Audit: Atlanta’s gas card controls lax


Digging Deep

The Atlanta Journal-Constitution acquired and dug into an internal city audit of the Public Works department that showed rampant risk of theft or other misuse of city fuel. Over the past 15 months the newspaper has also investigated absenteeism in Public Works and its failure to repair the city’s unsafe, crumbling sidewalks, which have cost the city millions of dollars in legal settlements.

More than $320,000 worth of fuel may be stolen from the city of Atlanta each year because of lax oversight of the fuel stations and fuel cards that employees use to fill up city vehicles.

That’s according to an audit obtained by The Atlanta Journal-Constitution that criticized the Department of Public Works’ controls to prevent or detect misuse of fuel.

The audit cited security issues at the city’s 10 fuel stations, shoddy record-keeping and misuse of employee IDs.

Most government or corporate fleet have some amount of bleed-off, the report noted, but it added the city’s rate of fuel that goes unaccounted for could be higher than 3 percent, a typical figure cited in studies.

“Given the weak control environment, it is likely that the city is experiencing a higher percentage of fuel loss due to theft,” according to the audit.

The audit found glaring security gaps in a system run by the Office of Fleet Services, part of the Public Works department. The department says it has tightened up its practices — including limiting the fill-up to the number of gallons listed as the vehicle’s fuel tank capacity — since the auditors uncovered the problems.

Dexter White, deputy commissioner of Public Works, said only police officers are now allowed to fuel up more than once in a 24-hour period, under recent policy changes. The department plans to ask for closed-circuit cameras at stations and radio-frequency identifiers for vehicles in the upcoming budget cycle. That technology could cost more than $2.5 million.

“We have a high risk of misuse of fuel happening,” White said in an interview. “What’s more important is that you follow up on the findings. For the department, it will be a high priority because we want to eliminate any risk we have.”

The Office of Fleet Services tested radio frequency vehicle identification technology last year, but decided it was too costly. Attaching an “RFID” tag to a vehicle can automatically identify the vehicle and transmit the odometer reading. That would prevent a private vehicle, for example, from being refueled with city gas.

About 600 police vehicles already have the devices. The auditors estimated that equipping the city’s remaining 2,540 vehicles would cost about $545,000, but yield $320,000 in annual savings. At those rates, the technology could pay for itself in less than two years.

Asked if any employees have been or will be disciplined, White demurred.

“I don’t know if I could pin the blame on anyone,” he said. He said the software used to track fuel use was purchased 12 years ago, before most of the department’s current leadership arrived.

The report detailed a range of potential breakdowns in the system. Users could fuel vehicles other than the one designated by the card and could enter an erroneous user ID or an inaccurate odometer reading. The system apparently had no mechanism to detect if a user was in the wrong vehicle.

In theory, vehicles would have been allowed to gas up as many as 99 times per day, although it is not clear if this ever occurred. In one case, $66,500 in fuel was dispensed using a retired employee’s ID card, which the city apparently had issued to another employee without changing the cardholder information.

The auditors identified more than 3,600 user IDs in FuelFocus, a software program used by the city, that did not match the list of current employees. That means the city had lost track of whether the IDs were being used by the right people. How many people had cards who should not have had them remains unknown.

“These control weaknesses increase the risk of unauthorized access to fuel,” the report stated. The Fleet Services office told the auditors it had obtained a master list of all active employees and has updated employee names and user IDs, with plans to review and update the list every month.

Richard Mendoza, commissioner of Public Works, told Channel 2 Action News that there is no evidence the 3,600 user IDs were being used by non-city employees.

Users at the fuel pumps could — and based on available video footage, did — type in IDs not assigned to them when dispensing fuel. Or, they fueled a vehicle other than the one associated with the assigned fuel key. That was possible because the system lacked any additional control — an electronic signature attached to the vehicle, for example — to check which vehicle was at the pump.

The city’s Office of Fleet Services dispensed 7.4 million gallons of fuel to city departments between March 2010 and June 2012, totaling $22.9 million.

The group operates 60 pumps at the 10 locations throughout the city. A variety of city employees have access to them, including police officers and crews from the parks, watershed management and public works departments.

As the auditors dug into the issue, the Department of Public Works was not able to provide video coverage of all the time periods the auditors requested, either because cameras were not working or because the footage could not be retrieved.