GAO

United States General Accounting Office

Testimony

Before the Subcommittee on Government Efficiency, 

Financial Management and Intergovernmental Relations, 

Committee on Government Reform, House of 

Representatives

For Release on Delivery

Expected at 10 a.m.

Monday, July 30, 2001

PURCHASE CARDS

Control Weaknesses Leave 

Two Navy Units Vulnerable 

to Fraud and Abuse

Statement of Gregory D. Kutz

Director, Financial Management and Assurance

Statement of Robert H. Hast

Managing Director, Office of Special Investigations

GAO-01-995T

Page 1 GAO-01-995T Navy Purchase Card Controls

Mr. Chairman, Members of the Subcommittee, and Senator Grassley:

Thank you for the opportunity to discuss Department of Defense (DOD) 

internal controls and accounting practices for purchase card transactions 

and payments. DOD reported that it used purchase cards—MasterCard or 

VISA cards issued to its civilian and military personnel—for more than 10 

million transactions valued at $5.5 billion in fiscal year 2000. DOD has 

increased the use of purchase cards with the intention of eliminating the 

bureaucracy and paperwork long associated with making small purchases 

and intends to expand the use of purchase cards over the next several 

years. Given the rapid growth of purchase card use at DOD, ensuring that 

key controls are in place over the program is critical to protecting the 

government from fraud, waste, and abuse. 

We began looking into this issue at the request of Senator Grassley, who 

was concerned about internal control weaknesses that may have 

contributed to reports of purchase card fraud related to Navy programs 

based in San Diego, California. As a result, we agreed to obtain and review 

DOD fraud case information related to Navy purchase card programs in the 

San Diego area and to review purchase card controls and accounting for 

two Navy units based in San Diego—the Space and Naval Warfare Systems 

Command (SPAWAR) Systems Center and the Navy Public Works Center.1

Further background information on the Navy purchase card program is 

included in appendix I. 

Today, I will discuss the results of our review of Navy purchase card 

controls, including (1) the purchase card control environment at the two 

Navy units’ San Diego activities and overall management issues that affect 

the Navy-wide purchase card program, (2) the results of our test work on 

statistical samples of purchase card transactions at the two Navy units, 

which identified control weaknesses in four critical areas, and (3) 

potentially fraudulent, improper, and abusive transactions made by the two 

Navy units. Some of these transactions are similar to those involved in five 

specific fraud cases related to Navy programs based in San Diego that had 

been identified at the time of our work. Information on the five fraud cases 

is presented in appendix II. 

1

SPAWAR and the Navy Public Works Center are working capital fund activities. SPAWAR 

performs research, engineering, and technical support, and the Navy Public Works Center 

provides maintenance, construction, and operations support to Navy programs. Both of 

these Navy programs have locations throughout the United States. Our review focused on 

the purchase card program at the San Diego units only.
Page 2 GAO-01-995T Navy Purchase Card Controls

Summary The two Navy units we reviewed had a significant breakdown in internal 

controls over the $68 million in fiscal year 2000 purchase card transactions 

that we tested, leaving SPAWAR San Diego and the Navy Public Works 

Center San Diego vulnerable to fraudulent, improper, and abusive 

purchases and theft and misuse of government property. The problems we 

found with the use of purchase cards by these two Navy units resulted from 

a weak overall internal control environment, flawed or nonexistent policies 

and procedures, and a lack of adherence to valid policies and procedures. 

Within this poor control environment, these two units had given purchase 

cards to over 1,700 employees, most of whom had credit limits of $20,000 

or more and contracting officer authority to make their own purchase 

decisions. 

We found a weak overall internal control environment, including four key 

weaknesses that contributed to the ineffective controls, particularly at 

SPAWAR San Diego. First, neither SPAWAR San Diego nor the Navy Public 

Works Center San Diego had effective policies over the issuance of 

purchase cards, with any employee having supervisor approval able to get a 

card. As a result, we found a proliferation of the authority to procure goods 

and services, with 1,526 SPAWAR San Diego employees (36 percent) and 

254 Navy Public Works Center San Diego employees (16 percent) holding 

purchase cards as of September 30, 2000. This purchase card proliferation 

resulted in a virtually impossible span of control issue at SPAWAR San 

Diego with only one approving official responsible for certifying summary 

billing statements covering 700 monthly purchase card statements for the 

1,526 purchase cardholders. Second, we found deficient policies for rebate 

management, including a lack of procedures to maximize rebates and 

ensure that bank calculations of rebates were correct. Consequently, we 

found rebates were not maximized and errors in rebate calculations by the 

bank went undetected. Third, we determined that nearly half of SPAWAR’s 

fiscal year 2000 purchase card transactions and over half of the Navy Public 

Works Center’s transactions were made by employees who did not have 

documented evidence of timely training, which is required by the Navy’s 

purchase card instruction. Fourth, we found that management was not 

effectively utilizing internal reviews and audits to determine whether 

purchase card internal controls were being effectively implemented. In 

fact, we found evidence that SPAWAR management ignored internal review 

results that demonstrated some of the serious problems discussed in this 

testimony, primarily because of complaints from cardholders and their 

supervisors regarding the administrative burden associated with 

procedural changes that would be needed to address the review findings. 
Page 3 GAO-01-995T Navy Purchase Card Controls

With the ineffective overall internal control environment, it is not 

surprising that the three basic internal controls we tested—(1) independent 

documented receipt and acceptance of goods and services, (2) independent 

documented certification of monthly purchase card statements, and 

(3) proper and timely allocation of costs to customer accounts—were 

ineffective. We found that the primary problem with the controls was that 

employees simply did not follow them. In addition, we found that easily 

pilferable or sensitive items in our sample, which are accountable property, 

were not recorded in property records. Specifically, our tests of SPAWAR 

and Navy Public Works Center fiscal year 2000 purchase card transactions 

that included accountable property, the two units failed to record one or 

more items in their property records for nearly all of the purchase card 

transactions that included accountable property. Further, when we 

analyzed the property items included in our sampled transactions, we 

found that SPAWAR San Diego and the Navy Public Works Center San 

Diego did not record 46 of the 65 accountable items included in our 

samples in their property records, as required by Navy policies. Moreover, 

when we asked to inspect these items, the two units could not provide 

conclusive evidence that 31 of them—including laptop computers; personal 

digital assistants (PDAs), such as Palm Pilots; and digital cameras—were in 

the possession of the government. For example, for four items, the serial 

numbers of the property we were shown did not match purchase or 

manufacturer documentation. We were also told that five items were at 

other Navy locations throughout the world. SPAWAR and the Public Works 

Center officials were unable to conclusively demonstrate the existence and 

location of these five items. We were unable to conclude whether any of 

these 31 pieces of government property were stolen, lost, or being misused. 

Weak internal controls contributed to five recent cases of alleged purchase 

card fraud related to Navy units in the San Diego area, including two 

involving Navy Public Works Center employees. One case has been 

successfully prosecuted, while the remaining four cases are still under 

investigation. All five of these purchase card fraud cases, which so far total 

over $660,000 in known and potential fraud, involved numerous purchases 

made over a period of several months to more than 2 years. Items that were 

purchased for personal use in these cases included home improvement 

items from The Home Depot, numerous items from Wal-Mart, laptop 

computers, Palm Pilots, DVD players, an air conditioner, clothing, jewelry, 

and other items such as eyeglasses, pet supplies, and pizza. The control 

breakdowns related to the frauds were so pervasive that the total dollar 

amount of these frauds could not be determined.
Page 4 GAO-01-995T Navy Purchase Card Controls

One of the ongoing Navy purchase card fraud cases involved the 

compromise of as many as 2,600 purchase card accounts assigned to Navy 

activities in the San Diego area. Navy investigators were only able to obtain 

a partial list consisting of 681 compromised accounts so the exact number 

is not known. Although the account numbers showed up on a computer 

printer at a community college library in San Diego in September 1999, the 

Navy has not canceled all of the compromised accounts. Navy investigators 

estimated that as of January 2001, at least 30 of the compromised account 

numbers were used by 27 alleged suspects to make more than $27,000 in 

fraudulent transactions for pizza, jewelry, phone calls, tires, and flowers. 

However, with the lack of controls over receipt of goods and services and 

proper certification of purchase card statements for payment that we 

identified at the two units, it will be difficult, if not impossible, for the Navy 

to identify fraudulent purchases as they occur, or to determine the extent 

of the fraudulent use of compromised accounts. As of May 21, 2001, we 

identified 22 compromised SPAWAR San Diego purchase card accounts on 

the partial listing that were still open. The financial exposure related to 

credit limits associated with the 22 accounts was $900,000 per month. 

There were no active Navy Public Works Center San Diego accounts on the 

partial listing. 

The specific internal control weaknesses at the two activities we reviewed 

contributed to additional purchases that we believe are potentially 

fraudulent, improper, or abusive. The abusive and improper purchases 

relate primarily to SPAWAR San Diego and include items where the 

purchase was at an excessive cost, or of questionable government need, or 

both. For example, we found purchases for flat panel computer monitors 

costing from about $800 to $2,500 each, compared to standard GSA 

schedule monitors costing about $300 each. In addition, we found routine 

purchases without documented government need, including personal 

digital assistants, such as Palm Pilots, as well as purchases of $100 designer 

Palm Pilot carrying cases and a $400 Coach leather briefcase. Navy Public 

Works Center San Diego also had numerous PDA purchases. However, 

neither unit had documented policies and procedures to support the valid 

government need for these types of items. We also found unauthorized, 

potentially fraudulent purchases of personal items, including cosmetics, 

gift certificates, and clothing at both SPAWAR San Diego and the Navy 

Public Works Center San Diego. Our Office of Special Investigations is 

conducting a further investigation of the potentially fraudulent transactions 

identified during this review. Further, we identified a number of purchases 

made on the same day from the same vendor, which appeared to 

circumvent cardholder single transaction limits.
Page 5 GAO-01-995T Navy Purchase Card Controls

Following this hearing, we plan to issue a report that will summarize the 

results of our review and make specific recommendations for corrective 

action.

Scope and 

Methodology

We conducted our audit work from August 2000 through June 2001 in 

accordance with generally accepted U.S. government auditing standards, 

and we performed our investigative work in accordance with standards 

prescribed by the President’s Council on Integrity and Efficiency. We 

briefed DOD managers, including officials in DOD’s Purchase Card 

Program Management Office and the Defense Finance and Accounting 

Service (DFAS), and Navy managers, including Navy Supply Command, 

Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San 

Diego officials on the details of our review, including our objectives, scope, 

and methodology and our findings and conclusions. We referred instances 

of potentially fraudulent transactions that we identified during our work to 

our Office of Special Investigations for further investigation. Our work was 

not designed to identify, and therefore we did not determine, the extent of 

fraudulent, illegal, or abusive transactions. Our control tests were based on 

stratified random probability samples of 135 SPAWAR San Diego purchase 

card transactions and 121 Navy Public Works Center San Diego 

transactions. Further details on our objectives, scope, and methodology are 

included in appendix III.

Weak Purchase Card 

Environment 

Contributed to 

Ineffective Controls

A weak internal control environment at SPAWAR San Diego and the Navy 

Public Works Center San Diego contributed to internal control weaknesses, 

fraud, and abuse. The importance of the “tone at the top” or the role of 

management in establishing a positive internal control environment cannot 

be overstated. GAO’s internal control standards go on to state that, 

“management plays a key role in demonstrating and maintaining an 

organization’s integrity and ethical values, especially in setting and 

maintaining the organization’s ethical tone, providing guidance for proper 

Management and employees should establish and maintain an environment 

throughout the organization that sets a positive and supportive attitude toward 

internal control and conscientious management. A positive control environment 

is the foundation for all other standards. It provides discipline and structure as 

well as the climate which influences the quality of internal control. GAO’s 

Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, 

November 1999)
Page 6 GAO-01-995T Navy Purchase Card Controls

behavior, removing temptations for unethical behavior, and providing 

discipline when appropriate.” The specific factors that contributed to the 

lack of a positive control environment at these two units included a 

proliferation of purchase cardholders, ineffective training of cardholders 

and certifying officers, ineffective rebate management, and a lack of 

monitoring and oversight.

Proliferation of Cardholders 

Resulting in Unreasonable 

Span of Control 

SPAWAR San Diego and the Navy Public Works Center San Diego did not 

have specific policies governing the number of cards issued or establishing 

criteria for identifying employees eligible for the privilege of cardholder 

status. At both units, cards were given out on the basis of a request from an 

individual employee’s supervisor. The request was then forwarded to the 

unit’s purchase card agency program coordinator, who approved the 

request and began the process for obtaining a new card from Citibank. 

According to SPAWAR and Navy Public Works Center officials, specific 

criteria did not exist for either the supervisors or the program coordinators 

to use in requesting and approving purchase cards for employees. This 

flawed policy has resulted in a proliferation of purchase cards at the two 

units. For example, as of September 30, 2000, about one in three, or 36 

percent of SPAWAR San Diego employees and about one in six, or 16 

percent, of Navy Public Works Center San Diego employees were 

cardholders. As a result, at the end of fiscal year 2000, about 1,526 SPAWAR 

San Diego employees and 254 Navy Public Works Center San Diego 

employees were authorized to procure goods and services. 

Within this weak control environment, these two Navy units had given 

purchase cards to over 1,700 employees, most of whom had credit limits of 

$20,000 or more and the authority to make their own purchase decisions. 

Table 1 shows the proliferation of cardholders and the percentage of 

employees at SPAWAR and the Navy Public Works Center in San Diego that 

were cardholders as of September 30, 2000. Most of SPAWAR’s 1,526 

cardholders had a $25,000 credit limit and most of the Navy Public Works 

Center’s 254 cardholders had a $20,000 credit limit. 
Page 7 GAO-01-995T Navy Purchase Card Controls

Table 1: Proliferation of Cardholders and Financial Exposure 

Information we obtained from six large defense contractors on their 

purchase card programs showed that the percent of the contractors’

employees that were cardholders ranged from about 2 percent to nearly 4 

percent—significantly less than at SPAWAR and the Navy Public Works 

Center in San Diego. 

The proliferation of cardholders, particularly at SPAWAR San Diego, 

created a situation where it was virtually impossible to maintain a positive 

control environment. For example, at SPAWAR, a significant span of 

control issue existed, with one approving official responsible for certifying 

monthly summary billing statements covering an average of over 700 

monthly purchase card statements relating to 1,526 purchase cardholders. 

At the Navy Public Works Center San Diego, the span of control problem 

was not as serious, with six approving officials responsible for certifying 

monthly summary statements covering an average of 55 monthly 

statements for 254 cardholders. The span of control issue is particularly 

important for purchase cards because supervisors and, in some cases, 

cardholders themselves, are responsible for authorizing purchases, rather 

than an independent contracting officer as is the case under the standard 

procurement process. Thus, the approving official serves as a key control 

in certifying cardholder purchases.

Lack of Documented 

Evidence of Training for 

Cardholders and Approving 

Officials 

The lack of documented evidence of purchase card training also 

contributed to a weak internal control environment at SPAWAR and the 

Navy Public Works Center in San Diego. GAO’s internal control standards 

emphasize that effective management of an organization’s workforce—its 

human capital—is essential to achieving results and is an important part of 

internal control. Training is key to ensuring that the workforce has the 

skills necessary to achieve organizational goals. In accordance with Navy 

Supply Command (NAVSUP) Instruction 4200.94, all cardholders and 

approving officials must receive purchase card training. Specifically, 

As of September 30, 2000 SPAWAR Navy Public Works Center

Number of cardholders 1,526 254

Number of employees 4,200 1,600

Percent of employees that were 

cardholders

36% 16%

Credit limit of most cardholders $25,000 $20,000
Page 8 GAO-01-995T Navy Purchase Card Controls

NAVSUP Instruction 4200.94 requires that prior to the issuance of a 

purchase card, all prospective cardholders and approving officials must 

receive training regarding both Navy policies and procedures as well as 

local internal operating procedures. Once initial training is received, the 

Instruction requires all cardholders to receive refresher training every 2 

years. 

Although we found the training policies and procedures to be generally 

adequate, we determined that SPAWAR and the Navy Public Works Center 

lacked documentation to demonstrate that all cardholders and approving 

officials had received the required training. Based on our tests of fiscal year 

2000 purchase card transactions, we estimate that about 40 percent of the 

SPAWAR transactions, totaling at least $6.8 million,2

 and 56 percent of the 

Navy Public Works Center transactions, totaling at least $10.9 million,3

were made by cardholders for whom there was no documented evidence 

that they had received either the required initial training or refresher 

training on purchase card policies and procedures. 

SPAWAR San Diego management contended that we should accept training 

provided under the Navy’s previous purchase card program as meeting the 

training requirements under the new program. Although we determined 

that the policies and procedures related to cardholder responsibilities were 

essentially the same under the previous Navy purchase card program, we 

found that several cardholders had received the prior training as many as 2 

years to 6 years before the current program began. Therefore, these 

cardholders had not received the required biennial refresher training. The 

Navy Public Works Center San Diego had no documented evidence that its 

cardholders had received any purchase card training prior to March 2000.

We also found no documented evidence that two of six Navy Public Works 

Center approving officials had received training on purchase card policies 

2

The range of our confidence interval, at a 95-percent confidence level, indicates that 

between 30 percent and 51 percent of the SPAWAR’s fiscal year 2000 purchase card 

transactions totaling between $6.8 million and $16.4 million were made by cardholders for 

whom there was no documented evidence that required training was received. 

3

The range of our confidence interval, at a 95-percent confidence level, indicates that 

between 44 percent and 68 percent of the Navy Public Works Center’s fiscal year 2000 

purchase card transactions totaling between $10.9 million and $26.3 million were made by 

cardholders for whom there was no documented evidence that required training was 

received.
Page 9 GAO-01-995T Navy Purchase Card Controls

and procedures prior to assuming certifying officer responsibilities. 

SPAWAR’s one approving official had received all required training.

Purchase Card Rebates Not 

Effectively Managed 

We found ineffective management of purchase card rebates4 by the Navy, 

SPAWAR San Diego, and the Navy Public Works Center San Diego. The 

Navy requested that Citibank defer payment of all of the purchase card 

rebates it earned since the current purchase card program began in 

November 1998 because, according to DOD and Navy officials, it had not 

yet determined how to record and allocate the rebates to Navy programs. 

According to Citibank officials, Citibank plans to pay cumulative purchase 

card rebates and accrued interest to the Navy on July 31, 2001, the payment 

date required in the Navy’s latest purchase card contract task order 

modification. Citibank estimates that the total payment will be about $8.8 

million, including an estimated $8.3 million in cumulative rebates and an 

estimated $530,000 in accrued interest on these rebates. In addition, the 

Navy had not established policies and procedures for managing rebates and 

had not monitored its rebate earnings. As a result, the Navy, SPAWAR San 

Diego, and the Navy Public Works Center San Diego were not aware that 

Citibank had miscalculated the rebates that SPAWAR and the Navy Public 

Works Center should have earned during fiscal year 2000 by about 

$150,000. Specifically, the rebates due SPAWAR were understated by 

$136,760, while the Navy Public Works Center’s rebates were overstated by 

$12,039. 

Further, SPAWAR and Navy Public Works Center managers were not 

effectively managing purchase card payments to maximize the amount of 

rebates earned. We determined that delays in the receipt of monthly 

purchase card statements had precluded the opportunity for these two 

units to earn another $242,000 in fiscal year 2000 rebates. We do not know 

the extent to which these factors have adversely impacted the Navy’s total 

fiscal year 2000 purchase card rebates. 

Program Monitoring and 

Audit Function Not 

Effective 

SPAWAR and the Navy Public Works Center in San Diego had not 

established an effective monitoring and internal audit function for the 

purchase card program. Further, the Navy’s purchase card policies and 

procedures did not require that the results of internal reviews be 

4

Under the Navy’s purchase card contract task order with Citibank, the Navy earns rebates 

(refunds) of up to 0.8 percent based on sales volume (payments) and payment timeliness.
Page 10 GAO-01-995T Navy Purchase Card Controls

documented or that corrective actions be monitored to help ensure that 

they are effectively implemented. 

NAVSUP Instruction 4200.94 calls for agency program coordinators5

 to 

perform semiannual reviews of their units’ purchase card program, 

including adherence to internal operating procedures, applicable training 

requirements, micro-purchase procedures, receipt and acceptance 

procedures, and statement certification and prompt payment procedures. 

Further, these reviews are to serve as a basis for agency program 

coordinators to initiate appropriate action to improve the local program or 

correct problem areas. However, the Instruction does not require written 

reports on the results of internal reviews to be submitted to either local 

management or a central Navy office for monitoring and oversight. As a 

result, the Navy did not have a consistent process for documenting the 

results of purchase card reviews, identifying systemic problems, and 

monitoring corrective actions to help ensure that they are effectively 

implemented. This weakness also impaired the Navy’s ability to assess 

purchase card controls for possible inclusion in its Annual Statements of 

Assurance pursuant to 31 U.S.C. 3512(d) (commonly referred to as the 

Federal Managers’ Financial Integrity Act of 1982), which requires agency 

heads to make annual disclosures regarding the adequacy of their internal 

controls. The Secretary of the Navy’s fiscal year 2000 Annual Statement of 

Assurance did not disclose any control weaknesses related to the purchase 

card program. 

Our analysis of SPAWAR San Diego Agency Program Coordinator fiscal 

year 2000 reviews showed that these reviews identified problems with 

about 42 percent of the monthly cardholder statements that were reviewed. 

The problems identified were consistent with the control weaknesses 

discussed later in this testimony, including lack of independent 

documentation that the Navy received items ordered by purchase card, 

accountable items that were not recorded in the property records, 

inadequate documentation for transactions, split purchases, and 

transactions that did not appear to be related to government business 

purposes. 

5

NAVSUP Instruction 4200.94 authorizes agency program coordinators to administer the 

purchase card program within their designated units and to serve as the communication link 

between the purchase card issuing bank and their unit, establish credit limits, issue cards to 

Navy employees, and administer the purchase card program.
Page 11 GAO-01-995T Navy Purchase Card Controls

During our review, we saw correspondence and other documentation 

showing that SPAWAR San Diego management had considered the findings 

identified in its agency program coordinator evaluations, but directed that 

corrective actions should not be implemented due to complaints from 

cardholders and their supervisors regarding the administrative burden 

associated with procedural changes that would be needed to address the 

review findings. As a result, the agency program coordinator had not used 

these reviews to make systematic improvements in the program. Rather, 

these reviews generally resulted in the reviewer counseling the cardholders 

or, in some instances, recommending that cardholders attend purchase 

card training. During fiscal year 2000, the SPAWAR San Diego Office of 

Command Evaluation internal review group had not conducted any reviews 

or audits of the purchase card program. Further, although the SPAWAR San 

Diego Command Inspector General6

 reviewed the SPAWAR purchase card 

program during fiscal year 2000 and prepared a draft report summarizing 

the results of this review, the final report has not yet been issued. Our 

review of the draft report determined that the Command IG identified a 

number of internal control problems that are consistent with our findings, 

including issues related to receipt and acceptance, training, and split 

purchases. 

The Navy Public Works Center San Diego purchase card agency program 

coordinator did not perform any systematic reviews of the program during 

fiscal year 2000. He told us that his monitoring efforts consisted of 

scanning some monthly invoices for duplicate payments, split purchases, 

and other suspicious payments. However, he did not document these 

actions. Further, the Public Works Center internal review group in the 

Office of Command Evaluation did not perform any reviews during fiscal 

year 2000. However, Navy Public Works Center managers told us that they 

asked the Naval Audit Service to review the Center’s purchase card 

program during fiscal year 2000 because of concerns about the growth of 

the program, the adequacy of internal controls, and recent instances of 

fraud. Although the Naval Audit Service completed its fieldwork in 

November 2000 and briefed Navy Public Works Center San Diego 

management on its findings, the results of that effort have yet to be 

6

The SPAWAR Command Inspector General organization is an internal review unit under the 

Navy Department’s Inspector General and is not a part of the DOD Inspector General’s 

Office. As part of the Navy Inspector General organization, the SPAWAR Command 

Inspector General makes inquiries and reports on matters affecting military efficiency or 

discipline, proposes and executes inspections, and cooperates with the DOD Inspector 

General.
Page 12 GAO-01-995T Navy Purchase Card Controls

externally reported. According to the Navy’s Deputy Assistant Auditor 

General, the Naval Audit Service plans to finalize its work and issue a 

report in the fall of 2001. 

Breakdown of Critical 

Internal Controls

Basic internal controls over the purchase card program were ineffective at 

the two units we reviewed. Based on our tests of statistical samples of 

purchase card transactions, we determined that the three transaction-level 

controls that we tested were ineffective, rendering SPAWAR San Diego and 

Navy Public Works Center San Diego purchase card transactions 

vulnerable to fraudulent and abusive purchases and theft and misuse of 

government property. As shown in table 2, the specific controls that we 

tested were (1) independent, documented receipt and acceptance of goods 

and services, (2) independent, documented certification of monthly 

purchase card statements, and (3) proper accounting for purchase card 

transactions. 

Table 2: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests

a

The numbers represent point estimates for the population based on our sampling tests. The 

confidence intervals for our sampling estimates are presented in appendix III of this testimony.

b

All seven approving officials with certifying officer responsibilities told us that they did not review 

support for transactions before certifying purchase card statements for payment.

In addition, we tested whether the accountable items—easily pilferable or 

sensitive items— included in some of the transactions in our samples were 

recorded in the units’ property records to help prevent theft, loss, and 

misuse of government assets. Our tests of SPAWAR and Navy Public Works 

Center fiscal year 2000 purchase card transactions that included 

accountable property items, showed that the two units failed to record one 

or more accountable items in their property records for nearly all of these 

transactions. Further, when we analyzed the property items included in our 

sampled transactions, we found that SPAWAR and the Navy Public Works 

Center did not record 46 of the 65 accountable items included in our 

Breakdowns in key purchase card controlsa

Independent, documented 

receipt Proper payment certification Timely customer accounting

Navy Units in San Diego, CA

Percent

failure

Projection

(millions)

Percent

failure

Projection

(millions)

Percent

failure

Projection

(millions)

SPAWAR 65% $14.5 100%b $38b 83% $20.4

Navy Public Works Center 47% $12.9 100%b $30b 35% $11.2
Page 13 GAO-01-995T Navy Purchase Card Controls

sampled transactions in their property records. Moreover, when we asked 

to inspect these items, the two units could not provide conclusive evidence 

that 31 of them, including laptop computers, Palm Pilots, and digital 

cameras, were in the possession of the government.

Lack of Independent 

Documented Receipt and 

Acceptance

SPAWAR San Diego and the Navy Public Works Center San Diego generally 

did not have independent, documented evidence that they received items 

ordered by purchase card. That is, they generally did not have a receipt for 

the acquired goods and services that was signed by someone other than the 

cardholder. As a result, there is no documented evidence that the 

government received the items purchased or that those items were not lost, 

stolen, or misused. NAVSUP Instruction 4200.94 generally requires 

segregation of duties between the individual making the purchase and the 

individual responsible for documenting receipt and acceptance of goods 

and services acquired by purchase card. However, employees at the two 

units were not following these procedures. In some instances employees 

were following an alternative procedure permitted by the NAVSUP 

Instruction whereby independent authorization of a purchase order can be 

substituted for independent confirmation of receipt of the items purchased. 

However, the alternative procedure does not provide any assurance that 

the items ordered and paid for were received.

Key duties and responsibilities need to be divided or segregated among different 

people to reduce the risk of error or fraud. This should include separating the 

responsibilities for authorizing transactions, processing and recording them, 

reviewing the transactions, and handling any related assets. Simply put, no one 

individual should control all the key aspects of a transaction or event. GAO’s 

Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, 

November 1999)
Page 14 GAO-01-995T Navy Purchase Card Controls

Based on our test work, we estimate that SPAWAR San Diego did not have 

independent, documented evidence to confirm the receipt and acceptance 

of goods and services acquired with the purchase card for about 65 

percent7

 of its fiscal year 2000 transactions totaling at least $10.1 million. 

For the Navy Public Works Center San Diego, we estimated that 47 percent8

of its fiscal year 2000 purchase card transactions totaling at least $6.6 

million did not include independent, documented receipt of goods and 

services. 

The types of items in our sampled transactions that lacked independent 

evidence of receipt and acceptance included computers, monitors, and 

compact disk writers that were purchased at stores such as Byte and 

Floppy Computer, Dell Computer, and CompUSA. Further, during fiscal 

year 2000, SPAWAR and the Navy Public Works Center in San Diego made 

over 2,000 transactions totaling over $468,000 for items from The Home 

Depot, Best Buy, Circuit City, and Wal-Mart. Our review of the five purchase 

card fraud cases related to Navy activities based in San Diego, discussed in 

appendix II, showed that fraudulent purchases had been made to acquire 

items for personal use from these same stores. Because the Navy 

purchases items for valid, government purposes from stores that are widely 

used by consumers to acquire items for personal use, verification of receipt 

of goods and services by an individual other than the cardholder is 

necessary to reduce the risk of fraudulent transactions. 

Lack of Proper Certification 

of Monthly Purchase Card 

Statements

7

The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of SPAWAR purchase card transactions that lacked independent 

confirmation of receipt of goods and services purchased was between 55 percent and 75 

percent and totaled between $10.1 million and $18.9 million.

8

The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of Navy Public Works Center purchase card transactions that lacked 

independent confirmation of receipt of goods and services purchased was between 35 

percent and 59 percent and totaled between $6.6 million and $19.2 million.

Transactions and other significant events should be authorized and executed only 

by persons acting within the scope of their authority. This is the principal means 

of assuring that only valid transactions to exchange, transfer, use, or commit 

resources and other events are initiated or entered into. GAO’s Standards for 

Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999)
Page 15 GAO-01-995T Navy Purchase Card Controls

We assessed a 100-percent failure rate at both units for this critical control. 

NAVSUP Instruction 4200.94 and, to a greater extent, a policy 

memorandum issued by the Navy Comptroller’s office on June 3, 1999, do 

not provide adequate internal controls and are inconsistent with the 

responsibilities of certifying officers reflected in statutes and DOD’s fiscal 

policy guidance. Approving officials at the two units told us that they were 

not following the existing procedures due to time constraints and the Navy 

Comptroller’s policy memorandum. 

Under 31 U.S.C. 3325 and DOD’s Financial Management Regulation,

9

disbursements are required to be made on the basis of a voucher certified 

by an authorized agency official. The certifying official is responsible for 

ensuring (1) the adequacy of supporting documentation, (2) the accuracy 

of payment calculations, and (3) the legality of the proposed payment 

under the appropriation or fund charged. Proper certification of bills for 

payment is a preventive control that requires and provides the incentive for 

certifying officers to maintain proper controls over public funds. It also 

helps detect fraud and improper payments, including invalid (unsupported 

or prohibited) transactions, split purchases, and duplicate payments. 

Further, section 933 of the National Defense Authorization Act for Fiscal 

Year 2000 requires the Secretary of Defense to prescribe regulations that 

ensure, among other things, that each purchase cardholder and approving 

official is responsible for reconciling charges on a billing statement with 

receipts and other supporting documentation. 

According to NAVSUP Instruction 4200.94, upon receipt of the individual 

cardholder statement, the cardholder has 5 days to reconcile the 

transactions appearing on the statement by verifying their accuracy to the 

supporting documents and notify the approving official in writing of any 

discrepancies in the statement or sign and forward it to the approving 

official. The approving official is responsible for ensuring that all purchases 

made by the cardholders within his or her cognizance were appropriate and 

that the charges are accurate. However, the Instruction further states that 

within 5 days of receipt of the cardholders’ statements, the approving 

official must review and certify the monthly summary statement for 

payment, whether or not the cardholder has reviewed the statement and 

notified the official of any discrepancies or agreement with the statement. 

That is, the approving official is to presume that all transactions on the 

9

DOD Financial Management Regulation, Volume 5, Chapter 33, “Accountable Officials 

and Certifying Officers."
Page 16 GAO-01-995T Navy Purchase Card Controls

monthly statements are proper unless notified in writing by the purchase 

cardholder. 

Under this process, the certifying officer relies upon the silence of a 

cardholder who may have failed to timely forward corrections or 

exceptions to the account statement or, even worse, may not have even 

reviewed the statement. A certifying officer in these circumstances is not 

taking steps to assure that a payment is proper and an agency therefore 

cannot rely on the certification for assurance that a payment is for the 

proper amount and a legal purpose. 

This NAVSUP policy is inconsistent with the purpose of certifying vouchers 

prior to payment, which is to maintain proper control over public funds and 

assure that payments are made for proper amounts and purposes. 

Certifying officers are responsible for the correctness of facts and 

computations in the voucher, and the legality of the proposed payment 

under the appropriation involved. A certifying officer is liable for losses 

resulting from improper certifications, but may be relieved from liability if 

the certification was based upon official records and the officer did not 

know, and could not have reasonably discovered, the correct information. 

While certifying officials may rely on systems, controls, and personnel that 

process transactions rather than personally reviewing the supporting 

documentation, they must show that their reliance was reasonable. 

Regardless of what system is used, there is no authority to make known 

improper payments. At SPAWAR and the Navy Public Works Center, the 

certifying officers relied on a process without assurances that even a 

minimal review of the facts and computations underlying the proposed 

payment or the legality of such payment was carried out before 

certification was made. Thus, the certifying officers may not be able to 

demonstrate that their reliance on such a system is reasonable. 

In addition to the problems with NAVSUP Instruction 4200.94, the Navy 

Comptroller’s June 3, 1999, policy memorandum further weakens the 

certification process. The policy memorandum does not explicitly state 

that the cardholder must review the statement of account and notify the 

approving official of any improper or incorrect items within 5 days of 

receipt. Nonetheless, the approving official must certify the invoices based 

on the presumption that all cardholder accounts are proper unless notified 

in writing within 5 days of receipt of the invoice. Navy officials told us that 

it is assumed that cardholders would review the statements and notify the 

approving officials of any problems. While the cardholder’s review is not 

explicitly required, the memorandum states that the change in policy “will 
Page 17 GAO-01-995T Navy Purchase Card Controls

ensure that the cardholder will inform the AO [approving official] in a 

prompt manner of any duplicate payments or fraudulent or improper 

charges to his account.” Again, by requiring certification within 5 days, 

whether or not a cardholder has reviewed a statement, the June 3, 1999, 

policy memorandum requires a certifying officer to rely upon a process that 

does not require review of a proposed payment or otherwise assure that a 

payment is properly payable before certification occurs.

All seven approving officials at the two activities (one at SPAWAR and six 

at the Navy Public Works Center) told us that they never reviewed the 

cardholders’ supporting documentation before signing and submitting 

purchase card statements for payment. Accordingly, we assessed the 

failure rate for this control as 100 percent for both SPAWAR San Diego and 

the Navy Public Works Center San Diego. Approving officials explained 

that they certify purchase card statements for payment without reviewing 

cardholders’ supporting documentation because (1) they do not have time 

to review the documentation and (2) the Navy Comptroller’s June 3, 1999, 

guidance relieves them of this responsibility. 

With regard to the first issue, both activities are faced with a significant 

span of control issue that makes the overall purchase card environment 

difficult, if not impossible, to control. With an average of over 700 monthly 

cardholder statements at SPAWAR San Diego and only one approving 

official—who is also the Agency Program Coordinator—proper 

certification of monthly summary statements within 5 days of receipt is not 

physically possible. Thus, the SPAWAR San Diego approving official told us 

that the certification process is largely a “rubber stamp” with no real 

verification of the underlying cardholder support for the monthly summary 

statements. The environment is somewhat more manageable at the Navy 

Public Works Center San Diego, with six approving officials charged with 

certifying summary statements that cover an average of 55 cardholder 

statements each month. However, Public Works Center approving officials 

also told us that they did not review all cardholder supporting 

documentation before certifying purchase card statements for payment. As 

a result, these two Navy units paid their monthly purchase card bills 

without knowing whether the charges were valid. As discussed later in this 

statement, this has contributed to payments being made for unauthorized 

and improper transactions.
Page 18 GAO-01-995T Navy Purchase Card Controls

With regard to the second issue, the June 3, 1999, policy memorandum 

appears to improperly assign certifying officer accountability to 

cardholders. The policy memorandum stated that because it is not possible 

for the approving official to personally review and verify individual 

cardholder transactions and statements of account, the approving official 

is to certify the purchase card statements for payment based on the 

presumption that all cardholder accounts are proper unless the approving 

official has been notified to the contrary by the cardholder. The 

memorandum goes on to say that, “[T]his new policy recognizes that the 

ultimate responsibility for purchases being proper is with the cardholder.”

However, under 31 U.S.C. 3528 and DOD’s Financial Management 

Regulation, certifying officers are liable for an illegal, improper, or 

incorrect payment as a result of an inaccurate or misleading certification. 

An agency may not shift certifying officer liability to other employees.10 The 

policy memorandum is also inconsistent with GAO’s internal control 

standard for ensuring that only valid transactions are entered into. 

According to DOD and Navy officials, this policy memorandum has created 

confusion about whether the cardholder or the approving official is 

responsible for proper certification of purchase card statements for 

payment. 

Problems in Proper 

Accounting for Purchase 

Card Transactions

1031 U.S.C. 3528 and Comp. Gen. Decision on “Department of Defense−Authority to Impose 

Pecuniary Liability by Regulation” (B-280764, May 4, 2000).

Transactions should be promptly recorded to maintain their relevance and value 

to management in controlling operations and making decisions. This applies to 

the entire process or life cycle of a transaction or event from the initiation and 

authorization through its final classification in summary records. GAO’s 

Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, 

November 1999)
Page 19 GAO-01-995T Navy Purchase Card Controls

The two units we reviewed did not have controls in place to ensure that 

purchase card transactions were recorded to customer accounts in a timely 

manner and that local accounting records reflected the proper 

classification of expense. The timely and accurate recording of purchase 

card transactions is important to ensure the reliability of data and 

information used in day-to-day management and decision-making, 

particularly for working capital fund activities such as SPAWAR and the 

Navy Public Works Center. We have previously reported11 that DOD has 

long-standing problems accumulating and reporting the full costs 

associated with its working capital fund operations. 

Recording Purchase Card Costs 

to Customer Accounts

The two units did not always record purchase card costs to customer 

accounts within required time frames. Consistent with GAO’s internal 

control standards and Statement of Federal Financial Accounting 

Standards (SFFAS), No. 4, “Managerial Cost Accounting Standards,”

SPAWAR San Diego and Navy Public Works Center San Diego operating 

procedures require timely recording of purchase card costs to projects that 

received the goods and services acquired by purchase card. This is an 

important control because as working capital fund operations, SPAWAR 

and the Navy Public Works Center are to provide their customers with 

information on the full cost of goods and services provided—either through 

billing or other information. Further, working capital fund activities are to 

operate on a break-even basis over time—that is, not make a profit or incur 

a loss. Accurate and timely recording of customer transactions are key to 

ensuring that these working capital fund objectives are met. 

11Department of Defense: Implications of Financial Management Issues (GAO/TAIMD/NSIAD-00-264, July 20, 2000). 
Page 20 GAO-01-995T Navy Purchase Card Controls

However, based on our tests of fiscal year 2000 purchase card transactions, 

we estimate that 83 percent12 of the SPAWAR transactions totaling at least 

$15.3 million and an estimated 35 percent13 of the Navy Public Works 

transactions totaling at least $5 million had not been recorded to customer 

or overhead accounts within 5 days of receipt of the purchase card 

statements.14 As time passes, the likelihood that documentation will be 

available to properly record transactions decreases. For example, because 

SPAWAR did not have the documentation to support timely and accurate 

recording of purchase card transactions, it wrote off as a loss $657,642 in 

fiscal year 2000 transactions that could not be identified to a specific job 

order. Further, according to the SPAWAR Accounting Officer, as of the end 

of fiscal year 2000, SPAWAR had a backlog of about $5.6 million in purchase 

card transactions that had not been recorded to customer accounts or its 

own overhead account. As a result of unrecorded transactions, year-end 

data on actual overhead costs used to estimate future overhead rates for 

billing purposes were unreliable. Navy Public Works Center San Diego 

officials were unable to provide reliable information on the amount of 

unrecorded purchase card transactions at the end of fiscal year 2000 

because systems weaknesses rendered their fiscal year-end data 

incomplete and unreliable.

12The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of SPAWAR purchase card transactions that were not recorded to 

customer accounts in a timely manner was between 74 percent and 90 percent and totaled 

between $15.3 million and $25.5 million. 

13The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of Navy Public Works Center purchase card transactions that were not 

recorded to customer accounts in a timely manner was between 24 percent and 47 percent 

and totaled between $5 million and $17.4 million. 

14For comparability, we used a 5-day criteria for calculating timely recording of transactions 

to customer and overhead accounts. Local SPAWAR San Diego policies and procedures 

required purchase card transactions to be recorded within 3 days and local Navy Public 

Works Center San Diego policies and procedures required these transactions to be recorded 

within 5 days.
Page 21 GAO-01-995T Navy Purchase Card Controls

Classifying Purchase Card 

Costs by Object Class

In addition to problems with timely and accurate recording of transactions 

to customer accounts, SPAWAR San Diego and the Navy Public Works 

Center San Diego did not properly classify purchase card transactions in 

their detail accounting records to show the nature and type of expenditures 

made using purchase cards. Office of Management and Budget (OMB) 

Circular A-11, Preparation and Submission of Budget Estimates, requires 

federal agencies to report obligations and expenditures by object class, 

such as salaries, benefits, travel, supplies, services, and equipment, to 

indicate the nature of the expenditures of federal funds. Object 

classification data are reported by appropriation in the President’s Annual 

Budget Submissions to the Congress. OMB prepares summary reports of 

object class data to support budget projections and other analyses. 

Accurate object classification data are critical to the reliability of 

information reported in the President’s budget submission and budget 

projections and other analyses that are based on these data. In addition, 

because the Congress has asked for and is using object class information 

for its oversight activities, it is important that these data be properly 

recorded. We previously reported15 that inaccurate reporting by object 

class hampers congressional oversight. 

DOD Purchase Card Program Office guidance requires payments of 

monthly purchase card statements to be recorded as summary records in 

the Navy’s accounting systems and has directed that these summary 

records be recorded to the object class for supplies and materials, 

regardless of the nature of the expenses incurred. After purchase card 

statements have been paid, SPAWAR San Diego and the Navy Public Works 

Center San Diego are to record the individual transactions included in the 

summary payment record in their local accounting records. However, we 

determined that SPAWAR did not classify summary records related to 

payment of monthly purchase card statements to any expense category in 

the Navy’s accounting system and recorded all of the purchase card 

transactions in our sample to object class 25, as services, in its local 

accounting records. Consistent with DOD Purchase Card Joint Program 

Management Office guidance, the Navy Public Works Center San Diego 

recorded both the summary records related to payment of monthly 

purchase card statements and the detailed transactions to object class 26, 

as supplies and materials, in its local accounting system.

15DOD Consulting Services: Erroneous Accounting and Reporting of Costs

(GAO/NSIAD-98-136, May 18, 1998).
Page 22 GAO-01-995T Navy Purchase Card Controls

Because SPAWAR San Diego and the Navy Public Works Center San Diego 

did not ensure that their detail transaction records reflected the proper 

classification of expense, 100 percent of the SPAWAR and Navy Public 

Works Center transactions in our samples were recorded to the wrong 

object class. For example, although the majority of the SPAWAR purchase 

card transactions in our sample—76 transactions totaling over $73,000—

were for equipment purchases, none of these transactions were properly 

classified and recorded. Further, SPAWAR did not maintain sufficient 

documentation to determine the correct object class for 15 of the 

transactions in our sample totaling about $12,000. In addition, although the 

Navy Public Works Center recorded all of the purchase card transactions in 

our sample as supplies and materials, many of these transactions should 

have been recorded as contractual services or equipment. Also, the Navy 

Public Works Center did not maintain sufficient documentation to 

determine the proper object class for nine of the transactions in our sample 

totaling about $6,000. 

Failure to Record 

Accountable Items in 

Property Records

Most of the accountable items—easily pilferable or sensitive items—in our 

samples were not recorded in property records. Recording these items in 

the property records is an important step to ensure accountability and 

financial control over these assets and, along with periodic inventory, to 

prevent theft or improper use of government property. Consistent with 

GAO’s internal control standards, DOD’s Property, Plant, and Equipment 

Accountability Directive and Manual, which was issued in draft for 

implementation on January 19, 2000, and the Appropriation, Cost and 

Property Accounting procedures (referred to as the NAVSOP 1000-3M) 

issued by DFAS Cleveland,16 require accountable property to be recorded in 

property records as it is acquired. Accountable property includes easily 

pilferable or sensitive items, such as computers and related equipment, 

cameras, cell phones, and power tools. The NAVSOP property procedures 

An agency must establish physical control to secure and safeguard vulnerable 

assets. Examples include security for and limited access to assets such as cash, 

securities, inventories, and equipment which might be vulnerable to risk of loss 

or unauthorized use. Such assets should be periodically counted and compared 

to control records. GAO’s Standards for Internal Control in the Federal 

Government (GAO/AIMD-00-21.3.1, November 1999)

16NAVSOP 1000-3M, Chapter 6, Part D, “Plant Property and Other Navy Property,”

(previously referred to as NAVCOMPT, Volume 3).
Page 23 GAO-01-995T Navy Purchase Card Controls

require such property to be recorded in property records along with a 

description of the item, property identification number, model and serial 

number, manufacturer, acquisition cost, and the location or custodian of 

the property. 

Based on our tests of fiscal year 2000 purchase card transactions that 

included accountable property items, we estimate that SPAWAR did not 

record all accountable items in its property records for about 84 percent17

of its purchase card transactions, covering at least $5.4 million in 

accountable property. Based on our tests of Navy Public Works Center 

fiscal year 2000 purchase card transactions that included accountable 

property items we estimate that the Center did not record all accountable 

items in its property records for about 95 percent18 of its purchase card 

transactions, covering at least $317,000 in accountable property. 

Our analysis of the individual property items included in our sampled 

SPAWAR and Navy Public Works Center fiscal year 2000 purchase card 

transactions showed that the two units did not record a total of 46 of the 65 

accountable items that were included in our sampled transactions in their 

property records, including 36 SPAWAR items and 10 Public Works Center 

items. SPAWAR officials told us that they were not aware of the 

requirement to record items such as computer monitors, cameras, and 

palm pilots in the property records. Moreover, when we asked to inspect 

these items, the two units could not provide conclusive evidence that 31 of 

them were in the possession of the government, including 19 SPAWAR 

items and 12 Public Works Center items. The unverified accountable items 

included laptop computers, Palm Pilots, and digital cameras. Of the 31 

items that could not be verified, 5 items had been transferred to other 

locations throughout the world and SPAWAR and the Public Works Center 

officials were unable to conclusively demonstrate their existence and 

location, serial numbers for 4 items did not match those on the purchase 

documentation, 3 items were declared to be lost or stolen by employees 

who had custody of these items, and the existence of the remaining 19 

17The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of SPAWAR purchase card transactions for which all accountable items 

were not recorded in the property records was between 52 percent and 99 percent and 

totaled between $5.4 million and $7.6 million. 

18The range of our confidence interval, at a 95-percent confidence level, indicates that the 

population estimate of Navy Public Works Center purchase card transactions for which all 

accountable items were not recorded in the property records was between 68 percent and 

100 percent and totaled between $317,792 and $484,249. 
Page 24 GAO-01-995T Navy Purchase Card Controls

items could not be verified because a serial number was not included in the 

purchase documentation or a receipt for the item including a serial number 

could not be located. 

The three items that were declared lost or stolen included two Palm Pilots 

that could not be located—one at SPAWAR San Diego and the other at the 

Navy Public Works Center San Diego—and a video conferencing camera 

that was reported stolen from a Public Works Center employee’s car. 

SPAWAR and Navy Public Works Center officials directed the employees to 

prepare lost property reports on the two Palm Pilots. Subsequently, in early 

June 2001, Navy Public Works Center officials advised us that their lost 

Palm Pilot had been located and showed us what they believed was the 

item in question. However, because the serial number had been rubbed off, 

we could not confirm that it was the accountable item acquired by 

purchase card. In late June 2001, SPAWAR officials advised us that their 

lost Palm Pilot had been located. Because we had already completed our 

review of SPAWAR property controls, we did not attempt to view and 

confirm the existence of this Palm Pilot. 

The third item was a video conferencing camera that was reported stolen 

on January 27, 2001, by a Navy Public Works Center San Diego employee. 

According to the employee, the video camera was stolen from his car along 

with a laptop computer that also belonged to the government. The 

employee submitted a claim to his insurance company, and the claim was 

paid on February 27, 2001. Although the stolen items cost about $3,876, the 

employee’s insurance policy limited payment of claims for business 

property to $2,500. However, about two months later, in May 2001, our 

investigators determined that the insurance check in the amount of $2,500 

was deposited in the employee’s personal bank account instead of being 

endorsed to the government. The employee admitted to our investigators 

that he had been reimbursed for the stolen items from his insurance 

company. On May 3, 2001, the employee issued a check to the government 

in the amount of $2,500. Navy Public Works Center officials told us that 

they are considering assessing the employee for the remaining loss of 

$1,376 and taking possible disciplinary action for the failure to reimburse 

the government for the equipment loss in a timely manner. 
Page 25 GAO-01-995T Navy Purchase Card Controls

Potentially Fraudulent, 

Improper, and Abusive 

Transactions

We identified several cases of potentially fraudulent, improper, and abusive 

transactions at both SPAWAR San Diego and the Navy Public Works Center 

San Diego. Given the breakdown of controls described in this testimony, 

the two units would have difficulty detecting and preventing these three 

types of transactions. We considered potentially fraudulent purchases to be 

those which were unauthorized and intended for personal use. Some of 

these instances may involve the use of compromised accounts, in which an 

account number was stolen and used to make fraudulent purchases. Other 

cases involve the cardholder making unauthorized purchases for personal 

use. The transactions we determined to be improper are those purchases 

intended for government use, but are not for a purpose that is permitted by 

law or regulation. We also identified as improper a number of purchases 

made on the same day from the same vendor, which appeared to 

circumvent cardholder single transaction limits. Federal Acquisition 

Regulation and NAVSUP Instruction 4200.94 guidelines prohibit splitting 

purchase card transactions into more than one segment to avoid the 

requirement to obtain competitive bids on purchases over the $2,500 micropurchase threshold or to circumvent higher single transaction limits for 

payments on deliverables under requirements contracts. We defined 

abusive transactions as those that were authorized, but the items 

purchased were at an excessive cost or for a questionable government 

need, or both. In these instances, it appears that cardholders were 

permitted to purchase items for which there was not a reasonable, 

documented justification. As discussed in our Objectives, Scope, and 

Methodology, our work was not designed to identify, and we cannot 

determine, the extent of fraudulent, improper, or abusive transactions.

Potentially Fraudulent 

Transactions

Although both SPAWAR and the Navy Public Works Center had policies and 

procedures that were designed to prevent fraudulent purchases, our tests 

showed that the controls were not implemented as intended. For example, 

as discussed previously, controls for independent verification of receipt 

and acceptance and proper certification of monthly statements prior to 

payment were ineffective. Fraudulent activities must then be detected after 

the fact during supervisor or internal reviews and disputed charge 

procedures must be initiated to obtain a credit from Citibank. Table 3 

shows examples of potentially fraudulent transactions that we identified 

from the universe of fiscal year 2000 purchases by SPAWAR San Diego and 

Navy Public Works Center San Diego cardholders.
Page 26 GAO-01-995T Navy Purchase Card Controls

Table 3: Examples of Potentially Fraudulent Purchase Card Transactions 

Navy Public Works Center San Diego officials told us that they were aware 

of the potentially fraudulent transactions that we identified. The officials 

told us that the apparently fraudulent Public Works Center transactions 

were all made using a limited number of cardholder accounts and that they 

had referred these transactions to the Naval Criminal Investigative Service. 

SPAWAR officials also told us that they were aware of their potentially 

fraudulent transactions. Both Public Works Center and SPAWAR officials 

said that they had submitted disputed charged forms to Citibank and had 

received credits for these transactions. However, given the extensive 

breakdowns in purchase card controls that we identified, SPAWAR and the 

Navy Public Works Center have no assurance that all fraudulent charges 

were detected. Our Office of Special Investigations is conducting a further 

investigation of the potentially fraudulent purchases we identified.

Improper Transactions We identified several SPAWAR San Diego transactions that involved the 

improper use of federal funds. For example, one case involved flowers 

costing $97 purchased for Secretary’s Day. We also identified several 

transactions for food for employee-related activities, including food costing 

$75 for an office outing. The Federal Acquisition Regulation, 48 C.F.R. 

13.301(a), provides that the Governmentwide Commercial Purchase Card 

“may be used only for purchases that are otherwise authorized by law or 

regulations.” Therefore, a procurement using the purchase card is lawful 

only if it would be lawful using conventional procurement methods.

Type of items 

purchased Unit Vendor

Total

amount

Cosmetics SPAWAR Mary Kay $500

Gift certificates Public Works Center Nordstrom $1,500

Clothing, electronics, and 

other personal items

Public Works Center Mervin’s, Macy’s, 

Circuit City, others

$10,000

Gas Public Works Center Citgo 7 Eleven, 

Exxon, Shell

$360

CD recordings Both Sam Goody $700
Page 27 GAO-01-995T Navy Purchase Card Controls

Pursuant to 31 U.S.C. 1301(a), “[a]ppropriations shall only be applied to the 

objects for which the appropriations were made . . . .” In the absence of 

specific statutory authority, appropriated funds may only be used to 

purchase items for official purposes, and may not be used to acquire items 

for the personal benefit of a government employee. For example, without 

statutory authority, appropriated funds may not be used to furnish meals or 

refreshments to employees within their normal duty stations.19 Free food 

and other refreshments normally cannot be justified as a necessary 

expense of an agency’s appropriation because these items are considered 

personal expenses that federal employees should pay for from their own 

salaries.20 Likewise, appropriated funds may not be used to purchase gifts 

for employees or others unless an agency can demonstrate that the items 

further the purposes for which the appropriation was enacted.21 The 

purchase of the flowers and food were both personal rather than official in 

nature and, therefore, may not be paid for with appropriated funds. 

Another transaction involved the purchase of a file cabinet from Macy’s at a 

cost of $1,462. Purchases of file cabinets are subject to rules prescribed in 

Title 41 of the Code of Federal Regulations, Subtitle C, “Federal Property 

Management Regulations System,” which cover specific procedures that 

must be followed to limit the purchases of new filing cabinets, including 

disposing of all records that have been authorized for disposition in 

accordance with authorized disposal schedules and transferring inactive 

records not needed for daily business to approved agency records centers. 

After taking appropriate steps to maximize the use of existing filing 

cabinets, if the agency determines that additional filing cabinets are 

required, the FAR requires the agency to submit a requisition to the General 

Service Administration (GSA). We found no documented evidence that the 

required procedures were followed. Further, we found no documented 

justification for purchasing the file cabinet from Macy’s instead of through 

GSA, as required.

Potentially Abusive 

Transactions

We also identified a number of potentially abusive transactions. These were 

purchases of items supposedly for official use but without any documented 

agency determination that these items were necessary for government

1972 Comp. Gen. 178, 179 (1993); 65 Comp. Gen. 508, 509 (1986).

2058 Comp. Gen. 738, 739 (1986).

21B-260260, December 28, 1995; 70 Comp. Gen. 248 (1991). 
Page 28 GAO-01-995T Navy Purchase Card Controls

business rather than merely to satisfy the personal preference of individual 

employees. When a contracting official—in this case, a purchase 

cardholder—purchases an item based on his or her own preferences (or 

the desires of another agency official or employee) without a management 

decision that the item is necessary, he or she is abusing the procurement 

process. Some of these items fall into categories described in GAO’s Guide 

for Evaluating and Testing Controls Over Sensitive Payments

(GAO/AFMD-8.1.2, May 1993). The guide states that “Abuse is distinct from 

illegal acts (noncompliance). When abuse occurs, no law or regulation is 

violated. Rather, abuse occurs when the conduct of a government 

organization, program, activity, or function falls short of societal 

expectations of prudent behavior.”

Our review of the transactions in our samples as well as our analytical 

review of the universe of SPAWAR and Navy Public Works Center fiscal 

year 2000 transactions identified a number of purchases that appear to be 

abusive, as shown in table 4. 

Table 4: Examples of Potentially Abusive Purchase Card Acquisitions 

a

The $900 amount represents the total cost of a Palm Pilot with accessories, including external 

keyboards, travel kits, additional memory, modems, and belt clips.

For example, SPAWAR San Diego cardholders purchased 9 flat-panel 

computer monitors at a total cost of $13,192. The cost of each monitor 

ranged from $800 to $2,500. In contrast, the current GSA schedule cost of a 

standard 17-inch computer monitor is about $300. We were unable to find 

any pre-purchase agency determination that the nature of the work 

performed by SPAWAR officials or employees was such that standard 

monitors would not satisfy their needs. SPAWAR’s commanding officer 

later told us that flat-panel monitors save space and energy and are easier 

Type of items 

purchased Unit Vendors Cost per item

Flat panel monitors SPAWAR Byte and Floppy 

Computers, Dell

 $800 - $2,500

Personal digital assistants 

(e.g., Palm Pilots)

SPAWAR and the

Public Works Center

CompUSA, Staples $250 - $900a

Designer briefcases SPAWAR The Coach Store, 

Nordstrom

 $400

Designer Palm Pilot 

holders

SPAWAR Dooney and Bourke $100
Page 29 GAO-01-995T Navy Purchase Card Controls

on the eyes. However, his opinion did not constitute an official agency 

determination that these monitors were needed. It appears more likely that 

cardholders purchased these more costly monitors to satisfy the personal 

preferences of individual SPAWAR officials or employees. Our sample 

transactions also included four SPAWAR purchases of PDAs for a total cost 

of $1,150.

We performed a similar review of the Navy Public Work Center’s fiscal year 

2000 transactions and generally did not identify the same types of 

potentially abusive transactions. We did, however, identify nine PDA 

purchases for a total cost $3,642. Again, we were unable to find any prepurchase agency determination that these officials or employees needed 

PDAs to perform their work. Therefore, it again appears likely that the 

PDAs were acquired to satisfy the personal preferences of the individuals 

for whom they were purchased. 

Split Purchases Our analysis of the universe of fiscal year 2000 Navy purchase card 

payments made by DFAS San Diego identified nearly $100 million in 

purchases made on the same day from the same vendor, which appeared to 

circumvent cardholder single transaction limits—including about

$2.5 million in potential SPAWAR split purchases and nearly $4.7 million in 

potential Navy Public Works Center split purchases. The Federal 

Acquisition Regulation and Navy purchase card policies and procedures 

prohibit splitting a transaction into more than one segment to avoid the 

requirement to obtain competitive bids for purchases over the 

$2,500 micro-purchase threshold or to avoid other established credit limits. 

DOD and Navy purchase card policies and procedures prohibit such 

actions as improper use of the purchase card. Once items exceed the 

$2,500 micro-purchase threshold, they are to be purchased in accordance 

with simplified acquisition procedures, which are more stringent than 

those for micro-purchases. 

Our analysis of the universe of fiscal year 2000 SPAWAR San Diego and 

Navy Public Works Center San Diego transactions identified a number of 

potential split purchases. To determine whether these were, in fact, split 

purchases, we obtained and analyzed the supporting documentation for 20 

purchases each at SPAWAR and the Navy Public Works Center. We found 

that in many instances, cardholders made multiple purchases from the 

same vendor within a few minutes or a few hours for items such as 

computers, computer-related equipment, and software, that involved the 

same, or sequential or nearly sequential purchase order and vendor invoice 
Page 30 GAO-01-995T Navy Purchase Card Controls

numbers. Based on our analyses, we concluded that 18 of the 20 SPAWAR 

purchases and 14 of the 20 Navy Public Works Center purchases that we 

examined were split into two or more transactions to avoid micro-purchase 

thresholds. Tables 5 and 6 provide examples of cardholder purchases that 

we believe represent split purchases intended to circumvent the $2,500 

micro-purchase limit or cardholder transaction limits.

Table 5: Examples of Potential SPAWAR San Diego Split Purchases 

Note: All cardholders making these purchases had $2,500 single transaction limits.

Vendor Date Charge Items purchased

Cost of

items Indicator of split purchase

Byte & Floppy 

Computers

11/3/1999 1 Computer flat LCD panel monitor $2,408 Sequential invoice numbers

2 Computer flat LCD panel monitor $2,398

Byte & Floppy 

Computers

9/25/2000 1 Computer, scanner $1,809 No receipt provided

2 Flat panel monitor $2,459

Byte & Floppy 

Computers

1/26/2000 1 Laptop computer $2,418 Receipts timed 2 minutes 

apart

2 Desktop computer and flat LCD 

panel monitor

$2,428

CompUSA 9/17/2000 1 Computer supplies $1,449 Receipt shows total 

purchase of $3,449

2 Computer $2,000

Fry’s Electronics 11/18/99 1 Computer equipment $1,841 Receipts timed 7 minutes 

apart

2 Computer equipment $472

3 6 PC cameras and computer 

equipment

$1,510

Fry’s Electronics 9/25/2000 1 Laptop computer $2,439 Sequential purchase orders 

and all items purchased on 

same day

2 Printers $2,433

3 PDA and other equipment $1,989

Circuit City 10/15/1999 1 Laptop computer $1,500 Sequential purchase order 

numbers 

2 Laptop computer $1,500
Page 31 GAO-01-995T Navy Purchase Card Controls

Table 6: Examples of Potential Navy Public Works Center San Diego Split Purchases

Note: All cardholders making these transactions had $2,500 single transaction limits.

In addition to the items in table 6, we identified three Navy Public Works 

Center purchases totaling $147,000 that were made to the same vendor on 

the same day by a cardholder with a $100,000 transaction limit. The Navy 

Public Works Center did not have receipts to document the items acquired.

Planned Actions to 

Mitigate Control 

Weaknesses

When we brought the control failures and other issues we identified to the 

attention of the Executive Officer at the Navy Public Works Center San 

Diego, he demonstrated a proactive position to identifying and correcting 

the weaknesses. According to the Executive Officer, because of concerns 

about recent instances of purchase card fraud, the Navy Public Works 

Center requested a Naval Audit Service review of purchase card activity 

and undertook a number of corrective actions as a result of auditor 

findings. For example, in February 2000, the Navy Public Works Center San 

Vendor Date Charge Items purchased Cost of items Indicator of split purchase

All Access 

Equipment 

11/2/1999 1 Equipment rental $1,893 Rental and invoice were 

sequential

2 Equipment rental $1,701

Apollo Electronics 4/20/2000 1 Ejector and subracks $835 Vendor invoices are sequential

2 Components $2,013

Astra Coatings 12/8/1999 1 Install flooring $2,285 Identical amount and 

description, and sequential 

invoice numbers

2 Install flooring $2,285

Barrett Engineered 

Pumps

10/20/1999 1 Rebar for retaining wall at 

San Clemente

$1,112 Transactions were for same 

vendor invoice and job order 

numbers

2 Rebar for chlorine contact 

tank at San Clemente

$1,667

Barrett Engineered 

Pumps

12/08/99 1 Receiver $2,277 Both invoices were dated 

11/12/999

2 Receiver $868

NPLTED Rentals 2/18/2000 1 Skip loader rental $1,544 Same day and time in and out 

as other rental

2 Dump truck rental $1,800

Perma Pipe, Inc. 5/1/2000 1 Leak detection cable $1,997 Sequential purchase order 

numbers

2 Perma pipe services $1,516
Page 32 GAO-01-995T Navy Purchase Card Controls

Diego started to reduce the number of purchase cardholders, which totaled 

359 at that time, to about 250, and in September 2000, the Public Works 

Center revised its purchase card policies and procedures to comply with 

NAVSUP Instruction 4200.94. In addition, due to the time required for 

review and proper certification of purchase card statements before 

payment, the Executive Officer told us that he would consider further 

reducing the number of cardholders to help ensure adequate review of 

documentation prior to certifying statements for payment. 

During fiscal year 2001, according to a SPAWAR acquisition official, 

SPAWAR reduced the number of its cardholders from over 1,500 to 1,070; 

however, it continued to have only one approving official who was 

responsible for certifying monthly summary purchase card statements, and 

the average number of individual monthly purchase card statements 

remained about the same. In addition, the SPAWAR San Diego 

Commanding Officer told us that SPAWAR planned to implement an 

Enterprise Resources Planning (ERP) system. The ERP system is expected 

to help improve overall controls for the purchase card program, including a 

central electronic file of imaged documents supporting purchase card 

transactions and an audit trail of actions by individuals executing various 

purchase card processing functions. A SPAWAR official advised us that 

SPAWAR implemented its ERP system in mid-July 2001. However, unless 

substantial improvements are made in the overall control environment and 

employees actually follow purchase card policies and procedures, the ERP 

system will simply automate the same weaknesses as the current manual 

process.

Conclusions The serious breakdown in internal controls at SPAWAR San Diego and 

Navy Public Works San Diego are the result of a weak overall internal 

control environment, flawed or nonexistent policies and procedures, and 

employees that do not adhere to valid policies. The proliferation of 

cardholders at these two activities resulted in over 1,700 cardholders with 

essentially the authority to make their own purchase decisions in an 

environment that lacked basic controls over receipt of government 

property, certification of monthly statements, and accountability over 

sensitive property items. Our work found that these weak internal controls 

resulted in lost, stolen, missing, or misused government property, 

potentially abusive use of purchase cards, and payment of unauthorized 

and potentially fraudulent charges. The combination of these factors also 

contributed to the five known fraud cases and leaves the government 
Page 33 GAO-01-995T Navy Purchase Card Controls

highly vulnerable to significant additional fraud, waste, and abuse from the 

purchase card program at these two Navy units.

Following this testimony, we plan to issue a report that will include 

recommendations to DOD and the Navy for improving internal controls 

over purchase card activity.

Mr. Chairman, Members of the Subcommittee, and Senator Grassley, this 

concludes my prepared statement. I would be pleased to respond to any 

questions that you may have.

Contacts and 

Acknowledgements

For future contacts regarding this testimony, please contact Gregory D. 

Kutz at (202) 512-9095. Individuals making key contributions to this 

testimony included Wendy Ahmed, Christie Arends, Bertram Berlin, Sharon 

Byrd, Francine DelVecchio, Stephen Donahue, Michael Chambless, 

Douglas Ferry, Gayle Fischer, Kenneth Hill, Wilfred Holloway, Jeffrey 

Jacobson, John Kelly, Richard Larsen, John Ryan, and Sidney Schwartz.
Page 34 GAO-01-995T Navy Purchase Card Controls

Appendix I

Background ApendxiI

The Navy’s purchase card program is part of the Governmentwide 

Commercial Purchase Card Program, which was established to streamline 

federal agency acquisition processes by providing a low-cost, efficient 

vehicle for obtaining goods and services directly from vendors. DOD 

reported that it used purchase cards for 95 percent of its eligible 

transactions—more than 10 million transactions, valued at $5.5 billion—in 

fiscal year 2000. The Navy’s reported purchase card activity represented 

nearly one third of the reported DOD total during fiscal year 2000—2.7 

million transactions, valued at $1.7 billion. According to unaudited DOD 

data, SPAWAR and Navy Public Works Center San Diego-based activities 

accounted for $68 million (about 15 percent) of the $451 million in fiscal 

year 2000 Navy purchase card payments processed by DFAS San Diego.

Although SPAWAR San Diego and the Navy Public Works Center San Diego 

are both working capital fund activities, their missions are very different. 

SPAWAR San Diego is a highly technical systems operation staffed by 

scientists and engineers who provide research, technology, and engineering 

support to other Navy programs worldwide. The Navy Public Works Center 

San Diego provides maintenance, construction, and operations support to 

other Navy programs in the San Diego area.

Governmentwide 

Purchase Card 

Program Guidelines

Under the Federal Acquisition Streamlining Act of 1994, the Defense

Federal Acquisition Regulation Supplement guidelines, eligible purchases 

include (1) micro-purchases (transactions up to $2,500 for which 

competitive bids are not needed); (2) purchases for training services up to 

$25,000; and (3) payment of items costing over $2,500 that are on the 

General Services Administration’s (GSA) pre-approved schedule, including 

items on requirements contracts. The streamlined acquisition threshold for 

such contract payments is $100,000. Accordingly, cardholders may have 

single transaction purchase limits of $2,500 or $25,000, and a few 

cardholders may have transaction limits of up to $100,000 or more. Under 

the GSA blanket contract, the Navy has contracted with Citibank for its 

purchase card services, while the Army and the Air Force have contracted 

with U.S. Bank. 

The Federal Acquisition Regulation, Part13, “Simplified Acquisition 

Procedures,” establishes criteria for using purchase cards to place orders 

and make payments. U.S. Treasury regulations issued pursuant to 

provisions of law in 31 U.S.C. 3321, 3322, 3325, 3327, and 3335, govern 

purchase card payment certification, processing, and disbursement. DOD’s 

Purchase Card Joint Program Management Office, which is in the office of 
Appendix I

Background

Page 35 GAO-01-995T Navy Purchase Card Controls

the Assistant Secretary of the Army for Acquisition, Logistics, and 

Technology, has established departmentwide policies and procedures 

governing the use of purchase cards. The Under Secretary of Defense 

(Comptroller) has established related financial management policies and 

procedures in various sections of DOD’s Financial Management 

Regulation. 

Navy Purchase Card 

Acquisition And 

Payment Processes

The Navy Supply Systems Command is responsible for the overall 

management of the Navy’s purchase card program, and has published the 

Navy Supply Command (NAVSUP) Instruction 4200.94, Department of the 

Navy Policies and Procedures for Implementing the Governmentwide 

Purchase Card Program. Under the NAVSUP Instruction, each Navy 

Command’s head contracting officer authorizes purchase card program 

coordinators in local Navy units to obtain purchase cards and establish 

credit limits. The program coordinators are responsible for administering 

the purchase card program within their designated span of control and 

serve as the communication link between Navy units and the purchase card 

issuing bank. 

Designation of Cardholders When a supervisor requests that a staff member receive a purchase card, 

the agency program coordinator is to first provide training on purchase 

card policies and procedures and then establish a credit limit and issue a 

purchase card to the staff member. The Navy had a total of about 1,700 

purchase card program coordinators during fiscal year 2000, including one 

program coordinator at SPAWAR San Diego and one at the Navy Public 

Works Center San Diego.

Ordering Goods and Services Purchase cardholders are delegated contracting officer ordering 

responsibilities, but they do not negotiate or manage contracts. SPAWAR 

San Diego and Navy Public Works Center San Diego cardholders use 

purchase cards to order goods and services for their units as well as their 

customers. Cardholders may pick up items ordered directly from the 

vendor or request that items be shipped directly to end users (requestors). 

Upon receipt of items acquired by purchase cards, cardholders are to 

record the transaction in their purchase log and obtain independent 

confirmation from the end user, their supervisor, or another individual that 

the items have been received and accepted by the government. They are 

also to notify the property book officer of accountable items received so 

that these items can be recorded in the accountable property records.
Appendix I

Background

Page 36 GAO-01-995T Navy Purchase Card Controls

Payment Processing The purchase card payment process begins with receipt of the monthly 

purchase card billing statements. Section 933 of the National Defense 

Authorization Act for Fiscal Year 2000, Public Law 106-65, requires DOD to 

issue regulations that ensure that purchase card holders and each official 

with authority to authorize expenditures charged to the purchase card 

reconcile charges with receipts and other supporting documentation. 

NAVSUP Instruction 4200.94 states that upon receipt of the individual 

cardholder statement, the cardholder has 5 days to reconcile the 

transactions appearing on the statement by verifying their accuracy to the 

transactions appearing on the statement and notify the approving official in 

writing of any discrepancies in the statement. In addition, under the 

NAVSUP Instruction, the approving official is responsible for (1) ensuring 

that all purchases made by the cardholders within his or her cognizance are 

appropriate and that the charges are accurate and (2) the timely 

certification of the monthly summary statement for payment by DFAS. The 

Instruction further states that within 5 days of receipt, the approving 

official must review and certify for payment the monthly billing statement, 

which is a summary invoice of all transactions of the cardholders under the 

approving official’s purview. The approving official is to presume that all 

transactions on the monthly statements are proper unless notified in 

writing by the purchase cardholder. However, the presumption does not 

relieve the approving official from reviewing for blatant improper purchase 

card transactions and taking the appropriate action prior to certifying the 

invoice for payment. In addition, the approving official is to forward 

disputed charge forms to the unit’s comptroller’s office for submission to 

Citibank for credit. Under the Navy’s contract, Citibank allows the Navy up 

to 60 days after the statement date to dispute invalid transactions and 

request a credit.

Upon receipt of the certified monthly purchase card summary statement, a 

DFAS vendor payment clerk is to (1) review the statement and supporting 

documents to confirm that the prompt payment certification form has been 

properly completed and (2) subject it to automated and manual validations. 

The purpose of the automated validation is to confirm that a SPAWAR or a 

Navy Public Works Center obligation for a purchase card invoice has been 

recorded in their respective cost accounting systems in an amount 

sufficient to cover the payment. Quality control clerks manually verify that 

purchase card statement and payment data were correctly entered in the 

Navy’s vendor payment (disbursing) system—STARS 1-Pay. Once the 

payment has passed these validation tests, the quality control supervisor 

authorizes the statement for payment. The DFAS vendor payment system 

then batches all of the certified purchase card payments for that day, 
Appendix I

Background

Page 37 GAO-01-995T Navy Purchase Card Controls

generates a tape for payment by electronic funds transfer to the purchase 

card bank, and sends the file to the accounting station for recording the 

payment as a summary record in the Navy’s accounting system. Figure 1 

illustrates the current purchase card payment process used by SPAWAR 

and the Naval Public Works Center in San Diego.

Figure 1: SPAWAR and Navy Public Works Center Purchase Card Process

Independent

documentation that items

have been received and

accepted

Purchase cardholder

orders/charges goods

and services

Monthly purchase card

statements are received

from bank

Cardholder reconciles

underlying receipts/sales

slips to monthly purchase

card statements,

identifies any invalid

charges, and prepares

dispute forms

Approving official reviews

cardholder support,

establishes obligation,

and certifies monthly

statements for payment

DFAS processes

purchase card payments

to Citibank

Cardholder logs items

not received and follows

up to (1) confirm receipt

or (2) dispute the charge

Pilferable items are

recorded in accountable

property records

Citibank reverses

disputed charges and

credits monthly statement

Items shipped

Items picked up Vendor

Cardholder or

approving official logs

disputed charges and

sends forms to Citibank

for credit

Navy accountants

record detail

transactions in

accounting systems

DFAS enters summary

payment record in Navy

 accounting system
Appendix I

Background

Page 38 GAO-01-995T Navy Purchase Card Controls

The Navy earns purchase card rebate revenue from Citibank of up to 0.8 

percent based on sales volume (purchases) and payment timeliness. 

According to the DOD Deputy Director of DOD’s Purchase Card Joint 

Program Management Office, rebate revenue is generally to be recorded to 

the purchase card statements and used to offset monthly charges.
Page 39 GAO-01-995T Navy Purchase Card Controls

Appendix II

San Diego Related Fraud Cases Investigated 

by NCIS ApendxiI

Pursuant to Senator Grassley’s request, we identified five fraud cases 

related to Navy programs based in the San Diego, California, area and 

investigated by the Naval Criminal Investigative Service (NCIS). All of 

these cases can be linked to the types of internal control weaknesses 

discussed in this testimony. Of these five cases, two involved Navy Public 

Works Center San Diego employees and one involved 2,600 compromised 

purchase card accounts, including 22 currently active SPAWAR San Diego 

accounts. One of the remaining cases, which has been concluded, was 

related to a fraud that occurred at the Navy’s Millington (Tennessee) Flying 

Club—an activity of the Navy Morale, Welfare, and Recreation entity, which 

is based in San Diego. The other case involved a military officer and other 

service members who were assigned to the Marine Corps Station in 

Miramar, near San Diego.

Case #1 The first San Diego-related purchase card fraud case is an example of the 

lack of segregation of duties. This case involved the cardholder at the 

Navy’s Millington (Tennessee) Flying Club, an entity of the U.S. Navy’s 

Morale, Welfare, and Recreation activity, which is based in San Diego, 

California. The cardholder, who was having financial problems, was hired 

by her stepfather, who was the club’s treasurer. The stepfather delegated 

nearly all purchase card duties to the cardholder, as well as the authority 

for writing checks to pay the Flying Club’s monthly purchase card 

statements. The cardholder made over $17,000 in fraudulent transactions 

to acquire personal items from Wal-Mart, The Home Depot, shoe stores, pet 

stores, boutiques, an eye care center, and restaurants over an 8-month 

period from December 1998 through July 1999. The fraud was identified 

when the club’s checking account was overdrawn due to excessively high 

purchase card payments and a bank official contacted the president of the 

Flying Club. The cardholder pleaded guilty and was sentenced to 15 

months in jail and assessed about $28,486 in restitution due to purchase 

card fraud and bounced checks. The defendant commented that illegal use 

of the card was “too easy” and that she was the sole authorizer of the card 

purchases.

Case #2 The second case involved a military officer and other service members who 

were assigned to the Marine Corps Station in Miramar, near San Diego, 

California. This alleged fraud occurred through collusion, and internal 

controls will not prevent collusion. However, adequate monitoring of 

purchase card transactions along with enforcing controls such as 
Appendix II

San Diego Related Fraud Cases Investigated 

by NCIS

Page 40 GAO-01-995T Navy Purchase Card Controls

documentation of independent confirmation of receipt and acceptance and 

recording accountable items in property records would have made 

detection easier. In this instance, the military officer allegedly conspired 

with cardholders under his supervision to make nearly $400,000 in 

fraudulent purchases from five companies—two that he owned, one owned 

by his sister, and the other two owned by friends or acquaintances. They 

charged thousands of dollars for items such as DVD players, Palm Pilots, 

and desktop and laptop computers. The officer also allegedly made cash 

payments to employees to keep silent about the fraud and provided 

auditors with falsified purchase authorizations and invoices to cover the 

fraud. The fraud occurred from June 1999 through September 2000. The 

total amount of the alleged fraud is unknown. The alleged fraud was 

identified based on a tip from a service member. The U.S. Attorney’s Office 

in San Diego has accepted the case for prosecution and four other active 

service members are under investigation.

Case #3 The third case involved a Navy Public Works Center San Diego 

maintenance/construction supervisor who allegedly made at least $52,000 

in fraudulent transactions to a suspect contractor on work orders for which 

the work was not performed by that contractor. Adequate monitoring of 

purchase card transactions along with enforcing controls such as 

independent, documented receipt and acceptance and recording 

accountable items in property books would have made detection easier. 

Navy investigators believe that the employee also may have used his 

government purchase card to make unauthorized purchases for personal 

use, including jewelry, an air conditioner, and other personal items from 

The Home Depot from April 1997 through October 1998. The total amount 

of this alleged purchase card fraud is unknown. The alleged fraud was 

identified when the employee’s supervisor reviewed Navy Public Works 

Center work orders and noticed that four work orders totaling 

approximately $7,000 were completed by the employee and paid for with 

the suspect’s government purchase card. Further inquiry by the supervisor 

revealed that Navy Public Works Center employees, not the contractor, had 

completed the work. NCIS investigators and Naval Audit Service auditors 

identified approximately $52,000 in purchase card transactions made by 

the employee to a suspect contractor for work that was performed by 

either the Public Works Center or other legitimate contractors. The 

employee has resigned and an investigation by the Federal Bureau of 

Investigation and NCIS is ongoing. The U.S. Attorney’s Office in San Diego 

has accepted the case for prosecution.
Appendix II

San Diego Related Fraud Cases Investigated 

by NCIS

Page 41 GAO-01-995T Navy Purchase Card Controls

Case #4 The fourth case involved a Navy Public Works Center San Diego purchasing 

agent that allegedly made at least $12,000 in fraudulent purchases and 

planned to submit approximately $103,000 in fraudulent disputed charge 

forms, including payments for hotels, airline tickets, computers, phone 

cards, and personal items from The Home Depot. The alleged fraud 

occurred from April 1997 through July 1999. As with the other cases, 

adequate monitoring of purchase card transactions along with enforcing 

controls such as independent, documented receipt and acceptance and 

recording accountable items in property books would have made detection 

easier. The alleged fraud was identified during an investigation of a 

possible bribery/kickback scheme. The employee has resigned and an 

NCIS investigation is ongoing. The U.S. Attorney’s Office in San Diego has 

accepted the case for prosecution.

Case #5 The fifth Navy purchase card fraud case is ongoing and involves the 

compromise of up to 2,600 purchase card accounts assigned to Navy 

activities in the San Diego area. Investigators were only able to obtain a 

partial list consisting of 681 compromised accounts so the exact number is 

not known. At least 45 of the compromised accounts were for SPAWAR 

San Diego and one of the compromised accounts was for the Navy Public 

Works Center in San Diego. Of these 46 compromised accounts, 22 

SPAWAR San Diego accounts were still active in May 2001. None of the 

active accounts on the partial listing found by investigators were for the 

Navy Public Works Center San Diego. Although the account numbers 

showed up on a computer printer in a community college library in San 

Diego in September 1999, the Navy has not canceled all of the 

compromised accounts. Instead, according to NCIS and Navy Supply 

Command officials, the Navy is canceling the compromised accounts as 

fraudulent transactions are identified. Naval Supply Systems Command, 

SPAWAR San Diego, and Navy Public Works Center San Diego officials told 

us that they were aware of this incident but did not have a listing of the 

account numbers affected. As a result, the Navy did not take any measures 

to flag the compromised accounts and implement special monitoring 

procedures to detect any potential fraudulent use of these accounts. 

According to Navy investigators, as of January 2001, at least 30 of the 

compromised account numbers had been used by 27 alleged suspects to 

make more than $27,000 in fraudulent transactions for pizza, jewelry, phone 

calls, tires, and flowers. As of May 21, 2001, 22 of the compromised 

SPAWAR accounts were still active. Our review of the monthly credit limits 
Appendix II

San Diego Related Fraud Cases Investigated 

by NCIS

Page 42 GAO-01-995T Navy Purchase Card Controls

associated with the 22 compromised accounts showed that SPAWAR 

continued to have an aggregate monthly financial exposure of $900,000 

associated with these accounts nearly 2 years after the compromised list 

was discovered in a San Diego community college library in September 

1999. Further, with the lack of controls over receipt of goods and 

certification of purchase card statements that we identified at the two 

activities we reviewed, it is impossible for the Navy to identify fraudulent 

purchases as they occur or to determine the extent of the fraudulent use of 

the compromised accounts. As a result, when fraudulent use of one of the 

comprised accounts was identified, the Navy could not determine if the 

incident was due to cardholder fraud or use of the compromised account 

by an outside party. A joint task force in San Diego, comprised of NCIS, the 

U.S. Secret Service, local police, and the U.S. Attorney’s Office, investigated 

this fraud. The task force investigators recently traced the list of 

compromised accounts to a vendor used by the Navy, which acknowledged 

that the list came from its database. The vendor identified two former 

employees as possible suspects. 
Page 43 GAO-01-995T Navy Purchase Card Controls

Appendix III

Objectives, Scope, and Methodology ApendxiI

Pursuant to Senator Grassley’s request, we obtained and reviewed 

information on five fraud cases related to Navy purchase card programs in 

the San Diego, California, area and to review purchase card controls and 

accounting for two Navy units based in San Diego—the Space and Naval 

Warfare Systems Command (SPAWAR) Systems Center and the Navy 

Public Works Center. Our assessment of SPAWAR San Diego and the Navy 

Public Works Center San Diego purchase card controls covered 

• the overall management control environment, including (1) span of 

control issues related to the number of cardholders, (2) training for 

cardholders and accountable officers,1

 (3) management of rebates, and 

(4) monitoring and audit of purchase card activity;

• tests of statistical samples of key controls over purchase card 

transactions, including (1) documentation of independent confirmation 

that items ordered by purchase card were received, (2) proper 

certification of purchase card statements for payment, and (3) proper 

accounting for purchase card transactions; 

• substantive tests of accountable items in our sample transactions to 

verify whether they were recorded in property records and whether they 

could be found; and 

• analysis of the universe of transactions to identify (1) any potentially 

improper, fraudulent, and abusive transactions and (2) purchases that 

were split into one or more transactions to avoid micro-purchase 

thresholds or other credit limits. 

We used as our primary criteria applicable laws and regulations; our 

Standards for Internal Control in the Federal Government;

2

 and our 

Guide for Evaluating and Testing Controls Over Sensitive Payments.

3

 To 

assess the management control environment, we applied the fundamental 

1

We tested statistical samples of transactions to determine whether the two units had 

documented evidence that cardholders had received required purchase card training.

2

Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1), was 

prepared to fulfill our statutory requirement under the Federal Managers’ Financial Integrity 

Act to issue standards that provide the overall framework for establishing and maintaining 

internal control and for identifying and addressing major performance and management 

challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement.

3

Guide for Evaluating and Testing Controls Over Sensitive Payments (GAO/AFMD-8.1.2), 

provides a framework for evaluating and testing the effectiveness of internal controls that 

have been established in various sensitive payment areas. 
Appendix III

Objectives, Scope, and Methodology

Page 44 GAO-01-995T Navy Purchase Card Controls

concepts and standards in the GAO internal control standards to the 

practices followed by management in the four areas reviewed. 

To test controls, we selected stratified random probability samples of 135 

SPAWAR San Diego purchase card transactions from a population of 47,035 

transactions totaling $38,357,656, and 121 Navy Public Works Center San 

Diego transactions from a population of 53,026 transactions totaling 

$29,824,160 that were recorded by the Navy during fiscal year 2000. We 

stratified the samples into two groups—transactions from computer 

vendors and other vendors. With this statistically valid probability sample, 

each transaction in the population had a nonzero probability of being 

included, and that probability could be computed for any transaction. Each 

sample element was subsequently weighted in the analysis to account 

statistically for all the transactions in the population, including those that 

were not selected. Table 7 presents our test results on three key 

transaction-level controls and shows the confidence intervals for the 

estimates for the universes of fiscal year 2000 purchase card transactions 

made by SPAWAR and the Navy Public Works Center in San Diego. 

Table 7: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests

a

The projections represent point estimates for the population based on our sampling tests at a 95-

percent confidence level. 

b

All seven approving officials with certifying officer responsibilities told us that they did not review 

support for transactions before certifying purchase card statements for payment.

Our analytical reviews covered the universe of fiscal year 2000 purchase 

card transactions for the two units’ San Diego-based activities covered 

about 47,000 transactions totaling about $38 million at SPAWAR San Diego 

and about 53,000 transactions totaling about $30 million at the Navy Public 

Works Center San Diego. For these reviews, we did not look for all 

potential abuses of purchase cards. For example, because a large number 

Breakdowns in key purchase card controlsa

Independent, documented 

receipt Proper payment certification Timely customer accounting

Navy units in San Diego, CA

Percent

failure

Projection

(millions)

Percent

failure

Projection

(millions)

Percent

failure

Projection

(millions)

SPAWAR 

65%

(+/- 10%)

$14.5

(+/- $4.4)

100%b $38b 83%

(74-90%)

$20.4

(+/- $5.1)

Navy Public Works Center 

47%

(+/- 12%)

$12.9

(+/- $6.3)

100%b $30b 35%

(+/- 11.4%)

$11.2

(+/- $ 6.2)
Appendix III

Objectives, Scope, and Methodology

Page 45 GAO-01-995T Navy Purchase Card Controls

of store receipts (such as those from The Home Depot) were missing, we 

were unable to determine whether certain purchases were made for 

personal use. In addition, we did not physically examine purchases made to 

determine whether goods and services were received and used for 

government purposes. While we identified some improper and potentially 

fraudulent and abusive transactions, our work was not designed to identify, 

and we cannot determine, the extent of fraudulent, improper, or abusive 

transactions.

We briefed DOD managers, including officials in DOD’s Purchase Card 

Joint Program Management Office and the Defense Finance and 

Accounting Service, and Navy managers, including Navy Supply Command, 

Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San 

Diego officials on the details of our review, including our objectives, scope, 

and methodology and our findings and conclusions. We conducted our 

audit work from August 2000 through June 2001 in accordance with 

generally accepted government auditing standards, and we performed our 

investigative work in accordance with standards prescribed by the 

President’s Council on Integrity and Efficiency. Following this testimony, 

we plan to issue a report, which will include recommendations to DOD and 

the Navy for improving internal controls over purchase card activity.

(918994) Letr
Orders by Internet: For information on how to access GAO reports on the Internet, 

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at: 

http://www.gao.gov

To Report Fraud, 

Waste, or Abuse in 

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Presorted Standard

Postage & Fees Paid

GAO

Permit No. GI00