Government Purchase Cards: Control Weaknesses Expose Agencies to Fraud and Abuse
Published: 2002-05-01T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: The use of government purchase cards has increased in recent years as agencies have sought to eliminate the bureaucracy and paperwork long associated with small purchases. At the same time, agencies need to have adequate internal controls in place to protect the government from waste, fraud, and abuse. GAO found significant internal control weaknesses in agency purchase card programs, including inadequate review and approval processes, a lack of training for both cardholders and approving officials, and poor monitoring. This lax environment allowed cardholders to make fraudulent, improper, abusive, and questionable purchases. Weak controls also resulted in lost, missing, or misused government property.

section_title: Letter
paragraphs: I am pleased to be here today to provide an overview of our reviews of the  government purchase card programs at two federal agencies and how the  control weaknesses we have identified made these agencies vulnerable to  improper or questionable purchases.  At the outset, I want to make clear  our support in concept for the purchase card program.  The use of  purchase cards has dramatically increased in past years as agencies have  sought to eliminate the bureaucracy and paperwork long associated with  making small purchases.  The benefits of using purchase cards are lower  costs and less red tape for both the government and the vendor community.
At the same time, given the nature, scale, and increasing use of purchase  cards, it is important that agencies have adequate internal controls in place  to help ensure proper use of purchase cards and thus to protect the  government from waste, fraud, and abuse.  Our audits to date have  identified serious internal control weaknesses.  In the past year, we have  found improper and fraudulent use of purchase cards at two Navy units  reviewed and at the Department of Education.  In addition, a number of  Inspectors General (IG) have identified and reported on control  weaknesses in the purchase card programs at their agencies, including the  Departments of Agriculture, the Interior, and Transportation.
Government purchase cards, a type of credit card, are available to agencies  as part of the Governmentwide Commercial Purchase Card Program,  which was established to streamline federal agency acquisition processes  by providing a low-cost, efficient vehicle for obtaining goods and services  directly from vendors.  The Federal Acquisition Regulation, Part 13,  “Simplified Acquisition Procedures,” establishes criteria for using purchase  cards to place orders and make payments.  The Department of the Treasury  requires agencies to establish approved uses of the purchase card and to  set spending limits.  According to the General Services Administration  (GSA), which administers the governmentwide contract for this program,  in fiscal year 2001, over 400,000 cardholders in about 60 agencies made  purchases totaling about $13.8 billion.  Given this widespread usage, you  asked us to provide an overview of internal control weaknesses we have  found in our reviews of purchase card programs at two Navy units and the  Department of Education and improvements needed to correct these  weaknesses.
In order to respond to your request, we reviewed our previous reports and  testimonies in this area, as well as reports issued by various IGs.  In our  purchase card program reviews, we assessed the internal controls over two  Navy units’ and the Department of Education’s purchase card programs  and used forensic auditing techniques, such as database searches, file  comparisons, and other detailed analyses to identify unusual transactions  and payment patterns.
As you know, internal controls serve as the first line of defense in  safeguarding assets and in preventing and detecting fraud, abuse, and  errors.  Heads of agencies are required to establish a system of internal  control consistent with our Standards for Internal Control in the Federal  Government.  My testimony today discusses some of the common control  weaknesses we and the IGs have identified in agency purchase card  programs, including weaknesses in the review and approval processes, lack  of training for cardholders and approving officials, and ineffective  monitoring.  These weaknesses created a lax control environment that  allowed cardholders to make fraudulent, improper, abusive, and  questionable purchases.  Weak controls also resulted or contributed to lost,  missing, or misused government property.  I will now describe some of the  problems we found and then provide specific examples of improper  payments we and various IGs identified.  I will also lay out some of the key  recommendations we and the IGs have made to address these problems.
subsections: section_title: Inadequate Review and Approval Processes
paragraphs: According to our Standards for Internal Control in the Federal  Government, transactions and other significant events should be  authorized and executed only by persons acting within the scope of their  authority.  Although review of transactions by persons in authority is the  principal means of assuring that transactions are valid, we found that the  review and approval process for purchase card purchases was inadequate  in all the agencies reviewed.
At the Department of Education, we found that 10 of its 14 offices did not  require cardholders to obtain authorization prior to making some or all  purchases, although Education’s policy required that all requests to  purchase items over $1,000 be made in writing to the applicable  department executive officer.  We also found that approving officials did  not use monitoring reports that were available from Bank of America to  identify unusual or unauthorized purchases.
Additionally, Education’s 1990 purchase card policy, which was in effect  during the time of our review (May 1998 through September 2000), stated  that an approving official was to ensure that all purchase card transactions  were for authorized Education purchases and in accordance with  departmental and other federal regulations.  The approving official  signified that a cardholder’s purchases were appropriate by reviewing and  signing monthly statements.  To test the effectiveness of Education’s  approving officials’ review, we analyzed 5 months of cardholder statements  and found that 37 percent of the 903 monthly cardholder statements we  reviewed were not approved by the appropriate official.  The unapproved  statements totaled about $1.8 million.  Further, we found that Education  employees purchased computers using their purchase cards, which was a  violation of Education’s policy prohibiting the use of purchase cards for  this purpose.  As I will discuss later, several of the computers that were  purchased with purchase cards were not entered in property records, and  we could not locate them.  If approving officials had been conducting a  proper review of monthly statements, the computer purchases could have  been identified and the practice halted, perhaps eliminating this computer  accountability problem.  Education implemented a new approval process  during our review.  We assessed this new process and found that while  approving officials were generally reviewing cardholder statements, those  officials were not ensuring that adequate supporting documentation  existed for all purchases.
Weaknesses in the approval process also existed at the two Navy units we  reviewed.  During our initial review, approving officials in these two units  told us that they did not review support for transactions before certifying  monthly statements for payment because (1) they did not have time and (2)  Navy policy did not specifically require that approving officials review  support.  At one of the Navy units, one approving official was responsible  for certifying summary billing statements covering an average of over 700  monthly statements for 1,153 cardholders.  Further, Navy’s policy allows  the approving official to presume that all transactions are proper unless  notified to the contrary by the cardholder.  The policy appears to  improperly assign certifying officer accountability to cardholders and is  inconsistent with Department of Defense regulations, which state that  certifying officers are responsible for assuring that payments are proper.
During our follow-up review, we found that throughout fiscal year 2001,  approving officials in the two units still did not properly review and certify  the monthly purchase card statements for payment.  Although the  Department of Defense Purchase Card Program Management Office issued  new guidance in July 2001 that would reduce the number of cardholders for  which each approving official was responsible, neither of the two units met  the suggested ratio of five to seven cardholders to one approving official  until well after the start of fiscal year 2002.  Further, the Department of  Defense agreed with our recommendation that Navy revise its policy to  assure that approving officials review the monthly statements and the  supporting documentation prior to certifying the statements for payment.   However, for the last quarter of fiscal year 2001, one of the Navy units  continued to inappropriately certify purchase card statements for payment.   The other unit issued local guidance that partially implements our  recommendation.
IGs at the Departments of Agriculture, the Interior, and Transportation also  identified weaknesses in the review and approval processes at these  agencies.  For example, Agriculture’s IG reported that the department has  not effectively implemented an oversight tool in its Purchase Card  Management System (PCMS), the system that processes purchase card  transactions.  This tool is an alert system that monitors the database for  pre-established conditions that may indicate potential abuse by  cardholders.  Responsible officials are to periodically access their alert  messages and review the details for questionable transactions.  These  reviewing officials should contact cardholders, if necessary, so that  cardholders can verify any discrepancies or provide any additional  information in order to resolve individual alert messages.  In order to close  out alert messages, reviewers must change the message status to “read”  and explain any necessary details to resolve the alerts.  According to  Agriculture’s IG, only about 29,600 out of 50,500 alerts in the database  during fiscal years 1999 and 2000 had been read as of January 9, 2001, and  only about 6,100 of the alerts that were read contained responses.  The  inconsistent use of this oversight tool means that Agriculture management  has reduced assurance that errors and abuse are promptly detected and  that cardholders are complying with purchase card and procurement  regulations.
Interior’s IG reported that it reviewed the work of 53 reviewing officials and  found that 42 of them performed inadequate reviews.  The IG defined an  adequate review as one in which the reviewing official, on a monthly basis,  reconciled invoices and receipts to the purchase card statements to ensure  that all transactions were legitimate and necessary.  The IG found that  several reviewing officials signed off on monthly statements indicating  completed reviews where supporting documentation was not available.
section_title: Lack of Training
paragraphs: Another common internal control weakness we identified was lack of or  inadequate training related to the use of purchase cards.  Our Standards  for Internal Control in the Federal Government emphasize that effective  management of an organization’s workforce—its human capital—is  essential to achieving results and is an important part of internal control.
Training is key to ensuring that the workforce has the skills necessary to  achieve organizational goals.  Lack of or inadequate training contributed to  the weak control environments at several agencies.
Navy’s policies required that all cardholders and approving officials must  receive initial purchase card training and refresher training every 2 years.   We determined that the two Navy units lacked documentation to  demonstrate that all cardholders and approving officials had received the  required training.  We tested $68 million of fiscal year 2000 purchase card  transactions at the two Navy units and estimated that at least $17.7 million  of transactions were made by cardholders for whom there was no  documented evidence they had received either the required initial training  or refresher training on purchase card policies and procedures.  Although  we found during our follow-up work that the two Navy units had taken  steps to ensure cardholders receive training and to document the training,  many cardholders at one of the units still had not completed the initial  training or the required refresher training.  Similarly, at Education, we  found that although the policy required each cardholder and approving  officials to receive training on their respective responsibilities, several  cardholders and at least one approving official were not trained.
Interior’s IG also reported a lack of training related to the purchase card  program.  Specifically, the IG reported that although Interior provided  training to individual cardholders, it did not design or provide training to  reviewing officials.  According to the IG, several reviewing officials said  that they did not know how to conduct a review of purchase card  transactions, nor did they understand how and why to review supporting  documentation.  As previously mentioned, the IG found that many  reviewing officials were not performing adequate reviews.
section_title: Ineffective Monitoring
paragraphs: Our Standards for Internal Control in the Federal Government state that  internal control should generally be designed to assure that ongoing  monitoring occurs in the course of normal operations.  Internal control  monitoring should assess the quality of performance over time and ensure  that findings of audits and other reviews are promptly resolved.  Program  and operational managers should monitor the effectiveness of control  activities as part of their regular duties.
At the two Navy units we reviewed, we found that management had not  established an effective monitoring and internal audit function for the  purchase card program.  The policies and procedures did not require that  the results of internal reviews be documented or that corrective actions be  monitored to help ensure they are effectively implemented.  The NAVSUP  Instruction calls for semiannual reviews of purchase card programs,  including adherence to internal operating procedures, applicable training  requirements, micro-purchase procedures, receipt and acceptance  procedures, and statement certification and prompt payment procedures.   These reviews are to serve as a basis for initiating appropriate action to  improve the program and correct problem areas.
Our analysis of fiscal year 2000 agency program coordinator reviews at one  of the Navy units showed that the reviews identified problems with about  42 percent of the monthly cardholder statements that were reviewed.  The  problems identified were consistent with the control weaknesses we  found.  Unit management considered the findings but directed that  corrective actions not be implemented because of complaints about the  administrative burden associated with the procedural changes that would  be needed to address the review findings. These reviews generally resulted  in the reviewer counseling the cardholders or in some instances,  recommending that cardholders attend purchase card training.  As a result,  the agency program coordinator had not used the reviews to make  systematic improvements in the program.  During our follow-up work, we  noted that this unit had recently made some efforts to implement new  policies directed at improving internal review and oversight activities.   However, these efforts are not yet complete.
At the time of our review, Education did not have a monitoring system in  place for purchase card activity.  However, in December 2001, the  department issued new policies and procedures that, among other things,  establish a quarterly quality review of a sample of purchase card  transactions to ensure compliance with key aspects of the department’s  policy.
Transportation’s IG reported that the Federal Aviation Administration  (FAA) had not performed required internal follow-up reviews on purchase  card usage since 1998.  A follow-up review is to consist of an independent  official (other than the approving official) reviewing a sample of purchase  card transactions to determine whether purchases were authorized and  that cardholders and approving officials followed policies and procedures.
The types of weaknesses that I have just described create an environment  where improper purchases could be made with little risk of detection.  I  will now provide a few examples of how employees used their purchase  cards to make fraudulent, improper, abusive, and questionable purchases.   We also found that property purchased with the purchase cards was not  always recorded in agencies’ property records, which could have  contributed to missing or stolen property.
section_title: Poor Controls Resulted in Fraudulent, Improper, Abusive, and Questionable Purchases
paragraphs: In a number of cases, the significant control weaknesses that we and the  IGs identified resulted in or contributed to fraudulent, improper, abusive,  and questionable purchases.  We considered fraudulent purchases to be  those that were unauthorized and intended for personal use.  Improper  purchases included those for government use that were not, or did not  appear to be, for a purpose permitted by law or regulation.  We defined  abusive or questionable transactions as those that, while authorized, were  for items purchased at an excessive cost, for a questionable government  need, or both.  Questionable purchases also include those for which there  was insufficient documentation to determine whether they were valid.
For example, at Education, we found an instance in which a cardholder  made several fraudulent purchases from two Internet sites for  pornographic services.  The name of one of the sites—Slave Labor  Productions.com—should have caused suspicion when it appeared on the  employee’s monthly statement.  We obtained the statements containing the  charges and noted that they contained handwritten notes next to the  pornography charges indicating that these were charges for transparencies  and other nondescript items.  According to the approving official, he was  not aware of the cardholder’s day-to-day responsibilities, and therefore,  could not properly review the statements.  The approving official stated  that the primary focus of his review was to ensure there was enough money  available in that particular appropriation to pay the bill.  As a result of  investigations related to these pornography purchases, Education  management issued a termination letter, prompting the employee to resign.
We also identified questionable charges by an Education employee totaling  $35,760 over several years for herself and a coworker to attend college.   Some of the classes the employees took were apparently prerequisites to  obtain a liberal arts degree, but were unrelated to Education’s mission.  The  classes included biology, music, and theology, and represented $11,700 of  the $35,760.  These classes costing $11,700 were improper charges.  The  Government Employees Training Act, 5 U.S.C. 4103 and 4107, requires that  training be related to an employee’s job and prohibits expenditures to  obtain a college degree unless necessitated by retention or recruitment  needs, which was not the case here.  We also identified as questionable  purchases totaling more than $152,000 for which Education could not  provide any support and did not know specifically what was purchased,  why it was purchased, or whether these purchases were appropriate.
The breakdown of controls at the two Navy units we reviewed made it  difficult to detect and prevent fraudulent purchases made by cardholders.   We identified over $11,000 of fraudulent purchases including gifts, gift  certificates, and clothing from Macy’s West, Nordstrom, Mervins, Lees  Men’s Wear, and Footlocker, and a computer and related equipment from  Circuit City.
During our follow-up work, we also identified a number of improper,  questionable, and abusive purchases at the Navy units, including food for  employees costing $8,500; rentals of luxury cars costing $7,028; designer  and high-cost leather briefcases, totes, portfolios, day planners, palm pilot  cases, wallets, and purses from Louis Vuitton and Franklin Covey costing  $33,054; and questionable contractor payments totaling $164,143.
The designer and high-cost leather goods from Franklin Covey included  leather purses costing up to $195 each and portfolios costing up to $135  each.  Many of these purchases were of a questionable government need  and should have been paid for by the individual.  To the extent the day  planners and calendar refills were proper government purchases, they  were at an excessive cost and should have been purchased from certified  nonprofit agencies under a program that is intended to provide  employment opportunities for thousands of people with disabilities.   Circumventing the requirements to buy from these nonprofit agencies and  purchasing these items from commercial vendors is not only an abuse and  waste of taxpayer dollars, but shows particularly poor judgment and  serious internal control weaknesses.
The contractor payments in question were 75 purchase card transactions  with a telecommunications contractor that appeared to be advance  payments for electrical engineering services.  Paying for goods and services  before the government has received them (with limited exceptions) is  prohibited by law and Navy purchase card procedures.  Navy employees  told us the purchase card was used to expedite the procurement of goods  and services from the contractor because the preparation, approval, and  issuance of a delivery order was too time-consuming in certain  circumstances.  For all 75 transactions, we found that the contractor’s  estimated costs were almost always equal or close to the $2,500 micro- purchase threshold.  Because we found no documentation of independent  receipt and acceptance of the services provided or any documentation that  the work for these charges was performed, these charges are potentially  fraudulent, and we have referred them to our Office of Special  Investigations for further investigation.
IGs also identified fraudulent purchases.  The Transportation Department’s  IG reported on two cases involving employees’ fraudulent use of their  purchase cards.  In one case, a cardholder used a government purchase  card to buy computer software and other items costing over $80,000 for a  personal business.  In the other case, a cardholder made numerous  unauthorized charges totaling more than $58,000, including a home stereo  system and a new engine for his car.  Additionally, Interior’s IG identified  fraudulent purchases such as payments for monthly rent and phone bills,  household furnishings, jewelry, and repairs to personal vehicles.
One type of improper purchase we identified is the “split purchase,” which  we defined as purchases made on the same day from the same vendor that  appear to circumvent single purchase limits.  The Federal Acquisition  Regulation prohibits splitting a transaction into more than one segment to  avoid the requirement to obtain competitive bids for purchases over the  $2,500 micro-purchase threshold or to avoid other established credit limits.   For example, one cardholder from Education purchased two computers  from the same vendor at essentially the same time.  Because the total cost  of these computers exceeded the cardholder’s $2,500 single purchase limit,  the total of $4,184.90 was split into two purchases of $2,092.45 each.  We  found 27 additional purchases totaling almost $120,000 where Education  employees made multiple purchases from a vendor on the same day.
Similarly, our analysis of purchase card payments at the two Navy units  identified a number of purchases from the same vendor on the same day.   To determine whether these were, in fact, split purchases, we obtained and  analyzed supporting documentation for 40 fiscal year 2000 purchases at the  two Navy units.  We found that in many instances, cardholders made  multiple purchases from the same vendor within a few minutes or a few  hours for items such as computers, computer-related equipment, and  software, that involved the same, or sequential or nearly sequential  purchase order and vendor invoice numbers.  Based on our analysis, we  concluded that 32 of the 40 purchases were split into two or more  transactions to avoid the micro-purchase threshold.  During our follow-up  work, we found that 23 of 50 fiscal year 2001 purchases by the two Navy  units were split into two or more transactions to avoid the micro-purchase  threshold.
Split purchases were also identified by the IGs at the Departments of  Agriculture and Transportation.  For example, Agriculture’s IG reported  that it investigated two employees who intentionally made multiple  purchases of computer equipment with the same merchant in amounts  exceeding their established single purchase limits.  During 3 different  months, these employees purchased computer systems totaling $121,123 by  structuring their individual purchases of components in amounts less than  the individual single purchase limit of $2,500.  In September 1999, a  computer procurement totaling $47,475 was made using 20 individual  purchase card transactions during a 4-day period.  Other computer  purchases were made in November 1999 involving 15 purchase card  transactions over a 3-day period totaling $36,418 and in June 2000 involving  15 individual transactions over a 5-day period totaling $37,230.  The IG  reported that these procurements should have been made by a warranted  contracting officer.  Similarly, Transportation’s IG reported that it identified  13 transactions totaling about $106,000 that violated the department’s  policies against splitting purchases.
section_title: Missing Property
paragraphs: Another problem we and the IGs identified is that some property purchased  with purchase cards was not entered in agency property records.   According to our Standards for Internal Control in the Federal  Government, an agency must establish physical control to secure and  safeguard vulnerable assets.  Such assets should be periodically counted  and compared to control records.  Recording the items purchased in  property records is an important step to ensure accountability and financial  control over these assets and, along with periodic inventory counts, to  prevent theft or improper use of government property.  At Education and  the Navy units, we identified numerous purchases of computers and  computer-related equipment, cameras, and palm pilots that were not  recorded in property records and for which the agencies could not provide  conclusive evidence that the items were in possession of the federal  government.
For example, the lack of controls at Education contributed to the loss of  179 pieces of computer equipment costing over $200,000.  We compared  serial numbers obtained from a vendor where the computers were  purchased to those in the department’s asset management system and  found that 384 pieces of computer equipment were not listed in the  property records.  We conducted an unannounced inventory to determine  whether the equipment was actually missing or inadvertently omitted from  the property records.  We found 205 pieces of equipment.  Education  officials have been unable to locate the remaining 179 pieces of missing  equipment.  They surmised that some of these items may have been  surplused; however, there is no documentation to determine whether this  assertion is valid.
At the Navy units, our initial analysis showed that the Navy did not record  46 of 65 sampled items in their property records.  When we asked to inspect  these items, the Navy units could not provide conclusive evidence that 31  of them—including laptop computers, palm pilots, and digital cameras— were in the possession of the government.  For example, for 4 items, the  serial numbers of the property we were shown did not match purchase or  manufacturer documentation.  In addition, we were told that 5 items were  at other Navy locations throughout the world.  Navy officials were unable  to conclusively demonstrate the existence and location of these 5 items.   We were unable to conclude whether any of these 31 pieces of government  property were stolen, lost, or being misused.
We and the IGs have made recommendations to the various agencies that, if  fully implemented, will help improve internal controls over the purchase  card programs so that fraudulent and improper payments can be prevented  or detected in the future and vulnerable assets can be better protected.   These recommendations include (1) emphasizing policies on appropriate  use of the purchase card and cardholder and approving official  responsibilities, (2) ensuring that approving officials are trained on how to  perform their responsibilities, and (3) ensuring that approving officials  review purchases and their supporting documentation before certifying the  statements for payment.  Agencies have taken actions to respond to the  recommendations made.  However, during our follow-up work at  Education and the Navy units, we found that weaknesses remain that  continue to leave them vulnerable to fraudulent and improper payments  and lost assets.  Management’s ongoing commitment to improving internal  controls is necessary to minimize this vulnerability.