Background

The U.S. Postal Service Office of Inspector General (OIG) uses data analytics to identify financial anomalies. Tripwires are analytic tools that look at specific behaviors and patterns that are strong indicators of improper activity. The Voyager credit card tripwire identified purchases made outside of OIG-defined normal workhours (7 a.m. – 5 p.m.) and exceeding Long Life Vehicle (LLV) and Ford Windstar tank capacities at the LAX Los Feliz Station, CA. These types of purchases are considered suspicious and could indicate ineffective internal controls or fraud.

Every Postal Service-owned vehicle is assigned a Voyager card and every driver receives a personal identification number (PIN). The card is used to pay for fuel, oil, and routine vehicle maintenance. Site managers are responsible for verifying Voyager card transactions and all supporting documentation.

The objectives of this audit were to review the validity of transactions outside of normal workhours and over the LLV and Ford Windstar fuel tank capacities and assess internal controls over the Voyager card purchases at the LAX Los Feliz Station.

What the OIG Found

The OIG tripwire identified 112 of 570 transactions (20 percent) valued at $6,345 were made outside of normal workhours. We found the site delivered mail and Amazon products to customers and other post offices from 1 a.m. to 11 p.m. from November 2015 to January 2016; therefore, we considered these transactions valid fuel purchases.

Additionally, the Voyager credit card tripwire identified 114 of 570 transactions (20 percent) where the amount of fuel purchased exceeded the LLV and Ford Windstar tank capacities. Reviewing Voyager card transaction supporting documentation, we verified 111 of 570 transactions exceeded the tank capacities by at least 1 gallon. The total value of the excess fuel was $2,543.06. The site manager did not exercise due diligence completing the required monthly Voyager card reconciliation. Specifically, he did not review receipts for allowable gallons and question overcapacity transactions. We referred the information to the OIG’s Office of Investigations for further review.

Also, we determined controls over Voyager card transactions needed improvement. The site manager did not:

• Require receipts or other documentation to explain missing receipts. In evaluating missing receipts, we reviewed 165 of the 570 total transactions and identified 37 transactions, valued at $2,203.24, that were missing receipts or the required supporting documentation to explain the missing receipts.

• Actively monitor driver PINs. We identified 58 transactions made by employees using PINs not assigned to them. We also referred this information to the OIG’s Office of Investigations for further review.

When internal controls are not in place and functioning, Voyager card holders may misuse the card to make unauthorized or improper purchases. Further, the practice of sharing PINs inhibits accountability of purchases by driver, making it more difficult for site managers or their designees to identify unauthorized use.

As a result of the audit, management agreed to stop the practice of sharing PINs. In addition, the site manager contacted U.S. Bank to deactivate shared PINs. As of May 16, 2016, U.S. Bank confirmed the deactivations and provided an updated PIN list.

What the OIG Recommended

We recommended management establish controls to ensure the Voyager card policy for monthly reconciliation high-risk transactions, missing receipts, and PIN security are followed.