September 18, 2008

Report No. 440

Internal Control Review of the 

Government Purchase Card Program 

   
UNITED STATES 

SECURITIES AND EXCHANGE COMMISSION 

WASHINGTON, D.C. 20549 

OFFICE OF 

INSPECTOR GENERAL September 18,2008 

To: Sharon Sheehan, Associate Executive Director, Office of Administrative 

Services 

From: H. David Kotz, Inspector Genera MJ 

Subject: Audit of the Government Purchase Card Program, Report No. 440 

This memorandum transmits the Securities and Exchange Commission, Office of 

Inspector General's (OIG's) final report detailing the results of our audit on the 

government purchase card program. The audit was conducted by OIG's contractor 

Kearney & Company, as part of our continuous effort, to assess the management of the 

Commission's programs and operations. 

The final report contains 17 recommendations, which if implemented, should improve the 

operations of the government purchase card program. Your written response to the draft 

report, dated September 15,2008, is included in its entirety in Appendix I1 to the audit 

report. The Office of Administrative Services concurred with all of the report 

recommendations and has already initiated corrective action to address many of the 

deficiencies identified during the audit. 

Should you have any questions regarding this report, please do not hesitate to contact me. 

'We appreciate the courtesy and cooperation that you and your staff extended to our 

auditors and contractor during this audit. 

Attachment 

cc: 

Peter M. Uhlmann, Chief of Staff 

Diego Ruiz, Executive Director, Office of the Executive Director 

Kristine Chadwick, Associate Executive Director, OFM 

Norbert Doyle, Assistant Director, Office of Acquisitions, OAS 

George Eckard, Assistant Director, Finance and Administration Office, OIT 

Zayra Okrak, Assistant Director, Finance and Accounting Office, OFM 

Diane Galvin, Assistant Director, Planning and Budget Office, OFM 

Alan Diguardia, Branch Chief, Financial Operations Branch, OFM 

Kim Davis, GPC Agency Program Coordinator, OAS 

Darlene L. Pryor, Management Analyst, OED 

Rick Hillman, Managing Director of Financial Markets and Community 

Investment, GAO 
TABLE OF CONTENTS

 Page # 

1. EXECUTIVE SUMMARY 1 

2. OBJECTIVES, SCOPE, AND METHODOLOGY 2 

3. BACKGROUND 3 

4. RESULTS 4 

APPENDIX I – LIST OF RECOMMENDATIONS 

APPENDIX II – MANAGEMENT COMMENTS 

APPENDIX III – OFFICE OF INSPECTOR GENERAL 

 RESPONSE TO MANAGEMENT COMMENTS 

 

ii
1 

1. EXECUTIVE SUMMARY 

The Securities and Exchange Commission’s (SEC’s) Office of Inspector General (OIG) 

contracted the services of Kearney & Company (Kearney) to conduct an audit of the SEC’s 

Government Purchase Card (GPC) program. Effective internal controls over the GPC program 

are necessary to ensure that fraudulent, improper, and abusive purchases do not occur, and if 

such purchases do occur, the transactions are promptly detected and appropriate corrective action 

is taken. 

The OIG contracted Kearney to conduct this audit as a follow-up to the OIG’s report, Purchase 

Cards, which was issued November 25, 2002. Kearney’s primary audit objectives were to assess 

the design of the GPC program’s internal controls and operations and to determine whether: 

1) improper or potentially fraudulent purchases were made through the GPC program; and 

2) GPC purchases complied with spending limits, competitive bid requirements, and Property 

Management program requirements. 

Kearney found that while the internal controls over the GPC program are generally adequately 

designed, based on the results of the test work performed, the controls are not operating 

effectively. Kearney identified several themes in exceptions that were found during testing of 

GPC transactions. The SEC is not in compliance with current documented policies and 

procedures, and the SEC has not revised its policies and procedures. In the interim, SEC 

divisions and offices have adopted unapproved, unofficial operating practices. This includes 

variation in the use of a BankCard Log to track GPC transactions. 

The SEC does not obtain required approvals or retain required documentation for GPC 

transactions. Kearney’s testing of GPC transactions identified missing transaction approvals, 

lack of required competitive bids, and missing supporting documentation. For example, 

approximately 20 percent of tested transactions did not provide support for receipt of goods or 

services. 

In addition, Kearney identified two expenditures that were bifurcated to circumvent approval 

dollar thresholds. Kearney also identified deficiencies in the training and certification of users 

prior to the issuance of GPCs, as well as inadequate control over spending limits and untimely 

cancellation of GPCs. Combined, these deficiencies increase the risk of waste and defalcation 

through poor training and monitoring of purchasing practices. 

Additionally, Kearney identified certain instances where the implementation of additional 

controls is needed. For example, the Office of Administrative Services (OAS) should set up a 

process to ensure completion of GPC training and a signed Letter of Delegation before the GPC 

is issued. 

Although Kearney noted no occurrences of fraud in its test work, the current internal control 

environment creates increased risk of waste, fraud, and abuse in the GPC program. This report 

provides seventeen recommendations, several of which OAS personnel have begun to address. 

OAS concurred with all seventeen of the findings and recommendations. Management’s 

response is included in its entirety in Appendix II. 
2 

2. OBJECTIVES, SCOPE, AND METHODOLOGY 

OIG contracted Kearney to conduct this audit as a follow-up to the OIG’s report, Purchase 

Cards, which was issued November 25, 2002. Kearney’s audit objectives were to assess the 

design of the GPC program’s internal controls and operations and to determine whether: 

• Corrective actions from the prior OIG report were implemented. 

• Improper or potentially fraudulent purchases were made through the GPC program. 

• GPC purchases complied with spending limits, competitive bid requirements, and 

Property Management program requirements. 

• Only authorized employees made purchases through the GPC program. 

• GPCs were deactivated in a timely manner when cardholders left the SEC. 

 

In performing the test work for the GPC Program, Kearney considered the following key 

controls as prescribed in the SEC Administrative Regulations and the Smartpay Purchasing Card 

Program procedures: 

• Current practices are in compliance with formal policies and procedures. 

• Cardholders verified funds were available before making a purchase. 

• Multiple order transactions had quotes from two or more suppliers to justify the vendor 

that was used. 

• Purchases were recorded on the BankCard log and supporting documentation was 

retained. 

• Purchases were tax exempt. 

• Cardholders did not exceed their GPC threshold authority. 

• Receiving reports or receipt confirmations for purchases were included in supporting 

documentation retained by the cardholder. 

• Partial deliveries were not charged the full amount on the GPC. 

• Amended cardholder statements had the supporting documentation sent to the 

Transaction Disputes Officer. 

• The cardholder reconciled the monthly statement and submitted it to the Approving 

Official within two days of receipt. 

• The Approving Official approved transactions for payment. 

• Cardholders did not use the GPC to procure prohibited items. 

• The Associate Executive Director, Office of Information Technology (OIT), approved 

purchases for Automated Data Processing equipment, supplies, or services. A copy of 

the Procurement Requisition authorizing the purchase was delivered to the property 

officer, who is responsible for verifying that the information agrees with the data in 

TRAQ, the property tracking system. 

• Payments were made within 30 calendar days of receipt of the cardholder statement as 

required by the Prompt Payment Act (Public Law 97-177). 

Kearney reviewed prior findings and recommendations from the OIG November 25, 2002 report, 

Purchase Cards and found that the SEC closed the report’s seven recommendations regarding 

the GPC, as the result of corrective action management took to correct the deficiencies. 
3 

However, based on the seventeen recommendations in the report resulting from Kearney’s audit, 

it is evident that the SEC needs to take additional corrective actions. 

The audit’s scope encompassed fiscal year (FY) 2007 and included 4,744 transactions that were 

posted to the GPC from October 1, 2006 to September 30, 2007. The audit focused solely on the 

SEC’s GPC program. Kearney conducted this performance audit in accordance with generally 

accepted government auditing standards. These standards require Kearney to plan and perform 

the audit in order to obtain sufficient, appropriate evidence to provide a reasonable basis for its 

findings and conclusions based on the audit objectives. Kearney believes that the evidence 

obtained provides a reasonable basis for its findings and conclusions based on the audit 

objectives. 

Kearney interviewed key personnel for the GPC program at SEC headquarters to gain an 

understanding of GPC program policy and procedures in place. Personnel interviewed included: 

the Agency Program Coordinator (APC), GPC holders, Approving Officials, and budget 

analysts. Kearney performed tests of controls in order to ensure that they were operating as 

intended. Kearney used IDEA® – Data Analysis Software to compute a sample size at a 95 

percent confidence level. Kearney selected a statistical sample of 76 GPC transactions totaling 

$491,465 from the universe of 4,744 transactions with an absolute value of $9,043,394 posted to 

the GPC from October 1, 2006 to September 30, 2007, and including all SEC offices. 

Consequently, SEC’s headquarters and its regional offices were included in Kearney’s testing 

procedures. Cardholders who had a GPC transaction selected in the sample of 76 GPC 

transactions were selected for cardholder testing, which was performed for 27 of the SEC’s 96 

cardholders. SEC’s operating procedures were first compared to the agency’s formal internal 

policies and procedures, and then were evaluated against applicable laws, regulations, and best 

practices prescribed by internal control guidance and issued by the Committee of Sponsoring 

Organizations (COSO) and the Government Accountability Office (GAO). Examples of the 

internal control guidance include COSO’s Internal Control – Integrated Framework and GAO’s 

Standards for Internal Control in the Federal Government (Green Book). 

3. BACKGROUND 

The SEC selected Mellon Bank to serve as the vendor for the GPC program. The SEC has 96 

employees located at its headquarters and regional offices that are approved GPC holders who 

make purchases on behalf of the agency. The GPC holders primarily make small purchases for 

the agency for goods and services up to $3,000. The OAS issued guidance for the GPC program, 

the SECR 10-6, Smartpay Purchasing Card Program, on June 30, 1999. 

Cardholders are responsible for the GPCs and are directed to use them as prescribed in the SECR 

10-6, Smartpay Purchasing Card Program. All cardholders receive a Letter of Delegation of 

Authority sanctioning their GPC authority and spending limits, as approved by the Associate 

Executive Director of OAS. According to the SECR 10-6, Smartpay Purchasing Card Program, 

“Training for cardholders and approving officials will be given by the APC. The objective of the 

training is to acquaint them with the guidelines in this regulation.” To satisfy this training 

requirement, cardholders must complete the General Services Administration’s (GSA) webbased training before they can be issued a GPC. 
4 

The OAS appoints an APC to oversee the GPC program. The APC’s duties include, but are not 

limited to serving as liaison to Mellon Bank, instructing cardholders and Approving Officials, 

conducting high-level reviews of purchases, following up on disputed charges and billing errors, 

etc. Approving Officials serve to ensure the GPC program is administered in compliance with 

governing GPC regulations. Approving Officials complete a detailed review of transactions 

prior to approving the cardholders’ statements for payment. OIT must approve all IT purchases 

– only cardholders in OIT are authorized to make IT purchases. 

 

Each month, Mellon Bank sends a statement to all cardholders. The statement identifies all the 

purchases made on the GPC by transaction. In addition, a consolidated statement is sent to the 

Office of Financial Management (OFM). The consolidated statement is comprised of all GPC 

purchases and is listed by the name of the cardholder. The consolidated statement is used to 

ensure that approved statements are received and the total amount due is remitted to Mellon 

Bank. Within two days of receipt, cardholders are required to reconcile and sign the individual 

statements, and then forward it to the Approving Official, who certifies the statement by signing 

it. OFM only pays statements that both the cardholders and the Approving Officials have signed. 

4. RESULTS 

 

A detailed discussion of Kearney’s findings follows: 

Outdated Purchase Card Regulation

The SECR 10-6, Smartpay Purchasing Card Program, was issued on June 30, 1999 and needs to 

be revised. The regulation is outdated and consists of procedures that are different from those 

currently followed by GPC program officials and cardholders. Thus, GPC program officials and 

cardholders are currently in violation of this SEC regulation in a number of areas. For example, 

cardholders are currently using a small purchase threshold of $3,000 whereas the SECR 10-6, 

Smartpay Purchasing Card Program, establishes a threshold of $2,500. 

In addition, several of the forms detailed in the SECR 10-6, Smartpay Purchasing Card 

Program, are obsolete. For example, only one department still uses the SEC Form 1710,

Procurement Requisition. 

Recommendation 1 

The Office of Administrative Services should revise the SECR 10-6 Smartpay Purchasing Card 

Program to reflect relevant procedures that Government Purchase Card program officials and 

cardholders should follow. Additionally, the SECR 10-6, Smartpay Purchasing Card Program, 

should be revised periodically as procedural or policy changes occur. 

BankCard Log Not Used

Kearney tested 76 GPC transactions and found that for 44 of the 76 GPC transactions tested, a 

BankCard log was not provided by the cardholder. At a minimum, the BankCard log should 

contain the vendor’s name, a brief description of the purchase, the amount spent, and the date of 
5 

purchase. BankCard logs are required to ensure that all GPC purchases are properly accounted 

for and comply with current SEC policy. The SECR 10-6, Smartpay Purchasing Card Program, 

Section B, Paragraph 9.c states, “When making a credit card purchase, the cardholder must enter 

the transaction on the BankCard order log, and retain in a file any documentation associated with 

the acquisition.” 

OAS officials stated that the SECR 10-6, Smartpay Purchasing Card Program, is outdated and 

that current practice no longer requires cardholders to use BankCard logs. However, Kearney 

identified several cardholders that have continued to maintain a BankCard log, and it is an 

effective internal control mechanism. Without the continued use of a BankCard log, individual 

GPC users will not be able to readily verify transactions that appear on GPC statements. 

Recommendation 2

The Office of Administrative Services should require that Government Purchase Cardholders use 

a BankCard log (manual or automated) each month to verify purchases. 

Documentation Not Available

The audit found that cardholders did not retain required documentation to support GPC 

transactions. Specifically, Kearney found that: 

• For 15 of 76 GPC transactions tested, no evidence of receipt of goods or services was 

available. 

• For 3 of 76 GPC transactions tested, no Mellon Bank GPC Statement was available. 

• For 10 of 76 GPC transactions tested, no invoice was available. 

• For 11 of 76 GPC transactions tested, no availability of funds confirmation was 

available. 

 

In addition, the audit found that cardholders did not always retain the Letter of Delegation, which 

documents their spending and usage limits, or the GSA training certificate that documents that 

the cardholder has completed the required training. Specifically, Kearney found that: 

• For 5 of 27 cardholders tested, no Letter of Delegation was provided. 

• For 1 of 27 cardholders tested, no GSA web training certificate was provided. 

SEC GPC cardholders did not have files that contained all the required documentation. The 

GAO’s Government Auditing Standards, Chapter 1, Section 1.02, states, “Government managers 

are responsible for providing reliable, useful, and timely information for accountability of 

government programs and their operations.” Further, the SECR 10-6, Smartpay Purchasing 

Card Program, Section B, Paragraph 9.c states, “When making a credit card purchase, the 

cardholder must enter the transaction on the BankCard order log, and retain in a file any 

documentation associated with the acquisition.” Because documentation was not retained, 

purchases were not adequately supported and the cardholders’ delegated authority to use the 

GPC was not evidenced. 
6 

Recommendation 3

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require cardholders to retain in their files: purchase receipts, Mellon Bank 

Government Purchase Card Statements, invoices, confirmations for availability of funds, Letters 

of Delegation, training certificates, etc. The documentation should be readily available for 

review and stored in a manner that will allow an individual other than the cardholder to find a 

specific transaction, if necessary. 

Approvals Not Obtained

The audit found that cardholders did not obtain approval of the monthly GPC statement from the 

assigned Approving Official. The SECR 10-6, Smartpay Purchasing Card Program, Section A, 

Paragraph 2.f states, “When reconciled and validated by the cardholder, the statement is 

forwarded to the cardholder’s approving official for signature.” Kearney found that the 

Approving Official did not sign the GPC statement for 4 of 76 transactions that were tested. 

However, in those cases, Mellon Bank was paid even though verifiable authorization for 

payment from the assigned Approving Official was not obtained. 

Recommendation 4 

The Office of Administrative Services Agency Program Coordinator should periodically issue a 

reminder to cardholders that monthly Government Purchase Card statements must be signed by 

the assigned Approving Official prior to payment and that without the signed statements, 

payment should not be made. 

Quotes Not Obtained

The SECR 10-6, Smartpay Purchasing Card Program, Section A, Subsection 3, Responsibilities, 

states, “Purchases in excess of $2,500 are treated subject to the requirements in 48 CFR Part 13,” 

and the cardholder “Ensures that when a purchase exceeds $2,500 with only one source or 

specific make or model, that an SEC Form 2180, Notation to the File for Non-Competitive 

Action, is prepared.” In September 2006, the Federal Acquisition Regulation, Part 13 was 

revised and the micro-purchase threshold was increased from $2,500 to $3,000. The SEC’s GPC 

practice during Kearney’s audit allowed cardholders to use $3,000 as the micro-purchase 

threshold limit. Therefore, the SECR 10-6, Smartpay Purchasing Card Program, is outdated 

and needs to be revised to reflect the Federal Acquisition Regulation $3,000 micro-purchase 

threshold limit. 

The audit found that cardholders made GPC purchases without the adequate price verification 

and authorization of procurement method (i.e., sole source). Of the 40 transactions (all of which 

were over the $3,000 threshold) that were tested, 5 did not have evidence of a quote from the 

vendor or the sole source justification that is required for transactions over $3,000. Without 

obtaining quotes or justifying the use of a sole source, the SEC may not receive the best value for 

the goods and services it procures. Details of the 5 transactions are provided in the table below: 
7 

Table 1. Transactions Without Vendor or 

Sole Source Justification 

Date of Transaction Amount 

October 13, 2006 $10,000.00

October 20, 2006 $5,388.63

January 15, 2007 $ 3,327.10

March 8, 2007 $10,120.00

July 20, 2007 $19,250.00

 Source: Kearney & Company Generated 

Recommendation 5 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, to ensure compliance with the Federal Acquisition Regulation pertaining to vendor 

quotes and the $3,000 micro-purchase threshold limit. 

Recommendation 6 

The Program Coordinator should periodically issue a reminder to cardholders that prior to 

making a purchase over $3,000, they must obtain and retain evidence of quotes or a sole source 

justification. 

Split Transactions

Cardholders used the GPC to make multiple payments to the same vendor, for the same type of 

items purchased, on the same day. The SECR 10-6, Smartpay Purchasing Card Program, 

Section A, Paragraph 2.p states, “Neither cardholders nor merchants are allowed to split a single 

purchase into smaller dollar transactions in order to avoid exceeding the single purchase limit.” 

Of the 76 transactions tested, 2 were split purchases. In these situations, the purchases were 

divided into multiple transactions. For example, one of the split purchase transactions involved a 

copier maintenance agreement that was paid for each machine, each month, and totaled 

$5,388.63 from October 17, 2006 to October 25, 2006. The second split purchase was for 

seminars totaling $10,120, which was paid for with four $2,530 transactions. By splitting the 

purchases and ignoring the purchase limits, the potential risk of improper purchases increases. 

Recommendation 7 

The Office of Administrative Services should issue guidance to cardholders describing what 

constitutes a split purchase, warning of the prohibition against splitting purchases and specifying 

the penalty for making a split purchase. 

Information Technology Approval Not Obtained

The audit found that IT purchases were made without OIT’s prior approval. The sample of 76 

GPC transactions selected contained 34 transactions for IT-related purchases. Kearney tested 
8 

these 34 transactions and found OIT did not approve 2 of the IT-related purchases. Without 

obtaining OIT approval, cardholders can potentially make purchases that are incompatible with 

SEC’s current IT infrastructure. 

The SECR 10-6, Smartpay Purchasing Card Program, Section B, Smartpay Purchasing Card 

Program, Paragraph 8.a states, “The purchase of ADPE [automatic data processing equipment] 

supplies and services must be approved by the Associate Executive Director, Office of 

Information Technology (OIT).” Since this position no longer exists, the SEC’s current practice 

is to have IT purchases made with the GPC approved by either the Assistant Director, Finance 

and Administration Office or the Branch Chief, Budget and Acquisitions Branch within OIT 

depending on the dollar amount of the purchase and other factors. For 2 of the 34 IT-related 

purchases we reviewed, we found no evidence of OIT approval by these individuals or offices on 

the SEC Form 1710, OIT Procurement Requisition, or supporting documents maintained by the 

cardholders. 

Recommendation 8 

The Office of Administrative Services, in consultation with the Office of Information 

Technology, should revise SECR 10-6, Smartpay Purchasing Card Program, to reflect current 

practices with regard to approval of information technology purchases made with the 

Government Purchase Card. The regulation should also emphasize the importance of 

information technology-related purchases being approved by the Office of Information 

Technology prior to the purchase and clarify the types of purchases that require Office of 

Information Technology approval. This will help ensure that Information Technology purchases 

are not made until all approvals are obtained. 

Availability of Funds Not Obtained Prior to Purchase

The audit found that cardholders made purchases on the GPCs prior to obtaining confirmation 

that funds were available to be obligated. Of the 76 transactions tested, Kearney found 9 

transactions where the confirmation of availability of funds was not made before the purchase 

occurred. While funding for the 9 transactions was ultimately available, cardholders are not 

authorized to make purchases without ensuring funding is available. The SECR 10-6, Smartpay 

Purchasing Card Program, Section A, Paragraph 3.d states, “The Cardholder: (1) Ensures funds 

are available before making credit card purchases.” 

Recommendation 9 

The Office of Administrative Services Agency Program Coordinator should issue a reminder to 

cardholders that Government Purchase Card transactions must have funds obligated prior to 

making a purchase. 

Incorrect Fiscal Year Funds Used

Of the 76 GPC transactions Kearney tested, ten were committed in FY 2006 and paid in FY 

2007. However, Kearney found that two of the ten transactions were paid with FY 2007 funds, 
9 

when FY 2006 funds should have been used. In those cases, FY 2006 funds should have been 

used because the purchases originated in FY 2006. Cardholders had to identify which 

commitments were open at the end of FY 2006 and then inform OFM so that the manual 

processes required by the Momentum system to reserve funds into the next FY could be 

completed. If the manual process was not done, then funds would not be reserved and current 

year funds would be required for payment. 

 

Recommendation 10 

The Office of Administrative Services Agency Program Coordinator should consult with the 

Office of Financial Management to verify that obligations that are open at the end of the fiscal 

year are rolled forward into the next fiscal year.

Late Payment

For GPC purchases tested, 12 of 76 were paid over 30 days after receipt of the Mellon Bank 

GPC statement. Per 5 CFR 1315.10, Late Payment Interest Penalties, “Interest will be 

calculated from the day after the payment due date through the payment date at the interest rate 

in effect on the day after the payment due date....” The root cause of the late payments could not 

be determined from the GPC transaction testing because no systemic trends were identified. Due 

to the late payments, the SEC paid $2,655 in interest to Mellon Bank, thus incurring unnecessary 

costs. 

 

Recommendation 11 

The Office of Administrative Services Agency Program Coordinator and the Office of Financial 

Management should work together to identify underlying root causes, thereby ensuring payments 

are made to Mellon Bank within 30 days after receipt of the Mellon Bank Government Purchase 

Card statement. 

Training Not Provided

The audit determined that the APC does not offer formal training to cardholders as directed by 

the SECR 10-6, Smartpay Purchasing Card Program. Cardholders only take training provided 

online by GSA. Upon completion of the training, the cardholder forwards the certification to the 

APC. However, based on a comparison of the GSA online training to the SECR 10-6, Smartpay 

Purchasing Card Program, the guidance contains numerous policies that are not covered in the 

GSA on-line training such as: 

• Authorized usage limits and Merchant Category Code access. 

• Review of the card statement and submission to the Approving Official. 

• What to do in case of a partial delivery. 

• What to do for a billing error or a dispute. 

• IT approval requirement. 

• Policies upon separation. 
10 

The APC occasionally sends cardholders an email to remind them of GPC policy. However, the 

APC’s e-mail distribution list does not include all cardholders. 

The SECR 10-6, Smartpay Purchasing Card Program, Section B, Smartpay Purchasing Card 

Program, Paragraph 18, Training, Subsection a, states that, “Training for cardholders and 

approving officials will be given by the APC. The objective of the training is to acquaint them 

with the guidelines in this regulation.” The lack of proper training can lead to misunderstanding 

and misuse of the GPC.

Recommendation 12 

The Office of Administrative Services should develop a formal Securities and Exchange 

Commission Government Purchase Card training course and set up a plan to rollout the training 

to all cardholders in a timely manner. 

Recommendation 13 

The Office of Administrative Services Agency Program Coordinator should update the email 

distribution list to ensure that Government Purchase Card email messages are sent to all 

cardholders.

Untimely Certification

Most cardholders received their GPC and purchase delegation authority prior to completing the 

appropriate GPC training and signing the Letter of Delegation. Without taking GPC-related 

training and signing a Letter of Delegation, cardholders will not be aware of the GPC limitations 

and governing regulations. Thus, the risk of GPC misuse and/or abuse increases. Specifically, 

Kearney found that: 

• Out of 27 cardholders tested, 20 completed the GSA web training after being issued the 

GPC. 

• Out of 27 cardholders tested, 24 signed their Letter of Delegation after being issued the 

GPC. 

The SECR 10-6, Smartpay Purchasing Card Program, Section A, Paragraph 3.b (3) states that 

the APC, “Provides information and conducts training to approving officials, cardholders, and 

others who may become involved in the SmartPay Purchasing Card Program.” 

 

The SECR 10-6, Smartpay Purchasing Card Program, Section A, Paragraph 2.g 

states, “Delegation of Authority. A memorandum issued by the Associate Executive Director, 

OAPM, [now OAS] that delegates the SEC employee as an authorized cardholder. This 

delegation of authority specifies: 

(1) The spending and usage limitations unique to that cardholder; and 

(2) The merchant category codes (MCC) the cardholder is permitted to use.” 
11 

However, currently no one has the responsibility to verify that GPC training was completed and 

the Letter of Delegation was signed before the GPC is issued to the cardholder. 

Recommendation 14 

The Office of Administrative Services should set up a process to ensure completion of 

Government Purchase Card training and a signed Letter of Delegation before the Government 

Purchase Card is issued to the cardholder. 

Inadequate Control over Limits

The audit found that the OAS has not established procedures to require the APC to review actual 

GPC limits per the Mellon Bank against limits set forth in the Letter of Delegation. Kearney 

found that 5 of 27 cardholders had transaction limits that did not agree to the limits set forth in 

their Letter of Delegation. Improper limits create an environment where the SEC is more 

susceptible to improper use of the GPC due to increased exposure. 

Recommendation 15 

The Office of Administrative Services should develop procedures to review and ensure that 

cardholder limits agree to the Letter of Delegation and the Government Purchase Card provider 

on a regular basis. 

Cancellation of the Government Purchase Card

Cardholders that leave SEC employment are required to surrender the GPC to either the 

Approving Official or an OFM representative. The cardholders leaving the SEC must complete 

SEC Form 1455 (4-07), Employee Clearance Record, upon separation. However, it is not 

required to be filed until the day the person separates the SEC. This gives the employee the use 

of the GPC until their last day of service. The practice allows for the increased risk of misuse of 

the GPC, because the cardholder can make unauthorized purchases that will not be detected or 

verified by the Authorizing Official until after the person no longer works for the SEC. 

Recommendation 16 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require supervisors or the Approving Official to notify the Agency Program 

Coordinator that a cardholder is leaving the Securities and Exchange Commission. The Agency 

Program Coordinator should immediately suspend the cardholder’s Government Purchase Card. 

 

APC Segregation of Duties

From February 2006 to February 2007, the APC had access to a GPC and performed oversight 

functions for the GPC program, creating an environment that allows for easier misuse of the 

GPC. A fundamental element of internal control is the segregation of certain key duties so that 
12 

an individual does not have the authority to approve purchase card transactions and serve as a 

cardholder at the same time. 

Recommendation 17 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, to ensure that the Agency Program Coordinator does not have direct access to a 

Government Purchase Card. 
Appendix I 

 List of Recommendations

Recommendation 1 

The Office of Administrative Services should revise the SECR 10-6 Smartpay Purchasing Card 

Program to reflect relevant procedures that Government Purchase Card program officials and 

cardholders should follow. Additionally, the SECR 10-6, Smartpay Purchasing Card Program, 

should be revised periodically as procedural or policy changes occur. 

Recommendation 2

The Office of Administrative Services should require that Government Purchase Cardholders use 

a BankCard log (manual or automated) each month to verify purchases. 

Recommendation 3

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require cardholders to retain in their files: purchase receipts, Mellon Bank 

Government Purchase Card Statements, invoices, confirmations for availability of funds, Letters 

of Delegation, training certificates, etc. The documentation should be readily available for 

review and stored in a manner that will allow an individual other than the cardholder to find a 

specific transaction, if necessary. 

Recommendation 4 

The Office of Administrative Services Agency Program Coordinator should periodically issue a 

reminder to cardholders that monthly Government Purchase Card statements must be signed by 

the assigned Approving Official prior to payment and that without the signed statements, 

payment should not be made. 

Recommendation 5 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, to ensure compliance with the Federal Acquisition Regulation pertaining to vendor 

quotes and the $3,000 micro-purchase threshold limit. 

Recommendation 6 

The Program Coordinator should periodically issue a reminder to cardholders that prior to 

making a purchase over $3,000, they must obtain and retain evidence of quotes or a sole source 

justification. 

13 
14 

Recommendation 7 

The Office of Administrative Services should issue guidance to cardholders describing what 

constitutes a split purchase, warning of the prohibition against splitting purchases and specifying 

the penalty for making a split purchase. 

Recommendation 8 

The Office of Administrative Services, in consultation with the Office of Information 

Technology, should revise SECR 10-6, Smartpay Purchasing Card Program, to reflect current 

practices with regard to approval of information technology purchases made with the 

Government Purchase Card. The regulation should also emphasize the importance of 

information technology-related purchases being approved by the Office of Information 

Technology prior to the purchase and clarify the types of purchases that require Office of 

Information Technology approval. This will help ensure that Information Technology purchases 

are not made until all approvals are obtained. 

Recommendation 9 

The Office of Administrative Services Agency Program Coordinator should issue a reminder to 

cardholders that Government Purchase Card transactions must have funds obligated prior to 

making a purchase. 

Recommendation 10 

The Office of Administrative Services Agency Program Coordinator should consult with the 

Office of Financial Management to verify that obligations that are open at the end of the fiscal 

year are rolled forward into the next fiscal year.

Recommendation 11 

The Office of Administrative Services Agency Program Coordinator and the Office of Financial 

Management should work together to identify underlying root causes, thereby ensuring payments 

are made to Mellon Bank within 30 days after receipt of the Mellon Bank Government Purchase 

Card statement. 

Recommendation 12 

The Office of Administrative Services should develop a formal Securities and Exchange 

Commission Government Purchase Card training course and set up a plan to rollout the training 

to all cardholders in a timely manner. 
15 

Recommendation 13 

The Office of Administrative Services Agency Program Coordinator should update the email 

distribution list to ensure that Government Purchase Card email messages are sent to all 

cardholders.

Recommendation 14 

The Office of Administrative Services should set up a process to ensure completion of 

Government Purchase Card training and a signed Letter of Delegation before the Government 

Purchase Card is issued to the cardholder. 

Recommendation 15 

The Office of Administrative Services should develop procedures to review and ensure that 

cardholder limits agree to the Letter of Delegation and the Government Purchase Card provider 

on a regular basis. 

Recommendation 16 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require supervisors or the Approving Official to notify the Agency Program 

Coordinator that a cardholder is leaving the Securities and Exchange Commission. The Agency 

Program Coordinator should immediately suspend the cardholder’s Government Purchase Card. 

Recommendation 17 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, to ensure that the Agency Program Coordinator does not have direct access to a 

Government Purchase Card. 
Appendix II 

 Management Comments

Recommendation 1 

The Office of Administrative Services (OAS) should revise the SECR 10-6 Smartpay Purchasing Card 

Program to reflect relevant procedures that Government Purchase Card program officials and cardholders 

should follow. Additionally, the SECR 10-6, Smartpay Purchasing Card Program, should be revised 

periodically as procedural or policy changes occur. 

Response 

Concur. The OAS is drafting a new regulation to replace SECR 10-6 with an estimated release date of 

March 2009. 

Recommendation 2 

The Office of Administrative Services should require that Government Purchase Cardholders use a 

Bankcard log (manual or automated) each month to verify purchases. 

Response 

Concur. 

• On August 7th, the APC notified all cardholders to begin using a GPC log and provided a sample 

log for consistency (Attachment A). 

• The APC will verify use of the GPC log during monthly oversight reviews. 

16 
17 

Recommend closure of this finding. 

Recommendation 3 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require cardholders to retain in-their files: purchase receipts, Mellon Bank Government 

Purchase Card Statements, invoices, confirmations for availability of funds, Letters of Delegation, 

training certificates, etc. The documentation should be readily available for review and stored in a manner 

that will allow an individual other than the cardholder to find a specific transaction, if necessary. 

Response 

Concur with comments. 

• The Office of Financial Management’s (OFM) financial system houses all 

commitment/obligation history and is readily accessible. 

• The APC notified all GPC holders on August 7th to maintain a log and keep all GPC records 

(receipts, invoices, CQs, etc) in a safe place for a period of 3 years 

(Attachment A). 

• Effective August 14th, the APC randomly pulls files on a monthly basis to ensure compliance 

(Attachments B&C). 

• The APC maintains electronic copies of all cardholder and approving official training and 

delegations on the J:Drive. 

• OAS has contracted for an electronic archive system that will be in place on or about March 

2009. The system will archive and allow for easy retrieval of GPC documentation starting from 

the initial request, monthly statements, and backup documentation through to the final 

statement/cancellation. 

Recommendation 4 

The Office of Administrative Services Agency Program Coordinator should periodically issue a reminder 

to cardholders that monthly Government Purchase Card statements must be signed by the assigned 

Approving Official prior to payment and that without the signed statements, payment should not be made. 

Response 

Concur. 

• The APC issues a reminder monthly to all cardholders that the AO must sign their statement 

before sending it to OFM (Attachment D). 

• The cardholder Delegation Letter states that the AO must sign all statements (Attachment E). 

• Both the AO and the cardholder sign the Acknowledgement and Acceptance memorandum before 

the APC orders a card (Attachment F). 
18 

• The APC gives OFM a current list of cardholders identifying their approving officials 

(Attachment G). 

Recommend closure of this finding. 

Recommendation 5 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, to ensure compliance with the Federal Acquisition Regulation pertaining to vendor quotes and 

the $3,000 micro-purchase threshold limit. 

Response

Concur. The OAS is drafting a new regulation to replace SECR 10-6 with an estimated release date of 

March 2009. 

Recommendation 6 

The Program Coordinator should periodically issue a reminder to cardholders that prior to making a 

purchase over $3,000; they must obtain and retain evidence of quotes or a sole source justification. 

Response 

Concur. The APC will continue to send periodic reminders to cardholders to obtain and retain evidence 

of quotes or a sole source justification in their files for purchases over $3,000 (Attachment H). 

Recommend closure of this finding. 

Recommendation 7 

The Office of Administrative Services should issue guidance to cardholders describing what constitutes a 

split purchase and warning of the prohibition against splitting purchases and specifying the penalty for 

making a split purchase. 

Response 

Concur. 

• The APC has issued guidance and warnings concerning misuse of the GPC to all cardholders 

(Attachment J). 

• The APC monitors GPC purchases in pvsnet, which is the Mellon Bank’s automated purchase 

card system, and addresses with the appropriate cardholder all purchases that appear to be split. 

Recommend closure of this finding. 
19 

Recommendation 8 

OAS in consultation with the Office of Information Technology should revise SECR 10-6, Smartpay 

Purchasing Card Program, to reflect current practices with regard to approval of IT purchases made with 

the Government Purchase Card. The regulation should also emphasize the importance of IT-related 

purchases being approved by the Office of Information Technology prior to the purchase and clarify the 

types of purchases that require OIT approval. This will help ensure that Information Technology 

purchases are not made until all approvals are obtained. 

Response

Concur. The OAS is drafting a new regulation to replace SECR 10-6 with an estimated release date of 

March 2009. The new regulation will address policies regarding the use of the GPC to purchase IT related 

items. 

Recommendation 9 

The Office of Administrative Services Agency Program Coordinator should issue a reminder to 

cardholders that Government Purchase Card transactions must have funds obligated prior to making a 

purchase. 

Response 

Concur. The APC has issued a reminder to cardholders (Attachment K). 

Recommend closure of this finding. 

Recommendation 10 

The Office of Administrative Services Agency Program Coordinator should consult with the Office of 

Financial Management to verify that obligations that are open at the end of the fiscal year are rolled 

forward into the next fiscal year. 

Response 

Concur. 

• The OFM and the APC have consulted on ways to verify open commitments at the end of the 

fiscal year. 

• OFM plans to re-institute the process whereby funds are obligated rather than committed prior to 

using the GPC. It is planned to re-institute the process to coincide with the transition of the GPC 

Program to JPMorgan Bank in November 2008. 

Recommendation 11 

The Office of Administrative Services Agency Program Coordinator and the Office of Financial 

Management should work together to identify underlying root causes, thereby ensuring payments are 

made to Mellon Bank within 30 days after receipt of the Mellon Bank Government Purchase Card 

statement. 
20 

Response 11 

Concur. 

• Since early 2008, OFM pays the bank as the approved statements arrive. 

• The APC sends emails periodically throughout the month reminding cardholders of the due date 

(Attachment L). 

• Since June 2008, cardholders receive their bank statements via email, which provides them 7 to 

10 additional calendar days to process their statements. 

• As of March 2008, OFM receives approved statements via email rather than receiving paper 

statements, which contributed to lost statements and a longer processing time. 

Recommend closure of this finding. 

Recommendation 12 

The Office of Administrative Services should develop a formal Securities and Exchange Commission 

Government Purchase Card training course and set up a plan to rollout the training to all cardholders in a 

timely manner. 

Response 12 

Concur: The APC developed formal training and conducted the first class on August 6, 2008 to new 

cardholders. To ensure adequate time for existing cardholders to attend classes the APC plans to conduct 

5 classes between August 2008 and March 2009. The APC will offer training quarterly thereafter 

(Attachment M). 

Recommend closure of this finding. 

Recommendation 13 

The Office of Administrative Services Agency Program Coordinator should update the email distribution 

list to ensure that Government Purchase Card email messages are sent to all cardholders. 

Response 13 

Concur. The GPC distribution list is up-to-date and will be maintained (Attachment N). 

Recommend closure of this finding. 

Recommendation 14 

The Office of Administrative Services should instruct the Agency Program Coordinator and Approving 

Officials to require completion of Government Purchase Card training and a signed Letter of Delegation 

before the Government Purchase Card is issued to the cardholder. 
21 

Response 14 

Concur. 

• The OAS is drafting a new regulation to replace SECR 10-6 with an estimated release date of 

March 2009. The regulation will address the requirement to complete GPC training and to return 

a signed memorandum of Acknowledgement and Acceptance before issuing a GPC. 

• The APC will revise AO delegation letters to stipulate that AO’s must ensure that CHs have 

current certificates of training prior to approving a GPC statement. 

Recommendation 15

The Office of Administrative Services should develop procedures to review and ensure that cardholder 

limits agree to the Letter of Delegation and the Government Purchase Card provider on a regular basis. 

Response 15 

Concur. On a quarterly basis, the APC will verify cardholder limits against delegation letters. The APC 

can also access spending limits real-time via the internet and may receive reports upon request from the 

bank. 

Recommend closure of this finding. 

Recommendation 16 

The Office of Administrative Services should revise the SECR 10-6, Smartpay Purchasing Card 

Program, and require supervisors or the Approving Official to notify the Agency Program Coordinator 

that a cardholder is leaving the Securities and Exchange Commission. The Agency Program Coordinator 

should immediately suspend the cardholder's Government Purchase Card. 

Response 16 

Concur. The OAS will incorporate this recommendation into the new SECR 10-6 with an estimated 

release date of March 2009. 

Recommendation 17 

The Office of Administrative Services should develop procedures to ensure that the Agency Program 

Coordinator does not have direct access to a Government Purchase Card. 

Response 17 

Concur. The OAS will incorporate this recommendation into the new SECR 10-6 with an estimated 

release date of March 2009. The card issued to the current APC was cancelled in February 2008 at the 

direction of the head of the contracting activity. 

 
Appendix III 

 Office of Inspector General 

Response to Management Comments

The Office of Administrative Services (OAS) concurred with all 17 findings and 

recommendations and they indicated that several recommendations are already being 

implemented. For 9 of the 17 findings, OAS provided the Office of Inspector General (OIG) 

with supporting documentation and requested the recommendations be closed. As part of our 

audit follow-up process we will conduct a detailed review of the supporting documentation OAS 

has provided OIG and based on our confirmation that the corrective action satisfactorily 

addresses the report’s findings and recommendations, we will close the recommendations 

accordingly.

22 
Audit Request and Ideas

The Office of Inspector General welcomes your input. If you would like to request an audit in 

the future or have an audit idea, please contact us at: 

U.S. Securities and Exchange Commission 

Office of Inspector General 

Attn: Assistant Inspector General, Audits (Audit Request/Ideas) 

100 F Street, N.E. 

Washington D.C. 20549-2736 

Tel. # 202-551-6061 

Fax # 202-772-9265 

Email: oig@sec.gov

Hotline 

To report fraud, waste, abuse, and mismanagement at SEC, contact the 

Office of Inspector General at: 

Phone: 877.442.0854 

Web-Based Hotline Complaint Form: www.reportlineweb.com/sec_oig