What OIG Notices First in Timekeeping Records

You don't need a villain for a timekeeping problem to become an OIG problem.

You need a rushed month. A supervisor covering two vacancies. A staff member who plans to fix the record later. A total that looks close enough. Shame does the rest.

When records are messy, people hide. They postpone corrections. They fill in blanks from memory. They change a line without writing down why. Not because they're criminal masterminds. Because they're embarrassed, tired, and trying to keep the program moving.

The AmeriCorps Office of Inspector General's Anti-Fraud Advisory Vol. 2: What is Timekeeping Fraud describes three patterns the OIG is watching for: intentionally charging time to an AmeriCorps grant that is knowingly false or incorrect, reckless disregard for timekeeping laws, rules, and regulations, and staff modifying volunteer time records without any basis or authorization. The advisory also says that 30% of OIG investigation cases opened since 2019 related to allegations of false or problematic timekeeping.

That's not niche.

It's management.

And if you're the person holding the grant together, the useful question isn't, "How do I catch a fraudster?"

It's, "What control keeps an ordinary bad month from becoming a false record?"

Sloppy systems create the cover that intentional misconduct needs.

Start with the baseline rule. For compensation charged to a federal award, 2 CFR § 200.430(i) requires records that accurately reflect the work performed; are supported by internal controls providing reasonable assurance that charges are accurate, allowable, and properly allocated; are incorporated into official records; and reasonably reflect the employee's total activity, including federally assisted and other activities. AmeriCorps State and National programs must also follow applicable program-specific requirements in 45 CFR part 2520 and 45 CFR part 2522, along with the terms of the particular award. Those parts address program and member requirements. The core federal personnel-cost documentation rule is still 2 CFR § 200.430(i). Check your own award, and verify against the current eCFR text before you revise a form or process.

Pattern one: knowingly false or incorrect charges

This is the one people picture first.

Someone charges time to the AmeriCorps grant that they know isn't true.

The OIG names it directly in the advisory. You don't need a dramatic scheme for this to happen. You need a record that can be filled out after memory has faded, without a specific review against actual work performed.

The control that matters most is contemporaneous accountability.

Not theater.

Not a signature at the bottom of the month.

A record created close enough to the work that the person entering time is documenting what happened, not reconstructing what ought to have happened.

Here's what that looks like in practice.

Control set for pattern one

1. Set the reporting period in advance. Decide whether staff and members report daily, weekly, or by another fixed interval allowed by your system and award terms. Write it down. Use the same interval every period.

2. Require entry close to the work performed. Daily entry or entry within a short, defined window is a common internal-control practice. The regulation doesn't prescribe one universal daily deadline for every situation, so if your practice varies, say so in policy and confirm it fits your award terms.

3. Use activity lines that match real work. If your categories are vague, people guess. If your categories mirror actual grant-funded activities, cost share activities, leave, and non-grant work, people can choose accurately.

4. Use documented confirmation by the person who performed the work or service when your rules call for it. Your award, program rules, or internal procedure may require a certification, signature, or electronic attestation. Even where a signature isn't specifically required, the record still has to meet the documentation standards in 2 CFR § 200.430(i).

5. Assign review to someone who can assess the record meaningfully. As an internal-control practice, the reviewer should know enough about the work, assignments, or supporting information to tell whether the record is plausible and coded correctly. Follow any more specific review requirements in your award or policy.

6. Document corrections in a visible, retained way. This is a strong internal-control practice, not a universal format required by 2 CFR § 200.430(i). If a correction is needed, keep the original entry or other retained correction record, plus the date of the change, who made it, and why.

7. Separate correction from approval when possible. If one person can enter, edit, and approve the same record without review, you're depending on trust alone.

What breaks this control?

Backdating.

Pre-populating full schedules and calling them actual time.

Approving from memory.

Treating certification as a formality.

None of that proves fraud by itself. But all of it creates the condition where knowingly false charging can sit in plain view.

Pattern two: reckless disregard for timekeeping rules

This pattern feels less dramatic. It should worry you more.

Because reckless disregard grows in offices full of good people.

The OIG's advisory includes reckless disregard for timekeeping laws, rules, and regulations as timekeeping fraud. That's a high-stakes reminder that "we were overwhelmed" doesn't fix a record that wasn't maintained with care.

You don't protect your team by pretending the rules are obvious.

You protect them by making the right action the easy action.

The control that matters most here is clarity before discretion.

If staff have to improvise the rules, your system is already failing them.

Control set for pattern two

Risk point	Preventive control	What to check monthly
People don't know what counts as grant time	Written timekeeping instructions tied to actual roles and activities	Ask one employee and one supervisor to explain the categories without prompts
Deadlines slide until everyone reconstructs time later	Fixed due dates and fixed approval dates for every period	Compare submission dates to the posted schedule
Review happens without enough attention	Reviewer checklist with 3-5 specific questions	Spot-check whether the checklist was completed, not assumed
Corrections happen informally	Written correction procedure with reason required	Review all edited records in the period
Different sites do it different ways	One organization-wide standard, with documented exceptions only where necessary	Confirm all locations used the same form and instructions, or that approved exceptions were documented

Now make it procedural.

Start with a one-page policy.

Not ten pages nobody reads.

One page that answers these questions in order:

• Who completes the record.
• When it must be completed.
• What categories to use.
• Who reviews it.
• When approval is due.
• How corrections are made.
• What documentation must be kept with the record, if any.
• Where the final record is stored.

Then train to the policy.

Not once at orientation and never again.

Train when someone changes roles. Train when forms change. Train when you see the same mistake twice.

Then test the policy.

Pick five records from last month.

For each one, ask:

• Was it entered on time under your policy?
• Was any required certification or confirmation completed?
• Was it reviewed the way your procedure requires?
• Were any corrections documented clearly enough that another reviewer could follow them later?
• If activity crossed funding sources or functions, was the allocation understandable from the record?

If you can't answer yes with confidence, don't hide the folder and hope for a better sample next month.

That's shame talking.

Write down the gap. Fix the process. Move forward.

Pattern three: staff modifying volunteer time records without basis or authorization

This one is painfully specific.

And that's why it matters.

The OIG advisory identifies staff modifying volunteer time records without any basis or authorization as a form of timekeeping fraud.

Notice what makes the problem plain.

No basis.

No authorization.

That means your control has to answer two separate questions every time a volunteer record changes:

1. Why was this changed?
2. Who had authority to make or approve that change?

The control that matters most here is change transparency.

If a volunteer time record can be adjusted quietly because a total "looked off" or a staff person thought they knew what the volunteer meant, your process is unsafe.

Control set for pattern three

1. Define who owns the original volunteer record. Decide whether the volunteer completes it, certifies it, or confirms it in another documented way consistent with your process.

2. Define who may request a correction. Usually that should be the volunteer, or a staff reviewer returning the record for clarification rather than making the change alone.

3. Define who may enter the correction. If staff enter corrections on behalf of a volunteer, the record should show the basis for the change and the volunteer's authorization or confirmation, according to your procedure and any applicable award requirements.

4. Require a reason for every change. "Math correction," "date transposed," or "activity reclassified after review" is better than silence. Specific beats vague.

5. Retain the history. Keep the original entry, the changed entry, who changed it, when, and the authorization or basis supporting it, or keep another retained correction record that shows the same information.

6. Review edited volunteer records separately. Don't bury them in the full batch. A short monthly edited-records review catches patterns early.

This is where many teams get into trouble while trying to be helpful.

A staff person sees an incomplete volunteer record and fixes it to keep the file moving.

A coordinator rounds time because the total seems more plausible.

Someone updates several entries before a deadline because they "know what the volunteer meant."

Those practices are risky when they lack a documented basis and appropriate authorization. A legitimate correction should be supported and handled under your documented procedure and any applicable award requirements.

The control map that keeps a sloppy month from becoming a false record

You don't need twenty new forms.

You need three guardrails that match the three patterns.

OIG pattern	Primary control	Minimum proof the control worked
Knowingly false or incorrect charging	Contemporaneous entry and meaningful review	Entry timing records, required certification or confirmation if applicable, and evidence the review occurred under policy
Reckless disregard for rules	Clear written process and recurring review	Current policy, evidence of training, and documented spot checks
Unauthorized modification of volunteer records	Visible correction record and documented authorization	Record of what changed, why it changed, and who authorized it

That's the strategy.

Make records timely.

Make expectations clear.

Make changes visible.

What to do this month

If your stomach dropped while reading this, start small.

Do these five things in order.

1. Pull one pay period or one service period. Don't audit the whole year first.

2. Identify every edited record in that period. If your system doesn't show edits clearly, determine whether you have another retained correction record that identifies the change, its basis, and approval. If not, treat that as a control gap.

3. Read your current written process against the actual record. Not the process you think people follow. The one the paper proves.

4. Ask two people where they get confused. One preparer. One approver. Confusion is a control finding, not a character flaw.

5. Rewrite one step before the next cycle begins. Tighten due dates. Add a correction reason field. Add a reviewer prompt. Pick one.

Then repeat next month.

This work is unglamorous.

It is also protective.

For your staff.

For your members and volunteers.

For you.

And for the federal record that may someday be read by someone who wasn't in the room when the month went sideways.

When that day comes, what helps most isn't your intention.

It's a record that shows what happened, who knew it, and why any change was made.

That's what trust looks like on paper.