Federal agencies can either distribute transit benefits directly to  employees, enter into an interagency agreement with another agency,  such as DOT, or contract with a private company for distribution. DOT’s  transit benefit program is administered by TRANServe, located within the  Office of the Assistant Secretary for Administration. The phrase “internal control” does not refer to a single event, but rather a  series of actions and activities that occur throughout an entity’s  operations on an ongoing basis and that serve as the first line of defense  in safeguarding assets and preventing and detecting errors and fraud.Moreover, internal controls should be designed to provide reasonable  assurance that unauthorized acquisition, use, or disposition of an entity’s  assets will be promptly detected. DOT Has Established Multiple Internal Control Activities Designed to Prevent Non-Transit-Related Purchases

DOT’s TRANServe debit-card program includes activities that correspond  to the five internal control standards—(1) control environment, (2) risk  assessment, (3) control activities, (4) monitoring, and (5) information and  communication. In combination, these activities would be expected to  provide reasonable assurance that non-transit-related purchases can be  identified and denied. Based on our review of the design of TRANServe’s  internal controls for the TRANServe debit-card program, we found that  those internal controls align with GAO’s Standards for Internal Control in  the Federal Government. TRANServe has established a control  environment framework for the debit-card program through the following:
A primary goal for the debit-card program: TRANServe has set a  primary goal for the debit-card program of offering enhanced internal  controls to preserve transit benefits by deterring waste, fraud, and  abuse. Internal controls officer: According to the program’s policy and  guidance, the internal controls officer is responsible for examining  current internal control activities and, identifying potential program  vulnerabilities, through testing of controls related to the debit card. These SOPs include:
Conducting debit card transaction data mining:provides the guidelines for weekly data mining, which includes  reviews of debit card transactions to identify potential misuse or  irregular activity, such as the purchase of non-transit items. Potential  misuse, among other things, may involve retail merchants, or  irregular transaction amounts. Inherent features of the debit card: According to TRANServe officials,  ensuring that transit beneficiaries do not make non-transit-related  purchases is an inherent feature in the design of the debit card  TRANServe has implemented through Treasury and J.P. Morgan. The  debit card is designed so that it can only be used to purchase transit  fare media through transit providers that are identified through a  limited list of MCCs approved by DOT. Sending anomaly letters: As previously described, TRANServe has  established a process for sending debit-card anomaly letters to client  agencies when consumer purchases are detected through the data  mining process. TRANServe Collaborated with IRS to Demonstrate That Its Debit Card Met Requirements for Qualifying as a Fringe Benefit

TRANServe worked with IRS to demonstrate that its debit-card program  was in compliance with relevant statutes, Treasury regulations, and IRS  administrative rules—specifically that the debit card qualified as a “transit  pass” as defined in section 132(f)—for the purposes of qualifying as a  transportation fringe benefit and being excludable from gross income. According to IRS, TRANServe demonstrated that the debit card was a  “transit pass” because the card restrictions effectively permit recipients of  the cards to use them only to purchase fare media on mass transit   In May 2011, TRANServe first tested the use of a debit card  systems. From 2011  to 2013, TRANServe implemented its field test, which included:  researching the transit usage in the region,  identifying target areas where the transit authorities are located,  selecting point-of-sale locations where transit media are sold and as  well as non-transit-related sales locations, distributing debit cards that already contained the MCC restrictions to  testers,  sending testers to the predetermined sales locations to purchase  either transit fare media or non-transit-related items, assigning some testers to make debit-card purchases on-line or via  telephone depending on the number of ways transit media were sold,  and  contacting J. P. Morgan to obtain transaction records during the field  testing phase. Once IRS was satisfied with the final results in a service area, IRS sent  TRANServe an email correspondence to confirm its understanding of the  test results and that based on such test results, the debit card constitutes  a transit pass and qualifies as a transportation fringe benefit. TRANServe  substantially completed the roll out of the debit-card program by the end  of fiscal year 2014. Agency Comments

We provided a draft of this report to the Department of Transportation and  Internal Revenue Service for review and comment. DOT and IRS  provided technical comments, which we incorporated, as appropriate.
Why GAO Did This Study

In 1992, Congress created a transportation fringe benefit that allowed public and private employers to offer employees transit benefits, excludable from gross income, to cover out-of-pocket public transportation commuting costs. Federal agencies may distribute these transit benefits directly or enter into an agreement with another agency, such as DOT, to distribute the benefits on a fee-for-service basis. In 2011, DOT's TRANServe began using debit cards to distribute transit benefits. IRS has established rules to help employers ensure their debit card programs qualify as allowable fringe benefits. Members of Congress have questioned whether the debit card restrictions prevent non-transit-related purchases and whether DOT's program complied with IRS rules.
This report describes the extent to which DOT has (1) designed internal controls to provide reasonable assurance that employees do not use the debit card to make non-transit-related purchases and (2) worked with IRS to ensure its debit card program complies with IRS's rules. GAO reviewed the design of TRANServe's internal control system for preventing non-transit purchases, but testing the system was not within the scope of the work; compared federal standards and TRANServe's practices; reviewed IRS rules on fringe benefits; and obtained TRANServe documentation of the steps taken to demonstrate that its debit card complied with the rules.
GAO is not making recommendations in this report. DOT and IRS provided technical comments that were incorporated as appropriate.

What GAO Found

The Department of Transportation's (DOT) Office of Transportation Services (TRANServe) has included multiple internal control activities in the design of the TRANServe debit card program. These controls are intended to prevent federal employees from using their debit card for non-transit-related purchases, and as designed, would be expected to provide reasonable assurance that non-transit-related purchases can be identified and denied. The phrase “internal control” does not refer to a single event, but rather a series of actions that occur throughout an entity's operations on an ongoing basis for safeguarding assets and preventing and detecting errors and fraud. DOT provided evidence that the design of its TRANServe debit card program aligns with each of the five internal control standards as identified in GAO's Standards for Internal Control in the Federal Government and as described below.
Control environment : DOT has established a control environment framework for the TRANServe debit card program by, among other things, setting the program's primary goal as enhancing internal controls to deter waste, fraud, and abuse of transit benefits.
Risk assessment : DOT established the position of internal controls officer, in 2007, to examine control activities and identify potential program vulnerabilities through the testing of debit card controls.
Control activities : TRANServe has established mechanisms for controlling the use of the debit card. For example, the debit card is restricted so it can only be used to purchase transit fare from transit providers that are identified by merchant category codes that have been approved by DOT. The codes are used to classify a business by type of goods or services it provides.
Monitoring : TRANServe conducts weekly data mining, which includes reviewing debit card transactions to identify potential misuse and irregularities.
Information and communication . TRANServe sends “anomaly letters” (letters detailing potential misuse of the debit card) to agencies when non-transit purchases are detected.
TRANServe worked with the Internal Revenue Service (IRS) to demonstrate that the debit card program is in compliance with IRS's rules for qualified transportation fringe benefits and that in particular, it was a transit pass and effectively prevented non-transit-related purchases. From 2011 to 2013, TRANServe staff tested the debit card with transit agencies in eight areas across the country, making dozens of purchases of both transit-related and consumer-related products. In most cases the purchase restriction succeeded in preventing the debit card from purchasing non-transit-related products. In the few cases where the restriction failed, TRANServe took steps to have additional restrictions placed on the debit cards. Once it completed the tests in each region, TRANServe sent the test results to IRS, and once IRS was satisfied with the final results, IRS officials sent DOT an e-mail confirming that the debit card qualified as a transportation fringe benefit in that area. TRANServe then completed the roll out of the debit card program by the end of fiscal year 2014.