Since March 2020, Congress has provided $69.5 billion in supplemental funding to the Federal Transit Administration (FTA) to help transit systems in the United States mitigate the impacts of the Coronavirus Disease 2019 (COVID-19) pandemic. As of August 1, 2022, FTA had obligated over $63 billion and expended over $46 billion. In addition to increased funding, the Coronavirus Aid, Relief, and Economic Security (CARES), Coronavirus Response and Relief Supplemental Appropriations (CRRSA), and American Rescue Plan (ARP) Acts permitted changes in how recipients use FTA funds. Accordingly, our audit objective was to assess the design of FTA’s controls to address risks FTA has identified for COVID-19 relief funding.
What We Found
FTA’s 2021 Internal Control Plan identified 16 risks and mitigation strategies related to its COVID-19 relief funds, 12 of which FTA currently considers to be risks. We determined that FTA’s controls fully address 8 of these 12 identified remaining risks, because they are relevant and sufficient in scope and specificity to mitigate the related risk, and partially address 4 of the 12 remaining risks. For the four risks that Agency officials indicated no longer applied, we found that FTA’s controls partially address two risks and do not address two. We included our assessment of these areas should FTA management determine the risks are applicable at a future time. Adding controls for those risk areas that are not fully addressed will help the Agency mitigate the potential impact of the risks facing its COVID-19 relief funding.
FTA concurred with our two recommendations to improve controls for addressing COVID-19 funding risks. We consider all recommendations resolved but open pending completion of the planned actions.
No. 1 to FTA
Design or redesign control activities for the four risks that have not been fully addressed and that FTA still deems as applicable. These are: a.) Risk of Fraud or Abuse, b.) Recipients May Attempt to Use Funding for a Non-Operating Expense Even Though They Have Furloughed Staff, c.) Private Sector Operators Are Now Eligible to Become Sub-recipients and d.) Limited Capacity of Current Oversight Contracts.
Closed on 05.11.2023
No. 2 to FTA
Document the determination that four of the risk areas in the August 2021 Internal Control Plan are no longer risks; therefore, additional controls are not necessary. These are: a. Pace/Speed of Obligations and Disbursements, b. Guidance and Instructions Related to the Use of COVID-19-Relief Funding, c. Risks Between Programs and d. Notification for Large Drawdown Requests.