U.S. RAILROAD RETIREMENT BOARD

OFFICE OF INSPECTOR GENERAL

Audit of the Purchase Card 

Program at the Railroad 

Retirement Board

Report No. 21-06 May 27, 2021 
OFFICE OF INSPECTOR GENERAL

U.S. RAILROAD RETIREMENT BOARD

Audit of the Purchase Card Program at the Railroad Retirement 

Board

Report Summary May 27, 2021 Report No. 21-06 

What HRK & Company Found

Harper, Rains, Knight & Company (HRK) concluded that the 

Railroad Retirement Board (RRB) purchase card program 

substantially complied with laws and regulations; however, 

they identified one instance of non-compliance with the 

Office of Management and Budget (OMB) Circular A-123, 

Appendix B, A Risk Management Framework for Government 

Charge Card Programs, Revised August 27, 2019, and one 

instance of non-compliance with the Government Charge 

Card Abuse Prevention Act of 2012. 

HRK also concluded that RRB properly designed its internal 

controls over its purchase card program to detect and 

prevent fraud, waste, abuse and misuse; however, oversight 

and monitoring of the cardholder account opening 

procedures controls could be improved. 

What HRK Recommends 

To address the weaknesses identified in this audit, HRK made 

four recommendations to the Office of the Director of 

Administration to: (1) update its policies and procedures to 

ensure compliance with the Government Charge Card Abuse 

Prevention Act of 2012 and Office of Management and 

Budget Circular A-123, Appendix B; (2) create a monitoring 

procedure to periodically review the higher-level federal 

policy for the purchase card program to address when 

changes or updates are made to federal law or Office of 

Management and Budget or General Services Administration 

guidance; (3) create a control where management reviews, 

on a sample basis, the purchase card account opening

documentation to ensure it adheres to the RRB’s policy to

ensure that the Program Coordinator does not process the 

application unless the cardholder and the approving official 

have completed the necessary training; and (4) maintain all 

documentation related to the opening of an account in an 

electronic environment. 

RRB management concurred with all four recommendations. 

What We Did

The Office of Inspector General (OIG) 

for the RRB engaged HRK to conduct a 

performance audit of the RRB’s 

purchase card program. This audit was 

conducted in accordance with the 

performance audit standards 

established by Generally Accepted 

Government Auditing Standards. HRK is 

responsible for the audit report and the 

conclusions expressed therein. RRB OIG 

does not express any assurance on the 

conclusions presented in HRK’s audit 

report. 

The audit objective was to identify and 

assess control weaknesses for the RRB's 

purchase card program. 

In order to complete this work, HRK 

identified criteria in laws, regulations, 

and best practices; identified applicable 

RRB policies, procedures; and gained an 

understanding of the monetary total 

and total purchase card transactions for 

fiscal year 2019. HRK also conducted 

walkthroughs and interviewed 

applicable agency staff to understand 

the internal controls, processes, 

systems, and procedures used to 

manage the agency's purchase card 

program.

The scope of the audit was purchase 

card transactions made during fiscal 

year 2019. 
U.S. RAILROAD RETIREMENT BOARD

PERFORMANCE AUDIT OVER THE

PURCHASE CARD PROGRAM

FOR THE FISCAL YEAR 2019

AUDIT OF THE PURCHASE CARD PROGRAM 

AT THE RAILROAD RETIREMENT BOARD

Harper, Rains, Knight & Company, P.A.

700 12th ST NW, Suite 700

Washington, DC 20005

601-605-0722

www.hrkcpa.com
TABLE OF CONTENTS

Independent Auditors' Performance Audit Report on the U.S. Railroad 

Retirement Board Purchase Card Program......................................................... 1

Objective, Scope, and Methodology ...................................................................... 3

Background ............................................................................................................. 4

Audit Results........................................................................................................... 6

Compliance with Laws and Regulations.............................................................6

Finding Number 1: RRB's purchase card policies and procedures do not 

include all required internal control safeguards and do not include a periodic 

review of Federal policy to address changes or updates.................................7

Recommendations......................................................................................7

Management Comments ...........................................................................8

Identification of Internal Controls......................................................................8

Operating Effectiveness of Internal Controls.....................................................8

Active Accounts and Purchase Card Openings................................................8

Finding Number 2: Controls over the issuance of purchase cards need to be 

strengthened. ...................................................................................................9

Recommendations......................................................................................9

Management Comments .........................................................................10

Purchase Card Closures..................................................................................10

Purchase Card Transaction Validity...............................................................10

Management's Response ...................................................................................... 11

Auditors' Consideration of Management's Response........................................ 11

Appendix A – Statistical Sample Methodology and Results............................. 12

Appendix B – Management's Response .............................................................. 17
1

INDEPENDENT AUDITORS' PERFORMANCE AUDIT REPORT

ON THE U.S. RAILROAD RETIREMENT BOARD PURCHASE CARD PROGRAM

Inspector General

U.S. Railroad Retirement Board:

We were engaged by the U.S. Railroad Retirement Board (RRB), Office of Inspector General 

(OIG), to conduct a performance audit of the RRB purchase card program for fiscal year 

(FY) 2019. RRB uses purchase cards to reduce administrative costs and time for purchasing and 

paying for goods and services.

Our performance audit objective over the purchase card program was to identify and assess control 

weaknesses for the RRB's purchase card program.

To perform our audit, we interviewed personnel within RRB's Office of Administration. We 

reviewed the existing RRB purchase card directives, guidance issued by regulatory agencies, and 

purchase card activity data supplied by RRB. We selected samples of the agency's controls over

both the issuance and closing of purchase cardholder accounts, as well as samples of the agency's 

active cardholder accounts. We selected a statistical sample of purchase card activity made during 

FY 2019 to conduct control and substantive tests over the RRB purchase card program.

We conducted this performance audit in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and conclusions based on our 

audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

We concluded that the RRB purchase card program substantially complies with laws and 

regulations; however, we did identify one instance of non-compliance with the Office of 

Management and Budget (OMB) Circular A-123, Appendix B, A Risk Management Framework 

for Government Charge Card Programs, Revised August 27, 2019 and one instance of noncompliance with the Government Charge Card Abuse Prevention Act of 2012. The identified 

instances of non-compliance are listed below:
Inspector General 

Purchase Card Performance Audit

2

• RRB Administrative Order OA-21 does not include reference to, "Rebates and refunds 

based on prompt payment, sales volume, or other actions by the agency on purchase card 

accounts are reviewed for accuracy and properly recorded as a receipt to the agency that 

pays the monthly bill."

• RRB Administrative Order OA-21 does not include reference to, "Contact employees to 

inquire about questionable or suspicious transactions."

We issued one Notice of Findings and Recommendations (NFR) to RRB over compliance with 

laws and regulations.

We concluded that the RRB has properly designed their internal controls over its purchase card 

program to detect and prevent fraud, waste, abuse and misuse; however, we found that oversight 

and monitoring of the cardholder account opening procedures controls could be improved. The 

exceptions were as follows:

• RRB could not provide a Form G-754 that was signed by the cardholder applicant's 

approving official to support one agency issued Government Purchase Card that was 

opened.

• RRB could not provide evidence that the approving official completed all required training 

prior to the approval of the application to support one agency issued Government Purchase 

Card that was opened.

We issued one NFR to RRB over the identified internal control deficiencies.

We found, through our substantive testing procedures, no exceptions over the validity and approval 

of purchase card transactions. 

This report is for the purpose of concluding on the audit objectives described above. Accordingly, 

this report is not suitable for any other purpose. We appreciate the cooperation and courtesies that 

RRB personnel extended to us during the execution of this performance audit.

May 26, 2021

Washington, D.C.
Inspector General 

Purchase Card Performance Audit

3

Objective, Scope, and Methodology

Objective

The audit objective was to identify and assess control weaknesses for the RRB's purchase card

program.

Scope

The scope of the audit was purchase card transactions made during fiscal year 2019.

Our performance audit was not designed to, and we did not, perform a financial audit of the 

amounts obligated or expended by RRB.

Methodology

To accomplish the audit objectives, we:

• Identified criteria from the Government Charge Card Abuse Prevention Act of 2012;

• Identified criteria from Title 31 U.S.C. § 1301 – Appropriations, and Title 31 United States

Code 1501 & 1502 – Documentary Evidence and Balances Available;

• Identified criteria from GAO's Standards for Internal Control in the Federal Government;

• Identified criteria from RRB internal guidance;

• Identified criteria from other guidance, as applicable;

• Identified the monetary total and total purchase card transactions for fiscal year 2019;

• Conducted interviews and process walkthroughs with officials at RRB and within the Office 

of Administration organization to understand the internal controls, processes, systems, and 

procedures used to manage the agency's purchase card program;

• Performed audit procedures to address the audit objective and in accordance with 

Government Auditing Standards (GAS); and

• Reviewed and assessed RRB internal controls as related to the purchase card program.

We selected samples of the agency's controls over the issuance of purchase accounts and closing 

of cardholder accounts at separation, as well as samples of the agency's controls overactive

cardholder accounts. Sample items were tested for compliance with RRB purchase card policies 

and procedures as well as compliance with the requirements of OMB Circular A-123, Appendix B.

We also selected samples of purchase card transactions during FY 2019. Testing performed over 

the sample included verification of: transaction support; transaction approval; allowable Merchant 

Category Codes (MCC); appropriate purchases for government use; purchases obtained from the 

required sources of supply and service; cardholder not splitting purchases; and balances paid 

timely.
Inspector General 

Purchase Card Performance Audit

4

Criteria

We used the following to perform the audit:

• GAO Government Auditing Standards, 2018 Revision:

o Chapter 8: Field Work Standards for Performance Audits;

o Chapter 9: Reporting Standards for Performance Audits;

• GAO Standards for Internal Control in the Federal Government, September 2014;

• OMB Circular No. A-123, Appendix B, A Risk Management Framework for Government 

Charge Card Programs, Revised August 27, 2019;

• Government Charge Card Abuse Prevention Act of 2012;

• Treasury Financial Manual, Vol.1, Part 4, Section 4525;

• Public Law 112-194;

• Title 31 U.S.C. § 1301 – Appropriations, and Title 31 United States Code 1501 & 1502 –

Documentary Evidence and Balances Available; and

• RRB internal guidance.

Background

A U.S. government purchase card (GPC) is an internationally accepted credit card issued by 

individual contractors and available to personnel in all federal agencies under a single General 

Services Administration (GSA) contract. The purpose of purchase card programs is to minimize 

the paperwork needed to make purchases with proper authorization.

The Office of Management and Budget (OMB) Circular No. A-123, Appendix B, A Risk 

Management Framework for Government Charge Card Programs, Revised August 27, 2019, sets 

forth policies and procedures Federal agencies should use to maintain internal controls that reduce 

the risk of fraud, waste, and error in government purchase card programs. Management's 

understanding of internal controls is essential in ensuring accountability at all levels of purchase

card use.

At the request of the Office of Management and Budget (OMB), the General Services 

Administration (GSA) awarded a schedule contract for Governmentwide commercial credit card 

services to multiple contractors. The contract is intended to provide, at the request of Federal 

ordering agencies, Government-wide commercial credit cards and associated services to civilian

and military Government employees for the purpose of paying for purchases made for official 

Government purposes. Based on the agency’s best-value review, it selected U.S. Bank.

Through November 29, 2018, Citibank was the contractor that provided commercial credit card 

services to RRB. On November 30, 2018, RRB changed contractors, as U.S. Bank is now the 

contractor that provides timely delivery of all products and services specified in the RRB's task 

order, within the parameters established under the GSA Master Contract. U.S. Bank assists the 

RRB with account setup, account maintenance, reporting and establishing billing, reconciliation, 
Inspector General 

Purchase Card Performance Audit

5

and dispute processes that properly support the RRB's GPC Program. Citibank, as the previous 

contractor, provided the exact same services to RRB that U.S. Bank currently provides. The 

contractor transition occurred because U.S. Bank provided better value to RRB.

Purchase cards allow the same individual to order, pay for, and receive goods and services. 

Purchase cards are at a high risk for misuse, fraud, waste, and abuse. Accordingly, if the internal 

controls governing the RRB purchase card program is not sufficient, properly designed, and fully 

implemented, RRB will not be able to detect and prevent fraudulent purchases or other improper 

use of the cards.

The Office of Administration at RRB has responsibility for overall management of the commercial 

purchase card program. RRB defines its internal controls for its purchase card programs in the 

form of Administrative Circular OA-21, Government Purchase Card Procedures. Included in the 

directive are responsibilities for individuals and RRB offices, guidance on authorized use of the 

purchase card, purchase limits, reconciliation and payments and training requirements for those 

involved with the use of the agency's purchase card.

Key roles within the RRB's purchase card program include the Head of Contracting Activity,

Agency/Organization Program Coordinator (A/OPC), approving officials, and cardholders. The 

Head of Contracting Activity, as the agency's procurement executive, issues the Delegation of 

Authority to cardholders. This Delegation specifies the authority being delegated and any 

limitations on the authority. The A/OPC oversees the agency's government purchase card program 

and establishes guidelines. The A/OPC also serves as the focal point for answering questions, 

completing contract administration activities, coordinating applications, issuing and destroying 

cards, establishing and reviewing reports, managing administrative training and serving as the 

overall point of contact between cardholders, the RRB, U.S. Bank and GSA. Approving officials

are designated by the cardholder's bureau/office head, and are normally the supervisor or 

administrative staff member to whom a cardholder reports for authorization to purchase required 

supplies and/or services. Approving officials review and certify the cardholder's monthly 

statements, assist in the reconciliation of cardholder accounts, and ensure that proper procedures 

are followed when purchasing supplies or services. The cardholder is the individual designated by 

the RRB who has been issued a GPC. The card bears the cardholder's name and may only be used 

by that individual.

Applications for GPC accounts will be forwarded from the respective bureau/office head to the 

A/OPC. Purchase cards, while issued to a named cardholder, are a delegation of RRB's 

procurement authority. When purchase cards are used for the purpose of micro purchases (anything 

less than $3,000), the purchase must be from a small business, and only one quotation is needed.

At least three sources must be solicited for purchases with an estimated price of $3,000 to 

$150,000.
Inspector General 

Purchase Card Performance Audit

6

Audit Results

We concluded that the RRB purchase card program substantially complies with laws and 

regulations; however, we did identify one instance of non-compliance with the Office of 

Management and Budget (OMB) Circular A-123, Appendix B, A Risk Management Framework 

for Government Charge Card Programs, Revised August 27, 2019 and one instance of noncompliance with the Government Charge Card Abuse Prevention Act of 2012.

We concluded that the RRB has properly designed their internal controls over its purchase card 

program to detect and prevent fraud, waste, abuse and misuse; however, we found that oversight 

and monitoring of the cardholder account opening controls could be improved.

We found, through our substantive testing procedures, no exceptions over the validity and approval 

of purchase card transactions.

Compliance with Laws and Regulations

The Office of Administration has overall responsibility for compliance with laws and regulations 

covering the RRB's purchase card program.

In order to determine if the RRB's purchase card program was in compliance with laws and 

regulations, we first made inquiries with Office of Administration personnel and obtained the RRB

Directive covering the purchase card program, Administrative Circular OA-21. We then identified 

the following applicable Federal law and regulations for the management and oversight of 

purchase card programs:

• Government Charge Card Abuse Prevention Act of 2012 (Public Law 112-194);

• Office of Management and Budget (OMB) Memorandum M-13-21 Implementation of the 

Government Charge Card Abuse Prevention Act of 2012;

• OMB Circular No. A-123, Appendix B, A Risk Management Framework for Government 

Charge Card Programs, Revised August 27, 2019;

• GAO Government Auditing Standards, 2018 Revision:

o Chapter 8: Field Work Standards for Performance Audits;

o Chapter 9: Reporting Standards for Performance Audits;

• GAO Standards for Internal Control in the Federal Government, September 2014;

• Treasury Financial Manual, Vol.1, Part 4, Section 4525; and 

• Title 31 U.S.C. § 1301 – Appropriations, and Title 31 United States Code 1501 & 1502 –

Documentary Evidence and Balances Available.
Inspector General 

Purchase Card Performance Audit

7

Finding Number 1: RRB's purchase card policies and procedures do not include all required 

internal control safeguards and do not include a periodic review of Federal policy to address 

changes or updates.

Using the above RRB directives and the applicable Federal laws and regulations, we compared the 

requirements found in the laws and regulations to the RRB Directives. Our tests for compliance 

with the applicable provisions of laws and regulations disclosed one instance of noncompliance 

with the Government Charge Card Abuse Prevention Act of 2012, and one instance of 

noncompliance with the Office of Management and Budget (OMB) Circular A-123, Appendix B, 

A Risk Management Framework for Government Charge Card Programs, Revised 

August 27, 2019, for the periods covered by our performance audit:

• RRB Administrative Circular OA-21 does not include reference to, "Rebates and refunds 

based on prompt payment, sales volume, or other actions by the agency on purchase card 

accounts are reviewed for accuracy and properly recorded as a receipt to the agency that 

pays the monthly bill." 

• RRB Administrative Circular OA-21 does not include reference to, "Contact employees to 

inquire about questionable or suspicious transactions." 

We considered the above to be a non-compliance with laws and regulations of the purchase card 

program.

RRB policies and procedures have not been updated to include all required safeguards and internal 

controls, specifically the two omitted requirements, as cited in the findings above, to be compliant 

with the Government Charge Card Abuse Prevention Act of 2012 and Office of Management and 

Budget Circular A-123, Appendix B. Not including all required safeguards and internal controls 

required by federal law has caused RRB to be non-compliant with the Government Charge Card 

Abuse Prevention Act of 2012 and Office of Management and Budget Circular A-123, Appendix 

B, and could lead to a failure to detect and prevent fraud, waste, abuse, and misuse in RRB's charge 

card program.

Recommendations

We recommend that the Office of the Director of Administration:

1. Update its policies and procedures to include the following required safeguards and internal 

controls to be compliant with the Government Charge Card Abuse Prevention Act of 2012 

and Office of Management and Budget Circular A-123, Appendix B. 

• "Rebates and refunds based on prompt payment, sales volume, or other actions by the 

agency on purchase card accounts are reviewed for accuracy and properly recorded as 

a receipt to the agency that pays the monthly bill." (per the Act)

• "Contact employees to inquire about questionable or suspicious transactions." (per 

OMB Circular A-123 Appendix B)
Inspector General 

Purchase Card Performance Audit

8

2. Create a monitoring procedure to periodically review the higher-level federal policy for the 

purchase card program to address when changes or updates are made to federal law or 

Office of Management and Budget or General Services Administration guidance.

Management Comments

The Office of Administration concurred with Recommendations 1 and 2 and stated that 

they would implement the changes.

Identification of Internal Controls

The purchase card program is the responsibility of the Office of Administration. RRB defines its 

internal controls for its purchase card programs in the form of Administrative Circular OA-21, 

Government Purchase Card Procedures. We performed walkthroughs with RRB personnel to gain 

an understanding of the controls documented in the respective directives.

To determine if the internal controls and processes documented in the directives were designed 

appropriately to meet the requirements of OMB A-123, Appendix B, we developed a crosswalk 

between the requirements from OMB and the internal control policies and procedures documented 

in the RRB directives. Based on our audit procedures, we determined that, with one exception, the 

internal controls documented in the RRB directives are designed properly, to detect and prevent 

fraud, waste, abuse, and misuse in the RRB purchase card program.

Operating Effectiveness of Internal Controls

The Office of Administration is responsible for the implementation, operating effectiveness, and 

monitoring of the internal control environment it has documented in 

Administrative Circular OA-21.

We tested the implementation, operating effectiveness, and monitoring of the controls by first 

identifying the key controls in the directives to meet the objectives of this performance audit. We 

designed procedures to test the operating effectiveness of the controls.

Active Accounts and Purchase Card Openings

In order to determine if RRB was properly managing its active cardholder accounts in accordance 

with its directives, we obtained the universe of active cardholder accounts in FY 2019. This 

universe consisted of 73 active purchase cards. We selected a sample of 15 purchase cards.

We verified that the cardholder had a current training certificate produced by GSA's online 

SmartPay Government Purchase Card Training Course, and that the cardholder's account 

expiration date did not expire prior to September 30, 2019. RRB provided sufficient audit evidence 

for all 15 of the requested sample items.
Inspector General 

Purchase Card Performance Audit

9

In order to determine if RRB was issuing purchase cards in accordance with its directives, we 

obtained the universe of purchase cards issued in FY 2019. This universe consisted of eight newly 

opened purchase cards. We selected a sample of five accounts opened in our testing period.

We verified that, prior to issuing the purchase card, the card applicant had completed the 

government purchase card set-up form; the application was reviewed and approved by the 

cardholder's supervisor; the approving official completed all required training prior to approval of 

the application; and the applicant successfully completed the GSA SmartPay purchase cardholder 

training.

Finding Number 2: Controls over the issuance of purchase cards need to be strengthened.

Two exceptions were identified as a result of our test work:

• RRB could not provide a Form G-754 that was signed by the cardholder applicant's 

approving official to support one agency issued Government Purchase Card that was 

opened.

• RRB could not provide evidence that the approving official completed all required training 

prior to the approval of the application to support one agency issued Government Purchase 

Card that was opened.

We considered the above to be a deficiency in the operating effectiveness of the purchase card 

program.

This deficiency was caused by RRB not consistently documenting, monitoring or enforcing the 

proper controls to support charge card procedures when an account is opened. This deficiency

could lead to a failure to detect and prevent fraud, waste, abuse, and misuse in RRB's purchase

card programs.

Recommendations

We recommend that the Office of the Director of Administration:

3. Create a control where management reviews, on a sample basis, the purchase card account 

opening documentation to ensure it adheres to the RRB Administrative Circular OA-21 

that states, "The Agency/Organization Program Coordinator will not process the 

application unless the cardholder and the approving official have completed the necessary 

training. The certificate of completion must be attached to the application, along with the 

completed RRB Form G-754." 

4. Maintain all documentation related to the opening of an account in an electronic 

environment to support ease of retrieval.
Inspector General 

Purchase Card Performance Audit

10

Management Comments

The Office of Administration concurred with Recommendations 3 and 4 and stated that they would 

implement the changes.

Purchase Card Closures

In order to determine if RRB is closing purchase cards in accordance with its directives, we 

obtained the universe of purchase cards issued in FY 2019. This universe consisted of 13 closed 

purchase cards. We haphazardly selected a sample of five accounts. No exceptions were identified 

as a result of our test work.

We verified that the purchase card was disabled in a timely manner, and that no transaction activity 

occurred after the account closing. RRB provided sufficient audit evidence for all five of the 

requested sample items.

Purchase Card Transaction Validity

The Office of Administration has responsibility to ensure purchase card transactions are valid and 

properly approved.

To test the validity of the purchase card transactions, we selected a random sample of 78 

transactions from the purchase card population from FY 2019. To ensure that the population was 

completed, we reconciled the purchase card population to the RRB FY 2019 general ledger. We 

performed the following procedures:

• Traced amounts to supporting invoices;

• Verified the transaction as appropriately authorized;

• Verified the Contracting Officer signed the purchase order for all purchase over the micropurchase levels at HQ and the District Director signed the purchase order for all purchase 

over the micro-purchase levels for the field offices;

• Verified the Merchant Category Code (MCC) is allowable;

• Verified the purpose of the transaction is reasonable;

• Verified the transaction as not part of a split-purchase agreement; and

• Verified the transaction was appropriately paid and done so in a timely manner.

RRB provided sufficient and appropriate evidence for the 78 sample transactions. Therefore, we 

have no findings and no recommendations related to the validity of purchase card transactions.
Inspector General 

Purchase Card Performance Audit

11

Management's Response

RRB management concurred with findings 1, 2, 3, and 4. 

Management's full response is provided at Appendix B.

Auditors' Consideration of Management's Response

RRB's response to the findings identified above are described throughout the report in summary 

and in Appendix B in full. RRB's response was not subjected to the auditing procedures applied 

in the performance audit and, accordingly, we express no conclusion on it. 
Appendix A

Statistical Sample Methodology and Results

Purchase Card Performance Audit

12

Appendix A – Statistical Sample Methodology and Results

This appendix presents the methodology and results of our statistical samples to assess compliance 

with key purchase card policies and implementation of related internal controls, as well as to 

project our results to the universe.

Scope

As we were testing transactions; account openings; account closings; and active accounts, we 

selected four different samples.

Our transaction sample was selected from a list of purchase card transactions for the period of 

October 1, 2018 through September 30, 2019. The universe consists of 1294 purchase card 

transactions, as received from a 3rd party, Citibank and US Bank, excluding OIG purchase card 

transactions.

Our account opening sample was selected from a list of purchase card account openings for the 

period of October 1, 2018 through September 30, 2019. The universe consists of 8 purchase card 

openings, as received as received from the RRB's OA, excluding OIG purchase card openings.

Our account closing sample was selected from a list of purchase card account closings for the 

period of October 1, 2018 through September 30, 2019. The universe consists of 13 purchase card 

closings, as received as received from the RRB's OA, excluding OIG purchase card closings.

Our active account sample was selected from a list of active purchase card accounts for the period 

of October 1, 2018 through September 30, 2019. The universe consists of 73 purchase cards, as 

received from the RRB's OA, excluding OIG purchase cards.

Sampling Methodology

We used attribute sampling to test specific controls (attributes) and to allow us to project the 

number of comparable errors to the universe. This resulted in the following sample sizes:

A sample size of 78 transactions from the universe of 1,294 purchase card transactions across both 

vendors, Citibank and US Bank. We identified two buckets with higher risk, consisting of MCC's 

with the most activity and cardholders with the greatest spending. For our sample of 78, we 

selected 25 transactions from each identified bucket. Using Excel's random number generator, we 

selected these 25 sample items from each bucket and the remaining 28 items were randomly 

selected from the remaining population of transactions. This approach ensures that the two areas 

we viewed as higher risk were guaranteed to have an appropriate level of transactions for testing 

and ensuring that every transaction in the population has an opportunity for selection. 
Appendix A

Statistical Sample Methodology and Results

Purchase Card Performance Audit

13

A sample size of 5 purchase card openings from the universe of 8 openings and a sample size of 5 

purchase card closings from the universe of 13 closings were randomly selected using Excel's 

random number generator. We consider these items to be small population size items, occurring

less than semi-monthly, therefore, we selected the conservative number of five transactions for 

further review.

We identified 73 purchase card accounts with activity during the period of review. For populations 

less than 250, the FAM recommends selecting 10 percent of the population. In this instance, we 

doubled the recommended sample size and selected 15 active purchase card accounts for further 

testing to ensure that we obtained appropriate coverage.

Results

We tested the following samples:

• A sample of 78 transactions, drawn from a population of 1294;

• A sample 5 purchase card openings, drawn from a population of 8;

• A sample of 5 purchase card closings, drawn from a population of 13; and,

• A sample of 15 active purchase card accounts, drawn from a population of 73.

A description of the attributes tested, shown as exceptions statements, and the results of our testing

are shown in Table 1. When no exception was found for a specific test, no projected minimum

number of errors is made.
Appendix A

Statistical Sample Methodology and Results

Purchase Card Performance Audit

14

Table 1: Statistical Sample Results

Attribute Tests

Sample 

Number 

Tested

Exceptions 

Observed 

in Sample

Exceptions 

as a 

Percentage 

of Sample

Projected 

Minimum 

Number of 

Errors in 

Universe

Transactions

Determine if appropriate and sufficient 

documentation (requisition, purchase 

card worksheet, invoice etc.) is available 

to support the purchase card transaction 

and subsequent payment.

78 0 - -

Verify the purchase card transaction was 

appropriately authorized by the 

Authorizing Official (or equivalent) and 

was a done so in a timely manner.

78 0 - -

Trace the dollar amount for each sample 

per the GL detail to the supporting 

obligating document, receiving report, 

and invoice.

78 0 - -

Verify a Contracting Officer manually 

signed the purchase order for all 

purchases over the micro-purchase level 

and verify the Contracting Officer had 

the appropriate warrant authority to 

execute the purchase card transaction.

78 0 - -

Verify the appropriateness of the 

Merchant Category Code (MCC) (or 

equivalent) assigned to the purchase card 

transaction based on the nature of the 

purchase and determine whether the 

MCC code used is allowable.

78 0 - -
Appendix A

Statistical Sample Methodology and Results

Purchase Card Performance Audit

15

Attribute Tests

Sample 

Number 

Tested

Exceptions 

Observed 

in Sample

Exceptions 

as a 

Percentage 

of Sample

Projected 

Minimum 

Number of 

Errors in 

Universe

Verify the purpose of the purchase card 

transaction is reasonable and appropriate 

based on the nature of the underlying 

purchase and established guidelines and 

protocols over the spending of federally 

issued funds.

78 0 - -

Verify the purchase card transaction was 

not part of split-purchase agreement 

(prohibited).

78 0 - -

Verify the purchase card transaction was 

appropriately paid and done so in a 

timely manner, according to the terms of 

the cardholder agreement.

78 0 - -

Account Openings

Verify the cardholder completed an 

application for the purchase card.

5 0 - -

Verify the cardholder's purchase card 

application was reviewed and approved 

by their supervisor.

5 1 20% 2

Verify the approving official completed 

all required training prior to approval of 

the application.

5 1 20% 2

Verify the employee applying for the 

purchase card account completed all 

required training prior to submission of 

their application.

5 0 - -
Appendix A

Statistical Sample Methodology and Results

Purchase Card Performance Audit

16

Attribute Tests

Sample 

Number 

Tested

Exceptions 

Observed 

in Sample

Exceptions 

as a 

Percentage 

of Sample

Projected 

Minimum 

Number of 

Errors in 

Universe

Account Closings

Determine whether protocols in place 

over the closing, suspension, and/or 

deactivation of purchase card accounts 

are being followed and determine if 

deactivation measures were taken in 

timely manner.

5 0 - -

Determine if purchase card transactions 

have erroneously taken place after 

deactivation of the cardholder's account.

5 0 - -

Active Accounts

Verify the cardholder has a current 

training certificate produced by GSA's 

online SmartPay Government Purchase 

Card Training course (within 3 years of 

9/30/19).

15 0 - -

Verify the cardholder's account 

expiration date does not expire prior to 

9/30/19.

15 0 - -
Appendix B

Management's Response

17

Appendix B – Management's Response
Appendix B

Management's Response

18