Lack of adequate controls left the EPA’s leave bank “vulnerable to fraud, waste and misuse,” an IG audit has found.

As at other agencies, employees who contribute annual leave into the bank can request withdrawals if they experience a medical emergency and exhaust their annual and sick leave. As of mid-2016, the bank held about 250,000 hours–worth about $10.8 million.

The IG found the agency did not routinely: assess and verify medical certifications to approve an application and determine how many hours should be provided; monitor the bank balance or the bank’s solvency; or assess whether adjustments were needed to the maximum number of hours that employees could use, or to the minimum number of hours an employee was required to contribute annually.

Further, it said, the EPA did not: have procedures to administer the bank and govern the actions of the leave bank board; prevent employees from entering more than the leave bank hours allowed; or adequately safeguard employee information.

The report said that management is taking actions that meet the intent of the IG’s recommendations.