforcement of NTSB’s travel policies. Strengthen Segregation of Duties. PwC noted a number of instances in which NTSB needed to take action to address inadequate segregation of key duties and responsibilities. Specifically, PwC’s review found that (1) an individual responsible for controlling access to the personnel system also had the ability to modify payroll time sheets, (2) certain management level staff were able to initiate and approve their own requisitions (up to $10,000) for products and services in the financial management system, and (3) an individual who authorized new purchase (credit) cards and convenience checks also received the new cards and checks when they were issued by the vendor. Improved Budget Execution Reporting. PwC concluded that NTSB needs to take a series of actions designed to improve its accounting and reporting on its use of funds (budget execution and reporting). PwC noted that NTSB had not recorded all of its transactions in its accounting system, which contributed, in part, to NTSB’s failure to prepare and submit its budget execution reports as required by OMB. In addition, PwC noted that NTSB did not have the ability to generate comprehensive budget execution data and reports from its automated system, further inhibiting NTSB’s ability to monitor its status of funds. In addition to the more than 45 recommendations related to the specific internal control weaknesses they identified, PwC made several important broad-based recommendations for management action. These recommendations were intended to address the need to (1) revise, update, and refocus NTSB policies to ensure that management’s directives are carried out and, once disseminated, that policies are monitored for effectiveness, (2) adequately train and/or reeducate NTSB employees to better appreciate their responsibilities under the policies, (3) hold all employees accountable for failing to follow established controls, and (4) provide visible management leadership and endorsement for establishing internal controls. In making its recommendations, PwC observed that the changes needed in NTSB’s internal control environment will be difficult, given the crisis-driven nature of NTSB’s mission and the erosion of internal controls that has occurred in recent years. PwC further observed that to accomplish this change NTSB’s senior management must set a tone for change—one that recognizes the need for strong controls, supports the changes needed to establish these controls, and demonstrates that all staff will be held accountable for their control responsibilities. The National Transportation Safety Board Amendments Act of 2000enacted November 1, 2000, includes various provisions designed to strengthen NTSB’s financial accountability. Specifically, the act provides for a statutory Chief Financial Officer reporting directly to the Chairman on matters of financial management and budget execution, a Board-approved budget for non-accident-related travel expenditures of Board members, the submission of the budget to congressional oversight committees, and an annual report detailing the non-accident-related travel and expenses by Board members, establishment of comprehensive internal controls for its financial programs based on findings and recommendations resulting from a review of NTSB’s internal controls conducted by PwC, and the Inspector General of the Department of Transportation to review the financial and property management and business operations of NTSB, including internal accounting and administrative controls systems, to determine whether they comply with applicable laws, rules, and regulations. According to NTSB officials, the agency has taken the following actions in response to this legislation: designated a Chief Financial Officer who reports directly to the Chairman; established a budget for non-accident-related travel for Board members and submitted it to the congressional oversight committees (and when due, plans to issue the required reports); developed, and is implementing, a corrective action plan based on the recommendations made by PwC; and arranged for the DOT IG to begin audit and review activities over NTSB business operations. Our review of the design and operating effectiveness of NTSB’s internal controls found that basic safeguards necessary to protect against fraud, waste, and mismanagement were lacking regarding the payments for travel, products and services, and nonroutine benefits that we selected. Certain control-related policies and procedures were poorly designed and NTSB staff often did not follow those that were properly designed. Also, the control design and compliance problems were compounded by the lack of effective review and approval functions, resulting in impaired organizational accountability for agency resources. NTSB management’s failure to monitor and report on the adequacy of its internal controls as required by FMFIA and OMB Circular A-123 for fiscal years 1999 and 2000 further evidenced the deterioration of NTSB’s internal control environment. Failure to monitor the adequacy of internal controls precluded NTSB management from having information it needed to assess whether control objectives were being achieved and whether it had proper accountability over agency resources and was in compliance with laws and regulations. While the scope and focus of our internal control–related review and those of PwC were different, the control weaknesses identified by these reviews were indicative of insufficient and/or ineffective management attention to building and maintaining a sound internal control environment at NTSB during the periods reviewed. With the results of these reviews and the requirements imposed by recent legislation, management has the opportunity and responsibility to fundamentally change NTSB’s organizational commitment to internal control and take the actions necessary to build an appropriate control environment—one in which the acceptance of and adherence to efficient and effective internal control represents an important element of NTSB’s management and operating culture. NTSB’s management has already taken some positive steps to this end and has expressed a commitment to address the problems identified by PwC and us. NTSB now needs to be vigilant in ensuring that all necessary actions for improving NTSB’s internal control are fully implemented. To aid NTSB in building an effective internal control environment and addressing the specific weaknesses identified during our and PwC’s reviews, we recommend that the Board and Managing Director or their designees take the following actions. Regularly monitor implementation of the corrective actions planned by NTSB in response to each PwC recommendation. Ensure that NTSB management fully and consistently carries out its responsibilities under OMB Circular A-123 and FMFIA to develop and implement effective controls, monitor and assess control adequacy, correct control deficiencies, and report annually on the adequacy of controls and the existence of material weaknesses in agency controls. Comprehensively review and, as necessary, revise administrative policies and procedures to ensure that they incorporate–in a clear and unambiguous manner–sufficient controls to ensure that management’s control objectives are being achieved. Specifically, ensure that policies and procedures clearly and unambiguously specify the nature and extent of supporting documentation required for each type of payment transaction and define the roles and responsibilities of individuals responsible for initiating, processing, reviewing, and approving transactions for payment. Ensure that management and staff are properly trained in the internal control–related provisions of all applicable policy guidance. This training should specifically cover each employee’s internal control–related responsibilities in initiating, processing and, to the extent applicable, reviewing and approving each type of transaction; safeguarding assets; and complying with applicable laws and regulations. Institute a regular and comprehensive process for monitoring the performance of those responsible for initiating, processing, reviewing, and approving each type of transaction and the adequacy of related supporting documentation. Ensure that those responsible for each function are held accountable for carrying out their responsibilities. Clarify travel policies to specifically prohibit the use of government travel cards and contract airfares for personal travel of any type. For all Alternative Home Base rule and indirect travel occurring since the start of fiscal year 1999, ensure that constructive cost analyses are prepared from appropriate supporting documentation and determine whether any reimbursements exceeded the amounts permitted by NTSB policy. Pursue recovery of any excess travel reimbursements or, if recovery of an excess reimbursement is not sought, document the authority, basis, and rationale for the decision. Minimize, to the extent practical, use of annual orders to authorize travel. Specifically, consider restricting the use of annual travel orders to those trips for which the exigencies of crash investigations or other emergencies make it impossible or impractical to obtain advance, trip-specific, supervisory review and approval of all pertinent travel provisions. Ensure that all annual travel orders include estimated costs of the travel being authorized by the annual travel order as required by the Federal Travel Regulation. Establish formal requirements for uniformly documenting the prepurchase determination of funds availability and approval to use available funds for the purchase of products or services costing $2,500 or less. Identify each item of NTSB’s existing accountable property, the accountable office, and the accountable employee through physical inventory and a review of accounting records, and ensure that information about each item of accountable property is entered in the property control in accordance with NTSB policy. Ensure that all control information required by NTSB’s property management policy is recorded in the property control record for each new accountable property item that is acquired. Review and revise policy guidance applicable to performance awards to ensure that it clearly and accurately documents the basis or bases on which managers are permitted to determine employee performance awards. In so doing, ensure that the revised policy guidance complies with applicable OPM regulations. Establish specific procedures, in accordance with applicable OPM regulations, for determining estimated aggregate annual compensation, award and bonus amounts (both paid and deferred), and amounts eligible for retention allowances. Use these procedures to review calendar year 1999, 2000, and 2001 determinations of aggregate annual compensation, award and bonus payments and deferrals, and retention allowance payments for all applicable NTSB employees. Determine and document what action is to be taken to correct for any payments or deferred amounts that exceed amounts allowable under statute and OPM regulations (e.g., pursue repayment, reduce deferred amounts carried forward, and/or suspend retention allowance payments). Establish and document policies that ensure that all amounts owed to NTSB–including those associated with the payment of salary advances and insurance benefit premiums for student employees in LWOP status–are identified, tracked, controlled, and collected on a timely basis. Review past employee advance transactions to identify those that have not been repaid and pursue collection of the amounts owed. We provided a draft of our report to NTSB for its review and comment and met with the Chief Financial Officer and other NTSB officials to discuss the draft and obtain their oral comments. These officials generally agreed with our findings, conclusions, and recommendations. In commenting on the draft report, NTSB officials told us that NTSB has taken multiple actions, since the period covered by our report, to improve and strengthen internal controls, including strengthening requirements for the submission of required documentation needed to support awards and bonuses. In addition, with respect to NTSB’s reporting on the adequacy of its internal controls for 2000, NTSB officials said that they believe the Chairman’s letter to the President in December 2000 satisfied NTSB’s requirement, under FMFIA, to report on the adequacy of its internal controls. We do not agree with NTSB on this matter, as the Chairman’s letter did not include management’s assessment of fiscal year 2000 internal controls that is required by FMFIA. While the Chairman’s letter noted that an assessment by management would be premature because an internal control evaluation by an independent public accounting (IPA) firm was ongoing, NTSB has not reported on its assessment since the IPA report was issued in January 2001. NTSB officials also provided comments of a technical and/or editorial nature. As appropriate, we have revised our report to incorporate those comments. We are sending copies of this report to the Ranking Minority Member of the House Budget Committee. In addition, we are sending copies to Members of the National Transportation Safety Board, the Office of Management and Budget, the Inspector General of the Department of Transportation, and the public accounting firm of PricewaterhouseCoopers, LLP. This report will also be available on GAO’s home page at http://www.gao.gov. Please call me at (202) 512-9508 if you or your staffs have any questions. Major contributors to this report are listed in appendix II. To achieve our objectives related to the design of and compliance with key controls applicable to the three payment types, we used GAO’s sensitive payments framework. Key elements of the framework include understanding applicable internal controls, identifying and testing key controls, and, for those transactions selected for testing, assessing whether key controls were followed. As requested by your offices and consistent with the sensitive payments framework, we targeted our selection of transactions for testing by including, to the extent applicable, transactions involving payments to or for the benefit of NTSB’s Board members and their staff, senior management, and other NTSB staff. To assess the design of key internal controls, we considered the NTSB control environment, identified key controls and related laws and regulations, and assessed whether, if effectively implemented, key controls would achieve their intended objectives. Specifically, we reviewed applicable NTSB policy guidance (Board orders and office memorandums) for the three payment types, applicable provisions of the Federal Travel Regulation, the Federal Acquisition Regulation and regulations issued by the Office of Personnel Management, and Standards for Internal Control in the Federal Government. We also discussed with NTSB officials the agency’s policies and procedures pertaining to the three types of transactions that we reviewed and applicable laws and regulations. For each of the three payment types that we reviewed, we identified internal controls that we considered key to providing reasonable assurance that assets are safeguarded from unauthorized use, loss, or misappropriation and that expenditures are executed in accordance with management authority and applicable laws and regulations. For travel, the key controls we identified included travel authorization, supporting documentation, and voucher approval. For purchases of products and services, the key controls we identified included purchase authorization (funds control and approval to purchase), receipt and acceptance of goods, review and approval of payment vouchers and supporting documentation, and property controls. For nonrecurring benefits, the key internal controls we identified included recommendation and justification of personnel action and review and approval. Because the underlying nature of individual transactions varied among the three payment types, different combinations of key controls were applicable to different transactions. Based on our understanding of the design and operation of key controls, we drew preliminary conclusions on the design of key controls. Following our review of compliance with key controls, we reconsidered our initial conclusions on the design of key controls. To determine, for those transactions selected for testing, whether NTSB complied with key internal controls, we reviewed supporting documentation; pursued, as necessary, any open issues by making follow- up inquiries and requesting additional information of NTSB officials; and concluded on whether the objectives of key controls were achieved and laws and regulations were followed. We selected payment transactions for testing of travel and purchases of products and services from an electronic database file of fiscal year 1999 payments that was provided to us by NTSB. We selected transactions for testing nonroutine benefit payments from electronic database information that included all NTSB fiscal year 1999 bonus, award, and allowance payments by employee, and NTSB fiscal year 1999 annual compensation rates by employee, which were provided to us by NTSB. We did not perform an assessment of the accuracy and completeness of the electronic database information provided to us by NTSB. In selecting transactions for testing, we intended, to the extent applicable, to target our selection to transactions that were to or for the benefit of Board members and their staff, senior management, and other NTSB staff. Upon making initial test transaction selections, we reviewed all available supporting documentation for those transactions. When selecting additional transactions for testing, we considered internal control weaknesses identified during our review of the transactions initially selected. For travel we selected a total of 149 payments for travel by 25 individuals. For purchases of products and services we selected a total of 86 payments. The electronic database information provided to us by NTSB for purposes of identifying transactions for testing did not include information sufficient to allow us to target expenditures to third parties that might benefit any specific employee. For nonroutine benefits, we selected 36 employees having a total of 99 payments for performance and special act awards, recruitment and relocation bonuses, and retention allowances. For the selected test transactions, we reviewed all available supporting documentation provided by NTSB for evidence that NTSB complied with key internal controls. We followed up, as necessary, with NTSB officials to obtain further clarification and additional information on selected transactions. Specifically, for selected test transactions from each of the three transaction types, we reviewed all available documentation including the following. Travel--travel vouchers, receipts, itineraries, constructive cost analyses, travel orders, and payment instrument copies. Purchases of products and services--requisition forms, purchase orders, transaction correspondence, invoices, receipts, and payment instrument copies. Nonroutine benefits--Requests for Personnel Action and other documents supporting the recommendation, justification, and approval of specific award, bonus, and allowance transactions that were contained in the Official Personnel Folder (OPF) or Employee Performance Folder (EPF) maintained for each employee or were maintained elsewhere and were located by NTSB staff. Because certain nonroutine benefit payments for awards, bonuses, or allowances were subject to calendar year aggregate compensation limitations and possible deferral provisions, we also reviewed award, bonus, and allowance transactions made during calendar year 1999, the preceding year, and the succeeding year for those selected employees that, according to our calculation, had aggregate calendar year 1999 compensation that approached the annual aggregate limitation on pay. We concluded, based on the supporting documentation provided, whether the individual transactions tested complied with NTSB’s key internal controls. Because the nature of individual transactions varied within one payment type, not all payments of one type were subject to the same set of key controls. Test results were therefore limited to the key controls applicable to individual transactions, and the test universe differed between various key controls within one transaction type. The nature and scope of our procedures, including the targeted selection of transactions for testing, were not sufficient to provide an opinion on internal control related to the payment areas we reviewed, nor would they disclose all weaknesses. Because of the inherent limitation in any system of internal control, errors or irregularities may nevertheless occur and not be detected. Also, projection of any evaluation of controls to future periods is subject to the risk that control procedures may become inadequate because of changes in conditions or that effectiveness of the design and operation of control policies and procedures may deteriorate. To determine whether the results of PwC’s ongoing reviews should be incorporated into our report, we gained an understanding of the nature and scope of both reviews through discussions with NTSB officials and PwC representatives. We reviewed PwC’s reports and considered their findings, conclusions, and recommendations, and discussed with NTSB officials and PwC representatives the scope, methodology, and results of PwC’s work. We determined those findings and conclusions that were relevant to the nature and scope of our review, particularly those related to the adequacy of NTSB’s internal control environment. We conducted our review from June 2000 through May 2001 in accordance with generally accepted government auditing standards. In addition to the individual named above, Carol Browder, Marian Cebula, Dave Engstrom, Jeff Jacobson, Jack Warner, and Greg Ziombra made key contributions to this report. The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO E-mail this list to you every afternoon, go to our home page and complete the easy-to-use electronic order form found under “To Order GAO Products.” Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 (automated answering system).

Summary: The National Transportation Safety Board (NTSB) promotes transportation safety through accident investigations, special studies, and recommendations intended to prevent accidents. Separate reviews at NTSB by PricewaterhouseCoopers, LLP (PwC) and GAO found significant shortcomings in the design and operation of NTSB's internal controls during 1999 and 2000. These deficiencies indicated insufficient or ineffective management attention to establishing and maintaining an effective system of internal control over financial management operations. The resulting weaknesses exposed the agency to waste, fraud, and mismanagement. Some basic controls were not always clearly and consistently incorporated into NTSB policies and procedures, and, in some cases, the written policies were ambiguous and contributed to possible improper transactions. Furthermore, NTSB's payment review and approval process--the last and best opportunity to detect and address inadequate documentation and other policy violations prior to payment--was often ineffective. Separate reviews of different aspects of NTSB's 1999 and 2000 financial activities and related internal controls, done by PwC at NTSB's request, documented various internal control weaknesses, including problems with the completeness and clarity of policies, the recording and review of transactions, and the tracking and reporting its use of funds.