FTA Can Enhance Its Controls To Mitigate COVID-19 Relief Funding Risks — FTA Report ST2023001
Summary
U.S. Department of Transportation Office of Inspector General report ST2023001, dated October 12, 2022, "FTA Can Enhance Its Controls To Mitigate COVID-19 Relief Funding Risks," from David Pouliott, Assistant Inspector General for Surface Transportation Audits. It states that since March 2020 Congress has provided $69.5 billion in supplemental funding to the Federal Transit Administration, and that as of August 1, 2022 FTA had obligated over $63 billion and expended over $46 billion. It states that FTA's controls fully address 8 of 12 identified remaining risks and partially address 4 of the 12. FTA concurred with the two recommendations.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“FTA Can Enhance Its Controls To Mitigate COVID-19 Relief Funding Risks — FTA Report ST2023001.”
Original at www.oig.dot.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/dot-oig-fta-can-enhance-its-controls-to-mitigate-covid-19-relief-fundi-9d346ff906/
, SHA-256 89793c1f272eb4ceaaa4d3739830aed8bc8e40fa3496c55053a40fde0c0132fc.Full text
FTA Report ST2023001
October 12, 2022
FTA Can Enhance Its Controls To Mitigate COVID-19 Relief
Funding Risks
Highlights
FTA Can Enhance Its Controls To Mitigate COVID-19 Relief
Funding Risks
Self-Initiated
Federal Transit Administration | ST2023001 | October 12, 2022
What We Looked At
Since March 2020, Congress has provided $69.5 billion in supplemental funding to the Federal Transit
Administration (FTA) to help transit systems in the United States mitigate the impacts of the
Coronavirus Disease 2019 (COVID-19) pandemic. As of August 1, 2022, FTA had obligated over
$63 billion and expended over $46 billion. In addition to increased funding, the Coronavirus Aid,
Relief, and Economic Security (CARES), Coronavirus Response and Relief Supplemental Appropriations
(CRRSA), and American Rescue Plan (ARP) Acts permitted changes in how recipients use FTA funds.
Accordingly, our audit objective was to assess the design of FTA’s controls to address risks FTA has
identified for COVID-19 relief funding.
What We Found
FTA’s 2021 Internal Control Plan identified 16 risks and mitigation strategies related to its COVID-19
relief funds, 12 of which FTA currently considers to be risks. We determined that FTA’s controls fully
address 8 of these 12 identified remaining risks, because they are relevant and sufficient in scope and
specificity to mitigate the related risk, and partially address 4 of the 12 remaining risks. For the four
risks that Agency officials indicated no longer applied, we found that FTA’s controls partially address
two risks and do not address two. We included our assessment of these areas should FTA
management determine the risks are applicable at a future time. Adding controls for those risk areas
that are not fully addressed will help the Agency mitigate the potential impact of the risks facing its
COVID-19 relief funding.
Our Recommendations
FTA concurred with our two recommendations to improve controls for addressing COVID-19 funding
risks. We consider all recommendations resolved but open pending completion of the planned
actions.
All OIG audit reports are available on our website at www.oig.dot.gov.
For inquiries about this report, please contact our Office of Government and Public Affairs at (202) 366-8751.
Contents
Memorandum 1
Results in Brief 3
Background 4
FTA Designed Controls To Fully Address 8 of the 16 Risks It Identified for
Its COVID-19 Relief Funding 7
Conclusion 22
Recommendations 22
Agency Comments and OIG Response 23
Actions Required 23
Exhibit A. Scope and Methodology 24
Exhibit B. Organizations Visited or Contacted 25
Exhibit C. List of Acronyms 26
Exhibit D. Major Contributors to This Report 27
Appendix. Agency Comments 28
ST2023001
U. S. Department of Transportation
Office of Inspector General
Memorandum
Date: October 12, 2022
Subject: ACTION: FTA Can Enhance Its Controls To Mitigate COVID-19 Relief Funding
Risks | Report No. ST2023001
From: David Pouliott
Assistant Inspector General for Surface Transportation Audits
To: Federal Transit Administrator
Since March 2020, Congress has provided $69.5 billion in supplemental funding
to the Federal Transit Administration (FTA) to help transit systems in the United
States mitigate the impacts of the Coronavirus Disease 2019 (COVID-19)
pandemic. 1 As of August 1, 2022, FTA had obligated over $63 billion and
expended over $46 billion. In addition to increased funding, the COVID-19 relief
laws—the Coronavirus Aid, Relief, and Economic Security (CARES), Coronavirus
Response and Relief Supplemental Appropriations (CRRSA), and American Rescue
Plan (ARP) Acts—permitted changes in how recipients use FTA funds.
Importantly, in an April 20, 2021, Dear Colleague letter, FTA identified as the most
significant change that all recipients, regardless of size or urbanized area
population, 2 could charge operating expenses to FTA grants at a 100-percent
Federal share, thus eliminating the local match requirement that usually applies.
Our work, including audits of FTA’s oversight of the over $10 billion provided in
response to Hurricane Sandy, 3 has shown that large amounts—coupled with
1
In March 2020, the Federal Transit Administration (FTA) received $25 billion through the Coronavirus Aid, Relief, and
Economic Security (CARES) Act to prevent, prepare for, and respond to COVID-19 (Pub. L. No. 116-136). In December
2020, FTA received an additional $14 billion for these purposes through the Coronavirus Response and Relief
Supplemental Appropriations Act of 2021 (Pub. L. No. 116-260). In March 2021, FTA received another $30.5 billion for
these purposes through the American Rescue Plan Act of 2021 (Pub. L. No. 117-2). The CARES Act also provided our
office with $5 million in no-year funds to conduct audits and investigations of DOT projects and activities carried out
with funds made available in that act.
2
FTA defines recipient size based on population density: large urbanized areas have 200,000 or more people, small
urbanized areas have at least 50,000 but fewer than 200,000 people, and rural areas have fewer than 50,000 people.
3
Our work examining FTA’s Hurricane Sandy funding oversight includes FTA Made Progress in Providing Hurricane
Sandy Funds but Weaknesses in Tracking and Reporting Reduce Transparency Into Their Use (OIG Report No.
ST2021032), July 21, 2021; FTA’s Limited Oversight of Grantees’ Compliance With Insurance Requirements Puts Federal
Funds and Hurricane Sandy Insurance Proceeds at Risk (OIG Report No. ST2020005), October 30, 2019; and FTA Has
ST2023001 1
unique requirements or short deadlines to provide funds—can expose gaps in an
agency’s controls.4 Given the magnitude of the funding Congress provided for
COVID-19 relief, the programmatic changes, and our prior audit findings related
to FTA’s oversight of Hurricane Sandy recovery funds, we initiated this audit.
Our announced objectives were to assess the design of FTA’s controls to address
(1) COVID-19 relief funding requirements and (2) oversight risks throughout the
grant lifecycle. Following our initial audit work, we refined the objectives and are
reporting on the design of FTA’s controls to address risks FTA has identified for
COVID-19 relief funding.
We conducted this audit in accordance with generally accepted Government
auditing standards. As Federal guidance calls on managers to design control
activities—policies, procedures, techniques, and mechanisms—to respond to
identified risks, we asked FTA to detail the controls it designed to address the
risks it identified. Exhibit A provides further details on our scope and
methodology. Exhibit B lists the organizations we visited or contacted.
We appreciate the courtesies and cooperation of Department of Transportation
(DOT) representatives during this audit. If you have any questions concerning this
report, please contact me or Tiffany Mostert, Program Director.
cc: The Secretary
DOT Audit Liaison, M-1
FTA Audit Liaison, TBP-30
Not Fully Implemented Key Internal Controls for Hurricane Sandy Oversight and Future Emergency Relief Efforts (OIG
Report No. ST2015046), June 12, 2015. OIG reports are available on our website at: https://www.oig.dot.gov/.
4
Internal controls help managers achieve desired results through effective stewardship of public resources and help
safeguard assets. They comprise the plans, methods, policies, and procedures the entity uses to fulfill its mission,
strategic plan, goals, and objectives.
ST2023001 2
Results in Brief
FTA designed controls to fully address 8 of the 16 risks it
identified for its COVID-19 relief funding.
The Department of Transportation (DOT) directed its Operating Administrations
(OA), including FTA, to develop plans to mitigate risks that could affect COVID-19
relief funding. FTA’s Internal Control Plan, which the Department approved in
August 2021, identified 16 risks and mitigation strategies related to COVID-19
relief funds. Federal guidance calls on managers to design control activities—
policies, procedures, techniques, and mechanisms—to respond to identified risks.
As such, we asked FTA to identify the specific control activities the Agency
designed to address the risks and implement the mitigation strategies in its
August 2021 Internal Control Plan. In the course of our audit, Agency officials
informed us that FTA no longer viewed 4 of the 16 areas as risks, leaving 12
remaining risk areas. For example, FTA initially identified a risk that the pace or
speed of obligations and disbursements could be slower than external
expectations. However, an FTA official informed us in April 2022 that the Agency
no longer considers this a risk area, based on the fact that 87 percent of the
funding was obligated at that time. Based on our review, we found that:
• FTA designed controls to fully address 8 of 12 remaining risk areas.
We determined that FTA’s controls fully address 8 of the 12 remaining
risks because they are relevant and sufficient in scope and specificity to
mitigate the related risk.
• FTA designed controls to partially address 4 of 12 remaining risk
areas. We found that FTA’s controls partially address the other 4 of the
12 risks. For example, the Agency identified a risk that recipients with
furloughed staff might attempt to use funding for a non-operating
expense, which is prohibited by law for some of the COVID-19 relief
funding, and listed a self-certification process as a control. However, our
office and other Federal oversight agencies have identified recipient self-
certification as a weak control and have called for agencies to also verify
self-reported information to determine eligibility. FTA has not designed a
detective control to compensate for the weakness in the self-certification
process, such as verifying recipients’ certifications by collecting and
reviewing payroll documentation through an oversight review. Adding
controls for those risk areas that remain to be fully addressed will help the
Agency mitigate the potential impact of the risks facing its COVID-19
relief funding.
• FTA designed controls to partially address 2 of the 4 areas that
Agency officials no longer consider to be risks. For the four risks that
ST2023001 3
Agency officials indicated no longer applied, we found that FTA’s controls
partially address two risks and do not address two. Since FTA has not yet
documented its determination that these risks no longer apply, and given
that risks evolve over time, we included our assessment of these areas in
this report for FTA management’s attention, should they determine the
risks are applicable at a future time.
As FTA prepares to administer and oversee a further influx of funding,5 it has an
opportunity to reexamine the design of its internal controls to ensure it achieves
its desired results through effective stewardship of public resources.
We are making recommendations to improve FTA’s controls for addressing risks
to its COVID-19 relief funding.
Background
Congress appropriated COVID-19 relief funding to FTA through the three laws
and directed the funds to specific FTA programs. FTA made the funds available
for these programs through apportionments; see table 1.
Table 1. Summary of FTA COVID-19 Relief Funding Made Available by Law and
Program
Program ARP Amount CRRSA Amount CARES Amount
Urbanized Area Formula Program $26,085,112,457 $13,261,831,064 $22,696,291,664
Urbanized Area Planning $25,000,000 $0 $0
Capital Investment Grants $1,675,000,000 $0 $0
Enhanced Mobility for Seniors and Individuals $50,000,000 $49,999,234 $0
with Disabilities Formula
Rural Formula Grants $317,214,013 $678,169,702 $2,228,708,336
Intercity Bus $100,000,000 $0 $0
Additional Assistance for Urban and Rural Areas $2,207,561,294 $0 $0
Administrative and Oversight Funding $1,467,770 $10,000,000 $75,000,000
Totals $30,461,355,534 $14,000,000,000 $25,000,000,000
Source: OIG analysis of FTA apportionment information on its website
5
In addition to the COVID-19 relief funding, in November 2021, Congress passed the Infrastructure Investment and
Jobs Act, Pub. L. No. 117-58 (2021), which further expanded public transportation investment by authorizing up to
$108.15 billion in funding for FTA through fiscal year 2026.
ST2023001 4
When Government agencies face changing conditions, such as rapid growth in
investment and significant changes to program requirements, Federal guidance
calls on them to assess risks and design control activities—policies, procedures,
techniques, and mechanisms—to respond to those risks.6 The Government
Accountability Office’s (GAO) Standards for Internal Control in the Federal
Government (Internal Control Standards) provide the overall framework for
establishing and maintaining an effective internal control system and cover all
aspects of an entity’s objectives (operations, reporting, and compliance). GAO’s
Internal Control Standards explain that management may use preventive or
detective controls to address risks and should implement the controls through
policies. 7 In addition, Office of Management and Budget (OMB) Circular No. A-
123 provides specific requirements for assessing and reporting on controls in the
Federal Government.
In May 2020, the Department asked its OAs to identify risks and mitigation
strategies for CARES Act funds.8 The OAs, including FTA, identified these items,
and DOT submitted them to the Pandemic Response Accountability Committee
in its June 25, 2020, Coronavirus Aid, Relief, and Economic Security (CARES Act) P.L.
116-136 Plan on the Use of Covered Funds. In that plan, FTA identified three risks:
1. Improper payments. CARES Act funding tripled FTA’s budget and
increased the amount of funding it uses for operating assistance by an
even greater amount. [The act] also increased the Federal share to
100 percent for both operating and capital expenses. According to FTA,
these changes potentially increase exposure for improper payments.9
2. Insufficient staffing for increased workload. FTA might be challenged
to grow to manage and oversee requirements for CARES Act funds and
complete regular program activities.
3. Duplication of benefits. Transit agencies potentially could seek and be
reimbursed for the same activities from multiple Federal funding streams
for certain expenses, such as [seeking reimbursement for] personal
6
Government Accountability Office (GAO), Standards for Internal Control in the Federal Government (GAO-14-704G),
September 2014.
7
A preventive control activity prevents an entity from failing to achieve an objective or address a risk. A detective
control activity discovers when an entity is not achieving an objective or addressing a risk before the entity’s
operation concludes; it also corrects the actions so that the entity can achieve the objective or address the risk. If the
control activity is for a significant purpose or a deficiency would significantly impact the achievement of the entity’s
objectives, management may design both preventive and detective control activities.
8
DOT, Memorandum on Financial Stewardship for the Coronavirus Aid, Relief, and Economic Security (CARES) Act
Funding, May 2020.
9
OMB defines an improper payment as a payment that was made in an incorrect amount under statutory, contractual,
administrative, or other legally applicable requirements.
ST2023001 5
protective equipment from [both] the Federal Emergency Management
Agency [and FTA].
After the passage of the ARP Act in March 2021, the Department directed the
OAs to continue to use best practices that include the internal controls necessary
for prudently awarding, managing, and reporting on contracts, grants, loans, and
other forms of assistance. To that end, DOT issued guidance to help the OAs
identify and document new or modified internal controls resulting from the
implementation of the funding. The guidance instructed OA program managers,
in collaboration with their agency’s Chief Financial Officer (CFO), to identify risks
for each program receiving the funding and the controls necessary to respond to
the risks.10 The Department’s guidance asked the OAs that received ARP funding,
which included FTA, to identify enterprise and program risks and types of fraud,
waste, and abuse that could affect COVID-19 relief funding and submit an
Internal Control Program Summary to DOT’s Office of the CFO. The guidance also
provided an Internal Control Planning Template as a supplemental tool to assist
each OA in its evaluation.
FTA employed a process that relied on staff input and management
determinations to identify risks. An FTA official described the Agency’s COVID-19
relief funding risk assessment process as a series of discussions with FTA
stakeholders and DOT officials, in which FTA officials considered the
Department’s guidance and how the COVID-19 relief funding differed from
existing FTA programs.
FTA submitted a draft summary, which it referred to as an Internal Control Plan,
to DOT’s CFO office and responded to comments and questions from staff in that
office. Then the Agency finalized the Internal Control Plan, which DOT’s CFO
office approved in August 2021. For the risks FTA included in the final plan, see
table 2.
10
DOT, Internal Control Guidance on Emergency Funds To Include ARPA, March 2021.
ST2023001 6
Table 2. Summary of COVID-19 Relief Funding Risks in FTA’s August 2021
Internal Control Plan
Risks in FTA’s Internal Control Plan
1. Risk of Fraud or Abuse 9. Risks Between Programs
2. Many Recipients Are Using FTA funds for Operating 10. Recipient Financial Management Systems
Assistance for the First Time
3. Recipients May Attempt To Use Funding for a Non- 11. Notification for Large Drawdown Requests
Operating Expense Even Though They Have
Furloughed Staff
4. FTA Staffing Levels May Not Be Sufficient 12. Time Between Oversight Reviews
5. Small Recipients Understanding Eligibility 13. Limited Capacity of Current Oversight Contracts
Requirements
6. Oversight of Sub-recipients 14. Guidance and Instructions Related to the Use of
COVID-19-Relief Funding
7. Private Sector Operators Are Now Eligible To 15. Risk of Improper Payments
Become Sub-recipients
8. Pace/Speed of Obligations and Disbursements 16. Grant-Accrual Methodology
Source: OIG analysis of risks in FTA’s August 2021 Internal Control Plan
Our audit looked at the risks and mitigation strategies that FTA identified in the
August 2021 Internal Control Plan. We also reviewed related controls and
supporting documentation, such as policies and procedures, for implementing
the controls that FTA subsequently identified at our request.
FTA Designed Controls To Fully Address 8 of the 16
Risks It Identified for Its COVID-19 Relief Funding
Federal guidance calls on managers to design control activities—policies,
procedures, techniques, and mechanisms—to respond to identified risks. As such,
we asked FTA to identify the specific control activities it designed to address the
16 risks and implement the mitigation strategies listed in its August 2021 Internal
Control Plan. In most instances, the controls that FTA identified were the same as
the risk mitigation strategies.
We then examined whether the control was relevant to the identified risk and
sufficient in scope and specificity to mitigate the risk. We also compared this
information to GAO’s Internal Control Standards, which provide an overall
framework for establishing and maintaining an effective internal control system,
ST2023001 7
and departmental guidance on internal controls. We assessed the control design
for each risk (fully address, partially address, or do not address) and recorded that
assessment with the basis of our reasoning. In the course of our audit, Agency
officials informed us that FTA no longer viewed 4 of the 16 areas as risks, leaving
12 remaining risk areas. Nonetheless, we included our assessment of those risks
for FTA management’s attention, should they determine the risks are applicable
at a future time. We found that FTA designed controls that fully address 8 of the
12 remaining risks and partially address 4 of the remaining risks. For the four risk
areas that FTA officials said no longer applied, we determined that, as designed,
FTA’s controls partially address two of the four areas and do not address the
other two.
FTA Designed Controls To Fully Address
8 of 12 Remaining Risk Areas
To address the risks it identified, FTA described different types of controls—
preventive controls, such as grantee outreach and education, or detective
controls, such as enhancements to its Triennial Reviews and State Management
Reviews (TR/SMR). We determined that FTA’s controls fully address 8 of the
12 remaining risks because they are relevant and sufficient in scope and
specificity to mitigate the related risk.
Many Recipients Are Using FTA funds for Operating Assistance for the First Time
FTA-Identified Expanded eligibility of allowable expenses: COVID-19 relief funding bills permitted large urban
Risk systems to use FTA funding for operating expenses. Although they report such expenses to the
National Transit Database, these recipients have little or no experience calculating and
documenting operating expenses for FTA grant awards.
FTA • FTA developed and delivered webinars to the transit industry covering the implementation of
Mitigation this requirement.
Strategy • Grant-making toolkit developed for FTA staff.
• CARES/CRRSA/ARP webinars, outreach events, and stakeholder calls to train operators how to
calculate and document operating assistance.
• COVID-19 webpage and frequently asked questions (FAQ) available and kept up to date.
• Routine Single Audit management and oversight.
• Supplemental guidance and instructions for current oversight review programs.
• Supplemental financial spot reviews for recipients not receiving a routine oversight review.
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Fully address
Assessment
ST2023001 8
FTA identified mitigation strategies for this risk, which it also described as
controls. We found that, as designed, they fully address this risk, as they are
relevant and sufficient in scope and specificity. FTA designed preventive controls,
such as internal guidance and external webinars, to educate staff and recipients
on this new eligibility. In addition, FTA designed detective controls by adding
specific procedures to its TR/SMRs and including steps in its financial spot
reviews to verify that recipients accurately calculated operating expenses.
FTA Staffing Levels May Not Be Sufficient
FTA-Identified FTA staffing levels may not be sufficient for workload of existing programs as well as supplemental
Risk funding (employees on board may not be sufficient to undertake regular program management
and oversight in addition to providing sufficient outreach, management, and oversight of
supplemental COVID funds).
FTA • FTA is applying CARES and CRRSA funds to hire a sufficient level of full-time equivalents (FTE) to
Mitigation compensate for regular attrition and adapt to new requirements associated with increased
Strategy workloads.
• FTA is applying CARES and CRRSA funds to bring additional contract support on board.
FTA-Identified • Over the last year, FTA has undertaken an ongoing hiring surge to immediately fill vacant
Controls positions in program offices and regions.
• In addition, FTA has added 26 new positions (funded by the CARES Act) to the FTA roster, and is
well underway in filling those positions—specifically to meet the new workloads presented by
implementation of the CARES Act, CRRSA and ARP. To date, we have filled 10 of the CARES Act
positions.
• In addition, FTA is working to develop a comprehensive workforce assessment, which will
develop a standard approach to assigning FTE and prioritizing positions within the Agency
based on workloads, complexity of work and distribution of grants.
• As a part of the implementation of the Future of Work changes, FTA will be adding new
flexibilities such as remote work, which will allow for a virtually distributed workforce in support
of new demands and able to shift attention to peaks in workload in certain regions. Through
leveraging of technology, and with lessons learned during the pandemic, FTA has demonstrated
that employees can support grantees and perform almost every task remotely and can be
redirected virtually in the future as needs dictate.
OIG Control
Design Fully address
Assessment
FTA identified mitigation strategies and accompanying controls for this risk. We
found that, as designed, they fully address this risk, as they are relevant and
sufficient in scope and specificity. The Agency provided a document that
described workload indicators by Region and another that identified 35 different
CARES- and CRRSA-funded positions with legal justifications for using the funds
for these positions. An FTA official explained that, to support the hiring needs
from COVID-19 relief funding, the Agency determined the type of work and skills
needed to complete the work were not changed. The official also stated FTA
apportioned additional FTEs to Regional offices based on the apportionment of
ST2023001 9
COVID-19 relief funds that office is responsible for administering and overseeing.
Furthermore, a control FTA identified was that it planned to develop a
comprehensive workforce assessment, which could help define its human capital
needs. According to FTA, this assessment will enable the Agency to develop a
standard approach to assigning full-time equivalents and prioritizing positions
within the Agency based on workload, complexity, and distribution of grants.
Small Recipients
FTA-Identified
Small recipients may not fully understand eligibility requirements.
Risk
FTA • Provide technical assistance including webinars, toolkit(s), and FAQs available to explain eligibility
Mitigation requirements.
Strategy • COVID-19 webpage and FAQs available and kept up to date.
• National Aging and Disability Transportation Center and National Rural Transit Assistance Program
available to provide supplemental technical assistance to section 5310 and rural recipients.
• Regional staff provide technical assistance.
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Fully address
Assessment
FTA identified mitigation strategies for this risk, which it also described as controls.
We found that, as designed, they fully address the related risk, as they are relevant
and sufficient in scope and specificity. The Agency designed preventive controls—
such as its internal guidance, an external toolkit, and FAQs—to educate its staff
and recipients about this requirement. An Agency official also explained that FTA
could identify and address gaps in understanding through oversight reviews.
Oversight of Sub-recipients
FTA-Identified Where FTA funds are passed through to a sub-recipient, FTA relies on the direct recipient for oversight of
Risk sub-recipients that receive those pass-through funds.
FTA • Direct recipients are subject to oversight through TR/SMRs. This includes their oversight of sub-recipients.
Mitigation • Supplemental guidance and instructions for current oversight review programs, including updated
Strategy sampling procedures for ECHOa draws.
• Supplemental financial spot reviews for recipients not receiving a regular oversight review would also
capture payments to sub-recipients.
FTA-Identified The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Fully address
Assessment
a
ECHO stands for FTA’s Electronic Clearing House Operation system, which recipients use to request drawdowns from their
grant awards.
ST2023001 10
FTA identified mitigation strategies for this risk, which it also described as
controls. We found that, as designed, they fully address this risk, as they are
relevant and sufficient in scope and specificity. FTA designed detective controls—
its TR/SMRs and financial spot reviews—to evaluate recipient oversight of sub-
recipients. These reviews include sampling recipient COVID-19 relief funding
draws from FTA’s Electronic Clearing House Operation (ECHO) system, which
recipients use to request payments (to draw down) from their grant awards.
Recipient Financial Management Systems
FTA-Identified Recipient financial management systems may not be fully capable of tracking, reporting, and
Risk reconciling a large volume of FTA funds for new programs with different Federal match
requirements.
FTA • Routine Single Audit management and oversight.
Mitigation • Supplemental guidance and instructions for current oversight review programs.
Strategy • Supplemental financial spot reviews for recipients not receiving a regular oversight review.
Some reviews will include an assessment of the financial systems.
FTA-Identified The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Fully address
Assessment
FTA identified mitigation strategies for this risk, which it described as controls.
We found that, as designed, they fully address this risk, as they are relevant and
sufficient in scope and specificity. FTA cited several detective controls: its Single
Audit Management standard operating procedure (SOP), which guides the
Agency’s identification and monitoring of recipient Single Audit findings; its
current TR/SMR guidance, which includes checks on the reporting and fund
tracing abilities of a recipient’s financial management system; and its financial
spot reviews, which may include specific financial management system reporting
and accuracy questions. FTA established criteria to use the most relevant
control—the financial spot review’s system assessment—to check a recipient’s
financial management system capability. The selection criteria included recipients
that were newly eligible to charge operating expenses and that met one of the
following conditions: they would not receive a TR/SMR until fiscal year 2023, had
a financial management finding during their last TR/SMR, or had over $100
million in COVID-19 supplemental funding obligations. Regional offices could
also request a review of a recipient.
ST2023001 11
Time Between Oversight Reviews
FTA-Identified FTA’s routine oversight is conducted on a 3-year cycle, leaving many recipients without an
Risk oversight review until FY 2023.
FTA • Routine Single Audit management and oversight.
Mitigation • Supplemental financial spot reviews for recipients not receiving a regular oversight review.
Strategy • Continue staff training for conducting remote monitoring, post-award management, and
informal oversight (Grants A-Z training.)a
FTA-Identified • TR/SMR reviews
Controls • COVID-19 financial spot reviews
• FTA's Single Audit management
OIG Control
Design Fully address
Assessment
a
FTA’s Grants A to Z Checklist is an internal SOP.
FTA identified mitigation strategies and described several controls for this risk.
We found that, as designed, they fully address the related risk, as they are
relevant and sufficient in scope and specificity. The addition of the spot reviews,
in particular, addressed the risk FTA identified. FTA would need to continue the
supplemental spot reviews until at least fiscal year 2023 to cover the gap it
identified, as shown in the table above.
Risk of Improper Payments
FTA-Identified Risk Risk of improper payments.
FTA Mitigation • FTA will perform a quantitative improper payment risk assessment.
Strategy • FTA will include the ARP program in the FY 2022 Improper Payments review portfolio.
FTA-Identified • FTA hired a contractor during FY 2021 to perform an improper payments quantitative risk
Controls assessment review for the CARES Act fund. Improper risk assessments may be qualitative or
quantitative per OMB A-123 Appendix C. The results of the risk assessment are reported on
www.paymentaccuracy.gov as indicated in the FY 2021 Agency Financial Report (OMB A-136
directs agencies to provide a link to OMB’s website). The result of quantitative risk assessment
is being used as the justification for moving forward to perform the full improper payment
review for the CARES Act in FY 2022.
• During FY 2022 FTA will perform a full improper payments review of the CARES Act based on
the level of risk determined by the contractor, and the final results will be reported in DOT
Annual Financial Report on or before November 15, 2022. OST and FTA officials stated that
ARP funds also would be included in the FY 2022 review.
OIG Control Design
Fully address
Assessment
FTA identified mitigation strategies and accompanying controls for this risk. We
found that, as designed, they are sufficient in scope and specificity to fully
ST2023001 12
address the related risk. Notably, FTA described detective controls for identifying
improper payments from its COVID-19 relief funding.
Grant-Accrual Methodology
FTA-Identified The 2020 financial statement audit included a finding on FTA’s process for estimating grant accrual
Risk for CARES Act funds.a
FTA • FTA updated the methodology in response to the audit finding.
Mitigation • FTA is examining whether further changes are needed.
Strategy
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Fully address
Assessment
a
Specifically, the 2020 financial statement audit found that FTA’s current methodology, combined
with the CARES Act funds, could result in material misstatements in grant accrual that are not
detected and corrected.
FTA identified mitigation strategies, which it described as controls for this risk.
We found that, as designed, they fully address the related risk, as they are
relevant and sufficient in scope and specificity. After the Internal Control Plan was
issued, the Agency addressed the finding identified in the 2020 financial
statement audit report11 by providing an updated grant accrual methodology—
which cites CARES, CRRSA, and ARP funding—and our office closed the related
audit recommendation in March 2022.
FTA Designed Controls To Partially
Address 4 of 12 Remaining Risk Areas
We determined that the controls partially address the other 4 of the 12 remaining
identified risks because they are not fully relevant or sufficient in scope and
specificity to address the risk. One example of particular note in light of past
oversight work is the FTA-identified risk that recipients with furloughed staff
might attempt to use funding for a non-operating expense. FTA identified as a
control a self-certification process in which an applicant would certify that it had
not furloughed staff before FTA awarded the funds. However, our office and
other Federal oversight agencies have previously identified recipient self-
certification as a weak control and have called for agencies to also take steps to
11
Quality Control Review of the Independent Auditor’s Report on the Department of Transportation’s Audited
Consolidated Financial Statements for Fiscal Years 2020 and 2019 (OIG Report No. QC2021008), November 16, 2020.
ST2023001 13
verify self-reported information regarding eligibility. Yet FTA has not designed a
detective control to compensate for weaknesses in the self-certification process,
such as subsequently verifying recipients’ certifications by collecting and
reviewing payroll documentation through an oversight review. We’ve included
our assessment of the controls that partially address the four risk areas below.
Risk of Fraud or Abuse
FTA-Identified FTA did not identify a special or heightened risk for fraud related to this funding compared to its
Risk other programs. Since recipients eligible for COVID-19 funding are public sector entities that
already receive FTA funding, there is not an increased risk that an ineligible recipient would receive
COVID-19 funding. Furthermore, as funds are primarily for operating assistance, which have broad
eligibilities and are available until expended, except for ARP funds that must be expended through
September 30, 2029, there is not an increased risk that an eligible recipient would not have
sufficient eligible activities or expenses to which they can apply funding. Note: This does not imply
that FTA believes there is no risk of fraud, but that this risk is in line with other programs and
mitigated through existing oversight mechanisms.
FTA • FTA is using its traditional oversight reviews (triennial reviews, state program reviews, financial
Mitigation management system reviews, procurement system reviews).
Strategy • Single annual audit requirement.
• Improper payment reviews.
• New supplemental financial spot reviews.
• Every 3 years FTA will reassess the fraud risk unless other information or changes are identified
earlier requiring a reassessment.
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Partially address
Assessment
Although FTA did not identify a special risk for fraud, it did—at the Department’s
request—include fraud in its Internal Control Plan and identify mitigation
strategies, which it also subsequently described as controls. We found that, as
designed, the controls are not sufficient in scope to fully address the identified
risk. FTA did establish some controls in its existing reviews and the new financial
spot reviews for detecting fraud in COVID-19 relief funding. For example, the
sampling procedures specific to the COVID-19 relief funding in the TR/SMRs and
the supplemental financial spot reviews instruct the contractor to select payments
that meet potential fraud indicators, such as flat dollar amounts (e.g., $1 million).
The TR/SMRs also include procedures for the contractor to assess whether
recipients inform FTA of various types of fraud, waste, or abuse. However, FTA
has not documented controls—policies, procedures, techniques, or
mechanisms—to ensure it can carry out the strategy it identified for reassessing
the fraud risk every 3 years or taking actions to determine if an earlier
reassessment is necessary.
ST2023001 14
We also noted in our review that FTA did not thoroughly identify the risks of
fraud, waste, and abuse. Specifically, FTA did not document risks related to waste
or abuse, although the Department specified that OAs should identify types of
fraud, waste, and abuse that could affect COVID-19 relief funding. In addition, the
definition FTA used to assess fraud risk did not align with the definition in GAO’s
Internal Control Standards, which hinges on willful misrepresentation in
attempting to obtain funding. Instead, FTA based its assessment on the risks that
an ineligible recipient would receive COVID-19 relief funding or an eligible
recipient would not have sufficient eligible activities or expenses to which they
could apply funding—issues that FTA did not link to willful misrepresentation.
Recipients May Attempt To Use Funding for a Non-Operating Expense
Even Though They Have Furloughed Staff
FTA-Identified Recipients may attempt to use 5307, 5310, or 5311a funding for a non-operating expense even
Risk though they have furloughed staff. Recipients are required to certify that, at the time of grant
award, they have not furloughed any staff if they use funding for a purpose other than operating
assistance (except for CARES funds obligated before CRRSA was enacted) (does not apply
prospectively).
FTA • Annual certifications and assurances.
Mitigation • FAQs on this issue are posted on the FTA website.
Strategy • Toolkit for recipients covers this issue.
• During grant review, Regions will follow-up with recipients requesting expenses other than
operating expenses to ensure no staff have been furloughed.b
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Partially address
Assessment
a
These numbers refer to the sections of Title 49, United States Code (U.S.C.) that pertain to three
FTA programs—5307 refers to the Urbanized Area Formula Program, 5310 refers to the Enhanced
Mobility of Seniors and Individuals With Disabilities Program, and 5311 refers to the Formula Grants
for Rural Areas Program.
b
FTA’s 10 Regional Offices work with local transit officials to develop and manage grants.
FTA identified mitigation strategies for this risk, which it also described as
controls. We found that, as designed, they are not sufficient in scope to fully
address the identified risk. The Agency did design preventive controls, such as its
internal guidance and external toolkit and FAQs, to educate staff and recipients
about this requirement. FTA also updated its certifications and assurances to
include this attestation. However, our office and other Federal oversight agencies
have identified recipient self-certification as a weak control and called for
agencies to take steps to verify self-reported information that is necessary to
determine eligibility. Specifically, in 2019, we reported that FTA had not verified
ST2023001 15
recipient flood insurance for Hurricane Sandy damages because it relied on self-
certification and did not require confirmation.12 Because FTA did not have a
verification step after self-certification—such as a specific TR/SMR procedure to
affirm that each grantee complied with flood insurance requirements—it could
not determine whether its grantees were eligible for the funds they received.
GAO has reported, and the Department’s guidance emphasizes, that self-
certification of eligibility requirements presents a significant fraud risk. As such,
GAO’s Fraud Risk Management Framework calls for agencies to take steps to
verify self-reported information that is necessary to determine eligibility.13 Based
on our review, FTA has not designed a detective control, such as collecting and
reviewing payroll documentation through an oversight review, for verifying
recipients’ self-certifications.
Private Sector Operators Are Now Eligible To Become Sub-recipients
FTA-Identified Private providers of public transportation may not be familiar with Federal cross-cutting
Risk requirements with which they must comply as sub-recipients. Recipients are responsible for
oversight of those operators.
FTA • Direct recipients are subject to oversight through TR/SMRs. This includes their oversight of sub-
Mitigation recipients.
Strategy • As these are nontraditional recipients, FAQs will be updated to provide guidance for internal
and external stakeholders.
FTA-Identified
TR/SMRs.
Controls
OIG Control
Design Partially address
Assessment
FTA identified mitigation strategies for this risk and described its reviews as
controls. We found that, as designed, they are not sufficient in scope or specificity
to fully address the related risk. In its plan, FTA identified a preventive mitigation
strategy—its FAQs—and designed detective controls—its TR/SMRs—to evaluate
recipient oversight of sub-recipients, which can now include private sector
operators. However, the sub-recipient oversight section of its TR/SMR guidance
does not specify steps for evaluating recipients’ oversight of private sector sub-
recipients in particular. Furthermore, the guidance did not include steps to ensure
that the ECHO drawdowns selected for review contained private sector sub-
recipients, and the ECHO drawdown sampling may not be sufficiently extensive to
include a drawdown from a grant where the recipient had a private sector sub-
12
FTA’s Limited Oversight of Grantees’ Compliance With Insurance Requirements Puts Federal Funds and Hurricane
Sandy Insurance Proceeds at Risk (OIG Report No. ST2020005), October 30, 2019.
13
GAO, A Framework for Managing Fraud Risks in Federal Programs (GAO-15-593SP), July 2015.
ST2023001 16
recipient. FTA’s fiscal year 2022 guidance on TR/SMRs instructs the reviewer to
sample at least four ECHO drawdowns of “supplemental funds” that may include
CARES, CRRSA, and ARP funding. The supplemental financial spot reviews call for
a sample of three ECHO drawdowns in total for CARES, CRRSA, and ARP awards.
According to a FTA official, the Agency will add guidance to address this risk for
the reviews that begin in October 2022.
Limited Capacity of Current Oversight Contracts
FTA-Identified Limited capacity of current oversight contracts to execute necessary oversight.
Risk
FTA • Increase number of contracts to be awarded in the Financial Management Oversight (FMO)
Mitigation Program.
Strategy • Share oversight assignments between the FMO and TR/SMR programs.
FTA-Identified • FMO Review Program
Controls • COVID-19 financial spot reviews
• FY 2022 TR/SMRs
OIG Control
Design Partially address
Assessment
FTA identified mitigation strategies and accompanying controls for this risk. We
found that, as designed, they are not sufficient in scope or specificity to fully
address the related risk. To begin, the reviews FTA listed as controls do not
specifically address the identified risk—FTA’s limited current oversight capacity.
Furthermore, the expanded scope of the reviews identified to address COVID-19
relief funding may place further strain on the Agency’s capacity. In line with the
mitigation strategies identified, an FTA official stated the Agency is seeking to
increase the capacity of its Financial Management Oversight (FMO) program by
50 percent—adding two contractors to its existing four FMO contractors.
However, FTA did not provide us with analysis to support its determination that
this increase will be sufficient to execute the necessary oversight. In addition, FTA
did not provide evidence of a plan to implement its mitigation strategy of sharing
assignments between the FMO and TR/SMR programs.
FTA Designed Controls To Partially
Address 2 of the 4 Areas That Agency
Officials No Longer Consider To Be Risks
For the four risk areas that FTA identified in the August 2021 Internal Control Plan
but officials subsequently said were no longer risks, we determined that, as
designed, FTA’s controls partially address two of the four areas and do not
ST2023001 17
address the other two. For example, for the FTA-identified risk that the pace or
speed of obligations and disbursements could be slower than external
expectations, we found that, as designed, the controls do not address the related
risk, as they are not relevant or sufficient in scope or specificity. The Agency did
not identify any controls to address managing external expectations, which is
central to the stated risk. In addition, FTA did not develop any policies or
procedures to implement the monitoring, estimating, and forecasting strategies it
described to mitigate this risk. An FTA official informed us in April 2022 that the
Agency no longer considers this a risk area because 87 percent of the funding
was obligated at that time. However, since about one-third of the funding
remained to be outlayed (expended) through August 1, 2022, FTA may still find a
strategy for communicating with external stakeholders beneficial. Since FTA has
not yet documented its determination that these risks no longer apply and, given
that risks evolve over time, we included our assessment of these areas below for
FTA management’s attention, should they determine the risks are applicable at a
future time.
Risks Between Programs
FTA-Identified FTA’s undisbursed obligation balances and/or unobligated balances of traditional chapter 53a
Risk funding could grow if recipients use COVID funds, which do not require local match, in lieu of
regular FTA funds. The latter is a public perception risk as recipients are legally entitled to use
funds within their period of availability.
FTA • Undisbursed obligations will be monitored through the annual grant closeout standard
Mitigation operating procedure (SOP).
Strategy • Lapsed funds will be reapportioned as statutorily required.
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Partially address; however, FTA no longer considers this an area of risk.
Assessment
a
49 U.S.C., chapter 53, covers public transportation.
FTA identified mitigation strategies for this risk, which it also described as
controls. We found that, as designed, they are not sufficient in relevance or scope
to fully address the related risk. FTA cited its annual grant closeout SOP, a
preventive control that includes steps to identify any undisbursed funds in an
award. However, the second item simply states what is legally required, which is
not a control because it is not a policy, procedure, technique, or mechanism.
Moreover, FTA does not address managing external perceptions related to
unobligated balances, which is central to the risk that it identified. An FTA official
informed us in April 2022 that the risk had not materialized, and the Agency no
longer considers this a risk area.
ST2023001 18
Guidance and Instructions Related to the Use of COVID-19-Relief Funding
FTA-Identified Ensuring guidance and instructions related to the use of COVID-19 relief funding is consistent
Risk across FTA and communicated consistently with recipients.
FTA • FTA used single email address to collect initial questions
Mitigation • FAQs posted to FTA’s website
Strategy • Grant-making toolkit for Regional staff (7/8/21)
• Recipient grant-making toolkit (5/28/21)
• Webinars with FTA staff
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Partially address; however, FTA no longer considers this an area of risk.
Assessment
FTA identified mitigation strategies, which it described as controls, for this risk.
We found that, as designed, they are not sufficient in scope or specificity to fully
address the related risk. An FTA official emphasized that the Agency developed
guidance to enhance consistency across its regions, and FTA officials described
quality control procedures for individual information sources. For example, an
FTA official stated that subject matter experts, legal counsel, and leadership at
FTA, OST, and OMB reviewed and vetted the FAQs posted on FTA’s website to
ensure consistency across the Federal Government. Another official explained
that FTA derived its webinars from the FAQs and that the toolkits underwent an
internal FTA review process. However, the officials indicated FTA did not
document the various review processes they described to us or develop and
document a way to compare information from different sources to maintain
consistency. In August 2022, an Agency official informed us that FTA no longer
considers this a risk because, at this point in time, it does not expect to issue
substantial new guidance or instructions that it would need to monitor for
consistency. Nonetheless, as we describe in the risk area related to Notification
for Large Drawdown Requests below, FTA has communicated inconsistent
information to its funding recipients in different sources. Given these
inconsistencies, the Agency may wish to consider whether a risk remains in this
area.
ST2023001 19
Pace/Speed of Obligations and Disbursements
FTA-Identified Pace/speed of obligations and disbursements could be slower than external expectations.
Risk
FTA • ARP funds must be obligated by September 30, 2024, and disbursed by September 30, 2029.
Mitigation • FTA will monitor and assess the pace of obligations and disbursements and update estimates as
Strategy needed.
• FTA will develop and update forecasts of obligations and disbursements on a biannual basis,
examine actuals versus forecasts, and identify any concerns.
FTA-Identified
The controls FTA identified to us were the same as the mitigation strategies included in the plan.
Controls
OIG Control
Design Do not address; however, FTA no longer considers this an area of risk.
Assessment
FTA identified mitigation strategies for this risk, which it also described as
controls. We found that, as designed, they do not address the related risk, as they
are not relevant or sufficient in scope or specificity. None of the strategies FTA
identified specifically addressed managing external expectations, which is central
to the risk. Furthermore, the first item simply restates ARP deadlines, which is not
a control, since it is not a policy, procedure, technique, or mechanism. Finally, FTA
has not developed any policies and procedures to implement the monitoring,
estimating, and forecasting activities it described to mitigate this risk. An FTA
official informed us in April 2022 that the Agency no longer considers the pace
and speed of obligations as a risk area, because 87 percent of the funds were
obligated at that time. However, since about one-third of the funding remained
to be outlayed through August 1, 2022, FTA management may still find a strategy
for communicating with external stakeholders beneficial.
Notification for Large Drawdown Requests
ECHO: Recipients unaccustomed to large drawdowns may fail to notify FTA in advance before
FTA-Identified requesting large ECHO-Web draws (minimum 3 business days for a disbursement totaling
Risk $50 million or more).
FTA • For information about ECHO-Web Payment procedures and policies, FTA will continue to refer
Mitigation recipients to FTA Circular 5010.1E, Chapter VI: Financial Management.
Strategy • FTA will also continue to refer recipients to the ECHO-Web User Manual, Section 4.6.4,
Troubleshooting: Rejected Payment Requests, which notes that grantees must “provide notice of
payments in excess of $50 million.”
FTA-Identified • COVID-19 financial spot reviews
Controls • TR/SMR supplemental guidance
OIG Control
Design Do not address; however, FTA no longer considers this an area of risk.
Assessment
ST2023001 20
FTA identified mitigation strategies and described accompanying controls for this
risk. We found that, as designed, the two detective controls cited do not address
the related risk, as they are insufficient in either scope or specificity. Specifically,
the scope of the TR/SMR supplemental guidance that FTA cited does not include
steps to address this risk. In addition, the financial spot review guidance is not
sufficiently specific; it instructs reviewers to determine if the recipient “timely
notified” FTA before requesting an ECHO drawdown of over $50 million, but it
does not specify what timely notification entails. This is especially problematic, as
FTA has communicated inconsistent information about the notification
requirement. The policy documents FTA cites in its mitigation strategy—FTA
Circular 5010.1E and the ECHO-Web User Manual—indicate the minimum notice
is 48 hours (2 days). However, FTA specifies 3 business days in its risk language
and the information it provides to its ECHO-Web users on the login page.
Additionally, FTA did not design preventive controls that could obviate or reduce
the need for detective controls through its reviews.
An FTA official informed us in April 2022 that the Agency no longer considers this
a risk area because FTA’s Office of Financial Management satisfies Treasury’s
requirement to provide notification of the total daily drawdown over $50 million
to be disbursed to the grantee the following day. However, this explanation does
not address either the risk, which was recipient-focused, or the disagreement
between FTA’s information sources on the notification requirement.
The controls FTA designed may facilitate administration and oversight of its
COVID-19 relief funding. However, to more fully mitigate the identified risks, the
Agency can enhance the controls in the areas we determined were not fully
addressed. Enhanced controls would also help FTA meet the Department’s goals
for prudently awarding, managing, and reporting on the funds. Our analysis of
the individual COVID-19 relief funding risks and controls provides concrete areas
for Agency officials to consider. As FTA prepares to administer and oversee a
further influx of funding under the Infrastructure Investment and Jobs Act, 14 it has
an opportunity to reexamine the design of its internal controls to ensure it
achieves its desired results through effective stewardship of public resources.
14
Pub. L. No. 117-58 (2021).
ST2023001 21
Conclusion
Since 2020, Congress has provided FTA with almost $70 billion to help mitigate
the impacts of the COVID-19 pandemic. Through August 1, 2022, FTA obligated
about 91 percent of these funds and outlayed about 67 percent. The Agency
actively took steps to identify and mitigate risks related to these funds. However,
FTA has an opportunity to further enhance the controls it developed to address
these risks. A timely reexamination of its control designs will help FTA ensure that
recipients meet Federal requirements, and providing stronger oversight will help
protect large influxes of funding from fraud, waste, and abuse.
Recommendations
To improve FTA’s controls for addressing risks to its COVID-19 relief funding, we
recommend that the Federal Transit Administrator, in consultation with staff from
DOT’s Office of the Chief Financial Officer:
1. Design or redesign control activities for the four risks that have not been
fully addressed and that FTA still deems as applicable. These are:
a. Risk of Fraud or Abuse
b. Recipients May Attempt to Use Funding for a Non-Operating
Expense Even Though They Have Furloughed Staff
c. Private Sector Operators Are Now Eligible to Become Sub-
recipients
d. Limited Capacity of Current Oversight Contracts
2. Document the determination that four of the risk areas in the August
2021 Internal Control Plan are no longer risks; therefore, additional
controls are not necessary. These are:
a. Pace/Speed of Obligations and Disbursements
b. Guidance and Instructions Related to the Use of COVID-19-Relief
Funding
c. Risks Between Programs
d. Notification for Large Drawdown Requests
ST2023001 22
Agency Comments and OIG Response
We provided FTA with our draft report on August 31, 2022, and received its
response, dated September 29, 2022, which is included as an appendix to this
report. FTA concurred with both of our recommendations and provided
appropriate actions and completion dates. Accordingly, we consider all
recommendations resolved but open pending completion of the planned actions.
Actions Required
We consider all recommendations resolved but open pending completion of
FTA’s planned actions.
ST2023001 23
Exhibit A. Scope and Methodology
This performance audit was conducted between August 2021 and August 2022.
We conducted this audit in accordance with generally accepted Government
auditing standards. Those standards require that we plan and perform the audit
to obtain sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that the
evidence obtained provides a reasonable basis for our findings and conclusions
based on our audit objectives.
Our announced objectives were to assess the design of FTA’s controls to address
(1) COVID-19 relief funding requirements and (2) oversight risks throughout the
grant lifecycle. However, after our initial audit work, we decided to clarify and
consolidate the objectives to remove the overlap between them. Our clarified
objective was to assess the design of FTA’s controls to address risks the Agency
identified for COVID-19 relief funding.
To assess the design of FTA’s controls to address its identified risks, we relied on
criteria such as DOT’s guidance for the OAs’ Internal Control Plans and GAO’s
Standards for Internal Control in the Federal Government and Framework for
Managing Fraud Risks in Federal Programs. We developed a data collection
instrument that allowed the Agency to identify specific controls, along with
supporting documentation, to address the risks FTA identified in its June 2020
and August 2021 Internal Control Plans. We also interviewed FTA staff about the
Agency-identified risks, mitigation strategies, and controls and met with DOT’s
policy and budget staff to understand their role in the Internal Control Plan
development and approval process. Based on the information FTA provided, we
narrowed our scope to the risks identified in the August 2021 plan, as it was more
recent and relevant. We gathered information from the data collection
instrument, supporting documentation, and interviews and compared it to the
criteria cited above. Based on this comparison, we assessed the design of FTA’s
controls to address each of the 16 risks it identified in the August 2021 plan.
Specifically, we looked at whether the controls were relevant to each identified
risk and sufficient in scope and specificity to mitigate the risk. We recorded our
assessment of the control design for each risk (fully address, partially address, or
do not address), along with the basis of our reasoning. We shared our preliminary
findings and recommendations with FTA in April 2022 and Agency officials
subsequently informed us that FTA no longer viewed 3 of the 16 areas as risks.
We also adjusted our responses for several risks based on additional information
the Agency provided. After we shared our draft recommendations with FTA in
July 2022, an Agency official informed us that FTA no longer considered a fourth
area a risk, leaving 12 remaining risks. We noted these in our report.
Exhibit A. Scope and Methodology 24
Exhibit B. Organizations Visited or Contacted
Department of Transportation
Office of Audit Relations and Program Improvement
Office of Budget, Performance, and Finance
Office of Transportation Policy
Office of General Counsel
Federal Transit Administration
Office of Budget and Policy
Office of Chief Counsel
Office of Program Management
Office of Transit Safety and Oversight
Office of Administration
Exhibit B. Organizations Visited or Contacted 25
Exhibit C. List of Acronyms
ARP Act American Rescue Plan Act
CARES Act Coronavirus Aid, Relief, and Economic Security Act
CFO Chief Financial Officer
COVID-19 Coronavirus Disease 2019
CRRSA Act Coronavirus Response and Relief Supplemental
Appropriations Act
DOT Department of Transportation
ECHO Electronic Clearing House Operation
FAQ Frequently Asked Questions
FMO Financial Management Oversight
FTA Federal Transit Administration
FTE Full-time equivalent
GAO Government Accountability Office
OA Operating Administration
OIG Office of Inspector General
OMB Office of Management and Budget
SOP Standard Operating Procedure
TR/SMR Triennial Reviews and State Management Reviews
U.S.C. United States Code
Exhibit C. List of Acronyms 26
Exhibit D. Major Contributors to This Report
TIFFANY MOSTERT PROGRAM DIRECTOR
LUKE BRENNAN PROJECT MANAGER
BRIAN CWERENZ SENIOR ANALYST
P. DAVID MCBRIDE SENIOR ANALYST
MORGAN MZHEN ANALYST
CELESTE VERCHOTA ATTORNEY ADVISOR
JANE LUSAKA SENIOR WRITER-EDITOR
Exhibit D. Major Contributors to This Report 27
Appendix. Agency Comments
Memorandum
U.S. Department
of Transportation
Federal Transit
Administration
Subject: INFORMATION: Management Response – Office of Inspector Date: September 29, 2022
General (OIG) Draft Report – FTA Can Enhance Its Controls To
Mitigate COVID-19 Relief Funding Risks Reply to
Attn. of: Chris Paul
From:
Nuria Fernandez (202) 366-6076
Administrator
Federal Transit Administration
To: David Pouliott
Assistant Inspector General for Surface Transportation Audits
The Federal Transit Administration (FTA) is committed to safeguarding the funding made available to
help U.S. transit systems mitigate the impacts of the Coronavirus Disease 2019 (COVID-19). As of
August 31, 2022, FTA has obligated: 99 percent of the $25 Billion (in 916 awards) in Coronavirus Aid,
Relief, and Economic Security (CARES) Act funds; 94 percent of the $14 Billion (394 Awards) in
Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) funds; and 88 percent
of the $30.5 Billion (662 awards) in American Rescue Plan (ARP) Act funds for COVID-19 response.
To ensure a strong control environment that addresses risk and supports the timely administration of
awards, FTA developed and disseminated extensive guidance to transit agencies and FTA staff on how
to comply with Federal requirements for CARES, CRRSAA, and ARP funds. FTA’s actions included:
• Industry Outreach: Distributed grant-making toolkits to transit agencies after each COVID-19
funding appropriation; shared information on how to use transit assets to increase access to essential
services like food, medicine, COVID-19 testing, and COVID-19 vaccines; provided multiple
webinars for each appropriation; and responded to over 100 Frequently Asked Questions.
• Focused Oversight:
o Developed and implemented the Fiscal Year (FY) 2021 COVID-19 Supplemental
Oversight Manual for Triennial Reviews and State Management Reviews to provide
specific guidance to contractors performing reviews which addressed COVID-19 funding
flexibilities, including the elimination of local match requirements, and the expansion of
eligible expenses, including the eligibility of large, urbanized areas to charge operating
expenses for the first time.
o Conducted payment accuracy testing in accordance with Office of Management and Budget
Circular A-123 requirements to determine an estimated amount of COVID-19 improper
payments. The results of FTA’s review along with specific mitigation plans, if applicable, will
be included in the Department’s FY 2022 payment accuracy reports.
• Accelerated Staffing: Hired personnel to fill 50 positions between FY 2020 and FY 2021 that
enabled FTA to efficiently administer COVID-19 supplemental funds provided under CARES,
Appendix. Agency Comments 28
CRRSAA, and ARP appropriations to support the transit industry and to provide critical
assistance to grantees.
Based on our review of the draft report, we concur with OIG’s two recommendations as written. We
plan to complete actions to implement recommendation 1 by December 31, 2023, and recommendation
2 by December 31, 2022.
We appreciate the opportunity to review the OIG draft report. Please contact Chris Paul, FTA’s Audit
Liaison Program Manager, at (202) 366-6076 with any questions.
Appendix. Agency Comments 29
https://www.oig.dot.gov/hotline
hotline@oig.dot.gov
(800) 424-9071
OUR MISSION
OIG enhances DOT’s programs and
operations by conducting objective
investigations and audits on behalf
of the American public.
1200 New Jersey Ave SE
Washington, DC 20590
www.oig.dot.gov
File and source
- File
- fta-can-enhance-its-controls-to-mitigate-covid-19-relief-funding-risks.pdf
- Size
- 957,269 bytes
- SHA-256
- 89793c1f272eb4ceaaa4d3739830aed8bc8e40fa3496c55053a40fde0c0132fc
- Original
- www.oig.dot.gov