The primary objectives of internal control in a T&A system are to ensure that the system complies with applicable legal requirements, supports reporting of reliable financial information, and operates effectively and efficiently. To achieve these objectives, internal control over T&A systems should be guided by GAO’s Standards for Internal Control in the Federal Government (Internal Control Standards) and control activities should provide reasonable assurance that (1) T&A transactions are authorized and approved and (2) T&A information is properly and promptly recorded and retained. As T&A systems evolve toward increasingly automated methods of recording and reporting employee work and leave times, it is important that agencies implement and maintain well-defined internal control activities that provide management with the confidence that the system is working as designed. GAO’s Internal Control Standards provide the criteria for federal agencies to follow in establishing internal control over their operations, including T&A reporting. Consistent with the Internal Control Standards, agency development of control activities over T&A information should give due consideration to (1) the control environment in which T&A processing occurs, (2) applicable risks, (3) the needs of users of T&A information, and (4) the results of control monitoring and evaluation. To do this the agency should have a well-defined organizational structure and flow of T&A information with clearly written and communicated policies and procedures setting forth the responsibilities of employees, timekeepers (if applicable), supervisors, and others regarding recording, examining, approving, and reporting on T&A information; apply available technology and concepts to achieve efficient and effective T&A system processes and controls in accordance with applicable legal and other requirements, this guidance, associated risks, and the environment in which the agency operates; and review and test all aspects of the T&A systems’ processing procedures and controls with sufficient scope, depth, and frequency to provide reasonable assurance that key procedures and controls are effective in meeting legal and other requirements, and that data integrity is maintained. The supervisor has primary responsibility for authorizing and approving T&A transactions. Supervisors and timekeepers should be aware of the work time and absence of employees for whom they are responsible. To help ensure proper recording of T&A information, completed T&A records should be reviewed and approved on an appropriate basis by the supervisor (or other equivalent official). To the extent practical, changes to an employee’s normal work schedule should generally be approved prior to the change actually occurring. Unanticipated changes should be reviewed for approval or disapproval as soon as reasonably possible. In an automated environment, system edits (such as those that check for format, omissions, and reasonableness of data) and other automated tests can assist the supervisor in his or her reviews to verify that T&A information has been properly recorded and provide a reasonable basis for making payments. The nature and extent of T&A transaction approvals and controls can vary among T&A systems. Fully automated systems, for example, may require fewer approvals than manual systems because of automated edits and controls and the use of automated signatures. Nevertheless, the nature and extent of T&A approvals should be such that management has assurance that supervisors or other authorized officials know they are accountable for the approval of an employee’s work time and absences. “Proper” recording of T&A information refers to whether the recorded information is complete, accurate, valid, and complies with applicable legal requirements. Such legal requirements may include, but are not limited to, statutes, regulations, and decisions. T&A information should also be recorded as promptly as practicable to maintain its relevance. Detailed control objectives relative to T&A information are presented later in this guidance. Most federal civilian employees are paid on an hourly basis (or fractions of an hour) and earn and charge leave on that basis. A proper record of the time an employee works should be retained as an official agency record available for review or inspection. To provide a basis for pay, leave, and benefits, the records should include aggregate hours of regular time, other time (e.g., overtime, credit hours, or compensatory time), and leave. Supervisory authorization and approval is a key part of ensuring the propriety of T&A information. The supervisor or other authorized official should review and authorize employee’s planned work schedules and applications for leave, and review and approve employee submissions of actual time worked and leave taken, as well as information in T&A reports, and any adjustments or corrections to T&A records. Employees may approve their own T&A reports when authorized in writing to do so, if they are high level managers or if it is infeasible for the supervisor to approve the T&A reports. This subsection defines approval and discusses how approvals can be achieved in a manual or automated T&A system environment. Approval is the supervisor’s, other equivalent official’s, or higher level manager’s agreement to, ratification of, or concurrence with (1) a planned work schedule and leave of an employee or (2) actual T&A information. Such approval indicates that the actual work schedule recorded is to the best of the approving official’s knowledge properly recorded and in accordance with applicable legal requirements. The approving official acknowledges awareness and understanding of his/her responsibility when approving T&A information. The documentary evidence of approval will of necessity differ between manual and automated systems. In manual systems, approval is usually indicated by the signature or initial of an individual on a hard copy document. Accountability is established by having the signature or initial be traceable to the individual providing the approval. In automated systems, approval is represented by what can be referred to generically as an electronic signature. There are many types of electronic signature technologies offering different degrees of confidence, control, and security. In selecting and/or developing and implementing a particular electronic signature technology for an automated T&A application, management should assess the risks associated with the loss, misuse, or compromise of the electronic T&A information and signature compared to the benefits, costs, and effort associated with selecting and/or developing and managing the automated systems and electronic signature. See appendix I for a further explanation of electronic signatures and GAO’s review of such applications. When an employee’s work schedule (1) differs from the agencywide schedule established by management or (2) reflects a flexible work schedule, the employee’s work schedule should be approved by the supervisor or the official most knowledgeable of the employee’s schedule in advance of the period when the plan takes effect. If the schedule is not approved in advance, the plan should be approved as soon after the start of the pay period as possible. When agency work schedule programs allow for credit hours to be earned, employee requests to work such hours should be reviewed by the supervisor to determine if work demands warrant the employee working the additional hours and, if so, approved before the work has been performed when feasible. Approval also should be obtained for overtime before the work has been performed when feasible and, when not feasible, as soon as possible after the work has been performed. Care should be taken to distinguish between regular overtime and irregular overtime or occasional overtime (or compensatory time in lieu of overtime, where allowed) in order for the agency to properly document and calculate an employee’s overtime pay entitlements. Approval of leave should be made by the employee’s supervisor, or other designated approving official, before the leave is taken. If leave is not approved in advance, because of an unusual or emergency situation, it should be reviewed for approval or disapproval as soon as reasonably possible after it is taken. All T&A reports and related supporting documents (e.g., overtime pay authorizations) should be reviewed and approved by an authorized official. Review and approval should be made by the official, normally the immediate supervisor, most knowledgeable of the time worked by and absence of the employee involved. Approval of T&A reports and related documents is based on personal observation, work output, timekeeper verification, information checks against other independent sources, reliance on other controls, or a combination of these methods. The integrity of the information recorded in the T&A reporting system depends largely on the conscientious exercise of the supervisor (or other official) of his or her approval authority and an appropriate basis for such approval. Management may want to reemphasize to supervisory staff (or other authorizing officials) the importance of this responsibility periodically or as needed. The official most knowledgeable of the time worked should approve any overtime or compensatory time records. Care should be taken (1) to ensure that the overtime was approved, preferably in advance, and (2) that the amount and type of overtime (regular or irregular), credit hours, and compensatory time is accurately recorded and reported. If practical, T&A information should be approved at the end of the last day of the pay period or later. When this is not feasible because of payroll processing requirements to meet established paydays, T&A information should be prepared and approved as close to the end of the pay period as possible to allow processing of the payroll by payday. Adjustments or corrections required because of changes after T&A information was approved should be processed promptly and be traceable to the pay period for which the correction applies. Changes should be approved by an authorizing official. In general, employees may not approve their own T&A information. However, the head of an agency (or designee) may authorize particular individuals to approve their own T&A information if they are high-level managers (such as the head of a large unit within the agency). Other exceptions to the general prohibition against self-approval of T&A information apply when the supervisor lacks a basis for approving the T&A information or when it is not feasible to have T&A information approved by a supervisor.