Purchase Cards: Control Weaknesses Leave Two Navy Units Vulnerable to Fraud and Abuse
Published: 2001-07-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: This testimony discusses internal controls weaknesses that left two Navy units in San Diego, California, vulnerable to purchase card fraud and abuse.
section_title: What GAO Found
paragraphs: GAO found a proliferation of purchase cards at the two units in San Diego--the Space and Naval Warfare Systems Command and the Navy Public Works. In the end, more than 1,700 cardholders essentially had the authority to make their own purchase decisions. A serious breakdown in internal controls over the receipt of government property and the certification of monthly statements, coupled with flawed or nonexistent policies and procedures and the failure of Navy employees to adhere to valid policies and procedures, led to (1) the loss, theft, and misuse of government property; (2) the potential abuse of purchase cards; and (3) payments of potentially fraudulent charges. Five fraud cases have already been identified, and the government remains extremely vulnerable to fraud, waste, and abuse arising from the purchase card program at the two Navy units. This testimony summarized the November report, GAO-02-32 .

section_title: Letter
paragraphs: Thank you for the opportunity to discuss Department of Defense (DOD)  internal controls and accounting practices for purchase card transactions  and payments. DOD reported that it used purchase cards—MasterCard or  VISA cards issued to its civilian and military personnel—for more than 10  million transactions valued at $5.5 billion in fiscal year 2000. DOD has  increased the use of purchase cards with the intention of eliminating the  bureaucracy and paperwork long associated with making small purchases  and intends to expand the use of purchase cards over the next several  years. Given the rapid growth of purchase card use at DOD, ensuring that  key controls are in place over the program is critical to protecting the  government from fraud, waste, and abuse.
We began looking into this issue at the request of Senator Grassley, who  was concerned about internal control weaknesses that may have  contributed to reports of purchase card fraud related to Navy programs  based in San Diego, California. As a result, we agreed to obtain and review  DOD fraud case information related to Navy purchase card programs in the  San Diego area and to review purchase card controls and accounting for  two Navy units based in San Diego—the Space and Naval Warfare Systems  Command (SPAWAR) Systems Center and the Navy Public Works Center.  Further background information on the Navy purchase card program is  included in appendix I.
Today, I will discuss the results of our review of Navy purchase card  controls, including (1) the purchase card control environment at the two  Navy units’ San Diego activities and overall management issues that affect  the Navy-wide purchase card program, (2) the results of our test work on  statistical samples of purchase card transactions at the two Navy units,  which identified control weaknesses in four critical areas, and (3)  potentially fraudulent, improper, and abusive transactions made by the two  Navy units. Some of these transactions are similar to those involved in five  specific fraud cases related to Navy programs based in San Diego that had  been identified at the time of our work. Information on the five fraud cases  is presented in appendix II.
subsections: section_title: Scope and Methodology
paragraphs: We conducted our audit work from August 2000 through June 2001 in  accordance with generally accepted U.S. government auditing standards,  and we performed our investigative work in accordance with standards  prescribed by the President’s Council on Integrity and Efficiency. We  briefed DOD managers, including officials in DOD’s Purchase Card  Program Management Office and the Defense Finance and Accounting  Service (DFAS), and Navy managers, including Navy Supply Command,  Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San  Diego officials on the details of our review, including our objectives, scope,  and methodology and our findings and conclusions. We referred instances  of potentially fraudulent transactions that we identified during our work to  our Office of Special Investigations for further investigation. Our work was  not designed to identify, and therefore we did not determine, the extent of  fraudulent, illegal, or abusive transactions. Our control tests were based on  stratified random probability samples of 135 SPAWAR San Diego purchase  card transactions and 121 Navy Public Works Center San Diego  transactions. Further details on our objectives, scope, and methodology are  included in appendix III.
section_title: Weak Purchase Card Environment Contributed to Ineffective Controls
paragraphs: Management and employees should establish and maintain an environment  throughout the organization that sets a positive and supportive attitude toward  internal control and conscientious management. A positive control environment  is the foundation for all other standards. It provides discipline and structure as  well as the climate which influences the quality of internal control. GAO’s  Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1,  November 1999)
A weak internal control environment at SPAWAR San Diego and the Navy  Public Works Center San Diego contributed to internal control weaknesses,  fraud, and abuse. The importance of the “tone at the top” or the role of  management in establishing a positive internal control environment cannot  be overstated. GAO’s internal control standards go on to state that,  “management plays a key role in demonstrating and maintaining an  organization’s integrity and ethical values, especially in setting and  maintaining the organization’s ethical tone, providing guidance for proper  behavior, removing temptations for unethical behavior, and providing  discipline when appropriate.” The specific factors that contributed to the  lack of a positive control environment at these two units included a  proliferation of purchase cardholders, ineffective training of cardholders  and certifying officers, ineffective rebate management, and a lack of  monitoring and oversight.
subsections: section_title: Proliferation of Cardholders Resulting in Unreasonable Span of Control
paragraphs: SPAWAR San Diego and the Navy Public Works Center San Diego did not  have specific policies governing the number of cards issued or establishing  criteria for identifying employees eligible for the privilege of cardholder  status. At both units, cards were given out on the basis of a request from an  individual employee’s supervisor. The request was then forwarded to the  unit’s purchase card agency program coordinator, who approved the  request and began the process for obtaining a new card from Citibank.  According to SPAWAR and Navy Public Works Center officials, specific  criteria did not exist for either the supervisors or the program coordinators  to use in requesting and approving purchase cards for employees. This  flawed policy has resulted in a proliferation of purchase cards at the two  units. For example, as of September 30, 2000, about one in three, or 36  percent of SPAWAR San Diego employees and about one in six, or 16  percent, of Navy Public Works Center San Diego employees were  cardholders. As a result, at the end of fiscal year 2000, about 1,526 SPAWAR  San Diego employees and 254 Navy Public Works Center San Diego  employees were authorized to procure goods and services.
Within this weak control environment, these two Navy units had given  purchase cards to over 1,700 employees, most of whom had credit limits of  $20,000 or more and the authority to make their own purchase decisions.  Table 1 shows the proliferation of cardholders and the percentage of  employees at SPAWAR and the Navy Public Works Center in San Diego that  were cardholders as of September 30, 2000. Most of SPAWAR’s 1,526  cardholders had a $25,000 credit limit and most of the Navy Public Works  Center’s 254 cardholders had a $20,000 credit limit.
Information we obtained from six large defense contractors on their  purchase card programs showed that the percent of the contractors’  employees that were cardholders ranged from about 2 percent to nearly 4  percent—significantly less than at SPAWAR and the Navy Public Works  Center in San Diego.
The proliferation of cardholders, particularly at SPAWAR San Diego,  created a situation where it was virtually impossible to maintain a positive  control environment. For example, at SPAWAR, a significant span of  control issue existed, with one approving official responsible for certifying  monthly summary billing statements covering an average of over 700  monthly purchase card statements relating to 1,526 purchase cardholders.  At the Navy Public Works Center San Diego, the span of control problem  was not as serious, with six approving officials responsible for certifying  monthly summary statements covering an average of 55 monthly  statements for 254 cardholders. The span of control issue is particularly  important for purchase cards because supervisors and, in some cases,  cardholders themselves, are responsible for authorizing purchases, rather  than an independent contracting officer as is the case under the standard  procurement process. Thus, the approving official serves as a key control  in certifying cardholder purchases.
section_title: Lack of Documented Evidence of Training for Cardholders and Approving Officials
paragraphs: The lack of documented evidence of purchase card training also  contributed to a weak internal control environment at SPAWAR and the  Navy Public Works Center in San Diego. GAO’s internal control standards  emphasize that effective management of an organization’s workforce—its  human capital—is essential to achieving results and is an important part of  internal control. Training is key to ensuring that the workforce has the  skills necessary to achieve organizational goals. In accordance with Navy  Supply Command (NAVSUP) Instruction 4200.94, all cardholders and  approving officials must receive purchase card training. Specifically,  NAVSUP Instruction 4200.94 requires that prior to the issuance of a  purchase card, all prospective cardholders and approving officials must  receive training regarding both Navy policies and procedures as well as  local internal operating procedures. Once initial training is received, the  Instruction requires all cardholders to receive refresher training every 2  years.
Although we found the training policies and procedures to be generally  adequate, we determined that SPAWAR and the Navy Public Works Center  lacked documentation to demonstrate that all cardholders and approving  officials had received the required training. Based on our tests of fiscal year  2000 purchase card transactions, we estimate that about 40 percent of the  SPAWAR transactions, totaling at least $6.8 million, and 56 percent of the  Navy Public Works Center transactions, totaling at least $10.9 million,  were made by cardholders for whom there was no documented evidence  that they had received either the required initial training or refresher  training on purchase card policies and procedures.
SPAWAR San Diego management contended that we should accept training  provided under the Navy’s previous purchase card program as meeting the  training requirements under the new program. Although we determined  that the policies and procedures related to cardholder responsibilities were  essentially the same under the previous Navy purchase card program, we  found that several cardholders had received the prior training as many as 2  years to 6 years before the current program began. Therefore, these  cardholders had not received the required biennial refresher training. The  Navy Public Works Center San Diego had no documented evidence that its  cardholders had received any purchase card training prior to March 2000.
We also found no documented evidence that two of six Navy Public Works  Center approving officials had received training on purchase card policies  and procedures prior to assuming certifying officer responsibilities.  SPAWAR’s one approving official had received all required training.
section_title: Purchase Card Rebates Not Effectively Managed
paragraphs: We found ineffective management of purchase card rebates by the Navy,  SPAWAR San Diego, and the Navy Public Works Center San Diego. The  Navy requested that Citibank defer payment of all of the purchase card  rebates it earned since the current purchase card program began in  November 1998 because, according to DOD and Navy officials, it had not  yet determined how to record and allocate the rebates to Navy programs.  According to Citibank officials, Citibank plans to pay cumulative purchase  card rebates and accrued interest to the Navy on July 31, 2001, the payment  date required in the Navy’s latest purchase card contract task order  modification. Citibank estimates that the total payment will be about $8.8  million, including an estimated $8.3 million in cumulative rebates and an  estimated $530,000 in accrued interest on these rebates. In addition, the  Navy had not established policies and procedures for managing rebates and  had not monitored its rebate earnings. As a result, the Navy, SPAWAR San  Diego, and the Navy Public Works Center San Diego were not aware that  Citibank had miscalculated the rebates that SPAWAR and the Navy Public  Works Center should have earned during fiscal year 2000 by about  $150,000. Specifically, the rebates due SPAWAR were understated by  $136,760, while the Navy Public Works Center’s rebates were overstated by  $12,039.
Further, SPAWAR and Navy Public Works Center managers were not  effectively managing purchase card payments to maximize the amount of  rebates earned. We determined that delays in the receipt of monthly  purchase card statements had precluded the opportunity for these two  units to earn another $242,000 in fiscal year 2000 rebates. We do not know  the extent to which these factors have adversely impacted the Navy’s total  fiscal year 2000 purchase card rebates.
section_title: Program Monitoring and Audit Function Not Effective
paragraphs: SPAWAR and the Navy Public Works Center in San Diego had not  established an effective monitoring and internal audit function for the  purchase card program. Further, the Navy’s purchase card policies and  procedures did not require that the results of internal reviews be  documented or that corrective actions be monitored to help ensure that  they are effectively implemented.
NAVSUP Instruction 4200.94 calls for agency program coordinators to  perform semiannual reviews of their units’ purchase card program,  including adherence to internal operating procedures, applicable training  requirements, micro-purchase procedures, receipt and acceptance  procedures, and statement certification and prompt payment procedures.  Further, these reviews are to serve as a basis for agency program  coordinators to initiate appropriate action to improve the local program or  correct problem areas. However, the Instruction does not require written  reports on the results of internal reviews to be submitted to either local  management or a central Navy office for monitoring and oversight. As a  result, the Navy did not have a consistent process for documenting the  results of purchase card reviews, identifying systemic problems, and  monitoring corrective actions to help ensure that they are effectively  implemented. This weakness also impaired the Navy’s ability to assess  purchase card controls for possible inclusion in its Annual Statements of  Assurance pursuant to 31 U.S.C. 3512(d) (commonly referred to as the  Federal Managers’ Financial Integrity Act of 1982), which requires agency  heads to make annual disclosures regarding the adequacy of their internal  controls. The Secretary of the Navy’s fiscal year 2000 Annual Statement of  Assurance did not disclose any control weaknesses related to the purchase  card program.
Our analysis of SPAWAR San Diego Agency Program Coordinator fiscal  year 2000 reviews showed that these reviews identified problems with  about 42 percent of the monthly cardholder statements that were reviewed.  The problems identified were consistent with the control weaknesses  discussed later in this testimony, including lack of independent  documentation that the Navy received items ordered by purchase card,  accountable items that were not recorded in the property records,  inadequate documentation for transactions, split purchases, and  transactions that did not appear to be related to government business  purposes.
During our review, we saw correspondence and other documentation  showing that SPAWAR San Diego management had considered the findings  identified in its agency program coordinator evaluations, but directed that  corrective actions should not be implemented due to complaints from  cardholders and their supervisors regarding the administrative burden  associated with procedural changes that would be needed to address the  review findings. As a result, the agency program coordinator had not used  these reviews to make systematic improvements in the program. Rather,  these reviews generally resulted in the reviewer counseling the cardholders  or, in some instances, recommending that cardholders attend purchase  card training. During fiscal year 2000, the SPAWAR San Diego Office of  Command Evaluation internal review group had not conducted any reviews  or audits of the purchase card program. Further, although the SPAWAR San  Diego Command Inspector General reviewed the SPAWAR purchase card  program during fiscal year 2000 and prepared a draft report summarizing  the results of this review, the final report has not yet been issued. Our  review of the draft report determined that the Command IG identified a  number of internal control problems that are consistent with our findings,  including issues related to receipt and acceptance, training, and split  purchases.
The Navy Public Works Center San Diego purchase card agency program  coordinator did not perform any systematic reviews of the program during  fiscal year 2000. He told us that his monitoring efforts consisted of  scanning some monthly invoices for duplicate payments, split purchases,  and other suspicious payments. However, he did not document these  actions. Further, the Public Works Center internal review group in the  Office of Command Evaluation did not perform any reviews during fiscal  year 2000. However, Navy Public Works Center managers told us that they  asked the Naval Audit Service to review the Center’s purchase card  program during fiscal year 2000 because of concerns about the growth of  the program, the adequacy of internal controls, and recent instances of  fraud. Although the Naval Audit Service completed its fieldwork in  November 2000 and briefed Navy Public Works Center San Diego  management on its findings, the results of that effort have yet to be  externally reported. According to the Navy’s Deputy Assistant Auditor  General, the Naval Audit Service plans to finalize its work and issue a  report in the fall of 2001.
section_title: Breakdown of Critical Internal Controls
paragraphs: Basic internal controls over the purchase card program were ineffective at  the two units we reviewed. Based on our tests of statistical samples of  purchase card transactions, we determined that the three transaction-level  controls that we tested were ineffective, rendering SPAWAR San Diego and  Navy Public Works Center San Diego purchase card transactions  vulnerable to fraudulent and abusive purchases and theft and misuse of  government property. As shown in table 2, the specific controls that we  tested were (1) independent, documented receipt and acceptance of goods  and services, (2) independent, documented certification of monthly  purchase card statements, and (3) proper accounting for purchase card  transactions.
In addition, we tested whether the accountable items—easily pilferable or  sensitive items— included in some of the transactions in our samples were  recorded in the units’ property records to help prevent theft, loss, and  misuse of government assets. Our tests of SPAWAR and Navy Public Works  Center fiscal year 2000 purchase card transactions that included  accountable property items, showed that the two units failed to record one  or more accountable items in their property records for nearly all of these  transactions. Further, when we analyzed the property items included in our  sampled transactions, we found that SPAWAR and the Navy Public Works  Center did not record 46 of the 65 accountable items included in our  sampled transactions in their property records. Moreover, when we asked  to inspect these items, the two units could not provide conclusive evidence  that 31 of them, including laptop computers, Palm Pilots, and digital  cameras, were in the possession of the government.
subsections: section_title: Lack of Independent Documented Receipt and Acceptance
paragraphs: Key duties and responsibilities need to be divided or segregated among different  people to reduce the risk of error or fraud. This should include separating the  responsibilities for authorizing transactions, processing and recording them,  reviewing the transactions, and handling any related assets. Simply put, no one  individual should control all the key aspects of a transaction or event. GAO’s  Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1,  November 1999)
SPAWAR San Diego and the Navy Public Works Center San Diego generally  did not have independent, documented evidence that they received items  ordered by purchase card. That is, they generally did not have a receipt for  the acquired goods and services that was signed by someone other than the  cardholder. As a result, there is no documented evidence that the  government received the items purchased or that those items were not lost,  stolen, or misused. NAVSUP Instruction 4200.94 generally requires  segregation of duties between the individual making the purchase and the  individual responsible for documenting receipt and acceptance of goods  and services acquired by purchase card. However, employees at the two  units were not following these procedures. In some instances employees  were following an alternative procedure permitted by the NAVSUP  Instruction whereby independent authorization of a purchase order can be  substituted for independent confirmation of receipt of the items purchased.  However, the alternative procedure does not provide any assurance that  the items ordered and paid for were received.
Based on our test work, we estimate that SPAWAR San Diego did not have  independent, documented evidence to confirm the receipt and acceptance  of goods and services acquired with the purchase card for about 65  percent of its fiscal year 2000 transactions totaling at least $10.1 million.  For the Navy Public Works Center San Diego, we estimated that 47 percent  of its fiscal year 2000 purchase card transactions totaling at least $6.6  million did not include independent, documented receipt of goods and  services.
The types of items in our sampled transactions that lacked independent  evidence of receipt and acceptance included computers, monitors, and  compact disk writers that were purchased at stores such as Byte and  Floppy Computer, Dell Computer, and CompUSA. Further, during fiscal  year 2000, SPAWAR and the Navy Public Works Center in San Diego made  over 2,000 transactions totaling over $468,000 for items from The Home  Depot, Best Buy, Circuit City, and Wal-Mart. Our review of the five purchase  card fraud cases related to Navy activities based in San Diego, discussed in  appendix II, showed that fraudulent purchases had been made to acquire  items for personal use from these same stores. Because the Navy  purchases items for valid, government purposes from stores that are widely  used by consumers to acquire items for personal use, verification of receipt  of goods and services by an individual other than the cardholder is  necessary to reduce the risk of fraudulent transactions.
section_title: Lack of Proper Certification of Monthly Purchase Card Statements
paragraphs: Transactions and other significant events should be authorized and executed only  by persons acting within the scope of their authority. This is the principal means  of assuring that only valid transactions to exchange, transfer, use, or commit  resources and other events are initiated or entered into. GAO’s Standards for  Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999)
We assessed a 100-percent failure rate at both units for this critical control.  NAVSUP Instruction 4200.94 and, to a greater extent, a policy  memorandum issued by the Navy Comptroller’s office on June 3, 1999, do  not provide adequate internal controls and are inconsistent with the  responsibilities of certifying officers reflected in statutes and DOD’s fiscal  policy guidance. Approving officials at the two units told us that they were  not following the existing procedures due to time constraints and the Navy  Comptroller’s policy memorandum.
Under 31 U.S.C. 3325 and DOD’s Financial Management Regulation,  disbursements are required to be made on the basis of a voucher certified  by an authorized agency official. The certifying official is responsible for  ensuring (1) the adequacy of supporting documentation, (2) the accuracy  of payment calculations, and (3) the legality of the proposed payment  under the appropriation or fund charged. Proper certification of bills for  payment is a preventive control that requires and provides the incentive for  certifying officers to maintain proper controls over public funds. It also  helps detect fraud and improper payments, including invalid (unsupported  or prohibited) transactions, split purchases, and duplicate payments.  Further, section 933 of the National Defense Authorization Act for Fiscal  Year 2000 requires the Secretary of Defense to prescribe regulations that  ensure, among other things, that each purchase cardholder and approving  official is responsible for reconciling charges on a billing statement with  receipts and other supporting documentation.
According to NAVSUP Instruction 4200.94, upon receipt of the individual  cardholder statement, the cardholder has 5 days to reconcile the  transactions appearing on the statement by verifying their accuracy to the  supporting documents and notify the approving official in writing of any  discrepancies in the statement or sign and forward it to the approving  official. The approving official is responsible for ensuring that all purchases  made by the cardholders within his or her cognizance were appropriate and  that the charges are accurate. However, the Instruction further states that  within 5 days of receipt of the cardholders’ statements, the approving  official must review and certify the monthly summary statement for  payment, whether or not the cardholder has reviewed the statement and  notified the official of any discrepancies or agreement with the statement.  That is, the approving official is to presume that all transactions on the  monthly statements are proper unless notified in writing by the purchase  cardholder.
Under this process, the certifying officer relies upon the silence of a  cardholder who may have failed to timely forward corrections or  exceptions to the account statement or, even worse, may not have even  reviewed the statement. A certifying officer in these circumstances is not  taking steps to assure that a payment is proper and an agency therefore  cannot rely on the certification for assurance that a payment is for the  proper amount and a legal purpose.
This NAVSUP policy is inconsistent with the purpose of certifying vouchers  prior to payment, which is to maintain proper control over public funds and  assure that payments are made for proper amounts and purposes.  Certifying officers are responsible for the correctness of facts and  computations in the voucher, and the legality of the proposed payment  under the appropriation involved. A certifying officer is liable for losses  resulting from improper certifications, but may be relieved from liability if  the certification was based upon official records and the officer did not  know, and could not have reasonably discovered, the correct information.  While certifying officials may rely on systems, controls, and personnel that  process transactions rather than personally reviewing the supporting  documentation, they must show that their reliance was reasonable.  Regardless of what system is used, there is no authority to make known  improper payments. At SPAWAR and the Navy Public Works Center, the  certifying officers relied on a process without assurances that even a  minimal review of the facts and computations underlying the proposed  payment or the legality of such payment was carried out before  certification was made. Thus, the certifying officers may not be able to  demonstrate that their reliance on such a system is reasonable.
In addition to the problems with NAVSUP Instruction 4200.94, the Navy  Comptroller’s June 3, 1999, policy memorandum further weakens the  certification process. The policy memorandum does not explicitly state  that the cardholder must review the statement of account and notify the  approving official of any improper or incorrect items within 5 days of  receipt. Nonetheless, the approving official must certify the invoices based  on the presumption that all cardholder accounts are proper unless notified  in writing within 5 days of receipt of the invoice. Navy officials told us that  it is assumed that cardholders would review the statements and notify the  approving officials of any problems. While the cardholder’s review is not  explicitly required, the memorandum states that the change in policy “will  ensure that the cardholder will inform the AO  in a  prompt manner of any duplicate payments or fraudulent or improper  charges to his account.” Again, by requiring certification within 5 days,  whether or not a cardholder has reviewed a statement, the June 3, 1999,  policy memorandum requires a certifying officer to rely upon a process that  does not require review of a proposed payment or otherwise assure that a  payment is properly payable before certification occurs.
All seven approving officials at the two activities (one at SPAWAR and six  at the Navy Public Works Center) told us that they never reviewed the  cardholders’ supporting documentation before signing and submitting  purchase card statements for payment. Accordingly, we assessed the  failure rate for this control as 100 percent for both SPAWAR San Diego and  the Navy Public Works Center San Diego. Approving officials explained  that they certify purchase card statements for payment without reviewing  cardholders’ supporting documentation because (1) they do not have time  to review the documentation and (2) the Navy Comptroller’s June 3, 1999,  guidance relieves them of this responsibility.
With regard to the first issue, both activities are faced with a significant  span of control issue that makes the overall purchase card environment  difficult, if not impossible, to control. With an average of over 700 monthly  cardholder statements at SPAWAR San Diego and only one approving  official—who is also the Agency Program Coordinator—proper  certification of monthly summary statements within 5 days of receipt is not  physically possible. Thus, the SPAWAR San Diego approving official told us  that the certification process is largely a “rubber stamp” with no real  verification of the underlying cardholder support for the monthly summary  statements. The environment is somewhat more manageable at the Navy  Public Works Center San Diego, with six approving officials charged with  certifying summary statements that cover an average of 55 cardholder  statements each month. However, Public Works Center approving officials  also told us that they did not review all cardholder supporting  documentation before certifying purchase card statements for payment. As  a result, these two Navy units paid their monthly purchase card bills  without knowing whether the charges were valid. As discussed later in this  statement, this has contributed to payments being made for unauthorized  and improper transactions.
With regard to the second issue, the June 3, 1999, policy memorandum  appears to improperly assign certifying officer accountability to  cardholders. The policy memorandum stated that because it is not possible  for the approving official to personally review and verify individual  cardholder transactions and statements of account, the approving official  is to certify the purchase card statements for payment based on the  presumption that all cardholder accounts are proper unless the approving  official has been notified to the contrary by the cardholder. The  memorandum goes on to say that, “his new policy recognizes that the  ultimate responsibility for purchases being proper is with the cardholder.”  However, under 31 U.S.C. 3528 and DOD’s Financial Management  Regulation, certifying officers are liable for an illegal, improper, or  incorrect payment as a result of an inaccurate or misleading certification.  An agency may not shift certifying officer liability to other employees. The  policy memorandum is also inconsistent with GAO’s internal control  standard for ensuring that only valid transactions are entered into.  According to DOD and Navy officials, this policy memorandum has created  confusion about whether the cardholder or the approving official is  responsible for proper certification of purchase card statements for  payment.
section_title: Problems in Proper Accounting for Purchase Card Transactions
paragraphs: Transactions should be promptly recorded to maintain their relevance and value  to management in controlling operations and making decisions. This applies to  the entire process or life cycle of a transaction or event from the initiation and  authorization through its final classification in summary records. GAO’s  Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1,  November 1999)
The two units we reviewed did not have controls in place to ensure that  purchase card transactions were recorded to customer accounts in a timely  manner and that local accounting records reflected the proper  classification of expense. The timely and accurate recording of purchase  card transactions is important to ensure the reliability of data and  information used in day-to-day management and decision-making,  particularly for working capital fund activities such as SPAWAR and the  Navy Public Works Center. We have previously reported that DOD has  long-standing problems accumulating and reporting the full costs  associated with its working capital fund operations.
subsections: section_title: Recording Purchase Card Costs to Customer Accounts
paragraphs: The two units did not always record purchase card costs to customer  accounts within required time frames. Consistent with GAO’s internal  control standards and Statement of Federal Financial Accounting  Standards (SFFAS), No. 4, “Managerial Cost Accounting Standards,”  SPAWAR San Diego and Navy Public Works Center San Diego operating  procedures require timely recording of purchase card costs to projects that  received the goods and services acquired by purchase card. This is an  important control because as working capital fund operations, SPAWAR  and the Navy Public Works Center are to provide their customers with  information on the full cost of goods and services provided—either through  billing or other information. Further, working capital fund activities are to  operate on a break-even basis over time—that is, not make a profit or incur  a loss. Accurate and timely recording of customer transactions are key to  ensuring that these working capital fund objectives are met.
However, based on our tests of fiscal year 2000 purchase card transactions,  we estimate that 83 percent of the SPAWAR transactions totaling at least  $15.3 million and an estimated 35 percent of the Navy Public Works  transactions totaling at least $5 million had not been recorded to customer  or overhead accounts within 5 days of receipt of the purchase card  statements. As time passes, the likelihood that documentation will be  available to properly record transactions decreases. For example, because  SPAWAR did not have the documentation to support timely and accurate  recording of purchase card transactions, it wrote off as a loss $657,642 in  fiscal year 2000 transactions that could not be identified to a specific job  order. Further, according to the SPAWAR Accounting Officer, as of the end  of fiscal year 2000, SPAWAR had a backlog of about $5.6 million in purchase  card transactions that had not been recorded to customer accounts or its  own overhead account. As a result of unrecorded transactions, year-end  data on actual overhead costs used to estimate future overhead rates for  billing purposes were unreliable. Navy Public Works Center San Diego  officials were unable to provide reliable information on the amount of  unrecorded purchase card transactions at the end of fiscal year 2000  because systems weaknesses rendered their fiscal year-end data  incomplete and unreliable.
section_title: Classifying Purchase Card Costs by Object Class
paragraphs: In addition to problems with timely and accurate recording of transactions  to customer accounts, SPAWAR San Diego and the Navy Public Works  Center San Diego did not properly classify purchase card transactions in  their detail accounting records to show the nature and type of expenditures  made using purchase cards. Office of Management and Budget (OMB)  Circular A-11, Preparation and Submission of Budget Estimates, requires  federal agencies to report obligations and expenditures by object class,  such as salaries, benefits, travel, supplies, services, and equipment, to  indicate the nature of the expenditures of federal funds. Object  classification data are reported by appropriation in the President’s Annual  Budget Submissions to the Congress. OMB prepares summary reports of  object class data to support budget projections and other analyses.  Accurate object classification data are critical to the reliability of  information reported in the President’s budget submission and budget  projections and other analyses that are based on these data. In addition,  because the Congress has asked for and is using object class information  for its oversight activities, it is important that these data be properly  recorded. We previously reported that inaccurate reporting by object  class hampers congressional oversight.
DOD Purchase Card Program Office guidance requires payments of  monthly purchase card statements to be recorded as summary records in  the Navy’s accounting systems and has directed that these summary  records be recorded to the object class for supplies and materials,  regardless of the nature of the expenses incurred. After purchase card  statements have been paid, SPAWAR San Diego and the Navy Public Works  Center San Diego are to record the individual transactions included in the  summary payment record in their local accounting records. However, we  determined that SPAWAR did not classify summary records related to  payment of monthly purchase card statements to any expense category in  the Navy’s accounting system and recorded all of the purchase card  transactions in our sample to object class 25, as services, in its local  accounting records. Consistent with DOD Purchase Card Joint Program  Management Office guidance, the Navy Public Works Center San Diego  recorded both the summary records related to payment of monthly  purchase card statements and the detailed transactions to object class 26,  as supplies and materials, in its local accounting system.
Because SPAWAR San Diego and the Navy Public Works Center San Diego  did not ensure that their detail transaction records reflected the proper  classification of expense, 100 percent of the SPAWAR and Navy Public  Works Center transactions in our samples were recorded to the wrong  object class. For example, although the majority of the SPAWAR purchase  card transactions in our sample—76 transactions totaling over $73,000— were for equipment purchases, none of these transactions were properly  classified and recorded. Further, SPAWAR did not maintain sufficient  documentation to determine the correct object class for 15 of the  transactions in our sample totaling about $12,000. In addition, although the  Navy Public Works Center recorded all of the purchase card transactions in  our sample as supplies and materials, many of these transactions should  have been recorded as contractual services or equipment. Also, the Navy  Public Works Center did not maintain sufficient documentation to  determine the proper object class for nine of the transactions in our sample  totaling about $6,000.
section_title: Failure to Record Accountable Items in Property Records
paragraphs: An agency must establish physical control to secure and safeguard vulnerable  assets. Examples include security for and limited access to assets such as cash,  securities, inventories, and equipment which might be vulnerable to risk of loss  or unauthorized use. Such assets should be periodically counted and compared  to control records. GAO’s Standards for Internal Control in the Federal  Government (GAO/AIMD-00-21.3.1, November 1999)
Most of the accountable items—easily pilferable or sensitive items—in our  samples were not recorded in property records. Recording these items in  the property records is an important step to ensure accountability and  financial control over these assets and, along with periodic inventory, to  prevent theft or improper use of government property. Consistent with  GAO’s internal control standards, DOD’s Property, Plant, and Equipment  Accountability Directive and Manual, which was issued in draft for  implementation on January 19, 2000, and the Appropriation, Cost and  Property Accounting procedures (referred to as the NAVSOP 1000-3M)  issued by DFAS Cleveland, require accountable property to be recorded in  property records as it is acquired. Accountable property includes easily  pilferable or sensitive items, such as computers and related equipment,  cameras, cell phones, and power tools. The NAVSOP property procedures  require such property to be recorded in property records along with a  description of the item, property identification number, model and serial  number, manufacturer, acquisition cost, and the location or custodian of  the property.
Based on our tests of fiscal year 2000 purchase card transactions that  included accountable property items, we estimate that SPAWAR did not  record all accountable items in its property records for about 84 percent  of its purchase card transactions, covering at least $5.4 million in  accountable property. Based on our tests of Navy Public Works Center  fiscal year 2000 purchase card transactions that included accountable  property items we estimate that the Center did not record all accountable  items in its property records for about 95 percent of its purchase card  transactions, covering at least $317,000 in accountable property.
Our analysis of the individual property items included in our sampled  SPAWAR and Navy Public Works Center fiscal year 2000 purchase card  transactions showed that the two units did not record a total of 46 of the 65  accountable items that were included in our sampled transactions in their  property records, including 36 SPAWAR items and 10 Public Works Center  items. SPAWAR officials told us that they were not aware of the  requirement to record items such as computer monitors, cameras, and  palm pilots in the property records. Moreover, when we asked to inspect  these items, the two units could not provide conclusive evidence that 31 of  them were in the possession of the government, including 19 SPAWAR  items and 12 Public Works Center items. The unverified accountable items  included laptop computers, Palm Pilots, and digital cameras. Of the 31  items that could not be verified, 5 items had been transferred to other  locations throughout the world and SPAWAR and the Public Works Center  officials were unable to conclusively demonstrate their existence and  location, serial numbers for 4 items did not match those on the purchase  documentation, 3 items were declared to be lost or stolen by employees  who had custody of these items, and the existence of the remaining 19  items could not be verified because a serial number was not included in the  purchase documentation or a receipt for the item including a serial number  could not be located.
The three items that were declared lost or stolen included two Palm Pilots  that could not be located—one at SPAWAR San Diego and the other at the  Navy Public Works Center San Diego—and a video conferencing camera  that was reported stolen from a Public Works Center employee’s car.  SPAWAR and Navy Public Works Center officials directed the employees to  prepare lost property reports on the two Palm Pilots. Subsequently, in early  June 2001, Navy Public Works Center officials advised us that their lost  Palm Pilot had been located and showed us what they believed was the  item in question. However, because the serial number had been rubbed off,  we could not confirm that it was the accountable item acquired by  purchase card. In late June 2001, SPAWAR officials advised us that their  lost Palm Pilot had been located. Because we had already completed our  review of SPAWAR property controls, we did not attempt to view and  confirm the existence of this Palm Pilot.
The third item was a video conferencing camera that was reported stolen  on January 27, 2001, by a Navy Public Works Center San Diego employee.  According to the employee, the video camera was stolen from his car along  with a laptop computer that also belonged to the government. The  employee submitted a claim to his insurance company, and the claim was  paid on February 27, 2001. Although the stolen items cost about $3,876, the  employee’s insurance policy limited payment of claims for business  property to $2,500. However, about two months later, in May 2001, our  investigators determined that the insurance check in the amount of $2,500  was deposited in the employee’s personal bank account instead of being  endorsed to the government. The employee admitted to our investigators  that he had been reimbursed for the stolen items from his insurance  company. On May 3, 2001, the employee issued a check to the government  in the amount of $2,500. Navy Public Works Center officials told us that  they are considering assessing the employee for the remaining loss of  $1,376 and taking possible disciplinary action for the failure to reimburse  the government for the equipment loss in a timely manner.
section_title: Potentially Fraudulent, Improper, and Abusive Transactions
paragraphs: We identified several cases of potentially fraudulent, improper, and abusive  transactions at both SPAWAR San Diego and the Navy Public Works Center  San Diego. Given the breakdown of controls described in this testimony,  the two units would have difficulty detecting and preventing these three  types of transactions. We considered potentially fraudulent purchases to be  those which were unauthorized and intended for personal use. Some of  these instances may involve the use of compromised accounts, in which an  account number was stolen and used to make fraudulent purchases. Other  cases involve the cardholder making unauthorized purchases for personal  use. The transactions we determined to be improper are those purchases  intended for government use, but are not for a purpose that is permitted by  law or regulation. We also identified as improper a number of purchases  made on the same day from the same vendor, which appeared to  circumvent cardholder single transaction limits. Federal Acquisition  Regulation and NAVSUP Instruction 4200.94 guidelines prohibit splitting  purchase card transactions into more than one segment to avoid the  requirement to obtain competitive bids on purchases over the $2,500 micro- purchase threshold or to circumvent higher single transaction limits for  payments on deliverables under requirements contracts. We defined  abusive transactions as those that were authorized, but the items  purchased were at an excessive cost or for a questionable government  need, or both. In these instances, it appears that cardholders were  permitted to purchase items for which there was not a reasonable,  documented justification. As discussed in our Objectives, Scope, and  Methodology, our work was not designed to identify, and we cannot  determine, the extent of fraudulent, improper, or abusive transactions.
subsections: section_title: Potentially Fraudulent Transactions
paragraphs: Although both SPAWAR and the Navy Public Works Center had policies and  procedures that were designed to prevent fraudulent purchases, our tests  showed that the controls were not implemented as intended. For example,  as discussed previously, controls for independent verification of receipt  and acceptance and proper certification of monthly statements prior to  payment were ineffective. Fraudulent activities must then be detected after  the fact during supervisor or internal reviews and disputed charge  procedures must be initiated to obtain a credit from Citibank. Table 3  shows examples of potentially fraudulent transactions that we identified  from the universe of fiscal year 2000 purchases by SPAWAR San Diego and  Navy Public Works Center San Diego cardholders.
Navy Public Works Center San Diego officials told us that they were aware  of the potentially fraudulent transactions that we identified. The officials  told us that the apparently fraudulent Public Works Center transactions  were all made using a limited number of cardholder accounts and that they  had referred these transactions to the Naval Criminal Investigative Service.  SPAWAR officials also told us that they were aware of their potentially  fraudulent transactions. Both Public Works Center and SPAWAR officials  said that they had submitted disputed charged forms to Citibank and had  received credits for these transactions. However, given the extensive  breakdowns in purchase card controls that we identified, SPAWAR and the  Navy Public Works Center have no assurance that all fraudulent charges  were detected. Our Office of Special Investigations is conducting a further  investigation of the potentially fraudulent purchases we identified.
section_title: Improper Transactions
paragraphs: We identified several SPAWAR San Diego transactions that involved the  improper use of federal funds. For example, one case involved flowers  costing $97 purchased for Secretary’s Day. We also identified several  transactions for food for employee-related activities, including food costing  $75 for an office outing. The Federal Acquisition Regulation, 48 C.F.R.  13.301(a), provides that the Governmentwide Commercial Purchase Card  “may be used only for purchases that are otherwise authorized by law or  regulations.” Therefore, a procurement using the purchase card is lawful  only if it would be lawful using conventional procurement methods.
Pursuant to 31 U.S.C. 1301(a), “ppropriations shall only be applied to the  objects for which the appropriations were made . . . .” In the absence of  specific statutory authority, appropriated funds may only be used to  purchase items for official purposes, and may not be used to acquire items  for the personal benefit of a government employee. For example, without  statutory authority, appropriated funds may not be used to furnish meals or  refreshments to employees within their normal duty stations. Free food  and other refreshments normally cannot be justified as a necessary  expense of an agency’s appropriation because these items are considered  personal expenses that federal employees should pay for from their own  salaries. Likewise, appropriated funds may not be used to purchase gifts  for employees or others unless an agency can demonstrate that the items  further the purposes for which the appropriation was enacted. The  purchase of the flowers and food were both personal rather than official in  nature and, therefore, may not be paid for with appropriated funds.
Another transaction involved the purchase of a file cabinet from Macy’s at a  cost of $1,462. Purchases of file cabinets are subject to rules prescribed in  Title 41 of the Code of Federal Regulations, Subtitle C, “Federal Property  Management Regulations System,” which cover specific procedures that  must be followed to limit the purchases of new filing cabinets, including  disposing of all records that have been authorized for disposition in  accordance with authorized disposal schedules and transferring inactive  records not needed for daily business to approved agency records centers.  After taking appropriate steps to maximize the use of existing filing  cabinets, if the agency determines that additional filing cabinets are  required, the FAR requires the agency to submit a requisition to the General  Service Administration (GSA). We found no documented evidence that the  required procedures were followed. Further, we found no documented  justification for purchasing the file cabinet from Macy’s instead of through  GSA, as required.
section_title: Potentially Abusive Transactions
paragraphs: We also identified a number of potentially abusive transactions. These were  purchases of items supposedly for official use but without any documented  agency determination that these items were necessary for government business rather than merely to satisfy the personal preference of individual  employees. When a contracting official—in this case, a purchase  cardholder—purchases an item based on his or her own preferences (or  the desires of another agency official or employee) without a management  decision that the item is necessary, he or she is abusing the procurement  process. Some of these items fall into categories described in GAO’s Guide  for Evaluating and Testing Controls Over Sensitive Payments  (GAO/AFMD-8.1.2, May 1993). The guide states that “Abuse is distinct from  illegal acts (noncompliance). When abuse occurs, no law or regulation is  violated. Rather, abuse occurs when the conduct of a government  organization, program, activity, or function falls short of societal  expectations of prudent behavior.”
Our review of the transactions in our samples as well as our analytical  review of the universe of SPAWAR and Navy Public Works Center fiscal  year 2000 transactions identified a number of purchases that appear to be  abusive, as shown in table 4.
For example, SPAWAR San Diego cardholders purchased 9 flat-panel  computer monitors at a total cost of $13,192. The cost of each monitor  ranged from $800 to $2,500. In contrast, the current GSA schedule cost of a  standard 17-inch computer monitor is about $300. We were unable to find  any pre-purchase agency determination that the nature of the work  performed by SPAWAR officials or employees was such that standard  monitors would not satisfy their needs. SPAWAR’s commanding officer  later told us that flat-panel monitors save space and energy and are easier  on the eyes. However, his opinion did not constitute an official agency  determination that these monitors were needed. It appears more likely that  cardholders purchased these more costly monitors to satisfy the personal  preferences of individual SPAWAR officials or employees. Our sample  transactions also included four SPAWAR purchases of PDAs for a total cost  of $1,150.
We performed a similar review of the Navy Public Work Center’s fiscal year  2000 transactions and generally did not identify the same types of  potentially abusive transactions. We did, however, identify nine PDA  purchases for a total cost $3,642. Again, we were unable to find any pre- purchase agency determination that these officials or employees needed  PDAs to perform their work. Therefore, it again appears likely that the  PDAs were acquired to satisfy the personal preferences of the individuals  for whom they were purchased.
section_title: Split Purchases
paragraphs: Our analysis of the universe of fiscal year 2000 Navy purchase card  payments made by DFAS San Diego identified nearly $100 million in  purchases made on the same day from the same vendor, which appeared to  circumvent cardholder single transaction limits—including about $2.5 million in potential SPAWAR split purchases and nearly $4.7 million in  potential Navy Public Works Center split purchases. The Federal  Acquisition Regulation and Navy purchase card policies and procedures  prohibit splitting a transaction into more than one segment to avoid the  requirement to obtain competitive bids for purchases over the  $2,500 micro-purchase threshold or to avoid other established credit limits.  DOD and Navy purchase card policies and procedures prohibit such  actions as improper use of the purchase card. Once items exceed the  $2,500 micro-purchase threshold, they are to be purchased in accordance  with simplified acquisition procedures, which are more stringent than  those for micro-purchases.
Our analysis of the universe of fiscal year 2000 SPAWAR San Diego and  Navy Public Works Center San Diego transactions identified a number of  potential split purchases. To determine whether these were, in fact, split  purchases, we obtained and analyzed the supporting documentation for 20  purchases each at SPAWAR and the Navy Public Works Center. We found  that in many instances, cardholders made multiple purchases from the  same vendor within a few minutes or a few hours for items such as  computers, computer-related equipment, and software, that involved the  same, or sequential or nearly sequential purchase order and vendor invoice  numbers. Based on our analyses, we concluded that 18 of the 20 SPAWAR  purchases and 14 of the 20 Navy Public Works Center purchases that we  examined were split into two or more transactions to avoid micro-purchase  thresholds. Tables 5 and 6 provide examples of cardholder purchases that  we believe represent split purchases intended to circumvent the $2,500  micro-purchase limit or cardholder transaction limits.
In addition to the items in table 6, we identified three Navy Public Works  Center purchases totaling $147,000 that were made to the same vendor on  the same day by a cardholder with a $100,000 transaction limit. The Navy  Public Works Center did not have receipts to document the items acquired.
section_title: Planned Actions to Mitigate Control Weaknesses
paragraphs: When we brought the control failures and other issues we identified to the  attention of the Executive Officer at the Navy Public Works Center San  Diego, he demonstrated a proactive position to identifying and correcting  the weaknesses. According to the Executive Officer, because of concerns  about recent instances of purchase card fraud, the Navy Public Works  Center requested a Naval Audit Service review of purchase card activity  and undertook a number of corrective actions as a result of auditor  findings. For example, in February 2000, the Navy Public Works Center San  Diego started to reduce the number of purchase cardholders, which totaled  359 at that time, to about 250, and in September 2000, the Public Works  Center revised its purchase card policies and procedures to comply with  NAVSUP Instruction 4200.94. In addition, due to the time required for  review and proper certification of purchase card statements before  payment, the Executive Officer told us that he would consider further  reducing the number of cardholders to help ensure adequate review of  documentation prior to certifying statements for payment.
During fiscal year 2001, according to a SPAWAR acquisition official,  SPAWAR reduced the number of its cardholders from over 1,500 to 1,070;  however, it continued to have only one approving official who was  responsible for certifying monthly summary purchase card statements, and  the average number of individual monthly purchase card statements  remained about the same. In addition, the SPAWAR San Diego  Commanding Officer told us that SPAWAR planned to implement an  Enterprise Resources Planning (ERP) system. The ERP system is expected  to help improve overall controls for the purchase card program, including a  central electronic file of imaged documents supporting purchase card  transactions and an audit trail of actions by individuals executing various  purchase card processing functions. A SPAWAR official advised us that  SPAWAR implemented its ERP system in mid-July 2001. However, unless  substantial improvements are made in the overall control environment and  employees actually follow purchase card policies and procedures, the ERP  system will simply automate the same weaknesses as the current manual  process.
section_title: Conclusions
paragraphs: The serious breakdown in internal controls at SPAWAR San Diego and  Navy Public Works San Diego are the result of a weak overall internal  control environment, flawed or nonexistent policies and procedures, and  employees that do not adhere to valid policies. The proliferation of  cardholders at these two activities resulted in over 1,700 cardholders with  essentially the authority to make their own purchase decisions in an  environment that lacked basic controls over receipt of government  property, certification of monthly statements, and accountability over  sensitive property items. Our work found that these weak internal controls  resulted in lost, stolen, missing, or misused government property,  potentially abusive use of purchase cards, and payment of unauthorized  and potentially fraudulent charges. The combination of these factors also  contributed to the five known fraud cases and leaves the government  highly vulnerable to significant additional fraud, waste, and abuse from the  purchase card program at these two Navy units.
Following this testimony, we plan to issue a report that will include  recommendations to DOD and the Navy for improving internal controls  over purchase card activity.
Mr. Chairman, Members of the Subcommittee, and Senator Grassley, this  concludes my prepared statement. I would be pleased to respond to any  questions that you may have.
section_title: Contacts and Acknowledgements
paragraphs: For future contacts regarding this testimony, please contact Gregory D.  Kutz at (202) 512-9095. Individuals making key contributions to this  testimony included Wendy Ahmed, Christie Arends, Bertram Berlin, Sharon  Byrd, Francine DelVecchio, Stephen Donahue, Michael Chambless,  Douglas Ferry, Gayle Fischer, Kenneth Hill, Wilfred Holloway, Jeffrey  Jacobson, John Kelly, Richard Larsen, John Ryan, and Sidney Schwartz.
section_title: Background
paragraphs: The Navy’s purchase card program is part of the Governmentwide  Commercial Purchase Card Program, which was established to streamline  federal agency acquisition processes by providing a low-cost, efficient  vehicle for obtaining goods and services directly from vendors. DOD  reported that it used purchase cards for 95 percent of its eligible  transactions—more than 10 million transactions, valued at $5.5 billion—in  fiscal year 2000. The Navy’s reported purchase card activity represented  nearly one third of the reported DOD total during fiscal year 2000—2.7  million transactions, valued at $1.7 billion. According to unaudited DOD  data, SPAWAR and Navy Public Works Center San Diego-based activities  accounted for $68 million (about 15 percent) of the $451 million in fiscal  year 2000 Navy purchase card payments processed by DFAS San Diego.
Although SPAWAR San Diego and the Navy Public Works Center San Diego  are both working capital fund activities, their missions are very different.  SPAWAR San Diego is a highly technical systems operation staffed by  scientists and engineers who provide research, technology, and engineering  support to other Navy programs worldwide. The Navy Public Works Center  San Diego provides maintenance, construction, and operations support to  other Navy programs in the San Diego area.
subsections: section_title: Governmentwide Purchase Card Program Guidelines
paragraphs: Under the Federal Acquisition Streamlining Act of 1994, the Defense  Federal Acquisition Regulation Supplement guidelines, eligible purchases  include (1) micro-purchases (transactions up to $2,500 for which  competitive bids are not needed); (2) purchases for training services up to  $25,000; and (3) payment of items costing over $2,500 that are on the  General Services Administration’s (GSA) pre-approved schedule, including  items on requirements contracts. The streamlined acquisition threshold for  such contract payments is $100,000. Accordingly, cardholders may have  single transaction purchase limits of $2,500 or $25,000, and a few  cardholders may have transaction limits of up to $100,000 or more. Under  the GSA blanket contract, the Navy has contracted with Citibank for its  purchase card services, while the Army and the Air Force have contracted  with U.S. Bank.
The Federal Acquisition Regulation, Part13, “Simplified Acquisition  Procedures,” establishes criteria for using purchase cards to place orders  and make payments. U.S. Treasury regulations issued pursuant to  provisions of law in 31 U.S.C. 3321, 3322, 3325, 3327, and 3335, govern  purchase card payment certification, processing, and disbursement. DOD’s  Purchase Card Joint Program Management Office, which is in the office of  the Assistant Secretary of the Army for Acquisition, Logistics, and  Technology, has established departmentwide policies and procedures  governing the use of purchase cards. The Under Secretary of Defense  (Comptroller) has established related financial management policies and  procedures in various sections of DOD’s Financial Management  Regulation.
section_title: Navy Purchase Card Acquisition And Payment Processes
paragraphs: The Navy Supply Systems Command is responsible for the overall  management of the Navy’s purchase card program, and has published the  Navy Supply Command (NAVSUP) Instruction 4200.94, Department of the  Navy Policies and Procedures for Implementing the Governmentwide  Purchase Card Program. Under the NAVSUP Instruction, each Navy  Command’s head contracting officer authorizes purchase card program  coordinators in local Navy units to obtain purchase cards and establish  credit limits. The program coordinators are responsible for administering  the purchase card program within their designated span of control and  serve as the communication link between Navy units and the purchase card  issuing bank.
subsections: section_title: Designation of Cardholders
paragraphs: When a supervisor requests that a staff member receive a purchase card,  the agency program coordinator is to first provide training on purchase  card policies and procedures and then establish a credit limit and issue a  purchase card to the staff member. The Navy had a total of about 1,700  purchase card program coordinators during fiscal year 2000, including one  program coordinator at SPAWAR San Diego and one at the Navy Public  Works Center San Diego.
section_title: Ordering Goods and Services
paragraphs: Purchase cardholders are delegated contracting officer ordering  responsibilities, but they do not negotiate or manage contracts. SPAWAR  San Diego and Navy Public Works Center San Diego cardholders use  purchase cards to order goods and services for their units as well as their  customers. Cardholders may pick up items ordered directly from the  vendor or request that items be shipped directly to end users (requestors).  Upon receipt of items acquired by purchase cards, cardholders are to  record the transaction in their purchase log and obtain independent  confirmation from the end user, their supervisor, or another individual that  the items have been received and accepted by the government. They are  also to notify the property book officer of accountable items received so  that these items can be recorded in the accountable property records.
section_title: Payment Processing
paragraphs: The purchase card payment process begins with receipt of the monthly  purchase card billing statements. Section 933 of the National Defense  Authorization Act for Fiscal Year 2000, Public Law 106-65, requires DOD to  issue regulations that ensure that purchase card holders and each official  with authority to authorize expenditures charged to the purchase card  reconcile charges with receipts and other supporting documentation.  NAVSUP Instruction 4200.94 states that upon receipt of the individual  cardholder statement, the cardholder has 5 days to reconcile the  transactions appearing on the statement by verifying their accuracy to the  transactions appearing on the statement and notify the approving official in  writing of any discrepancies in the statement. In addition, under the  NAVSUP Instruction, the approving official is responsible for (1) ensuring  that all purchases made by the cardholders within his or her cognizance are  appropriate and that the charges are accurate and (2) the timely  certification of the monthly summary statement for payment by DFAS. The  Instruction further states that within 5 days of receipt, the approving  official must review and certify for payment the monthly billing statement,  which is a summary invoice of all transactions of the cardholders under the  approving official’s purview. The approving official is to presume that all  transactions on the monthly statements are proper unless notified in  writing by the purchase cardholder. However, the presumption does not  relieve the approving official from reviewing for blatant improper purchase  card transactions and taking the appropriate action prior to certifying the  invoice for payment. In addition, the approving official is to forward  disputed charge forms to the unit’s comptroller’s office for submission to  Citibank for credit. Under the Navy’s contract, Citibank allows the Navy up  to 60 days after the statement date to dispute invalid transactions and  request a credit.
Upon receipt of the certified monthly purchase card summary statement, a  DFAS vendor payment clerk is to (1) review the statement and supporting  documents to confirm that the prompt payment certification form has been  properly completed and (2) subject it to automated and manual validations.  The purpose of the automated validation is to confirm that a SPAWAR or a  Navy Public Works Center obligation for a purchase card invoice has been  recorded in their respective cost accounting systems in an amount  sufficient to cover the payment. Quality control clerks manually verify that  purchase card statement and payment data were correctly entered in the  Navy’s vendor payment (disbursing) system—STARS 1-Pay. Once the  payment has passed these validation tests, the quality control supervisor  authorizes the statement for payment. The DFAS vendor payment system  then batches all of the certified purchase card payments for that day,  generates a tape for payment by electronic funds transfer to the purchase  card bank, and sends the file to the accounting station for recording the  payment as a summary record in the Navy’s accounting system. Figure 1  illustrates the current purchase card payment process used by SPAWAR  and the Naval Public Works Center in San Diego.
The Navy earns purchase card rebate revenue from Citibank of up to 0.8  percent based on sales volume (purchases) and payment timeliness.  According to the DOD Deputy Director of DOD’s Purchase Card Joint  Program Management Office, rebate revenue is generally to be recorded to  the purchase card statements and used to offset monthly charges.
section_title: San Diego Related Fraud Cases Investigated by NCIS
paragraphs: Pursuant to Senator Grassley’s request, we identified five fraud cases  related to Navy programs based in the San Diego, California, area and  investigated by the Naval Criminal Investigative Service (NCIS).  All of  these cases can be linked to the types of internal control weaknesses  discussed in this testimony.  Of these five cases, two involved Navy Public  Works Center San Diego employees and one involved 2,600 compromised  purchase card accounts, including 22 currently active SPAWAR San Diego  accounts.  One of the remaining cases, which has been concluded, was  related to a fraud that occurred at the Navy’s Millington (Tennessee) Flying  Club—an activity of the Navy Morale, Welfare, and Recreation entity, which  is based in San Diego.  The other case involved a military officer and other  service members who were assigned to the Marine Corps Station in  Miramar, near San Diego.
subsections: section_title: Case #1
paragraphs: The first San Diego-related purchase card fraud case is an example of the  lack of segregation of duties.  This case involved the cardholder at the  Navy’s Millington (Tennessee) Flying Club, an entity of the U.S. Navy’s  Morale, Welfare, and Recreation activity, which is based in San Diego,  California.  The cardholder, who was having financial problems, was hired  by her stepfather, who was the club’s treasurer.  The stepfather delegated  nearly all purchase card duties to the cardholder, as well as the authority  for writing checks to pay the Flying Club’s monthly purchase card  statements.  The cardholder made over $17,000 in fraudulent transactions  to acquire personal items from Wal-Mart, The Home Depot, shoe stores, pet  stores, boutiques, an eye care center, and restaurants over an 8-month  period from December 1998 through July 1999.  The fraud was identified  when the club’s checking account was overdrawn due to excessively high  purchase card payments and a bank official contacted the president of the  Flying Club.  The cardholder pleaded guilty and was sentenced to 15  months in jail and assessed about $28,486 in restitution due to purchase  card fraud and bounced checks. The defendant commented that illegal use  of the card was “too easy” and that she was the sole authorizer of the card  purchases.
section_title: Case #2
paragraphs: The second case involved a military officer and other service members who  were assigned to the Marine Corps Station in Miramar, near San Diego,  California.  This alleged fraud occurred through collusion, and internal  controls will not prevent collusion.  However, adequate monitoring of  purchase card transactions along with enforcing controls such as  documentation of independent confirmation of receipt and acceptance and  recording accountable items in property records would have made  detection easier.  In this instance, the military officer allegedly conspired  with cardholders under his supervision to make nearly $400,000 in  fraudulent purchases from five companies—two that he owned, one owned  by his sister, and the other two owned by friends or acquaintances.   They  charged thousands of dollars for items such as DVD players, Palm Pilots,  and desktop and laptop computers.  The officer also allegedly made cash  payments to employees to keep silent about the fraud and provided  auditors with falsified purchase authorizations and invoices to cover the  fraud.  The fraud occurred from June 1999 through September 2000.  The  total amount of the alleged fraud is unknown. The alleged fraud was  identified based on a tip from a service member.  The U.S. Attorney’s Office  in San Diego has accepted the case for prosecution and four other active  service members are under investigation.
section_title: Case #3
paragraphs: The third case involved a Navy Public Works Center San Diego  maintenance/construction supervisor who allegedly made at least $52,000  in fraudulent transactions to a suspect contractor on work orders for which  the work was not performed by that contractor. Adequate monitoring of  purchase card transactions along with enforcing controls such as  independent, documented receipt and acceptance and recording  accountable items in property books would have made detection easier.  Navy investigators believe that the employee also may have used his  government purchase card to make unauthorized purchases for personal  use, including jewelry, an air conditioner, and other personal items from  The Home Depot from April 1997 through October 1998.  The total amount  of this alleged purchase card fraud is unknown. The alleged fraud was  identified when the employee’s supervisor reviewed Navy Public Works  Center work orders and noticed that four work orders totaling  approximately $7,000 were completed by the employee and paid for with  the suspect’s government purchase card.  Further inquiry by the supervisor  revealed that Navy Public Works Center employees, not the contractor, had  completed the work.  NCIS investigators and Naval Audit Service auditors  identified approximately $52,000 in purchase card transactions made by  the employee to a suspect contractor for work that was performed by  either the Public Works Center or other legitimate contractors.  The  employee has resigned and an investigation by the Federal Bureau of  Investigation and NCIS is ongoing. The U.S. Attorney’s Office in San Diego  has accepted the case for prosecution.
section_title: Case #4
paragraphs: The fourth case involved a Navy Public Works Center San Diego purchasing  agent that allegedly made at least $12,000 in fraudulent purchases and  planned to submit approximately $103,000 in fraudulent disputed charge  forms, including payments for hotels, airline tickets, computers, phone  cards, and personal items from The Home Depot.  The alleged fraud  occurred from April 1997 through July 1999.  As with the other cases,  adequate monitoring of purchase card transactions along with enforcing  controls such as independent, documented receipt and acceptance and  recording accountable items in property books would have made detection  easier.  The alleged fraud was identified during an investigation of a  possible bribery/kickback scheme.  The employee has resigned and an  NCIS investigation is ongoing.  The U.S. Attorney’s Office in San Diego has  accepted the case for prosecution.
section_title: Case #5
paragraphs: The fifth Navy purchase card fraud case is ongoing and involves the  compromise of up to 2,600 purchase card accounts assigned to Navy  activities in the San Diego area.  Investigators were only able to obtain a  partial list consisting of 681 compromised accounts so the exact number is  not known.  At least 45 of the compromised accounts were for SPAWAR  San Diego and one of the compromised accounts was for the Navy Public  Works Center in San Diego.  Of these 46 compromised accounts, 22  SPAWAR San Diego accounts were still active in May 2001.  None of the  active accounts on the partial listing found by investigators were for the  Navy Public Works Center San Diego.  Although the account numbers  showed up on a computer printer in a community college library in San  Diego in September 1999, the Navy has not canceled all of the  compromised accounts.  Instead, according to NCIS and Navy Supply  Command officials, the Navy is canceling the compromised accounts as  fraudulent transactions are identified.  Naval Supply Systems Command,  SPAWAR San Diego, and Navy Public Works Center San Diego officials told  us that they were aware of this incident but did not have a listing of the  account numbers affected.  As a result, the Navy did not take any measures  to flag the compromised accounts and implement special monitoring  procedures to detect any potential fraudulent use of these accounts.
According to Navy investigators, as of January 2001, at least 30 of the  compromised account numbers had been used by 27 alleged suspects to  make more than $27,000 in fraudulent transactions for pizza, jewelry, phone  calls, tires, and flowers.  As of May 21, 2001, 22 of the compromised  SPAWAR accounts were still active.  Our review of the monthly credit limits  associated with the 22 compromised accounts showed that SPAWAR  continued to have an aggregate monthly financial exposure of $900,000  associated with these accounts nearly 2 years after the compromised list  was discovered in a San Diego community college library in September  1999.  Further, with the lack of controls over receipt of goods and  certification of purchase card statements that we identified at the two  activities we reviewed, it is impossible for the Navy to identify fraudulent  purchases as they occur or to determine the extent of the fraudulent use of  the compromised accounts.  As a result, when fraudulent use of one of the  comprised accounts was identified, the Navy could not determine if the  incident was due to cardholder fraud or use of the compromised account  by an outside party.  A joint task force in San Diego, comprised of NCIS, the  U.S. Secret Service, local police, and the U.S. Attorney’s Office, investigated  this fraud.  The task force investigators recently traced the list of  compromised accounts to a vendor used by the Navy, which acknowledged  that the list came from its database.  The vendor identified two former  employees as possible suspects.
section_title: Objectives, Scope, and Methodology
paragraphs: Pursuant to Senator Grassley’s request, we obtained and reviewed  information on five fraud cases related to Navy purchase card programs in  the San Diego, California, area and to review purchase card controls and  accounting for two Navy units based in San Diego—the Space and Naval  Warfare Systems Command (SPAWAR) Systems Center and the Navy  Public Works Center. Our assessment of SPAWAR San Diego and the Navy  Public Works Center San Diego purchase card controls covered   the overall management control environment, including (1) span of  control issues related to the number of cardholders, (2) training for  cardholders and accountable officers, (3) management of rebates, and  (4) monitoring and audit of purchase card activity;  tests of statistical samples of key controls over purchase card  transactions, including (1) documentation of independent confirmation  that items ordered by purchase card were received, (2) proper  certification of purchase card statements for payment, and (3) proper  accounting for purchase card transactions;   substantive tests of accountable items in our sample transactions to  verify whether they were recorded in property records and whether they  could be found; and   analysis of the universe of transactions to identify (1) any potentially  improper, fraudulent, and abusive transactions and (2) purchases that  were split into one or more transactions to avoid micro-purchase  thresholds or other credit limits.
We used as our primary criteria applicable laws and regulations; our  Standards for Internal Control in the Federal Government; and our  Guide for Evaluating and Testing Controls Over Sensitive Payments. To  assess the management control environment, we applied the fundamental  concepts and standards in the GAO internal control standards to the  practices followed by management in the four areas reviewed.
To test controls, we selected stratified random probability samples of 135  SPAWAR San Diego purchase card transactions from a population of 47,035  transactions totaling $38,357,656, and 121 Navy Public Works Center San  Diego transactions from a population of 53,026 transactions totaling  $29,824,160 that were recorded by the Navy during fiscal year 2000. We  stratified the samples into two groups—transactions from computer  vendors and other vendors. With this statistically valid probability sample,  each transaction in the population had a nonzero probability of being  included, and that probability could be computed for any transaction. Each  sample element was subsequently weighted in the analysis to account  statistically for all the transactions in the population, including those that  were not selected. Table 7 presents our test results on three key  transaction-level controls and shows the confidence intervals for the  estimates for the universes of fiscal year 2000 purchase card transactions  made by SPAWAR and the Navy Public Works Center in San Diego.
Our analytical reviews covered the universe of fiscal year 2000 purchase  card transactions for the two units’ San Diego-based activities covered  about 47,000 transactions totaling about $38 million at SPAWAR San Diego  and about 53,000 transactions totaling about $30 million at the Navy Public  Works Center San Diego. For these reviews, we did not look for all  potential abuses of purchase cards. For example, because a large number  of store receipts (such as those from The Home Depot) were missing, we  were unable to determine whether certain purchases were made for  personal use. In addition, we did not physically examine purchases made to  determine whether goods and services were received and used for  government purposes. While we identified some improper and potentially  fraudulent and abusive transactions, our work was not designed to identify,  and we cannot determine, the extent of fraudulent, improper, or abusive  transactions.
We briefed DOD managers, including officials in DOD’s Purchase Card  Joint Program Management Office and the Defense Finance and  Accounting Service, and Navy managers, including Navy Supply Command,  Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San  Diego officials on the details of our review, including our objectives, scope,  and methodology and our findings and conclusions. We conducted our  audit work from August 2000 through June 2001 in accordance with  generally accepted government auditing standards, and we performed our  investigative work in accordance with standards prescribed by the  President’s Council on Integrity and Efficiency. Following this testimony,  we plan to issue a report, which will include recommendations to DOD and  the Navy for improving internal controls over purchase card activity.
subsections: section_title: Orders by Internet:
section_title: To Report Fraud, Waste, or Abuse in Federal Programs
paragraphs: Web site: http://www.gao.gov/fraudnet/fraudnet.htm  e-mail: fraudnet@gao.gov  1-800-424-5454 (automated answering system)