Controls Over the SEC’s Government

Purchase Card Program 

March 28, 2014

Report No. 517
 UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

 WASHINGTON, D.C. 20549

 OFFICE OF

INSPECTOR GENERAL

M E M O R A N D U M

March 28, 2014

To: Vance Cathell, Director, Office of Acquisitions

From: Carl W. Hoecker, Inspector General, Office of Inspector General

Subject: Controls Over the SEC’s Government Purchase Card Program, 

Report No. 517

Attached please find the Office of Inspector General’s (OIG) final report detailing the results of 

our audit of controls over the U.S. Securities and Exchange Commission’s (SEC’s) 

government purchase card program. The report contains 11 recommendations for corrective 

action that, if fully implemented, should strengthen the SEC’s government purchase card 

program. 

On March 13, 2014, we provided you with a draft of our report for your review and comment. 

In your response, you concurred with our recommendations. We have included your response 

as Appendix III in the final report.

Within the next 45 days, please provide the OIG with a written corrective action plan that 

addresses the recommendations. The corrective action plan should include information such 

as the responsible official/point of contact, timeframe for completing required actions, and 

milestones identifying how your office will address the recommendations.

We appreciate the courtesies and cooperation extended to us during the audit. If you have 

questions, please contact me or Rebecca L. Sharek, Deputy Inspector General for Audits, 

Evaluations, and Special Projects.

Attachment

cc: Mary Jo White, Chair

Erica Y. Williams, Deputy Chief of Staff, Office of the Chair

Luis A. Aguilar, Commissioner

Daniel M. Gallagher, Commissioner

Kara M. Stein, Commissioner 

Michael S. Piwowar, Commissioner 

Jeffery Heslop, Chief Operating Officer

Anne K. Small, General Counsel

Timothy Henseler, Director, Office of Legislative and Intergovernmental Affairs

John J. Nester, Director, Public Affairs
Michael Whisler, Assistant Director, Office of Acquisitions

Judith Blake, Branch Chief, Business Management Office, Office of Acquisitions

Tanya Dorsey, Management and Program Analyst, Business Management 

Office, Office of Acquisitions

Karen Glass, Agency/Organization Program Coordinator, Office of Acquisitions

Darlene L. Pryor, Management and Program Analyst, Office of the Chief 

Operating Officer
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

i

Why We Did This Audit

Purchase cards, by their nature, are 

at risk for misuse, fraud, waste, and 

abuse. The Government Charge 

Card Abuse Prevention Act of 2012

(Act) requires that executive 

agencies that issue and use 

purchase cards “establish and 

maintain safeguards and internal 

controls” over their usage. The Act 

further requires the Inspector 

General of each executive agency 

to conduct, at a minimum, annual 

assessments of the agency’s 

purchase card program and to 

perform analysis or audits, as 

necessary, of purchase card 

transactions. Inspectors General 

must report the results of such 

analysis or audits to the head of the 

executive agency and report to the 

Director of the Office of 

Management and Budget on the

agency’s progress in implementing 

corrective actions.

What We Recommended

To improve the SEC’s controls over 

its purchase card program, we 

made 11 recommendations for 

corrective action. The 

recommendations address training; 

controls over transactions; 

requirements of the Government 

Charge Card Abuse Prevention Act 

of 2012; controls over monthly 

purchase limits; reconciliations with 

bank information; and reviews of 

rebates. Management concurred 

with the recommendations, which 

will be closed upon completion and 

verification of corrective action.

What We Found

We conducted a risk assessment of the SEC’s purchase card 

program and determined an overall risk level of moderate. We 

found that the SEC Office of Acquisitions (OA) has established 

internal controls that reduce the risk of fraud, waste, and abuse 

in the usage of purchase cards and convenience checks. 

Moreover, we did not find any instances of illegal or erroneous 

use of purchase cards or convenience checks. Nevertheless, 

certain areas need strengthening. We found that:

 purchase cardholders and approving officials did not 

complete or properly document all required training; 

 controls over purchase card and convenience check 

transactions need improvement; 

 OA did not always adjust monthly credit limits as necessary 

or meet all requirements of the Government Charge Card 

Abuse Prevention Act of 2012;

 purchase cardholders and approving officials did not timely 

reconcile purchases with bank information;

 OA did not develop a charge card management plan and 

other information for agency reporting to the Office of 

Management and Budget; and 

 OA did not review bank rebates for accuracy and proper 

recording.

Three findings – “BankCard Log Not Used,” “Documentation Not 

Available,” and “Untimely Certification [of Training]” – were 

previously identified as weaknesses in our 2008 report, Internal 

Control Review of the Government Purchase Card Program, 

Report No. 440, September 18, 2008. Management concurred 

with all 17 recommendations for corrective action resulting from 

the report, all of which were closed.

In September 2012, OA assigned a new Agency/Organization 

Program Coordinator who has taken steps to improve the SEC’s 

purchase card program. During our audit, the Coordinator 

identified and reported to management many of the deficiencies 

we observed. Additional management attention is warranted to 

ensure that the SEC’s safeguards and internal controls over 

purchase card and convenience check use are adequate and 

effective.

Executive Summary Controls Over the SEC’s Government Purchase 

Card Program

Report No. 517

March 28, 2014

For additional information, contact the Office of Inspector General at 

(202) 551-6061 or http://www.sec.gov/about/offices/inspector_general.shtml.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 ii MARCH 28, 2014

TABLE OF CONTENTS 

Executive Summary .....................................................................................................i

Background and Objectives.......................................................................................1

Background .................................................................................................................1

Objectives ....................................................................................................................4

Results ........................................................................................................................5

Finding 1: Compliance With and Oversight of Purchase Card Training Requirements 

Need Improvement .................................................................................................5

Recommendation 1 ......................................................................................................6

Recommendation 2 ......................................................................................................6

Finding 2: Controls Over Purchase Card and Convenience Check Transactions 

Need Improvement .................................................................................................8

Recommendation 3 ....................................................................................................11

Recommendation 4 ....................................................................................................11

Recommendation 5 ....................................................................................................11

Recommendation 6 ....................................................................................................12

Recommendation 7 ....................................................................................................12

Finding 3: OA Did Not Always Adjust Monthly Credit Limits or Meet All Requirements

of the Charge Card Abuse Prevention Act ...........................................................14

Recommendation 8 ....................................................................................................15

Recommendation 9 ....................................................................................................16

Finding 4: PCHs and AOs Did Not Timely Reconcile Purchases with Bank

Information ...........................................................................................................17

Recommendation 10 ..................................................................................................18

Finding 5: OA Did Not Develop a Charge Card Management Plan and Other

Information for Agency Reporting to OMB ............................................................20

Finding 6: OA Did Not Review Bank Rebates for Accuracy and Proper Recording....22

Recommendation 11 ..................................................................................................23

Tables

Table 1: SEC Purchase Card and Convenience Check Spending by FY.....................2

Table 2: Results of Testing: Sampled Purchase Card and Convenience Check 

Transactions...........................................................................................................9

Table 3: A/OPC’s Followup on Late Reconciliations and Approvals...........................18

Table 4: SEC Purchase Card Rebates by FY ............................................................22

Appendices 

Appendix I: Scope and Methodology .........................................................................24

Appendix II: Applicable Federal Laws, Regulations, Policies, and Guidance .............28

Appendix III: Management Comments.......................................................................30

Appendix IV: OIG Response to Management Comments ..........................................33
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 iii MARCH 28, 2014

ACRONYMS

AO approving official or alternate approving official

A/OPC Agency/Organization Program Coordinator

FAR Federal Acquisition Regulation

FY fiscal year

GSA General Services Administration

MCL monthly credit limit

OA Office of Acquisitions

OMB Office of Management and Budget

PCH purchase cardholder

SEC U.S. Securities and Exchange Commission

TFM Treasury Financial Manual
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 1 MARCH 28, 2014

Background and Objectives 

Background 

Executive agencies, including the U.S. Securities and Exchange Commission (SEC), 

use purchase cards and convenience checks1to purchase needed goods and services. 

Agencies must maintain internal controls that reduce the risk of fraud, waste, and abuse

in their purchase card programs. Specifically, the Government Charge Card Abuse 

Prevention Act of 2012 (Charge Card Abuse Prevention Act or Act) 2requires heads of 

executive agencies that issue and use purchase cards and convenience checks to 

“establish and maintain safeguards and internal controls” over their usage. The Act 

further requires the Inspector General of each executive agency to take these actions:

 conduct periodic assessments of the agency’s purchase card program to identify 

and analyze the risks of illegal, improper, or erroneous purchases and payments;

 perform analysis or audits, as necessary, of purchase card transactions designed 

in part to identify potentially illegal, improper, or erroneous uses of purchase 

cards; 

 report the results of such analysis or audits to the head of the executive agency 

concerned; and

 report to the Office of Management and Budget (OMB) on the agency’s 

implementation of recommendations that address the audit findings.3

Additionally, the Act requires the head of each executive agency having more than 

$10 million in annual purchase card spending to report semiannually to the OMB, jointly 

with the agency’s Inspector General, any violations or other actions committed by the 

agency’s employees that are covered by the Act. OMB Memorandum M-13-21,

Implementation of the Government Charge Card Abuse Prevention Act of 2012, 

September 6, 2013, provides guidance to executive departments and agencies on 

implementing the Act’s internal control and reporting requirements. 

 

1

According to Office of Management and Budget Circular A-123, Management’s Responsibility for 

Internal Control, Appendix B, Revised, convenience checks are “a payment and/or procurement tool 

intended only for use with merchants that do not accept purchase cards and for other authorized 

purposes where charge cards are not accepted.” In this report, “purchase card program” includes both 

purchase cards and convenience checks.

2

Public Law 112-194 (October 5, 2012). 

3 On January 27, 2014, we reported to OMB that our most recent audit of the SEC’s purchase card 

program – Internal Control Review of the Government Purchase Card Program, Report No. 440,

September 18, 2008 – resulted in 17 recommendations for corrective action, all of which were closed (see 

http://www.sec.gov/about/offices/oig/reports/audits/2008/440finmemo.pdf). We further reported that the 

OIG was in the process of performing an audit of the SEC’s purchase card program and expected to 

issue this report by March 31, 2014.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 2 MARCH 28, 2014

As shown in Table 1, the SEC’s purchase card and convenience check spending 

averaged about $5.3 million between fiscal years (FY) 2010 and 2013.

4

Table 1: SEC Purchase Card and Convenience Check Spending by FY

FY

Purchase 

Card 

Spending

Convenience 

Check 

Spending

Total Average Amount 

Spent

2010 $4,932,258 $184,980 $5,117,238

$5,266,202

2011 $4,474,987 $324,395 $4,799,382

2012 $5,636,457 $512,063 $6,148,520

2013 $4,531,635 $468,031 $4,999,666

Source: SEC Office of Acquisitions.

The requirements for agency acquisitions using simplified acquisition methods such as 

government purchase cards are outlined in the Federal Acquisition Regulation (FAR).

5

 

Additionally, OMB Circular No. A-123, Management’s Responsibility for Internal Control, 

Appendix B, Revised (OMB Circular A-123), provides policies and procedures for 

agencies’ management of purchase cards and requires agencies to have internal 

controls to reduce the risk of fraud, waste, and error in the usage of those cards. 

Further, SEC Operating Procedure, OP 10-6, Government Purchase Card Program (OP 

10-6), details the policies and procedures for the SEC’s purchase card program and 

describes the responsibilities of those who administer and manage the program.

SEC’s Purchase Card Program

The Office of Acquisitions (OA) oversees the SEC’s purchase card program. 

Specifically, OA’s Agency/Organization Program Coordinator (A/OPC) is responsible for 

the program’s management, administration, and day-to-day operations. According to 

OP 10-6, the A/OPC’s responsibilities include, in part, the following duties: 

 reviewing and processing nominations for new purchase cardholders (PCHs) and 

approving officials (AOs)

6

and opening, maintaining, and closing cardholder 

accounts; 

 facilitating and ensuring adequate training and maintaining PCH and AO training 

records;

 developing and updating program policies and procedures and serving as the 

primary contact for program policy matters;

 

4

Because the SEC’s annual purchase card spending amounted to less than the $10 million reporting 

threshold, the SEC Office of Inspector General and the SEC Chair are not required to issue to OMB a 

joint semiannual report. 

5

48 Code of Federal Regulations, Chapter 1, Subchapter C, Part 13.

6

In this report, “AO” also refers to personnel who function as alternate AOs when the designated AO is 

unavailable.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 3 MARCH 28, 2014

 reviewing and raising or lowering purchase card credit limits; and

 serving as the SEC liaison with the bank that issues purchase cards and 

ensuring that PCHs timely reconcile transactions with bank information.

Until December 2011, the SEC’s purchase card issuer was J.P. Morgan Chase and Co. 

(J.P. Morgan Chase). U.S. Bancorp has been the SEC’s purchase card issuer from 

January 2012 to present. 

As of September 30, 2013, the SEC had 85 PCHs at its headquarters and regional 

offices. PCHs have a single purchase, micro-purchase threshold7of $3,000 for standalone procurements and a monthly purchase limit set by the A/OPC. In addition, every 

PCH has a designated AO who is required to approve purchases in advance. 

Some PCHs also use convenience checks to purchase needed goods and services. 

However, according to OMB Circular A-123 and OP 10-6, convenience checks are 

permitted only when a vendor does not accept the purchase card and there is no other 

source available. Before using a convenience check, PCHs are required to make a 

reasonable effort to locate another vendor that can provide the same goods and 

services and that can accept the purchase card; PCHs are also required to document

that effort.

Purchase Card and Convenience Check Training 

As a safeguard and internal control, the Charge Card Abuse Prevention Act mandates 

that “[a]ppropriate training is provided to each purchase cardholder and each official 

with responsibility for overseeing the use of purchase cards issued by the executive 

agency.” OMB Circular A-123, as well as Treasury Financial Manual Part 4—4500, 

Government Purchase Cards (TFM, Part 4—4500), also require that PCHs and AOs 

complete training before their appointments, take refresher training at least every 

3 years, and maintain evidence of completed training. Lastly, the SEC’s purchase card 

operating procedure requires PCHs and AOs to take initial and refresher training. 

Specifically, OP 10-6 requires PCHs, AOs, and the A/OPC (purchase card program 

participants) to take the online course “GSA [General Services Administration] 

SmartPay Purchase Card Training (Cardholders).” PCHs and AOs are required to 

complete the training before assuming their purchase card duties. The course provides 

PCHs and AOs instructions on how to secure and use the purchase card and how to 

avoid fraudulent use. The course also includes standards of conduct and ethics for the 

use of the card and the consequences for misuse of the card. PCHs who use 

convenience checks are required to take supplemental training before using the checks. 

PCHs must confirm with the A/OPC that they have completed the convenience check 

training. Purchase card program participants are also required to take the GSA online 

purchase card course as refresher training every 3 years. Upon completing the course,

 

7

According to the FAR, Section 13.201, a “micro-purchase” is an acquisition of supplies or services using 

simplified acquisition procedures. The amount of the purchase cannot exceed the specified “micropurchase threshold.”
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 4 MARCH 28, 2014

purchase card program participants must take a test and score 75 percent or higher to 

obtain a completion certificate. The certificate includes the employee’s name, course 

name, and training completion date. The employee is required to print a copy of the 

certificate for his or her records and provide a copy to the A/OPC.

Best Practice – A/OPC’s Reviews of PCH Activity

In September 2012, OA assigned a new A/OPC. In January 2013, the A/OPC began

conducting reviews of the purchase card records for all PCHs with purchase cards as of 

December 31, 2012 (74 cardholders). The A/OPC performed the reviews from January 

to August 2013. The A/OPC informed us that the reviews consisted of discussions with 

PCHs about their purchase card and convenience check procedures and reviews of a 

sample of purchase card transactions. In September 2013, the A/OPC detailed her 

findings in a memo to the OA Director. The A/OPC informed us that she would be

conducting reviews of all PCHs again in FY 2014. She indicated in her memo to the OA 

Director that she would schedule FY 2014 reviews first with those cardholders who were 

found noncompliant with policies and procedures “to ensure proper corrective actions 

were implemented.” We consider the A/OPC’s reviews to be a best practice.

Objectives 

The objectives of the audit were to:

 determine whether the SEC’s purchase card program effectively operates and is

properly managed in compliance with governing laws and regulations and 

agency policy; and

 assess whether the internal controls over the SEC’s purchase card program have 

been adequately designed, appropriately implemented, and are operating 

effectively to detect misuse, fraud, waste, or abuse by cardholders or others.

Appendixes I and II include additional information on our scope and methodology;

review of internal controls; statistical sampling; prior coverage; and the applicable

Federal laws, regulations, policies, and guidance.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 5 MARCH 28, 2014

Results

Finding 1: Compliance With and Oversight of Purchase Card

Training Requirements Need Improvement

Some PCHs and AOs did not complete required refresher training. 

In addition, some AOs had not taken any purchase card training. 

Further, OA’s purchase card training files were not current for all 

purchase card program participants.

OMB Circular A-123, TFM Part 4—4500, and OP 10-6 require PCHs and AOs to 

complete training before their appointments and to take periodic refresher training. 

Purchase card program participants are further required to document their completion of 

purchase card training.

The A/OPC oversees cardholder training and maintains the OA file that contains the 

PCHs’ and AOs’ training records. In addition, the A/OPC keeps a control list of all 

PCHs and AOs and the dates they last completed required training. The A/OPC uses 

that list to monitor the PCHs’ and AOs’ training status to ensure that they comply with 

training requirements.

To determine whether purchase card training was properly managed for compliance 

with governing regulations and guidance and whether appropriate internal controls were 

designed, implemented, and operating effectively, we reviewed PCH and AO training 

and A/OPC oversight. We obtained the A/OPC’s May 28, 2013, control list, which

consisted of the names and training dates of 137 PCHs and AOs. We then reviewed 

OA’s training records for all PCHs and AOs. We noted that some AOs oversee more 

than one PCH and that some PCHs also function as AOs to other PCHs. 

We determined that most SEC purchase card program participants had timely 

completed required purchase card training, as evidenced by a current training certificate 

in OA’s files. However, we found that 8 percent (10 of 137) of PCHs and AOs—7 PCHs 

and 3 AOs—had training certificates that were over 3 years old. We also found that an 

additional four AOs did not have any training certificates on file. We contacted those 

14 individuals and asked whether they had current purchase card training certificates. 

One PCH who had an outdated certificate on file and one AO who had no certificate on 

file provided us with certificates that showed their purchase card training was current. 

We were unable to locate current certificates for the remaining 12 PCHs and AOs 

identified as having missing or outdated certificates. Our review determined that the 

purchase card training files were not current and that PCH and AO compliance with 

training requirements, and A/OPC oversight, need to be strengthened.

We also found that the A/OPC had not tracked PCHs’ convenience check training. This 

training consists of PowerPoint presentation slides that PCHs are required to review 

before they can use convenience checks. The A/OPC informed us that since March 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 6 MARCH 28, 2014

2013 she has required PCHs to confirm that they have viewed the slides and that they 

have no questions about them. The A/OPC also told us that she was extending this 

requirement to AOs.

Conclusion

Not all PCHs and AOs complied with training requirements. Further, OA had not fully 

established controls to ensure that PCHs and AOs complied with the SEC’s training 

policy. We noted that the A/OPC had been newly assigned and had not had an 

opportunity to fully establish such controls.

Without effective controls over purchase card training, PCHs and AOs might not 

complete required training, which could result in a lack of awareness about purchase 

card program requirements and restrictions. This could potentially lead to misuse of 

purchase cards and/or convenience checks.

Recommendation 1: 

The Office of Acquisitions should (a) establish procedures to periodically verify that

purchase cardholders and approving officials have taken the required purchase card 

and convenience check training; and (b) restrict purchase cardholders’ use of 

purchase cards or approving officials’ participation in the approval process when 

those individuals do not timely complete required purchase card training.

Management Comments. The OA Director concurred with this recommendation

and stated that OA had identified this issue and was working to correct it during 

the audit. The OA Director further stated that OA completed a 100 percent 

verification of training in July 2013 and established internal procedures and 

controls to assure that training is current and that OA takes action to restrict 

official’s participation if training is not current. Management’s complete response 

is reprinted in Appendix III.

OIG Evaluation of Management’s Response. Management’s actions are 

responsive; therefore, the recommendation is resolved and will be closed upon 

verification of the actions taken.

Recommendation 2:

The Office of Acquisitions should remind purchase cardholders and approving 

officials of the requirement to (a) notify the Agency/Organization Program 

Coordinator that they have completed initial and refresher training; and (b) send their 

training certificates to the Agency/Organization Program Coordinator.

Management Comments. The OA Director concurred with this recommendation

and stated that the A/OPC conducted training in August 2013, and provided a 

general reminder to all purchase card program participants. The OA Director 

further stated that, as training renewals become due, each participant will be 

reminded and appropriate action will be taken if their training certificates are not 

received. Management’s complete response is reprinted in Appendix III.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 7 MARCH 28, 2014

OIG Evaluation of Management’s Response. Management’s actions and 

proposed actions are responsive; therefore, the recommendation is resolved and 

will be closed upon verification of the actions taken.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 8 MARCH 28, 2014

Finding 2: Controls Over Purchase Card and Convenience 

Check Transactions Need Improvement

PCHs and AOs did not fully comply with the SEC’s purchase card 

program’s operating procedure. Further, OA did not implement 

adequate internal controls needed to ensure that PCHs obtained 

and maintained supporting documentation and used purchase card 

logs and that AOs properly approved purchase card and 

convenience check transactions.

Federal laws and regulations, as well as the SEC’s purchase card operating procedure,

require PCHs to obtain and keep adequate documentation for purchase card 

transactions and to adhere to purchase card policies. The Charge Card Abuse 

Prevention Act requires that each executive agency establish safeguards and internal 

controls to ensure that the “[r]ecords of each purchase card transaction (including 

records on associated contracts, reports, accounts, and invoices) are retained in 

accordance with standard Government policies on the disposition of records.” 

According to the National Archives and Records Administration guidelines,

8

these 

materials must be retained for 3 years after the final payment is made. OP 10-6 

requires cardholders to “[m]aintain supporting documentation of individual transactions, 

such as vendor quotes, receipts, invoices, and sole-source justifications if applicable, 

and make documentation readily available for examination.” OP 10-6 also requires 

PCHs to keep a purchase card log which, along with the documentation supporting 

each transaction, must be reconciled with bank information. 

Supporting documentation assists the AO and the A/OPC in examining the 

appropriateness of a given purchase, and the PCHs need it to reconcile their purchase 

records with the transaction information from the bank. PCHs are also required to 

obtain the AO’s approval in writing before making a purchase.

OP 10-6, in alignment with OMB Circular A-123, states that “[c]ardholders may use 

convenience checks as a method of payment for transactions only when the vendor will 

not accept a GPC [government purchase card] and no other source is available.” OP 

10-6 requires the PCH, before using a convenience check, to make a reasonable effort 

to locate a vendor that provides the same goods and services and accepts purchase 

cards. PCHs are also required to document that effort.

Testing of Purchase Card and Convenience Check Transactions

To determine whether controls over the purchase card program were effectively 

operating and properly managed in compliance with governing regulations, guidance, 

and policy, we randomly selected a total of 148 transactions, comprised of two samples. 

We selected 749purchase card and convenience check transactions from a universe of 

 

8 National Archives and Records Administration, General Records Schedules, Transmittal No. 22, April 

2010, General Records Schedule 3, Procurement, Supply, and Grant Records.

9

Ten of the 148 transactions were made with convenience checks. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 9 MARCH 28, 2014

approximately 25,000 transactions from October 2009 to September 2012,

10 and 

74 purchase card and convenience check transactions from a universe of 

7,368 transactions from October 2012 to September 2013. The PCHs were requested 

to provide documentation to support the related transactions. Second, and in some 

cases, third requests were sent to PCHs who did not respond to our initial requests for 

information or who did not provide all requested documents.

Using the supporting documents provided to us, we tested the transactions to determine 

whether they were properly approved, adequately documented, and followed Federal 

regulations and SEC policy. Table 2 shows the results of our testing.

Table 2: Results of Testing: Sampled Purchase Card and Convenience Check 

Transactions

Results Cause

For 2 of 148 transactions, PCHs did not provide 

supporting documents; those two transactions 

were made by individuals who are no longer 

PCHs. 

OA did not, at the time, have a process to 

obtain the records of PCHs who relinquish 

their purchase cards.

For 52 out of 148 transactions, the PCHs did not 

provide documentation that the AO had approved 

the transactions before the purchases were

made. 

These PCHs did not comply with OP 10-6, 

which requires PCHs to obtain AO approval in 

writing before making a purchase. 

For 3 out of 10 convenience check transactions,

no documentation was provided to support the 

use of convenience checks. 

These PCHs did not comply with OP 10-6 

documentation requirements for the use of

convenience checks.

For 18 out of 148 transactions, we did not find the 

purchase recorded on the purchase log, or the 

amount either was not recorded on the log or 

differed from the amount on the invoice or bank 

information. 

Certain PCHs used self-designed purchase 

log formats instead of the OA-recommended 

template; we could not find all purchases 

recorded on these logs. Some differences 

between the log and the bank information 

were due to the accumulation of amounts on 

the log that were shown individually by the 

bank.

For 18 out of 148 transactions, PCHs did not 

provide purchase card logs.

Some PCHs did not adhere to the requirement 

in OP 10-6 to maintain purchase card logs.

For 2 purchase card transactions, there was no 

documented preapproval by the Office of 

Financial Management for the purchase of food 

or drink.

Certain PCHs did not comply with SEC policy.

Source: Results of Office of Inspector General transactions testing.

Overall, we did not identify any instances of illegal or erroneous use of the purchase 

card. However, we found areas that need improvement and additional oversight. For 

example, for some transactions in our sample, we were unable to obtain supporting 

 

10 We were unable to test transactions for October 2009 because the bank statements were not available. 

We also did not test transactions from January through March of 2012, because the information from the 

bank indicated that those months’ transactions had not been closed. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 10 MARCH 28, 2014

documentation or evidence that the AO had approved the transaction before the 

purchase was made. In addition, for some transactions using convenience checks, no 

documentation was provided to show that the PCH had made a reasonable effort to 

locate other vendors that could provide the same goods and services and that could

accept the purchase card. Finally, we found that some PCHs had not maintained or 

properly completed purchase card logs in accordance with OP 10-6. These instances

were primarily caused by a lapse in compliance by PCHs and oversight by OA and 

resulted in reduced controls over purchasing activity. We previously identified 

deficiencies in the maintenance of purchase logs and the unavailability of 

documentation in our audit report entitled Internal Control Review of the Government 

Purchase Card Program, Report No. 440, September 18, 2008.11

Moreover, our review revealed an internal control deficiency in the processing and 

approval of certain invoices for deposition services. A PCH informed us that an SEC

attorney had requested deposition services directly from a vendor and that the vendor 

had forwarded three resulting invoices, totaling $5,247, directly to the attorney. The 

PCH said that she was unaware of the transaction until she received the invoices from 

the attorney. The AO told us that he had not approved the transactions before the 

services were ordered, as required. The A/OPC also noted this practice during her FY

2013 reviews of cardholder activity. In her summary memo to the OA Director, the 

A/OPC stated, “There was a long-term acceptance of the practice of attorneys and 

paralegals contacting vendors with the intention of ordering services/supplies,” and she 

called it a “serious” issue. If SEC attorneys continue this practice, there is a risk that the 

PCHs could exceed their spending limits, and/or the attorneys could make unauthorized 

purchases of goods and services.

Conclusion

We found deficiencies in AOs’ purchase approvals and PCHs’ transaction 

documentation and purchase log maintenance. We also identified an internal control 

deficiency in the processing and approval of certain invoices. Specifically, an SEC 

attorney, rather than the PCH, had ordered deposition services from a vendor, and the 

AO did not approve the transaction before it was placed.

Accordingly, internal controls over purchase card and convenience check transactions

need strengthening. This includes controls for PCHs’ and AOs’ compliance with 

purchase card policy and the A/OPC’s related oversight responsibilities. Having

effective controls helps ensure that purchase cards and convenience checks are used 

properly in accordance with governing regulations, guidance, and policy. 

 

11 The report can be accessed over the Internet at 

http://www.sec.gov/about/offices/oig/reports/audits/2008/440finmemo.pdf. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 11 MARCH 28, 2014

Recommendation 3:

The Office of Acquisitions should ensure that the Agency/Organization Program 

Coordinator takes these actions: 

(a) continues to conduct periodic purchase card reviews and monitors

compliance with purchase card policies such as (1) transaction approvals by 

approving officials prior to purchase; (2) adequate documentation of purchase 

card and convenience check transactions; and (3) maintenance of purchase logs 

using the purchase log template; and

(b) promptly communicates to the appropriate purchase cardholders and 

approving officials any deficiencies identified during these reviews that need 

corrective action.

Management Comments. The OA Director concurred with this recommendation

and stated that the A/OPC will continue to follow the procedures and 

communicate any deficiencies identified for corrective action. Management’s 

complete response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. Management’s proposed actions 

are responsive; therefore, the recommendation is resolved and will be closed 

upon verification of the actions taken.

Recommendation 4:

The Office of Acquisitions should (a) remind purchase cardholders and approving 

officials that only cardholders may order goods and services; and (b) ensure that the 

Agency/Organization Program Coordinator includes compliance with this 

requirement in her periodic purchase card reviews.

Management Comments. The OA Director concurred with this recommendation

and stated that the A/OPC reminded purchase card program participants during 

the August 2013 training that only cardholders may place orders. The OA 

Director further stated that the A/OPC will review compliance during the periodic 

purchase card reviews. Management’s complete response is reprinted in 

Appendix III.

OIG Evaluation of Management’s Response. Management’s actions and 

proposed actions are responsive; therefore, the recommendation is resolved 

and will be closed upon verification of the actions taken.

Recommendation 5:

The Office of Acquisitions should take appropriate action, up to and including 

suspension and cancellation of purchase card or approval authority, for cardholders 

and approving officials who do not comply with purchase card policies.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 12 MARCH 28, 2014

Management Comments. The OA Director concurred with this recommendation

and stated that, based on the facts of any occurrence, OA will consider other 

remedies up to and including suspension or cancellation of program authority for 

those who fail to comply with purchase card policies. Management’s complete 

response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. Management’s proposed actions 

are responsive; therefore, the recommendation is resolved and will be closed 

upon verification of the actions taken.

Recommendation 6:

The Office of Acquisitions should consider obtaining a contract for deposition 

services.

Management Comments. The OA Director concurred with this recommendation

and stated that OA’s Mission Support Branch, in conjunction with the 

Enforcement Division, has been working on a strategic sourcing initiative. The 

OA Director further stated that a request for proposal was issued, proposals are 

being evaluated, and an award is anticipated in the near future. Management’s 

complete response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. Management’s proposed actions 

are responsive; therefore, the recommendation is resolved and will be closed 

upon verification of the actions taken.

Recommendation 7:

The Office of Acquisitions should determine whether the purchase of deposition 

services without proper authority and approval is consistent with (a) SEC Operating 

Procedure OP 10-6, “Government Purchase Card Program”; and (b) SEC 

Administrative Regulations SECR 10-1 (Rev. 1), “Ratification of Unauthorized 

Commitments,” and take appropriate action as necessary.

Management Comments. The OA Director concurred with this recommendation

and stated that OA shares the concern about potential procurement of deposition 

services or other services without proper authority and is committed to 

implementing the purchase card program with all reasonable controls to assure 

proper exercise of authority. The OA Director further stated that ongoing efforts 

to establish contractual methods to support deposition services, increase 

oversight, and enhance training for program participants will effectively manage 

risk in this area. Management’s complete response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. We are pleased that 

management concurred with this recommendation and agree that management’s 

proposed actions will improve controls over future purchases. However, we 

reiterate that OA should determine whether known purchases of deposition 

services without proper authority and approval require action in accordance with 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 13 MARCH 28, 2014

SEC Administrative Regulations SECR 10-1 (Rev. 1), “Ratification of 

Unauthorized Commitments.” We will conduct followup activities to determine 

whether OA takes corrective action that is responsive to the recommendation. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 14 MARCH 28, 2014

Finding 3: OA Did Not Always Adjust Monthly Credit Limits 

or Meet All Requirements of the Charge Card Abuse 

Prevention Act

OA does not periodically review and adjust PCHs’ monthly credit 

limits (MCL) to reflect actual needs. Also, OA has not established

policies on the number of purchase cards to issue to PCHs, 

authorized credit limits, and categories of employees eligible for 

cards, as required by the Charge Card Abuse Prevention Act.

Government purchase cards have credit limits on the total amount that PCHs can spend 

during the month. Credit limit requirements are governed by the Charge Card Abuse 

Prevention Act, OMB Circular A-123, and OP 10-6. MCLs are designed to reduce 

financial risks. They ensure that PCHs do not have more credit than they require to 

make needed purchases. MCLs help prevent PCHs from spending more than is 

authorized, and they also reduce the risk that PCHs might use the card to procure 

unauthorized products or services. Therefore, it is important that the MCLs do not 

exceed the amount that the PCHs actually need.

To determine whether OA’s process for establishing and reviewing MCLs was operating 

effectively and was properly managed, we reviewed OA’s process for determining the 

PCHs’ MCLs. Previously, the default MCL for all PCHs was set at $50,000; however, 

MCLs no longer have a default amount. The PCH’s supervisor recommends an MCL 

for that PCH at the time a new purchase card application is completed. The A/OPC told

us that she reduced some PCHs’ limits after reviewing cardholder activity.

The A/OPC informed us that in December 2013 she compared, for each PCH, the 

highest month’s purchase card and convenience check spending for FY 2013 with the 

PCH’s assigned MCL. She then sent an email to each PCH’s AO, listing the highest 

month’s spending and the assigned MCL. The A/OPC stated in her email, “Specifically, 

if there is a wide gap from what you spent in FY13/month and what is authorized, we 

will be seeking to reduce the monthly limit.” In that email she also asked the AO to 

recommend, for the PCH, an appropriate MCL for FY 2014. We obtained and reviewed 

the A/OPC’s emails and noted that the highest month’s spending in FY 2013 was 

sometimes significantly less than the assigned MCL. For example, according to the 

emails, one PCH with a $50,000 MCL spent less than $1,000 in her most active month; 

another PCH with a $50,000 MCL spent in her most active month less than $10,000.

In summary, the MCLs of PCHs sometimes greatly exceeded their monthly spending. 

Better oversight over MCLs is needed to ensure that they align more closely with actual 

purchasing needs and reflect actual usage over a period of time as well as anticipated 

purchasing requirements. Having an MCL that is significantly higher than the PCH’s

purchasing needs creates a risk that the PCH could use the purchase card to spend 

more than is actually required to purchase goods and services.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 15 MARCH 28, 2014

Need for Policies on the Number, Categories, Credit Limits, and Eligibility of 

Cardholders

The Charge Card Abuse Prevention Act requires “specific policies regarding the number 

of purchase cards issued by various component organizations and categories of 

component organizations, the credit limits authorized for various categories of 

cardholders, and categories of employees eligible to be issued purchase cards, and that 

those policies are designed to minimize the financial risk to the Federal Government of 

the issuance of the purchase cards and to ensure the integrity of purchase card 

holders.”

The Charge Card Abuse Prevention Act was enacted in October 2012, and OA has not 

yet established and implemented policies on the categories of employees who are 

eligible for cards, the number of purchase cards to issue, and authorized credit limits for 

the different categories of PCHs. OA officials told us that the SEC is a small agency 

and categories of cardholders and employees are not needed. As a result, the SEC’s 

purchase card program is not fully aligned with the Act’s policy requirements. By not 

having established policies in these areas, there is a risk that the SEC’s purchase cards 

could be abused or misused.

Conclusion

We noted that there were PCHs whose monthly purchases were much lower than their 

MCLs. This indicates that all MCLs and PCH spending trends should be reviewed to 

determine whether PCHs’ MCLs should be lowered and aligned with the amount that 

the PCHs actually need. In addition, OA did not establish and implement the Charge 

Card Abuse Prevention Act requirements on credit limits, categories of cardholders, and 

eligible employees. The SEC should establish and implement all polices that are 

required by the Act. 

Recommendation 8:

The Office of Acquisitions should ensure that the Agency/Organization Program 

Coordinator, at least annually, reviews the purchase cardholders’ monthly credit 

limits and adjusts the limits on the basis of the purchase cardholders’ actual needs.

Management Comments. The OA Director concurred with this recommendation

and stated that the A/OPC has instituted a review of the monthly credit limits, to 

occur annually at the minimum. Management’s complete response is reprinted in 

Appendix III.

OIG Evaluation of Management’s Response. Management’s proposed actions 

are responsive; therefore, the recommendation is resolved and will be closed 

upon verification of the actions taken.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 16 MARCH 28, 2014

Recommendation 9:

The Office of Acquisitions should establish and implement policies on the number of 

purchase cards issued by various component organizations, the categories of 

component organizations, credit limits authorized for various categories of 

cardholders, and the categories of employees who are eligible to be issued a 

purchase card, as required under the Government Charge Card Abuse Prevention 

Act of 2012.

Management Comments. The OA Director concurred with this recommendation

and stated that, although the SEC has no component organizations that will be 

issuing purchase cards, OA will establish limits on the categories of employees 

who are eligible to receive purchase cards as well as their credit limits. 

Management’s complete response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. Management’s proposed actions 

are responsive; therefore, the recommendation is resolved and will be closed 

upon verification of the actions taken.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 17 MARCH 28, 2014

Finding 4: PCHs and AOs Did Not Timely Reconcile 

Purchases with Bank Information

Our review of the reconciliation process found that PCHs were not 

timely reconciling purchases with purchase card bank information. 

Further, AOs were not timely approving PCHs’ reconciliations.

Reconciliation is an essential internal control for the purchase card program. It ensures

that the bank has accurately recorded purchases and that the PCH has properly verified 

the purchases with the supporting documentation such as invoices and receipts. The 

Charge Card Abuse Prevention Act provides that purchase cardholders and officials 

with the authority to authorize purchase card transactions are responsible for 

“reconciling the charges appearing on each statement of account for that purchase card 

with receipts and other supporting documentation.” The SEC’s Government Purchase 

Card Program Supplemental Procedures, dated December 21, 2012 (Supplemental 

Procedures), require PCHs to “at a minimum reconcile their transactions within 30 days 

of the posting date.” Once the PCH has completed reconciliation, the AO should review 

and approve the reconciliation within that same 30-day timeframe.

To assess whether internal controls over the reconciliation process were adequately 

designed, appropriately implemented, and operating effectively, we reviewed the status 

of reconciliations with the A/OPC. The A/OPC informed us that some PCHs and AOs 

were not completing their reconciliations and approvals within the required 30-day 

period. We asked the A/OPC what control procedures she had implemented to remedy 

the situation, and she told us that she sends an email to those who miss, or are about to 

miss, the 30-day deadline.

We obtained and reviewed the A/OPC’s emails to the PCHs and AOs, which evidenced 

her followup efforts. For example, we found that on December 28, 2012, one week after 

the issuance of the Supplemental Procedures, which include the 30-day reconciliation 

requirement, the A/OPC sent an email to the PCHs and AOs informing them that they 

“...MUST reconcile transactions within 30 days.... Currently there are lots of 

transactions which need to be reviewed and approved and some are very close to 

exceeding the 30 day timeline.” We further found that she had followed up, on an 

ongoing basis, late or soon-to-be late reconciliations that the PCHs and AOs were 

responsible for completing. Table 3 details the A/OPC’s followup on reconciliations

during the first 6 months of calendar year 2013. 

 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 18 MARCH 28, 2014

Table 3: A/OPC’s Followup on Late Reconciliations and Approvals

Email Dates Number of PCHs

and AOs

Status of Reconciliations

Noted in A/OPC’s Emails

January 11, 2013 28 Late

January 16, 2013 13 Late or will be late within the week

January 25, 2013 6 Will be late within two weeks

February 1, 2013 8 Will be late within two weeks

February 22, 2013 7 Late or will be late within the week

March 18, 2013 9 Late or will be late within the week

April 26, 2013 19 Late or will be late within two weeks

May 1, 2013 13 Late

May 23, 2013 20 Late or will be late within two weeks

June 24, 2013 21 Late or will be late within two weeks

Source: A/OPC, OA.

By not performing timely reconciliations, PCHs and AOs could expose the SEC to 

undue financial risks. In February 2014, the A/OPC notified PCHs that those who miss 

the 30-day deadline for reconciliation would have their purchase card use suspended

until all late reconciliations were completed. 

Conclusion

Some PCHs and AOs have not adhered to the SEC’s requirement to reconcile and 

approve reconciliations within 30 days of the bank’s posting of charges, despite the 

A/OPC’s commendable ongoing monitoring and followup efforts. It is important that 

PCHs and AOs reconcile the bank’s information with their purchase documentation in a 

timely manner. Banks could incorrectly record charges for transactions, and OA would 

be unaware because PCHs and AOs are not timely reconciling their transactions. 

Recommendation 10:

The Office of Acquisitions (OA) should (a) notify the supervisors of purchase 

cardholders and approving officials who are habitually late reconciling purchase card 

transactions with bank information or approving such reconciliations, and 

(b) consider cancelling the purchase card program authorities of such employees.

Management Comments. The OA Director concurred with this recommendation

and stated that the A/OPC has already issued guidance to purchase card 

program participants that late reconciliation will result in suspension of the 

cardholder account. The OA Director further stated that OA will consider other 

remedies up to and including cancellation of program authority. Management’s 

complete response is reprinted in Appendix III.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 19 MARCH 28, 2014

OIG Evaluation of Management’s Response. Management’s actions and 

proposed actions are responsive; therefore, the recommendation is resolved and 

will be closed upon verification of the actions taken.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 20 MARCH 28, 2014

Finding 5: OA Did Not Develop a Charge Card Management 

Plan and Other Information for Agency Reporting to OMB

OA did not develop a charge card management plan and specified 

statistical and narrative information for the agency’s reporting to 

OMB in accordance with OMB Circular A-123.

Chapter 2.1 of OMB Circular A-123 requires Federal agencies with a purchase card 

program to have a “charge card management plan.” The plan is to include the following

elements:

 identification of key management officials and their responsibilities for the 

charge card program;

 establishment of a process for formally appointing PCHs and AOs, where 

applicable, and implementation of a process to ensure new PCHs’ 

creditworthiness;

 management controls, policies, and practices to ensure appropriate 

charge card and convenience check usage and oversight of payment 

delinquencies, fraud, misuse, or abuse;

 establishment of appropriate authorization controls; 

 documentation and record retention requirements;

 recovery of purchase cards and other documentation when employees 

terminate employment; and

 description of how the agency will ensure the ongoing effectiveness of the 

actions taken pursuant to OMB Circular A-123, including evaluation of the 

effectiveness of training and the implementation of risk management

controls.

According to OMB Circular A-123, maintaining a charge card management plan is 

important because establishing written, formal policies and procedures is needed to 

assure that internal controls are followed and the potential for fraud, misuse, and 

delinquency is minimized. The efficiency and integrity of the charge card program can 

be impaired if the agency does not consider and act upon the elements required in the 

plan. Agencies are required to submit charge card management plans at least annually, 

but not later than January 31 of each calendar year.

We determined that OA did not develop and maintain specified statistical and narrative 

information about the charge card program for the SEC’s reporting to OMB, as required 

by Chapter 5.3 of OMB Circular A-123. The SEC is required to report to OMB’s Office 

of Federal Financial Management statistical information on an annual basis and 

narrative information on a biannual basis.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 21 MARCH 28, 2014

The A/OPC told us that she was unaware of these requirements and that OA had not 

developed or maintained a charge card management plan nor had OA developed 

specified statistical or narrative information for submission to OMB. The former A/OPC 

told us that she had thought this reporting was not required. The A/OPC told us that OA 

would develop a charge card management plan and the required statistical and 

narrative information for submission to OMB by January 31, 2014. 

The A/OPC subsequently notified us that, on January 29, 2014, OA sent to OMB the

charge card management plan dated January 28, 2014, and the required statistical and 

narrative information. The A/OPC sent us a copy of the documents. Accordingly, we 

are not making a recommendation for corrective action.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 22 MARCH 28, 2014

Finding 6: OA Did Not Review Bank Rebates for Accuracy 

and Proper Recording 

OA did not verify the accuracy and proper recording of quarterly 

rebates it received from banks that issued purchase cards, resulting

in noncompliance with the Charge Card Abuse Prevention Act.

Each quarter the SEC receives rebates from U.S. Bancorp for the purchase card

program. The rebate amounts are based on the volume of purchases the SEC makes 

(minus any refunds the SEC has received) in a given quarter and the timeliness of the 

settlement of these purchases with the bank. The rebate amounts the SEC has 

received by FY are shown in Table 4.

Table 4: SEC Purchase Card Rebates by FY

FY Rebate

2010 $57,054

2011 $53,300

2012 $24,364

2013 $32,490

Source: A/OPC, OA.

The Charge Card Abuse Prevention Act requires that “[r]ebates and refunds based on 

prompt payment, sales volume, or other actions by the agency on purchase card 

accounts are reviewed for accuracy and properly recorded as a receipt to the agency 

that pays the monthly bill.”

The A/OPC informed us that OA did not review rebate amounts for accuracy or verify

that the rebates were properly recorded as a receipt to the SEC. The A/OPC said that 

she would begin reviewing these activities in the quarter commencing October 1, 2013.

By not reviewing the rebate amounts for accuracy and ensuring that the SEC properly 

records the rebates, the SEC could be exposed to the risks that (1) the bank did not 

properly calculate the rebate amounts; or (2) the SEC did not correctly record them.

Conclusion

OA did not review rebate amounts for accuracy and did not ensure that the SEC 

properly recorded the rebates, as required by the Charge Card Abuse Prevention Act. 

Reviewing rebates and following up as needed are important procedures that OA 

should implement to ensure that the bank’s rebate amounts are accurate and that the 

SEC properly records them.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 23 MARCH 28, 2014

Recommendation 11:

In accordance with the Government Charge Card Abuse Prevention Act of 2012, the 

Office of Acquisitions should review for accuracy and proper recording as a receipt 

to the agency rebates issued by the SEC’s purchase card-issuing bank.

Management Comments. The OA Director concurred with this 

recommendation. Management’s complete response is reprinted in Appendix III.

OIG Evaluation of Management’s Response. We are pleased that 

management concurred with this recommendation. We will conduct followup 

activities to determine whether OA takes corrective action that is responsive to 

the recommendation. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 24 MARCH 28, 2014

Appendix I. Scope and Methodology

We conducted this performance audit in accordance with generally accepted 

government auditing standards. Those standards require that we plan and perform the 

audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We determined that the 

evidence obtained provides a reasonable basis for our findings and conclusions based 

on our audit objectives. 

Scope. The audit covered the period of October 1, 2009, to September 30, 2013. The

scope included reviews of (1) governing purchase card laws, regulations, and guidance;

(2) OP 10-6; (3) purchase card and convenience check transactions; (4) OA’s training 

files; (5) MCLs; (6) purchase and transaction information from the SEC’s purchase cardissuing banks, J.P. Morgan Chase and U.S. Bancorp; (7) purchase card rebates; and 

(8) the A/OPC’s duties.

We conducted fieldwork from January 2013 to March 2014 at the SEC’s headquarters in 

Washington, D.C.

We tested purchase card and convenience check transactions. We were unable to test 

transactions for October 2009 because of the unavailability of bank statements for that 

month. We did not test transactions from January through March of 2012 because the 

information from U.S. Bancorp indicated that these months’ transactions had not been

closed. These months represented a small percentage of the total months included in 

our sample and, in our opinion, the absence of these months did not impact our ability 

to draw conclusions on the SEC’s purchase card program.

Methodology. To achieve the objective of determining whether SEC’s purchase card 

program operates effectively and is managed in compliance with governing laws,

regulations, and agency policy, we obtained and reviewed relevant laws, regulations, 

and guidance. We also reviewed the SEC’s internal operating procedures for the 

purchase card program. Further, we interviewed OA personnel who were responsible 

for overseeing purchase card operations. 

To determine whether staff members were properly trained in purchase card operations, 

we reviewed for appropriate content the online training course entitled “GSA SmartPay 

Purchase Card Training (Cardholders)” that the SEC requires PCHs and AOs to take. 

We also reviewed the PCHs’ and AOs’ completion certificates in OA’s training files. For 

those PCHs and AOs that had either outdated training certificates (over 3 years old) or 

no training certificate, we contacted them to determine whether they had current training 

certificates in their possession. 

To achieve the objective of assessing whether the internal controls for the SEC’s 

purchase card program were adequately designed, appropriately implemented, and 

effectively operated to detect purchase card program representatives’ abuse or misuse

of the card, we reviewed the “Required Safeguards and Internal Controls” in the 

Government Charge Card Abuse Prevention Act of 2012. We determined whether the 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 25 MARCH 28, 2014

safeguards and internal controls that the Act requires existed in the SEC’s program. 

Further, we assessed risk, focusing on risk considerations that we had identified in our 

internal control review.

To further meet our audit objectives, we developed and performed tests of purchase 

card and convenience check transactions. We tested a sample of transactions from 

J.P. Morgan Chase for FYs 2010, 2011, and the first quarter of FY 2012, and U.S. 

Bancorp from January 2012 to September 2013. As noted in the “Scope” section of this

report, we were unable to test transactions for October 2009 and January through

March 2012, because of the unavailability or reliability of data.

For the convenience checks in our review, we requested that the PCHs provide us with 

documentation showing that the PCHs were not able to procure the service or goods

with a purchase card. We obtained and reviewed documentation such as purchase 

card logs, invoices and documents showing the receipt of the goods or services, and 

evidence of the AO’s prior approval of purchases. For transactions that had purchases 

from the same vendor within several days of the transaction date, we requested 

additional documentation from the PCH to assess whether any of those transactions 

might be a split purchase.

To determine whether there were categories of purchases that could be made by 

means other than purchase cards to better aggregate purchases and obtain lower 

prices, we analyzed the purchase card and convenience check transactions selected for 

our testing during the period October 2009 – September 2012. We sorted them into 

categories by nature of goods or services and then reviewed the categories. We 

determined that two categories—office supplies (32 percent, 24 of 74 transactions in our 

sample) and process servers (10 percent, 7 of 74 transactions in our sample)—

accounted for approximately 42 percent of the transactions. The 24 office supply 

purchases originated from SEC’s headquarters and 9 regional offices that used

15 different vendors. The seven purchases for the services of process servers 

originated from five regional offices that used different vendors for all seven purchases.

We asked OA whether the SEC could realize cost efficiencies by aggregating 

purchases. OA informed us that for office supplies, the items would have to be shipped 

to each regional office and additional expenses would be incurred for shipping. There 

would also be an increased lead time needed to plan for these purchases. We were 

told that, for office supplies and process servers, the cost in time and effort would not be 

worth the potential savings involved with aggregating purchases. On the basis of our 

inquiries and analysis, we concluded that aggregating purchases would not be more 

cost effective than using the purchase card for individual purchases. 

Internal Controls. We obtained an understanding of OA’s internal controls over the 

purchase card program and assessed the internal controls in accordance with the 

“Required Safeguards and Internal Controls” in the Government Charge Card Abuse 

Prevention Act of 2012. For our review of internal controls, we considered the following:

 Control Environment – We identified the A/OPC in OA as the designated internal 

control official over purchase card and convenience check operations and 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 26 MARCH 28, 2014

determined that this person is responsible for ensuring that the program is 

operating in accordance with U.S. Government laws, regulations, and guidance,

and OP 10-6.

 Risk Assessment – We conducted a risk assessment that focused on risk 

considerations that we had identified in our internal control review. We assessed 

whether the safeguards and internal controls enumerated in the Charge Card 

Abuse Prevention Act were present and how they were monitored to ensure that 

the purchase card program functioned properly. We summarized our risk 

assessment on the basis of inherent risk, control risk, and detection risk and 

initially concluded that the overall level of risk was moderate to high. We 

subsequently reduced our assessment of overall risk to moderate, based upon 

items that came to our attention during the course of the audit. These items 

included:

o The A/OPC’s FY 2013 reviews of records maintained by all PCHs, and the

detailed memo to the OA Director of her findings, many of which we had 

also noted. We consider this to be a “best practice.”

o Communications from the A/OPC that she had taken action in order to 

correct missing training certificates and bank reconciliation timeliness.

o The August 2013 training conducted by the A/OPC for all PCHs and AOs.

o The SEC’s use, beginning in FY 2013, of U.S. Bancorp’s “Analytics” 

software, which searches for questionable purchase transactions.

We used the results of our risk assessment to determine the attributes for testing 

and the estimated error rate.

 Monitoring – We discussed with the A/OPC her program for conducting reviews 

from January 2013 to August 2013 of cardholder activities. We tested the 

A/OPC’s oversight of training by reviewing OA’s training files to determine 

whether training was current. Also, we reviewed the A/OPC’s monitoring of the 

PCH and AO bank reconciliation process.

 Control Activities – We reviewed the SEC’s operating procedure for its 

government purchase card program and U.S. Government laws, regulations, and 

guidance on purchase card and convenience check operations and identified 

areas where compliance needed improvement. We reviewed the A/OPC’s 

control activities over PCH and AO training, the PCHs’ timeliness in reconciliation 

of transactions documents with bank charges, and the compliance by PCHs and 

AOs with documentation and purchasing policies.

 Information and Communication – We identified how the A/OPC disseminated 

information to the PCHs and AOs so that they could properly and effectively carry 

out their responsibilities. The A/OPC conducted training in November 2012 to 

acquaint PCHs and AOs with new online banking procedures and in August 2013 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 27 MARCH 28, 2014

to discuss policy and procedural matters. The A/OPC reviewed the timeliness of 

PCHs’ reconcilement of bank charges with related documentation and followed

up by sending reminder emails to the PCHs and AOs who missed, or would miss,

the 30-day reconciliation deadline. 

Overall, OA has established internal controls that reduce the risk of fraud, waste, and 

error in the usage of purchase cards and convenience checks. However, certain areas

of compliance and oversight need strengthening. These areas, as discussed in the 

report’s findings, include improved oversight of PCH and AO purchase card training, 

compliance by PCHs and AOs with purchase card policy, timely reconciliation of bank 

information, and review of rebates for accuracy and their proper recording in the SEC’s 

records.

Statistical Sampling. We used E-Z-Quant statistical sampling software to determine 

the sample size of our two transactions tests, for FYs 2010-2012 and for FY 2013. We 

used a 90-percent confidence level, 10-percent precision range, and 5-percent 

expected error rate in determining our sample sizes. The result was two samples of 

identical size, 74 transactions. For FYs 2010-2012, we obtained bank information for 

J.P. Morgan Chase and U.S. Bancorp transactions and used systematic selection with 

random number starting points to select the purchase card and convenience check 

transactions for testing. For FY 2013, we obtained a listing of U.S Bancorp transactions 

and used E-Z-Quant’s random number generator to select the items to test. We 

requested that the PCHs provide us with documentation in support of each transaction

selected.

Prior Coverage. In September 2008, the Office of Inspector General issued its audit 

report entitled Internal Control Review of the Government Purchase Card Program, 

Report No. 440. The report contained 17 recommendations for corrective action, all of 

which were closed. Three findings in our current report were also identified in the 2008 

audit report: “BankCard Log Not Used,” “Documentation Not Available,” and “Untimely 

Certification [of training].” 

In addition, the SEC engaged Cotton & Company LLP (Cotton) to perform a risk 

assessment in FY 2013 of select programs and activities administered by the SEC, for 

compliance with the Improper Payments Elimination and Recovery Act of 2012. Cotton 

communicated its findings, which included certain internal control exceptions relating to 

the purchase card program, including use of convenience checks, in its Risk 

Assessment Summary Report dated June 16, 2013.
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 28 MARCH 28, 2014

Appendix II. Applicable Federal Laws, Regulations, 

Policies, and Guidance

48 C.F.R. Parts 13 and 32 (Federal Acquisition Regulation). This FAR section 

outlines the requirements for acquisitions made with purchase cards. Subpart 13.2 

details the guidelines for purchases at or below the micro-purchase threshold. Subpart 

13.3 details various simplified acquisition methods including government purchase 

cards and explains procedures for the handling of those simplified acquisition methods. 

48 C.F.R. § 13.003 explains the prohibition on split purchases for acquisitions.

Government Charge Card Abuse Prevention Act of 2012, Public Law 112-194, 

October 5, 2012. The Act explains the requirements for management of purchase 

cards and convenience checks in executive agencies. It details the safeguards and 

internal controls required for the management of the purchase card program, along with 

penalties for violations and OIG risk assessments and audits required to evaluate the 

purchase card and convenience check process. 

National Archives and Records Administration, General Records Schedules, 

Transmittal No. 22, April 2010, General Records Schedule 3, Procurement, 

Supply, and Grant Records. Number 3.a.(1)(b) provides guidance on destruction of 

procurement files. It states that files for transactions at or below the simplified 

acquisition threshold are to be destroyed 3 years after final payment.

OMB Circular No. A-123, Appendix B, Revised, January 15, 2009. This document 

prescribes policies and procedures for agencies on how to maintain internal controls 

that reduce the risk of fraud, waste, and error in government charge card programs. It 

provides guidance on, among other things, the charge card management plan, training, 

risk management, and the use of convenience checks. 

SEC Operating Procedure, OP 10-6, Government Purchase Card Program. The 

operating procedure details the policies and procedures for the SEC’s purchase card 

program. The procedure describes the responsibilities of those who manage or 

administer the program. OP 10-6 succeeds SECR 10-6, Rev. 1, Government Purchase 

Card Program. 

Government Purchase Card Program Supplemental Procedures, December 21, 

2012. The procedures supplement SEC OP 10-6 and address such areas as 

maintaining a purchase card log and approving purchase card transactions. The 

supplemental procedures describe the “pay and chase” system and require that PCHs, 

at a minimum, reconcile their transactions within 30 days of the bank’s posting date.

SEC Administrative Regulations, SECR 10-1 (Rev. 1), “Ratification of 

Unauthorized Commitments,” September 27, 2012. This regulation prescribes 

policies and procedures pertaining to the ratification of unauthorized commitments.

Treasury Financial Manual, Part 4—Chapter 4500, “Government Purchase Cards.” 

The chapter outlines the procedures for all agencies that have Government purchase 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 29 MARCH 28, 2014

card programs. It defines the responsibilities of individuals who manage or administer 

the purchase card program.

OMB M-13-21, “Implementation of the Government Charge Card Abuse 

Prevention Act of 2012,” September 6, 2013. This memorandum provides guidance 

to agencies and Offices of Inspector General for implementing the provisions of the Act.

GSA SMARTPAY® SMART BULLETIN, Smart Bulletin No. 021, September 6, 2013; 

revised and reissued November 18, 2013. The Bulletin provides a summary of the 

requirements of the Government Charge Card Abuse Prevention Act of 2012, the 

implementation of which is described in OMB M-13-21, and provides A/OPCs with the 

compliance summary matrix addressed in OMB M-13-21. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 30 MARCH 28, 2014

Appendix III. Management Comments

MEMORANDUM

March 26, 2014

TO: Rebecca Sharek, Deputy Inspector General for Audits, Evaluations, and Special 

Projects, Office of Inspector General

FROM: Vance Cathell, Director, Office of Acquisitions

SUBJECT: Response to SEC IG’s Draft Audit 517, Controls Over the SEC’s Government 

Purchase Card Program

Thank you for the opportunity to review and comment on the recommendations in draft Audit 

Report, Controls Over the SEC’s Government Purchase Card Program dated March 13, 2014. 

The Office of Acquisitions (OA) appreciates the recommendations designed to strengthen the 

OA’s controls over the purchase card program. We are pleased the OIG found that controls to 

administer the SEC’s purchase card program appear to be reasonable, and that certain procedures 

are considered a best practice.

I welcome your suggestions on improvements in our policies and processes. OA is committed to 

assuring proper management and oversight of the purchase card program, assuring appropriate 

safeguards are present and reinforcing our processes of internal controls to provide reasonable 

assurance that the card program is used efficiently, economically, and effectively. 

Recommendation 1: The Office of Acquisition should (a) establish procedures to periodically 

verify that purchase cardholders and approving officials have taken the required purchase card 

and convenience check training; and (b) restrict purchase cardholders’ use of purchase cards or 

approving officials’ participation in the approval process when those individuals do not timely 

complete required purchase card training.

OA concurs with this recommendation. As recognized in your report, OA had identified this 

issue and was working to correct it during the audit. We completed a 100% verification of 

training in July 2013. We established internal procedures, and have controls in place to assure 

that training is current and that OA takes action to restrict officials’ participation if training is not 

current.

Recommendation 2: The Office of Acquisitions should remind purchase cardholders and 

approving officials of the requirement to (a) notify the Agency/Organization Program 

Coordinator that they have completed initial and refresher training; and (b) send their training 

certificates to the Agency/Organization Program Coordinator.

OA concurs with this recommendation. The Agency/Organization Program Coordinator 

(AOPC) conducted training in August 2013, and provided a general reminder to all GPC 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 31 MARCH 28, 2014

participants. As training renewals become due, each participant will be reminded individually 

and appropriate action will be taken if their training certificates are not received in OA.

Recommendation 3: The Office of Acquisitions should ensure that the Agency/Organization 

Program Coordinator takes these actions: (a) continues to conduct periodic purchase card 

reviews and monitors compliance with purchase card policies such as (1) transaction approvals 

by approving officials prior to purchase; (2) adequate documentation of purchase card and 

convenience check transactions; and (3) maintenance of purchase logs using the purchase log 

template; and (b) promptly communicates to the appropriate purchase cardholders and approving 

officials any deficiencies identified during these reviews that need corrective action.

OA concurs with this recommendation. We especially appreciate your recognition in the report 

that the procedures we have established are a best practice. The AOPC will continue to follow 

these procedures and communicate any deficiencies identified to cardholders and approving 

officials for corrective action.

Recommendation 4: The Office of Acquisitions should (a) remind purchase cardholders and 

approving officials that only cardholders may order goods and services; and (b) ensure that the 

Agency/Organization Program Coordinator includes compliance with this requirement in her 

periodic purchase card reviews.

OA concurs with this recommendation. The AOPC reminded GPC participants during the 

August, 2013 training that only cardholders may place orders, and will review for compliance 

during the periodic purchase card reviews.

Recommendation 5: The Office of Acquisitions should take appropriate action, up to and 

including suspension and cancellation of purchase card or approval authority, for cardholders 

and approving officials who do not comply with purchase card policies.

OA concurs with this recommendation. Based on the facts of any occurrence, OA will consider 

other remedies up to and including suspension or cancellation of program authority for those 

who fail to comply with purchase card policies. 

Recommendation 6: The Office of Acquisitions should consider obtaining a contract for 

deposition services.

OA concurs with this recommendation. Office of Acquisitions, Mission Support Branch in 

conjunction with Enforcement Division has been working on this strategic sourcing initiative. A 

request for proposal was issued, proposals are being evaluated, and an award is anticipated in the 

near future. 

Recommendation 7: The Office of Acquisitions should determine whether the purchase of 

deposition services without proper authority and approval is consistent with (a) SEC Operating 

Procedure OP 10-6, “Government Purchase Card Program”; and (b) SEC Administrative 

Regulations SECR 10-1 (Rev. 1), “Ratification of Unauthorized Commitments,” and take 

appropriate action as necessary.

OA concurs with this recommendation. OA shares your concern about potential procurement of 

deposition or other services without proper authority. We are committed to implementing the 

GPC Program with all reasonable controls to assure proper exercise of authority. Our ongoing 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 32 MARCH 28, 2014

efforts to establish contractual methods to support deposition services, increase oversight, and 

enhance training for program participants will effectively manage risk in this area. 

Recommendation 8: The Office of Acquisitions should ensure that the Agency/Organization 

Program Coordinator, at least annually, reviews the purchase cardholders’ monthly credit limits 

and adjusts the limits on the basis of the purchase cardholders’ actual needs.

OA concurs with this recommendation. The AOPC has instituted a review of the monthly credit 

limits, to occur annually at the minimum. 

Recommendation 9: The Office of Acquisition should establish and implement policies on the 

number of purchase cards issued by various component organizations, the categories of 

component organizations, credit limits authorized for various categories of cardholders, and the 

categories of employees who are eligible to be issued a purchase card, as required under the 

Government Charge Card Abuse Prevention Act of 2012.

OA concurs with this recommendation. Although SEC has no component organizations who 

will be issuing cards, we will establish limits on the categories of employees who are eligible to 

receive purchase cards as well as their credit limits. 

Recommendation 10: The Office of Acquisitions should (a) notify the supervisors of purchase 

cardholders and approving officials who are habitually late reconciling purchase card 

transactions with bank information or approving such reconciliations, and (b) consider cancelling 

the purchase program authorities of such employees.

OA concurs with this recommendation. As noted in the report, the A/OPC has already issued 

guidance to the GPC participants that late reconciliation will result in suspension of the 

cardholder account, and we will consider other remedies up to and including cancellation of 

program authority. 

Recommendation 11: In accordance with the Government Charge Card Abuse Prevention Act 

of 2012, the Office of Acquisitions should review for accuracy and proper recording as a receipt 

to the agency rebates issued by the SEC’s purchase card-issuing bank.

OA concurs with this recommendation. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 33 MARCH 28, 2014

Appendix IV. OIG Response to Management 

Comments

The OIG is pleased that OA concurred with the report’s 11 recommendations for 

corrective action. We are also encouraged that OA has indicated that it has taken 

certain actions to address many of the recommendations in this report.

We believe that fully implementing all of the recommendations will enhance the controls 

over the SEC’s government purchase card program. 
U.S. SECURITIES AND EXCHANGE COMMISSION OFFICE OF INSPECTOR GENERAL

REPORT NO. 517 34 MARCH 28, 2014

To Report Fraud, Waste, or Abuse, Please Contact:

Web: www.reportlineweb.com/sec_oig

E-mail: oig@sec.gov

Telephone: (877) 442-0854 

Fax: (202) 772-9265

Address: U.S. Securities and Exchange Commission

Office of Inspector General

100 F Street, N.E.

Washington, DC 20549-2736

Comments and Suggestions 

If you wish to comment on the quality or usefulness of this report or suggest ideas for 

future audits, please contact Rebecca Sharek, Deputy Inspector General for Audits, 

Evaluations, and Special Projects at sharekr@sec.gov or call (202) 551-6083. 

Comments, suggestions, and requests can also be mailed to the attention of the Deputy 

Inspector General for Audits, Evaluations, and Special Projects at the address listed 

above.