Department of Homeland Security 

Office of Inspector General 

Improving FEMA's Disaster Purchase Card Program 
 

OIG-10-91 May 2010 
Office ofInspector General 

u.s. Department of Homeland Security 

Washington, DC 20528 

Homeland 

Security 

MAY 2 7 2010 

Preface 

The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 

established by the Homeland Security Act of2002 (Public Law 107-296) by amendment 

to the Inspector General Act of1978. This is one of a series of audit, inspection, and 

special reports prepared as part of our oversight responsibilities to promote economy, 

efficiency, and effectiveness within the department. 

This report presents the results of the audit of the Federal Emergency Management 

Agency's (FEMA) disaster purchase card program. It is based on interviews with 

employees and officials of relevant agencies and institutions, direct observations, and a 

review of applicable documents. We performed the audit according to generally accepted 

government auditing standards. The report contains four recommendations for improving 

FEMA's disaster purchase card program. 

The recommendations herein have been developed to the best knowledge available to our 

office, and have been discussed in draft with those responsible for implementation. 

Where appropriate, we plan to refer cardholders responsible for improper purchases to 

FEMA management for possible administrative action. We trust this report will result in 

more effective, efficient, and economical operations. We express our appreciation to all 

of those who contributed to the preparation of this report. 

£~C;(.~

Richard L. Skinner 

Inspector General 
Table of Contents/Abbreviations 
 

Executive Summary.............................................................................................................1
 


Background..........................................................................................................................2 
 

Results of Audit ...................................................................................................................5 


 Improving Disaster Purchase Card Guidance.................................................................5 
 

Recommendation ............................................................................................................7 


 Management Comments and OIG Analysis ...................................................................7 


 Strengthening Disaster Purchase Card Internal Controls................................................8 
 

Recommendations.........................................................................................................11

 Management Comments and OIG Analysis .................................................................12 
 

Addressing GSA SmartPay®2 and CCTMS Issues.......................................................12 
 

Recommendation ..........................................................................................................13


 Management Comments and OIG Analysis .................................................................13 
 

Appendixes 

Appendix A: Purpose, Scope, and Methodology.........................................................14 
 

Appendix B: Management Comments to the Draft Report .........................................15 
 

Appendix C: Disaster Purchase Card Process Diagram ..............................................18 
 

Appendix D: FEMA Regional Offices ........................................................................19 
 

Appendix E: Case Studies............................................................................................20 
 

Appendix F: Major Contributors to This Report .........................................................21 
 

Appendix G: Report Distribution.................................................................................22 
 

Abbreviations 

AO Approving Official 
 

CCTMS Credit Card Transaction Management System
 


DHS Department of Homeland Security 
 

DISC Disaster Information Systems Clearinghouse 
 

FEMA Federal Emergency Management Agency 
 

GAO Government Accountability Office 
 

GPS global positioning system 
 

GSA General Services Administration 
 

MCC Merchant Category Codes 
 

OIG Office of Inspector General 
 

SOP Standard Operating Procedure 
 
OIG 
 

Department of Homeland Security 

Office of Inspector General 

Executive Summary 

The Federal Emergency Management Agency has improved its internal 

controls for the disaster purchase card program and addressed a number of 

prior audit recommendations. For example, cardholders have met initial 

purchase card training requirements, the span of control for approving 

officials is reasonable, and the results of monthly postpayment audits are 

being acted upon. However, internal control issues remain, and we 

identified more than $247,100 of improper purchases. 

The Federal Emergency Management Agency can improve its disaster 

purchase card program and related internal controls by: 

�	 

�	 

�	 

�	 

�	 

Consolidating, updating, and more effectively communicating 

policies and procedures; 

Taking better advantage of preventive controls to minimize risk 

exposure; 

Working with the Department of Homeland Security and JP 

Morgan Chase to ensure that states and merchants do not tax 

purchases at the point of sale; 

Establishing a multifaceted, strategic approach to monitoring 

and oversight; and 

Resolving issues with its transition to the General Services 

Administration SmartPay®2 and the Credit Card Transaction 

Management System. 

With proper controls in place, the Federal Emergency Management 

Agency will be in a position to (1) develop a stronger strategy on 

appropriate use and application of disaster purchase cards, and 

(2) maximize efficiencies and potential rebates. 

Improving FEMA’s Disaster Purchase Card Program 


Page 1 

 

Background 

The Federal Emergency Management Agency (FEMA) purchase 

card is a centrally billed government charge card used to pay for 

goods and services in support of official government business. It 

streamlines traditional federal procurement and payment 

processes by eliminating the need for numerous purchase orders 

and payments. When well controlled, it provides FEMA with a 

flexible and efficient way of quickly obtaining commercial goods 

and services through over-the-counter purchases, phone orders, 

mail/catalog orders, and Internet purchases. 

To improve accountability and oversight, FEMA has different 

purchase cards for regular operations and emergency disaster 

response activities. Disaster purchase cards can be used only for 

disaster needs, using disaster funding, and are the preferred 

method to pay for disaster-related micro-purchases.1 Figure 1 is 

an example of a disaster purchase card. 

Figure 1. Disaster Purchase Card 

12345- DISASTER

Source: OIG. 
 

1

 The micro-purchase limit is $3,000, but certain exceptions apply: (1) construction greater than $2,000 

is subject to the Davis-Bacon Act; (2) services greater than $2,500 are subject to the Service Contract 

Act; and (3) under the Stafford Act or emergencies, the Department of Homeland Security’s Chief 

Procurement Officer may authorize heads of the contracting activities to increase the micro-purchase 

thresholds for emergency procurements. 

Improving FEMA’s Disaster Purchase Card Program 

Page 2 
Improving FEMA’s Disaster Purchase Card Program 


Page 3 


The FEMA Organization Program Coordinator, located within 

the FEMA Management Directorate, Acquisition Management 

Division, manages the FEMA disaster purchase card program 

and investigates questionable or inappropriate cardholder 

transactions. Approving Officials (AOs) provide approval, 

validation, oversight, and monitoring of purchase card activity 

within their span of control. Cardholders verify that funds are 

available prior to making each purchase with their card; make 

purchases with their card; notify local property officers of 

acquired accountable property; and reconcile and maintain all 

required transaction documentation. Appendix C illustrates 

FEMA’s business process for carrying out the disaster purchase 

card program. 

Most AOs are located at FEMA regional offices and usually do 

not deploy to disaster operations field offices. Cardholders, 

although assigned to FEMA regional offices, typically travel to 

disaster field offices throughout the country as needed. When 

deployed, cardholders commonly report to and receive 

performance appraisals from supervisors who are not their AOs. 

However, cardholders’ purchases are still approved by their AOs, 

who often are not at the disaster site. See Appendix D for the 

locations of FEMA regional offices and the number of disaster 

purchase cardholders in each region. 

Between October 2007 and June 2009, FEMA’s 280 disaster 

purchase cardholders spent more than $14.1 million. Office 

supplies, including printer cartridges, were the most commonly 

purchased items. Figure 2 shows disaster purchase card 

spending from October 2003 through June 2009. 
Improving FEMA’s Disaster Purchase Card Program 

Page 4 

 

 $40.0 

35.0 

M 30.0

i 

l 25.0 l 

i 

20.0

o 

n 

15.0 s 

10.0 

5.0 

0.0 

Figure 2. FEMA Disaster Purchase Card Spending 

Fiscal Year 2004 Through June 2009 

2004 2005 2006 2007 2008 2009 

Fiscal Year 

Source: OIG analysis of FEMA and U.S. Bank data.2 

In June 2009, the FEMA disaster purchase card program 

transitioned to a new service provider under the General Services 

Administration (GSA) SmartPay®2 purchase card program. The 

GSA SmartPay®2 program provides charge cards to U.S. 

government agencies through master contracts that are negotiated 

with major national banks. JP Morgan Chase is the service 

provider for the Department of Homeland Security (DHS) 

Purchase Card Program, of which the FEMA disaster purchase 

card program is a part. 

2

 Until June 2009, U.S. Bank was the service provider for FEMA’s disaster purchase card program. 
 

 

Results of Audit 

Improving Disaster Purchase Card Guidance 

The FEMA Organization Program Coordinator is responsible for 

establishing disaster purchase card policies and procedures consistent 

with departmental policy. However, some regional offices and other 

FEMA activities have implemented their own guidance. This has 

resulted in a proliferation of conflicting and outdated guidance. For 

example, the FEMA Disaster Plan for Purchase Card Usage and FEMA 

Disaster Contracting Desk Guide provide different “standard operating 

procedures.” The FEMA Disaster Plan for Purchase Card Usage 

outlines specific procedures for the use of purchase cards during the 

operations phase and assistance phase of a disaster, whereas the FEMA 

Disaster Contracting Desk Guide makes no distinction between the 

phases. Figure 3 summarizes the stated purposes of the two documents 

and key differences. 

Figure 3. Example of Different Standard Operating Procedures 

FEMA Disaster Plan for 

Purchase Card Usage 

“...This Standard Operating Procedure 

(SOP) guidance establishes the 

Department of Homeland Security 

policy for ...use of the Government 

Purchase Card in response to or 

recovery from a disaster...This SOP 

applies to all FEMA employees...” 

“...During the disaster operations phase 

the following steps are taken...During 

the Disaster Assistance Phase the 

following steps are taken...” 

“...Ensure written approval and 

Certification Form (Appendix A) is 

obtained from the designated on-site 

Comptroller in a timely manner prior to 

making purchases...” 

Source: FEMA. 

FEMA Disaster Contracting Desk Guide 

“...provides Standard Operating Procedures 

(SOP) regarding the acquisition of supplies, 

services, and equipment in support of declared 

disasters...The section on the Government 

purchase card covers the unique requirements 

relative to purchasing services and supplies at 

a disaster with the card...is applicable to all...” 

“...The purchase card purchase process is 

similar to the acquisition process...” 

“...Receive 60-1(s) [Requisition for Supplies, 

Equipment, and/or Services] from Logistics for 

Purchase(s)...” 

Figure 4 highlights some similarities and differences in FEMA disaster 

purchase card guidance. 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 5
 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 6
 


� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

� 

 

 

Figure 4. FEMA Disaster Purchase Card Guidance Comparison 

FEMA FEMA FEMA FEMA 

Disaster Disaster Emergency REGION VI 

Plan for Contracting Acquisition Disaster 

Purchase Desk Guide Field Logistics 

Card (05/2009) Guide Ordering 

Usage (09/2007) Unit SOP 

(12/2007) (06/2009) 

Applies to all disaster cardholders. 

Lists distinct procedures for the 

disaster operations phase and the 

disaster assistance phase. 

Names the Comptroller as the onsite authorizing official. 

Identifies specific prohibited 

charges. 

Requires use of the Comptroller 

Certification Form. 

Requires a minimum of three quotes 

be sought and documented.3 

Requires that a warranted contract 

specialist document and justify sole 

source selections. 

Requires a waiver for the purchase 

of bottled water. 

Requires a written waiver for 

disaster information systems from 

the Disaster Information Systems 

Clearinghouse. 

Requires that original receipts and 

support be maintained for 6.3 years. 

Source: OIG analysis of FEMA disaster purchase card guidance.
 


3

 According to Federal Acquisition Regulation Subpart 13.202, micro-purchases may be awarded without 

soliciting competitive quotations if the price is considered reasonable. 
There are gaps in the guidance as well. For example, neither the FEMA 

Disaster Plan for Purchase Card Usage nor FEMA Disaster 

Contracting Desk Guide clearly identifies how cardholders should 

handle store credits. Cardholders generally do not have a choice 

whether their card is credited or a store credit is issued. Merchants can 

choose to give cardholders a store credit when purchased items are 

returned or exchanged, paid orders are subsequently canceled, or 

overcharges are refunded. Between October 2007 and June 2009, 

FEMA canceled more than $6,900 of disaster card purchases. FEMA 

needs to establish clear and consistent guidance regarding store credits. 

Several cardholders told us that they would like to see clearer and more 

concise guidance. A cardholder with extensive disaster experience said 

that each FEMA region does things differently. When there are multiple 

sources of written guidance, cardholders can become confused as to 

which procedures they should follow and what constitutes an eligible 

purchase. Eighteen cardholders and AOs told us that they usually go to 

their colleagues or the FEMA Organization Program Coordinator for 

guidance, and a number of cardholders identified confusing guidance as 

an area needing improvement. 

Recommendation 

We recommend that the Federal Emergency Management 

Agency Organization Program Coordinator, in coordination with 

acquisition staff at Federal Emergency Management Agency 

headquarters and regional offices: 

Recommendation #1: Consolidate, update, and more 

effectively communicate Federal Emergency Management 

Agency disaster purchase card program guidance. The guidance 

should be timely and address known gaps. There should only be 

one set of guidance for the Federal Emergency Management 

Agency disaster purchase card program. 

Management Comments and OIG Analysis 

FEMA concurred with the recommendation and said it is 

eradicating conflicting guidance and addressing known gaps 

within a single consolidated set of guidance. The anticipated 

date of completion is December 31, 2010. We consider FEMA’s 

current actions responsive to the recommendation. 

Improving FEMA’s Disaster Purchase Card Program 

Page 7 
 

Strengthening Disaster Purchase Card Internal Controls 

FEMA has improved its internal controls and addressed a number of 

prior audit recommendations.4 Senior leadership has clearly 

communicated its commitment to establishing a necessary level of 

financial stewardship and program accountability within FEMA. For 

example, in July 2009, the FEMA Administrator established an Internal 

Control Board of senior leadership to assess and govern internal controls 

across the organization, and to identify and implement improvements on 

a continuous basis. With respect to the disaster purchase card program, 

FEMA has ensured that: 

�	 

�	 

�	 

�	 

�	 

Cardholders have met initial purchase card training requirements; 

The span of control for approving officials is reasonable; 

Results of monthly postpayment audits are being acted upon; 

Purchase cards to be used only for disaster needs are specifically 

and clearly marked; and 

Disaster cards have appropriate per-purchase and monthly 

purchase limits. 

FEMA also blocks purchases from merchants coded in certain categories 

using Merchant Category Codes (MCC). However, this action does not 

restrict what is purchased from merchants who have not identified 

themselves with the blocked MCCs. For example, disaster purchase 

cards may not be used to make purchases at businesses categorized as 

providing money orders, a prohibited item; however, they may be used 

at grocery stores that sell money orders. 

To help address this gap, FEMA needs to use specialized reports of 

cardholder activity more effectively and develop a strategy for reviewing 

reports (i.e., who, what, and when). These reports are very useful for 

identifying, analyzing, and documenting problem areas. They can also 

be used to reveal trends in disaster purchase card use. Electronic reports 

make fraud or misuse far easier to detect than paper-based reports. 

When used proactively, the information can help FEMA (1) prevent 

4 Internal Controls in the FEMA Disaster Acquisition Process, (OIG-09-32, February 2009) and 

Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to Fraudulent, Improper, and 

Abusive Activity, (GAO-06-1117, September 2006). 

Improving FEMA’s Disaster Purchase Card Program 

Page 8 
Improving FEMA’s Disaster Purchase Card Program 


Page 9 


fraud, waste, and abuse; and (2) identify potential strategic sourcing 

opportunities. 

FEMA can further strengthen its controls through the use of data mining. 

Data mining is extracting useful information from a database using 

artificial intelligence and neural networks. Model patterns of purchase 

card misuse and fraud can be programmed into systems that 

automatically monitor cardholder activity for similar patterns. In order 

to develop accurate models, the patterns of cardholder misuse and fraud 

must be well documented and understood. 

With more effective internal controls, FEMA could have prevented more 

than $247,100 of improper purchases or detected them more quickly. 

An improper purchase is any purchase that should not have been made 

or that was made in an incorrect amount under statutory, contractual, or 

administrative requirements. An improper purchase can be incorrect, 

unauthorized, or fraudulent. 

Incorrect purchases are mistakes caused by an unintentional error during 

the purchase process. For instance, when a purchase cardholder is asked 

to buy one type of printer but inadvertently purchases a different type, this 

is an incorrect purchase. Duplicate purchases and purchases for incorrect 

amounts, if made in error, are also examples of incorrect purchases. A 

series of ostensibly incorrect purchases may require investigation to 

determine whether they are actually unauthorized purchases. 

Unauthorized purchases are items that are intentionally purchased 

outside of the cardholder’s purchasing authority. Examples include 

purchases intentionally made (a) on the same day from the same vendor 

to circumvent cardholder single transaction limits; (b) for ineligible 

recipients; (c) for ineligible services; or (d) in the absence of available 

funding. 

Fraudulent purchases include those that were unauthorized and intended 

for personal use; made using government charge cards or account 

numbers that had been compromised; and correctly charged to the 

charge card but that involve potentially fraudulent activity. For instance, 

using a government charge card to purchase a gift card for personal use 

is a fraudulent purchase. 

If FEMA had more effective internal controls, the following improper 

purchases could have either been prevented or detected more quickly: 
Improving FEMA’s Disaster Purchase Card Program 


Page 10 


�	 

�	 

�	 

More than $5,800 of questionable and prohibited charges made 

by three different cardholders in two different FEMA regions. 

Had the FEMA Organization Program Coordinator used 

specialized reporting tools effectively, these purchases would 

have been quickly identified. The charges included two gift 

cards totaling $4,318; a 3-year 24/7 hardware maintenance 

agreement for $463; and 19 ceramic heaters, a personal 

convenience item, for $1,098. See Appendix E for case studies. 

At least $78,000 in split purchases by three cardholders in one 

FEMA region. Items purchased included umbrellas, tents, 

telephones, and office supplies. All three cardholders should 

have forwarded the actions to warranted contract specialists 

rather than breaking up the requirements so that they were below 

the single purchase limit established for each cardholder. By 

acting as they did, these cardholders exceeded their authority and 

violated federal acquisition regulations. 

More than $158,600 of purchases, by 26 cardholders, using funds 

designated for other purposes. For example, cardholders bought 

more than $20,400 of software, printers, facsimile machines, 

copiers, and scanners using funds designated for other 

commodities. By not using the correct categories of funds, these 

cardholders made it difficult for FEMA to know where money 

was actually needed and for what types of goods or services. 

Also, they increased FEMA’s risk of making expenditures in 

excess of available funds and having unliquidated obligations 

that could be used for other needs. 

�	 More than $2,800 of purchases that appeared to have been made 

by individuals other than the cardholders. This includes 

someone other than the cardholder signing the credit card receipt 

for a purchase. DHS and FEMA policies prohibit this, since 

procurement authority is granted only to the individual to whom 

the card has been issued. More effective cardholder training 

might have prevented this from occurring. Better oversight by 

the AOs should have detected it. 

With respect to purchases with incorrect amounts, more than $1,900 was 

charged for sales tax. Transactions against federal government accounts, 

directly paid by the government, are exempt from state and local taxes. 

Under the terms of the GSA SmartPay®2 Master Contract, JP Morgan 

Chase is to work with state governments and merchants to ensure that 

states and merchants do not tax these transactions at the point of sale. 
Additionally, JP Morgan Chase is to assist the government in the 

resolution of any other tax exemption issues that arise, as well as contact 

merchants at the government’s request regarding tax exemption. 

There was insufficient documentation that key purchase card internal 

controls were performed involving more than $47,400 of accountable 

property. To avoid excess inventory or purchases of items that do not 

meet standard specifications, purchases of the following items must be 

approved in advance by the Disaster Information Systems Clearinghouse 

(DISC): facsimile machines; four-in-one office machines 

(print/fax/copy/scan); laptops; digital cameras; hubs; modems; and GPS 

units (global positioning system/navigational use). DISC approval should 

be in writing and included in a cardholder’s backup documentation. 

Twelve cardholders did not have such documentation for purchases in this 

category. 

Fraud, waste, and abuse of federal funds is a serious offense. According 

to the DHS Purchase Card Manual, “Abuse and/or fraud will result in 

immediate cancellation of the employee’s purchase card. In addition, the 

CH [cardholder] may be subject to disciplinary action up to and 

including termination of employment. An employee also may be 

personally liable to the Government for the amount of any unauthorized 

transaction and may be subject to criminal prosecution....” Cardholders 

and AOs need to be mindful of the consequences for inappropriate or 

negligent behavior. Effective periodic training, coupled with swift 

action against violators, should help deter cardholders from making, and 

AOs from allowing, improper purchases. 

Recommendations 

We recommend that the Federal Emergency Management 

Agency Organization Program Coordinator: 

Recommendation #2: Establish a multifaceted, strategic 

approach to monitoring and oversight. This includes (a) providing 

more effective training to cardholders and approving officials; 

(b) taking better advantage of preventive controls and data mining 

to minimize risk exposure; (c) developing and implementing a 

strategy for using specialized reports of cardholder activity; and 

(d) taking swift action against cardholders and approving officials 

for inappropriate or negligent behavior. 

Improving FEMA’s Disaster Purchase Card Program 

Page 11 
 

Recommendation #3: Continue to work with the Department of 

Homeland Security and JP Morgan Chase to ensure that states 

and merchants do not tax purchases at the point of sale. 

Management Comments and OIG Analysis 

FEMA generally concurred with the recommendations. With 

respect to recommendation #2, FEMA said it would take 

advantage of the robust monitoring tools available under the 

General Services Administration SmartPay®2 program. With 

respect to recommendation #3, FEMA said it would work with 

the Department of Homeland Security and the purchase card 

bank to ensure that States and merchants do not tax purchases at 

the point of sale. We consider FEMA’s planned actions 

responsive to the recommendation. 

Addressing GSA SmartPay®2 and CCTMS Issues 

Since transitioning to GSA SmartPay®2 in June 2009, FEMA 

cardholders and AOs have had difficulty using their new accounts. 

Reported problems include authorized users not being able to log into 

the bank’s Electronic Access System, view accounts or statements, and 

review or certify transactions. FEMA officials also identified the bank’s 

customer service as needing improvement. Most troubling, the FEMA 

Organization Program Coordinator asserts that JP Morgan Chase had 

assigned a number of cardholders to the wrong AOs, resulting in 

unauthorized individuals being able to certify cardholder statements. 

Issues with FEMA’s Credit Card Transaction Management System 

(CCTMS)5

 also plagued cardholders. Examples include cardholders not 

being able to access the system; critical report functions that stopped 

working; reports with incorrect data; duplicate transactions; and 

incorrect rejection or suspension of transactions. According to FEMA 

Finance Center officials, the contractor responsible for sustaining and 

improving the system is behind schedule in addressing these and other 

issues. Since May 2009, critical maintenance releases have not been 

deployed into production, and workarounds are needed to make the 

system work properly. However, while FEMA staff identified these 

5

 CCTMS is a custom-built, web-based application that FEMA’s cardholders are required to use for 

(1) allocating expenses to the appropriate lines of accounting, and (2) entering descriptive information 

about their transactions into a purchase log. 

Improving FEMA’s Disaster Purchase Card Program 

Page 12 
Improving FEMA’s Disaster Purchase Card Program 


Page 13 


Recommendation 

We recommend that the Federal Emergency Management 

Agency Associate Administrator, Mission Support: 

Recommendation #4: Facilitate efforts to resolve issues with 

Federal Emergency Management Agency’s transition to the 

General Services Administration SmartPay®2 program and the 

Credit Card Transaction Management System. 

Management Comments and OIG Analysis 

FEMA generally concurred with the recommendation and said it 

is working with its partners to resolve the issues. With respect to 

the Credit Card Transaction Management System, FEMA said 

that a root cause analysis has been completed and corrective 

actions are underway. We consider FEMA’s current and planned 

actions responsive to the recommendation. 

problems to us, the responsible contracting officer stated that she had not 

been made aware of any performance issues. 

FEMA, in partnership with its contractors and DHS, needs to identify 

the root causes of these issues and resolve them. Effective information 

technology management is vital to achieving useful, reliable, and 

continuous recording and communication of information. According to 

the Standards for Internal Control in the Federal Government 

(GAO/AIMD-00-21.3.1, November 1999), “Information should be 

recorded and communicated to management and others within the entity 

who need it and in a form and within a time frame that enables them to 

carry out their internal control and other responsibilities.” 
Appendix A 

Purpose, Scope, and Methodology 

Our objective was to determine whether FEMA has adequate internal 

controls in place to deter and detect fraud, waste, and abuse in its disaster 

purchase card program. We assessed whether guidance was consistent, 

complete, accurate, and accessible; cardholders made proper purchases; 

and funding was properly obligated and deobligated. 

Based on our assessment of risks, we judgmentally selected 756 

transactions for detailed review. These transactions, totaling about 

$506,100, occurred between October 2007 and June 2009. Factors we 

considered in making our selections included merchant category code 

blocks; frequency of certain transactions; sales tax paid; transactions 

associated with lost, stolen, or compromised cards; and historical 

knowledge and experience. 

FEMA was not readily able to provide cardholder backup documentation 

for 46 transactions totaling about $24,100. Missing documentation 

included approved requisition and funding documents, sales slips, and 

receiving reports. 

We performed the audit at FEMA headquarters and facilities located in 

Denver, CO; Washington, DC; Atlanta, GA; Philadelphia, PA; Denton, 

TX; Texas City, TX; and Berryville, VA. We interviewed 51 FEMA 

disaster purchase card Approving Officials and cardholders, the FEMA 

Organization Program Coordinator, and other responsible officials. We 

reviewed applicable laws and regulations and prior audit reports. We 

analyzed disaster purchase card guidance, bank transaction data, 

cardholder backup documentation, and FEMA Organization Program 

Coordinator postpayment audit records. We validated the reliability of 

data by comparing them with source documents such as sales receipts, and 

we believe, within the scope of this audit, that we can reasonably rely on 

the data. 

We conducted this performance audit between June and December 2009 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

Improving FEMA’s Disaster Purchase Card Program 


Page 14 

I _~. r..p,""'<'" "f """'<b"d S«uri'~'

~OO C' S,,,"rt. S\\

"",,,'~"". Ill-lO";l

MAY 1 11O~

MEMORANDUM FOR: Malt Jadacki

[h;puly InSJX-'Ctur Gcnerdl

Office ofEmcrgellcy Managtmlent Oversight

Office uf lnsp<.'<,:.t.\.'f G~ncral

:<d-\c "j;(t'"<.-.- Fi--

FROM: David J. Kaufman

Dir~"Ctor

Office ofPoliey and Program Anulysis

SL;BJECT' Comments on OIG Druft Repon.!mpl",,,·illg FEMA's

DiSC/slcr Pllrchwi(' C,ml PJ"ogrmll

Thank you for the opportunity 10 review amI ,-"{)mment un the Office of Inspector

Gen",.al's (OIG's) subj'-'Ct draft audit report. As the Fcdeml Emergency Management

Agency (FEMA) works toward refining its progr:UllS. the OIG's independent amllysis of

progmm perfonnancc greatly b<:nefits our ability to continuously improve our activltics.

Technical comments have been provided under separate oovu,

FEMA ooneurs with the dmft report's four recommendations. While we will b<:

providing enTreetivl': action plans in our 91l-du)' re~pon.~e, we pnll'ide the following

infortnation relative to the four reoommendations:

Recommendation 111; Consolidate. update, and more effectively communicale Federal

Emergency Management Agc"c>, disaster purcha,'e card !,'llitlance. The .\,'llidance shol.lld

be timely and address known gaps. Therc should only be one sel of guidance for the

Fedcral Emcrgcnc>' ManagemCllt disaster purchase card pro.\,'TlIm.

Response: FEMA concurs with thc rcc\Hl1IncnJati\ll1 to eonsoliJale, update, and more

effectively cUlOJllunicatc disastcr purchase earJ guid'lllce. As a result uf uJditiollal

support 10 the ?urehasc Card rwgram, efforts to emdicatc conflicting guidance a.' well as

address known gaps within a single oonsolidated set of guidance can be implcmented

more quickly. The anticipated datc of completion is December 31. 2010.

Appendix B 

Management Comments to the Draft Report 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 15
 

Page 2

Recommendation #2: Establish a Illultifacctcd, stratcgic approach to monilOring and

oversight. This includes (a) providing more clTt:t:ti"e training to cardholders and

approving officials: (b) taking better advantage of preventive controls and data mining to

minimize risk exposure; (c) developing and implementing a strategy for using specialized

reports ofcardholder m;tivity; amI (d) taking swift action against cardholders and

approving officials for inapp....'pr;at<;: or ucgligcnt b<:l1a"ior.

Response: FEMA Cllncu!'S in principal with thc recommcudation to establish a

multifaccted. strategic apprweh to monitoring and conducting oversight functions in

order to: (a) pro\'ide more effcctivc training, (b) use data mining tools to minimize risk

of abuse ofthc purchase Cltrd, (c) otherwise monitor card usc, and (d) take swift action

against those who ;'iolatc policy and card usc. FEMA will take advantage ofthe robust

tools made available through GSA Smartl'ay2.

Reeommendslion #3: Continue to work with the DepartmCtlt of Homeland Security and

11' Morgan Chase to ensure that states and merchanl~ do not tax purchases at the point of

sale.

Response: FEMA concurs with the recommendation and will work with the I)cpartmCtlt

ofHomc1and Security (OHS) aUll the purehasc card bank to cnsure that statcs ami

merchants do not tax purchasl:s at the point ofsale. FEMA has infonne<1 purchasc

cardholdcrs on numcrous oecasiol1s tl1m thcir purchases should oot he taxed and to

conlllctthe Office ofthe Chicf Procurement Offieer if a merchant imposes an

unauthori7ed tlU. This will also be addre~SI;t.l in the gui<.lanec discussed ullder

Recommctldation #1 above.

Reconlmcndat!on #4: Facilitate e!Torts to rcwlvc issu~"S with F~'Ilcral Emergency

Management AgCtlcy's transition 10 the General Scrvic(;S Administration Smortl'ay2

program amI the Credit Card Trans,1etion Management System

Response: FEMA crmeurs with this recommcndaliun. FEMA will t:olllillue to partner

with OHS to resolve issues with FEMA's transition to the SmartPay 2 Program with JP

Morgan Chase. With [C.,peetto FEMA 's Cr~'dit Card Tronsaction Managemcnt System

(CCTMS), a collaborative team eITort by multiple FEMA OCFO pcrsonnel and

contractors has resulted in new business proecsscs aod reporting to correct functional

issues in CCTMS. and espand the visibility ofthc contractor's performance to all

eonccm~'Il parties. In February/March 2010. the contractor perfonned an extensive root

cause analysis ofthc syst~,n, which resultell in some fixCl; to reports and cxpamiL'd

several other ctld·user reports to the quartcrly release. which had not becn Cllmplct~'Il

from March 2009. The quancrly relcase j\1.~t completed the User Aecept:lTlce Testing

(UAT) phasc with a 671330/. pass/fail rate. Other data has been provided to the OCFO

financial staff to analy,o:e in order to address and fix other issues or look at possible

workaroumls. The root cause allaly~is identified other issues, which arc in the

Appendix B 

Management Comments to the Draft Report 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 16
 

 

Page 3

design/review stage and are part oftbe next quarterly release $Cheduled to roll out by the

end ofJuly 2010.

Thank you again for the opportunity to comment on this draft report and we look forward

to WQricing with you OD other issues as we both strive to improve FEMA.

Appendix B 

Management Comments to the Draft Report 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 17
 

( ShIrt )

-.

Logistics

> Prepare bulk 4O-!s [Requisition and Conunilrncnl for Services and Supplies] to fund purchue cards for specifIC disasters

> Route 40-15 10 ProjM Offic<l" and Finance

> Start disaster purchase card file

I

FiIlUlla

> Conunit and obligate funds

> Retain copies ofapprovcd 40-18

> Send origutal40-1s to cardholderii and copies 10 Logistics

•

Omlholden

> Receive6Q-ls {Requisition for Supplies, Equipment, and/or Services] for purchases and any requiroo waivers

> C.'11ock required sources

> Vc:rifY items are tax-exempt

> Purchase items from vendor

> Update Disaster PurclIaseCard Log

> Insert 60-18 in files with back-up documentation

> Reallocatetransaclions in Credit Card Tramaction l\1anagemml System (CCTMS)

> Send copies of60-1s 10 Re.civing Offi<=s

1>EUVERY Ddiver PICK UP

Ret:6\;1IC Offiurs ClITdholden

> Receive items > Pick up items

> Prql8re and sign receiving documents > Sign receipt from vendor

> Verify with Accoontabk: Property Officer ifilems are aCCOllJl~ble property > Deliver items to Receiving Officer

> DehvCf items 10 Rt,:l;jucator

> Requestor signs receiving documents

> Send receiving documenh 10 cardholders and retain copia;

Qm/ltolder9

> File receipts, 6O-1s, and other required documents by Iransaclion

> Update Disaster PurchaseCard Log

> Reconcile Iransaclions U1 CCTh1S

> Complete statemmt TeQOI\eiliation and approval within 7 days after the cycle date

> Fon',ard rooeipl.s., 6Q.1s. and other required documents to appropriate regional disaster office for filing and retain oopies

1

Appro";n& 0ffl£U,!s

> Ensure accowlla are reconciled within 14 days of the cycle close dale

> Ensure lhlIt charges wert allowable and documentalion IS COOlplete

> As appropnalt, certify cardholder statemmts

Appendix C 

Disaster Purchase Card Process Diagram 

Source: OIG analysis of the business process for the FEMA disaster purchase card program.
 

Improving FEMA’s Disaster Purchase Card Program 

Page 18 
Appendix D 

FEMA Regional Offices 

FEMA REGION NUMBER OF CARDHOLDERS 

I 10–20 

II 10–20 

III >20 

IV >20 

V <10 

VI >20 

VII <10 

VIII 10–20 

IX >20 

X 10–20 

Source: FEMA. 

Improving FEMA’s Disaster Purchase Card Program 

Page 19 
Appendix E 

Case Studies 

The “Happy Birthday” Gift Cards 

A cardholder purchased two “Happy Birthday” gift cards totaling $4,318. 

Each card was for $2,159, and they were bought within minutes of each 

other using funds for Hurricane Ike disaster relief operations in Texas. 

According to FEMA, the store charged two gift cards, using the 

cardholder’s purchase card and then cashed these two gift cards to pay for 

120 cases of copy paper at a total cost of $4,318.80. The cardholder states 

that he never received the gift cards and has no explanation for this. The 

receipts in the cardholder’s file for these transactions show that the 

purchase was for two “Happy Birthday” gift cards. The cardholder was 

able to provide copies of the FEMA request form for the paper, as well as 

copies of the order forms used by the store to order and have delivered the 

paper. FEMA has been unable to provide any receiving documents. 

Personal Convenience Items – Ceramic Heaters 

FEMA officials requested 40 portable ceramic heaters for staff at a 

regional office. These heaters were to be bought using funds that had been 

allocated for disaster relief efforts in Oklahoma. The cardholder 

purchased 19 heaters from an online retailer for about $1,098. DHS 

prohibits cardholders from purchasing personal convenience items such as 

heaters. According to the FEMA Emergency Acquisition Field Guide, 

cardholders are not to buy items for their personal use or purchase items 

unrelated to the mission of their office. The cardholder should have 

rejected the purchase request and, if necessary, requested assistance from 

her AO and the FEMA Organization Program Coordinator. 

The Golf Umbrellas 

FEMA officials requested 360 golf umbrellas for Hurricane Ike disaster 

relief operations in Texas. The requisition was given to two cardholders 

who intentionally split the $9,000 purchase in order to stay below their 

$3,000 single purchase limits. Both cardholders purchased the umbrellas 

from a California-based company that normally sells computer and 

imaging supplies. This resulted in taxpayers paying $25 for each 

umbrella, although similar ones were available via GSA for half the cost. 

At least 60 of the purchased umbrellas were never used. According to 

FEMA policy, all purchase requests greater than $3,000 must be 

forwarded to warranted contract specialists. Neither cardholder was a 

warranted contract specialist. 

Improving FEMA’s Disaster Purchase Card Program 


Page 20 

Appendix F 

Major Contributors to This Report 

Donald Bumgardner, Director 

Trudi Powell, Audit Manager 

John Woo, Auditor-in-Charge 

Polin Cohanne, Senior Program Analyst 

Puja Patel, Program Analyst 

Scott Wrightson, Forensics Specialist 

Improving FEMA’s Disaster Purchase Card Program 


Page 21 

Appendix G 

Report Distribution 

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

FEMA Audit Liaison (09-175-EMO-FEMA) 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

Improving FEMA’s Disaster Purchase Card Program 
 

Page 22
 

ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 

fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 

OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 

misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 

Attention: Office of Investigations - Hotline, 

245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.