Final Report: TIME AND ATTENDANCE Agencies Generally Compiled Data on Misconduct, and Reported Using Various Internal Controls for Monitoring

Misconduct is generally considered an action by an employee that impedes the efficiency of the agency's service or mission. Fraud involves obtaining something of value through willful misrepresentation. In 2018, the Government Accountability Office (GAO) reported that, on average, less than 1 percent of the federal workforce is formally disciplined for misconduct—of which time and attendance misconduct is a subcomponent. Misconduct hinders an agency's efforts to achieve its mission, and fraud poses a significant risk to the integrity of federal programs and erodes public trust in government. The GAO was asked to review agencies' efforts to prevent and address time and attendance misconduct, including fraud. This report describes what is known about the extent of time and attendance misconduct and potential fraud across the 24 Chief Financial Officers Act (CFO) agencies, and the controls and technologies agencies reported using to monitor employee time and attendance. Twenty-two of the 24 CFO Act agencies compiled data on instances of time and attendance misconduct and potential fraud from fiscal years 2015 through 2019. However, the agencies tracked data differently, and the data could not be aggregated across the 22 agencies. The remaining two agencies reported that they did not compile misconduct data agency-wide but began using systems to collect this data in fiscal year 2020. The Inspector General (IG) for each agency reported that they substantiated five or fewer allegations of time and attendance misconduct or fraud over the 5-year period. In total, the IGs substantiated 100 allegations, ranging from zero substantiated allegations at six agencies to more than 10 at four agencies. The IGs stated that they may not investigate allegations for several reasons, including resource constraints or limited financial impact. Agencies reported using various internal controls, including technologies, to monitor time and attendance, which can also prevent and detect misconduct. First-line supervisors have primary responsibility for monitoring employee time and attendance. Additional internal controls include policies, procedures, guidance, and training. Agencies also reported using controls built into their timekeeping system to provide reasonable assurance that time and attendance information is recorded and accurate. Agencies and IGs reported using a mix of technologies to assess allegations of time and attendance misconduct, such as badge-in and -out data, video surveillance, network login information, and government-issued routers. However, agency and IG officials stated that these technologies have limitations, such as not accounting for when an employee is in training or at an off-site meeting. The GAO collected misconduct data from the 24 CFO Act agencies and their IGs. The GAO also obtained information on fraud risk reported by agencies but did not independently assess agencies' fraud risk. Using a semi-structured questionnaire, the GAO obtained information on controls and technologies agencies reported using to monitor time and attendance and any challenges associated with their use. The GAO found that most CFO Act agencies compiled time and attendance misconduct data, and most of their IGs reported few substantiated allegations. Most agencies reported using various internal controls, including technologies, to monitor time and attendance. However, agencies and IGs reported that these technologies have limitations, and technology alone cannot prevent or detect fraud. The GAO recommends that agencies continue to monitor and assess their internal controls and technologies used to prevent and detect time and attendance misconduct. Agencies should also consider implementing additional controls and technologies to address the limitations of existing ones.