FEDERAL TRADE COMMISSION
Office of Inspector General
MANAGEMENT ADVISORY
Lack of Controls Over Federal Express Shipping Account
MA-11-16
2
July 27, 2011
To: Eileen Harrington, Executive Director
From: John M. Seeba, Inspector General
Subject: Management Advisory on Lack of Controls over Federal Express Shipping Account
As part of an investigation related to abuse of a Government purchase card, the Office of
Inspector General (OIG) has identified contractor and FTC employees abusing the FTC’s Federal
Express (FedEx) Shipping Account. The OIG first notified agency management of FedEx
Shipping Account abuses in 2005 following criminal prosecution of an FTC attorney who
misused the agency’s shipping account for years and incurred several thousand dollars in
shipping costs for personal use. As noted in our 2005 investigative alert issued to management
(see “Weak Internal Controls Over Use of Federal Express Mail Services”), the FTC had not
established sufficient controls to prevent abuse of the FedEx Shipping Account. Since that
report, the FTC has not implemented any additional controls to prevent or minimize abuse of the
FedEx Shipping Account. While the cost of individual shipments using FedEx is generally low,
the FTC has spent $335,000 for over 31,000 shipments during the past two calendar years (2009
- 2010). Because FedEx is a low cost service (per transaction) and the cost to implement controls
was thought to be significant, the FTC has essentially relied on the honesty and integrity of
contractors and employees to refrain from misuse of the FedEx shipping account. Since nearly
anyone in the agency can send a letter or package by FedEx at their discretion, a system of
controls needs to be implemented to deter and prevent further abuse of the service.
Analysis of the evidence in the recent purchase card abuse case confirms the
longstanding need for immediate and effective internal controls over the agency’s FedEx
shipping account. Had the agency implemented the recommended controls following our 2005
management alert, the recent abuse of the Government purchase card may have been deterred or
at the very least would have been detected much earlier, potentially saving the agency from
significant financial losses (more than $217,000 in unauthorized purchases using the purchase
card) in addition to intangible losses (e.g. disruption to agency operations, public goodwill, etc.)
The former employee abused the purchase card for 18 months before two vendor errors drew
management’s attention to his misconduct on December 7, 2010. The former employee also
informed the IG that he used the FedEx account to avoid detection by the FTC security guards.
(The use of FedEx allowed him to ship goods out of the building without detection.) Therefore,
the lack of internal controls in this area at the very least fostered an environment that allowed the
illegal activity to continue. Internal control serves as the first line of defense in safeguarding
assets and preventing and detecting errors and fraud. Internal controls should be designed to
UNITED STATES OF AMERICA
FEDERAL TRADE COMMISSION
WASHINGTON, D.C. 20580
Office of Inspector General
3
provide reasonable assurance regarding prevention of or prompt detection of unauthorized
acquisition, use or disposition of an agency’s assets.
Background
FedEx shipping services are available to FTC staff to ship letters and packages in an
expedited manner. Agency staff uses the FedEx shipping account to send legal and other official
documents to FTC regional offices, law firms, businesses, litigants and consumers. In addition,
staff uses FedEx for administrative purposes in support of the agency’s overall mission (e.g.,
transmittal of materials in on-going investigations and enforcement actions, to candidates
selected for hire, returning merchandise to vendors, etc.). FedEx is under contract with the U.S.
Government as an alternative to the U.S. Postal Service for expedited shipping (at a discounted
rate). FedEx offers tracking services (showing status of shipment while in transit) and evidence
of shipment delivery at no additional cost.
The procedure for use of the FTC’s FedEx Shipping Account number has remained
unchanged since our 2005 management alert. When a FTC staff member needs to ship an item,
he or she can go to the mailroom and obtain a FedEx preprinted airbill (mailing label) or fill out
a blank airbill from any FedEx drop box or printed from the FedEx website, www.fedex.com.
The preprinted information on the airbill available from the mailroom includes the FTC address
and the FedEx account number. The account number is important as it determines who will pay
for delivery. There are a total of ten FTC FedEx account numbers: one for Headquarters, one for
the New Jersey building and one for each of the eight regional offices.
Before each FedEx package is sent out, the sender generally provides his or her name and
recipient information on the airbill, the type of service requested (i.e., priority, standard, “2
Day,” etc.) and any handling instructions. The only required information is for the recipient
address; the sender information may be generic (“FTC”) or specific (name of individual and FTC
affiliation) depending on what the preparer enters on the airbill. The sender may include an
additional completed airbill and a FedEx envelope inside the FedEx package so that the recipient
can return any documents to the sender without incurring charges. This ensures that the FTC,
rather than the sender, will be billed for the return shipment.
Once the airbill is completed and attached to the package, it can be dropped at any FedEx
mailbox. FedEx drop boxes are located near the mail room in the New Jersey Avenue satellite
building, in the headquarters building garage and on several other floors of each building,
including the regional offices. Parcel pickup occurs at preset times each business day.
FedEx bills the agency weekly for mail services used by FTC staff. Amounts invoiced
for individual transactions depend on the weight of the item mailed and the type of service
requested. As shown in Graph 1, for FY 2009 and 2010:
In the $19.99 or less range, 87% of the transactions (27,662) amounted to 51% of the
total cost ($181,000).
In the $20 to $49.99 range, 11% of the transaction (3,561) amounted to 32% of the total
cost ($108,938).
4
In the $50 or greater range, 2% of the transactions (640) accounted for over 18% of the
cost ($65,711).
Because transactions in the $50 or greater range are generally for high cost, overnight
delivery, the FTC should ensure that high priced delivery options are used judiciously and only
when necessary. Because there are no controls in place to limit selection of this option, we do
not know if these options were necessary and selected in the best interest of the government.
However, a recent memo by the Executive Director has informed staff to be cost conscious in
selecting the most cost effective shipping option.
27,662
$181,083
3,561
$108,938
640
$65,711
0
50,000
100,000
150,000
200,000
$1 to $19.99 $20 to $49.99 $50 to $999.99
Federal Express Shipping Charges for the two year
period of 2009 and 2010
Number of Transactions Total Dollars Paid
Fed Ex sends invoices weekly to the FTC’s Contracting Officer’s Technical
Representative (COTR) in the Administrative Services Office (ASO) and to the FTC’s payment
servicer, the National Business Center (NBC). They are not seen by the sender or his/her
bureau/office supervisor. The COTR completes a receiving report (which authorizes NBC to
pay the outstanding invoice) and sends it to NBC where the invoice is scheduled for payment.
Prior Coverage
As noted earlier, the OIG issued an investigative alert in 2005, “Weak Internal Controls
Over Use of Federal Express Mail Services.” This report found weaknesses in the following
areas:
Finding 1. FTC account numbers for FedEx usage are not controlled. The FTC did
not control the account number that FedEx uses to bill for mail services. Further, the account
number, which has not been changed for several years, is preprinted on airbills supplied to staff
by FTC mailroom personnel. Mailroom personnel told the OIG that these preprinted labels are
given out upon request with no justification or approval required.
As an alternative, staff can simply go online and download airbills and write in the FTC
account number (which is readily available from the widely-distributed FedEx pre-printed
5
airbills). In either scenario, knowing the account number provides the sender with the equivalent
of a credit card for FedEx mailing purposes. Anyone with knowledge of this account number
could use it to send FedEx packages at any time from any location (including shipments that do
not originate in FTC facilities).
Finding 2. Supervisory Approval is not Required to use FedEx. The FTC does not
require supervisory approval before FedEx can be used by agency staff. As a result, staff alone
can make determinations on the best method for delivery of the correspondence or parcel.
Finding 3. FedEx is Centrally Billed Within the FTC and there is no Supervisory
Review of FedEx Invoices. The FTC receives an average of 60 FedEx invoices per month.
Each invoice contains hundreds of individual transactions. Invoices reviewed by the OIG
included the following information:
Sender Name & Address
Recipient Name & Address
Tracking ID
Service Type (e.g., priority service, overnight, etc.)
Drop-Off Location
Signature of Person accepting Delivery
Delivery Date & Time
When the COTR reviews invoices, he identifies egregious transactions based on cost or
shipping weight. Transactions that are less than $50 are usually not questioned. Managers in
ASO told the OIG that requiring supervisory review would be very cumbersome, due to the
number of monthly invoices (60) and the current invoice format. FedEx invoices do not
segregate users by division or organization code. Since the FedEx is paid from a central account,
bureau and office management are unaware of who is using FedEx, for what purposes and to
what extent. Without accountability, there is little incentive to use FedEx efficiently and greater
risk that FedEx services will be abused.
Current Situation
As a result of a recent investigation on purchase card abuse, we found several employees
and contractor personnel using the FedEx shipping account for personal and illegal activities.
Some of the illegal activities were related to the abuse of the purchase card (i.e., theft of
Government property), while others were abusing the Fed Ex shipping account for personal
purposes. As a side note, we also found another Federal agency that had used the FTC account
number for their expedited shipping on a limited basis. We contacted FTC management and the
other agency to correct the errors and prevent a reoccurrence of the mistake.
The recent criminal investigation revealed that the FedEx shipping account abuses remain
ongoing at the agency. That discovery prompted the OIG to review its 2005 investigative alert to
assess whether our recommendations to prevent and deter such abuses were adequate. The OIG
learned that the FTC has done very little to change and improve controls over the FedEx
shipping account since our 2005 recommendations. As a result, there is little assurance that
6
additional abuse is not occurring and because of the volume of transactions, it is difficult to
detect on an individual transaction basis.
As part of our criminal investigation, the OIG contacted Federal Express to obtain access
to a database of all of the FTC’s FedEx shipping transactions for calendar years 2009 and 2010.
We also contacted FedEx’s FTC account representative who, in conjunction with their Integrated
Solutions consultant provided a presentation and explanation of options that the FTC can
implement to establish cost effective controls over the use of FedEx expedited shipping services.
Their presentation focused on several existing FedEx internet based systems that could easily be
accessed and used by the FTC to establish control over the printing and distribution of shipping
labels to FTC staff and enhance the agency’s ability to monitor costs. These internet based
FedEx controls are already in place on FedEx.com and can be tailored to FTC user needs with
minimal effort. The main control feature is to limit access to the printing of FedEx shipping
labels to a select group of individuals such as administrative officers or secretaries. This would
enhance control over the use of shipping labels for several reasons:
1. An individual needing to ship via FedEx would have to go to a designated individual and ask
for a shipping label. The act of having to do this would deter most people from using this
account inappropriately. In addition, the FTC could assign as many staff as needed to have
the ability to print shipping labels. This would provide easy access to those needing
airbills/mailing labels, legible printing on the label and better information for billing
purposes. Pre-populated information would also expedite the label printing process for
frequently used addresses such as regional and headquarter locations. There is no cost
associated with having additional accounts or using the on-line FedEx system. In addition,
less paper would be generated because only a single airbill copy would be needed versus the
current triplicate paper label used by FedEx.
2. Individuals assigned with the responsibility for distributing FedEx shipping labels would
have a unique profile to allow only certain types of shipping services. Services that are lower
in cost would be permitted for all account holders while the use of premium services would
be assigned to a select few individuals that would be authorized to use this service. This has
the potential to lower FedEx costs to the agency and prevent unnecessary and expensive
services from being used excessively or inappropriately.
3. Account numbers would not be printed on the shipping labels but would be associated with
the preprinted label and would not be easily discernable by the individual user. This would
prevent others from creating their own manual labels and misusing the FTC account number.
All that would appear for accounting purposes would be the UPC bar code that FedEx would
scan as it tracks the package in transit.
4. FedEx account transactions could be monitored on-line by supervisors or a FedEx
coordinator on a periodic basis. If costs become a significant concern, they could be more
closely monitored in real-time. Pre-printed labels with the names of individual requestors
would also provide for better accountability. When setting up the system, the FTC can
determine which fields on the online form must be completed, including the name of the FTC
staff member who is associated with the shipment. Designated managers assigned to review
7
FedEx billing would be able to scan a bill or monthly report and more readily determine if a
FedEx shipment was appropriate versus the FedEx coordinator who is somewhat detached
from the offices using the service.
5. When an authorized FTC FedEx online user logs onto the website to print a label, basic
information can be required to be typed onto the online form, including the name of the case
matter or other justification/business project information. Such information would enable the
supervisors and FedEx COTR who monitor FedEx usage to more easily assess legitimate
FedEx shipments as compared to those for personal use.
Summary
The OIG found essentially no controls over the use of FedEx at the front end of FedEx
use (i.e., when the agency employee prepares the airbill for shipment) or after the fact
(supervisory review of FedEx usage) that would eliminate or minimize the opportunity for fraud,
waste and abuse of this program. The 2005 OIG investigative alert and the recent criminal
investigation highlight the ongoing need to establish effective controls over the FedEx shipping
account. The agency should establish effective, yet efficient program controls to provide
assurances that the program is used only for its intended purposes. These vulnerabilities are
commonplace in various organizations and FedEx has created a means for its clientele to prevent
theft of its shipping services. The company has expressed interest in assisting the FTC in
eliminating these abuses by FTC staff and would provide this service at no cost to the agency.
We would also like to commend our Executive Director for issuing a memorandum on
March 21, 2011 that discussed suggestions from staff members on ways to select less expensive
shipping options. This memorandum also provided a shipping guide with associated costs as well
as explained when it is appropriate to use expedited shipping. We believe this is a good start in
creating awareness among the staff on shipping guidelines and alternatives. However, the fact
that all staff still retain the discretion in selecting any shipping option and using it with little to
no oversight leaves the process vulnerable to fraud, waste and abuse. In addition, the agency
faces criticism when contractors or employees abuse agency resources.
Recommendations
The OIG recommends that ASO/FedEx COTR work with the FedEx Integrated Solutions
Consultant to:
1. establish new account numbers for the FTC to prevent potential abuse through use of
hand completed shipping bills
2. establish an internal control process using the FedEx online shipping portal that will
centralize the distribution and printing of labels to a limited number of FTC staff.
3. establish an on-line monitoring system to allow both supervisory and COTR review of
transactions and costs associated with FedEx transactions on a periodic basis.
8
Management Comments
Management concurred in principle with all the findings and recommendations in the report.
Where management did not specifically agree to implement our recommendations, they offered
alternatives that satisfy the intent of the recommendation and result in improved controls over the
FedEx program. We appreciate management’s working with the OIG to establish an effective
internal control process. Management’s complete response in shown in the appendix.
cc: Jon Leibowitz, Chairman
Jon Schroeder, FMO
9
Appendix – Management Comments
10
Appendix – Management Comments (continued)
Appendix – Management Comments (continued)
