Government Purchase Cards: Little Evidence of Potential Fraud Found in Small Purchases, but Documentation Issues Exist
Published: 2017-02-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: For fiscal year 2014, the most recently available data at the time of GAO's review, the federal government spent $8.7 billion in micropurchases using purchase cards. In its last government-wide review of the program in 2008, GAO found that internal control weaknesses in agency purchase card programs left the government vulnerable to fraud, waste, and abuse. GAO was asked to review purchase card micropurchases to determine whether weaknesses still exist.
GAO examined (1) what actions GSA and OMB have taken since 2008 to enhance program controls over micropurchases and (2) whether weaknesses exist in the approval process for them and, if so, whether there are indicators of improper or potentially fraudulent purchases. GAO analyzed purchase card policies and guidance issued by OMB and GSA; obtained purchase card data on fiscal year 2014 transactions; tested three elements of the approval process through a generalizable random, stratified sample of 300 transactions from a population of over 17 million across the government; and conducted targeted data mining for improper or potentially fraudulent purchases.
section_title: What GAO Found
paragraphs: Since 2008, the General Services Administration (GSA) and the Office of Management and Budget (OMB) have taken several steps, in part to address prior GAO recommendations, to enhance purchase card program controls over micropurchases, which are currently capped at $3,500 for most purchases. These steps include developing training, monitoring tools, and guidance. For example, according to OMB guidance, a cardholder should maintain documentation to minimize risk of erroneous and improper purchases, including documentation of the purchase request and preapproval for self-generated purchases.
GAO's government-wide review found some weaknesses in the approval process for micropurchases due to inadequate documentation. Specifically, in its sample, GAO found that 22 percent of transactions government-wide did not have complete documentation to substantiate the transactions' approval process. Additionally, GAO estimated that 23 percent of Department of Defense (DOD) transactions and 13 percent of Department of Veterans Affairs (VA) transactions had incomplete documentation. Together, DOD and VA accounted for about two-thirds of all micropurchase spending in fiscal year 2014.
GAO's government-wide review and targeted data mining of selected categories for potentially improper purchases found little evidence of improper or potentially fraudulent purchases among micropurchase transactions. However, incomplete documentation increases the risk that fraud, charge card misuse, and other abusive activity could occur without detection. One agency, the Department of the Interior (DOI), granted blanket purchase authority for cardholders for most transactions under the micropurchase limit, and therefore did not require any documentation of the purchase request or preapproval. This blanket authority may increase the risk that fraudulent, improper, and other abusive activity could occur. Following OMB guidance for documentation can help reduce such risks.
section_title: What GAO Recommends
paragraphs: GAO recommends that GSA reemphasize OMB guidance to obtain and retain complete documentation of micropurchases, and that DOI require cardholders to document purchase request and preapproval for self-generated purchases. GSA concurred with GAO's recommendation. DOI partially agreed, noting potential challenges with requiring preapproval. GAO still believes this recommendation is valid.

section_title: Letter
paragraphs: The government purchase card program was created in the late 1980s as  a way for federal agencies to streamline the acquisition process by  providing a low-cost, efficient way to obtain goods and services directly  from vendors. In fiscal year 2014, federal agencies used purchase cards  to procure over $17 billion of goods and services through millions of  individual purchases. The majority of these transactions were for  purchases that were within the micropurchase dollar threshold, currently  set at $3,500 for most purchases.
The General Services Administration (GSA), the Office of Management  and Budget (OMB), and individual federal agencies all hold some  responsibility for the purchase card program. GSA administers the federal  government’s purchase card program and maintains contracts with three private banks that issue purchase cards. OMB is responsible for issuing  government-wide policy on purchase card use. Individual agencies decide  which bank to use to support their purchase card requirements and are  responsible for monitoring the actions of their cardholders as well as  issuing agency-specific policies and procedures on the appropriate use of  purchase cards.
We have previously reported that using purchase cards for smaller  purchases has reduced administrative costs and increased the flexibility  to meet a variety of government needs; however, if not properly managed  and controlled, it can also expose the government to significant risk. In  our last government-wide review of the purchase card program issued in  2008, we found that internal-control weaknesses in agency purchase card  programs—such as purchases without proper authorization or lacking  evidence that the goods and services were received by an independent  party—left the government vulnerable to fraud, waste, and abuse.
In our 2008 report, we made a number of recommendations to GSA and  OMB to improve internal controls and management in the purchase card  program. OMB responded to our recommendations in part by issuing  revised guidance in 2009, and Congress subsequently imposed new  requirements to improve internal controls in the purchase card program  by enacting the Government Charge Card Abuse Prevention Act of 2012  (Charge Card Act). In light of these changes to the purchase card  program, and the predominance of micropurchases among purchase card  transactions, you asked us to conduct another government-wide review of  the purchase card program with a focus on micropurchases.
This report addresses (1) what actions GSA and OMB have taken since  2008 to enhance program controls over micropurchases made using  government purchase cards, and (2) whether weaknesses exist in the  approval process for micropurchase transactions and, if so, whether there  are indicators of improper or potentially fraudulent purchases.
To determine what actions GSA and OMB may have taken to enhance  program controls in the federal purchase card program, we reviewed  purchase card policies and guidance issued by OMB and GSA since  2008. In addition, we obtained and analyzed purchase card training data  from 2011 to 2015 from GSA, which were the most recently available data  at the time of our review. We determined that the training data were  sufficiently reliable for the purpose of reporting on the total number of  completed training per year. We also reviewed agency documentation  submitted to OMB, including purchase card violation reports for 2014, the  most recently available at the time of our review. We interviewed GSA  and OMB officials and requested documents and reports these agencies  produced to implement and comply with program requirements.
To determine the extent to which any weaknesses exist in the approval  process for micropurchase transactions and whether there are indicators  of improper or potentially fraudulent purchases, we obtained purchase  card transaction data for all transactions posted during fiscal year 2014  from the three purchase card–issuing banks. We assessed the reliability  of the data by: (1) performing electronic testing of key data elements,  including checks for missing, out-of-range, or logically inaccurate data; (2)  reviewing documents for information about the data and the banks’  systems; and (3) interviewing bank officials knowledgeable about the data  to discuss any limitations. We determined that the data were sufficiently  reliable for the purposes of this report. From these data, we extracted and  tested a random, stratified statistical sample of 300 transactions from a  population of over 17 million micropurchases that were posted during  fiscal year 2014 from the 48 executive agencies with at least $1 million in  fiscal year 2014 micropurchase spending. We obtained source  documentation from agencies for each sample item and evaluated it  against the requirements of the Charge Card Act and OMB guidance to  determine whether review elements of the transaction approval process  were effective. We also evaluated the source documentation for each  sample item against OMB guidance to determine whether there were any  indicators of improper or potentially fraudulent purchases.
Our stratified sample of transactions included 100 transactions each from  (1) the Department of Defense (DOD), (2) the Department of Veterans  Affairs (VA), and (3) all other executive agencies within our scope, which  allowed us to provide estimates for fiscal year 2014 for the entire  population of government agencies in our review (i.e., government-wide),  as well as separate estimates specific to DOD and VA. Our sample  examined DOD and VA separately because, together, both agencies  accounted for over three-fourths of all purchase card spending and about  two-thirds of all micropurchase spending in fiscal year 2014. We reviewed  applicable federal statutes and regulations related to purchase card use  and management, and identified and applied internal-control activities in  Standards for Internal Control in the Federal Government. Additionally,  we performed targeted data mining of micropurchase transactions that  posted in fiscal year 2014 and requested and reviewed source  documentation from agencies of selected transactions to determine  whether transactions were improper purchases according to OMB  guidance. We interviewed agency officials to discuss purchase card  policies and specific sample and data-mining transactions. Appendix I  describes our objectives, scope, and methodology in greater detail.
We conducted this performance audit from January 2015 to February  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: GSA manages the federal government’s purchase card program, which  has existed since the late 1980s. The Federal Acquisition Streamlining  Act of 1994 first defined a micropurchase threshold, and permitted certain  agency employees to make purchases under this amount without  competitive quotations if the employee considered the price to be  reasonable. On the day of the act’s enactment, an Executive Order was  issued that directed agencies to expand the use of purchase cards and  take maximum advantage of the micropurchase authority provided in the  act. As a result, purchase card use broadened, improving the ability of  agencies to quickly and easily acquire items needed to support daily  operations and reducing the administrative costs associated with such  small purchases. The Federal Acquisition Regulation (FAR) designated  the purchase card as the preferred method of making micropurchases,  the threshold for which was set at $3,000 for the period of our review  (fiscal year 2014) and was raised to its current level, $3,500, for most  purchases, on October 1, 2015.
Government purchase card spending grew rapidly from the late 1990s  into the early 2000s. During the 10-year period from fiscal year 1999  through 2008, annual purchase card spending increased by nearly 60  percent—from about $14 billion in fiscal year 1999 to a peak of over $22  billion in fiscal year 2008, in 2015 dollars. Between 2008 and 2013,  spending declined slightly, followed by a slight uptick in purchase card  spending from 2014 to 2015, as illustrated in figure 1 below.
In fiscal year 2014, federal agencies made over 19.5 million purchase  card transactions for supplies and services, spending over $17 billion. Of  these transactions, over 18.5 million (95 percent) were for  micropurchases, which accounted for about half of the total spending  using purchase cards ($8.7 billion). DOD and VA together accounted for  over three-fourths of all purchase card spending and about two-thirds of  all micropurchase spending in fiscal year 2014, as shown in table 1. DOD  micropurchase spending covered a wide range of items to support its  civilian and military operations, such as housing-repair services on a  military base. According to VA officials, the majority of VA’s  micropurchase spending was through the Veterans Health Administration  for medical supplies for veterans.
GSA’s Center for Charge Card Management administers the SmartPay  charge card program, which includes purchase cards (for supplies and  services), travel cards (for airline, hotel, and related travel expenses),  fleet cards (for fuel and supplies for government vehicles), and integrated  cards (a combination of purchase, travel or fleet cards). GSA currently  maintains purchase card contracts—as part of the SmartPay program— with three commercial banks. These three contracts are collectively  referred to as the GSA SmartPay2 Master Contract. The current master  contract base year began in November 2008. With all option years  included, it is set to expire in November 2018. According to GSA’s  SmartPay website, the replacement of paper-driven acquisition processes  of the past with the use of purchase cards saves the government about  $1.7 billion annually in administrative costs. Further, when selecting which  bank to use for its purchase card program, an agency can negotiate with  its bank the terms for purchase card refunds under the purchase card  program’s contract. These refunds are based on speed of payment and  volume of transactions and may also result in a cost savings for agencies.  GSA’s SmartPay website indicates that the government has received  approximately $3 billion in refunds from purchase card spending since the  SmartPay program’s inception in 1998.
Along with deciding which bank to use to support its purchase card  requirements, individual agencies are responsible for monitoring the  actions of their cardholders as well as issuing agency-specific policies  and procedures on the appropriate use of purchase cards. Individual  cardholders have primary responsibility for the proper use of purchase  cards, including following agency policies and other acquisition laws and  regulations. Cardholders must also reconcile the transactions that appear  on their monthly statements with receipts and other supporting  documentation, and ensure records are maintained in accordance with  agency policies. Cardholders are assigned to an Approving Official (AO),  who is often the cardholder’s supervisor. AOs make sure that purchases  are necessary for accomplishing the mission of the agency and must  provide final approval of purchase card transactions after they are  reconciled by the cardholder.
OMB is responsible for prescribing policies and procedures to agencies  regarding how to maintain internal controls in government charge card  programs. Specifically, OMB has established minimum requirements and  suggested best practices for government charge card programs in  Appendix B of Circular No. A-123, Improving the Management of  Government Charge Card Programs. OMB most recently revised  Appendix B in January 2009 in response to recommendations in our 2008  report. According to officials, OMB is currently in the process of revising  Appendix B as part of a larger effort to update Circular A-123; the revised  Appendix B is scheduled to be released in 2017.
section_title: GSA and OMB Have Taken Several Steps since 2008 to Enhance Program Controls over Micropurchases
paragraphs: GSA and OMB have taken a number of actions since 2008 to enhance  program controls over micropurchases made using purchase cards. GSA  created new purchase card training and certification programs,  implemented new monitoring and management tools, and provided  agencies with updates to guidance through its website, while OMB  revised its guidance to executive agencies and facilitated new reporting  requirements in response to the Charge Card Act, as shown in figure 2.
subsections: section_title: GSA Has Provided New Training, Monitoring, and Management Tools, and Guidance
subsections: section_title: Training
paragraphs: In February 2011, GSA expanded its SmartPay website to include online  training modules for cardholders and agency program managers, and  later developed additional training opportunities for agency program  managers. GSA’s online training modules enable agencies to meet  training requirements established by OMB and are available to all  agencies via GSA’s SmartPay website. Each training module provides  information on the respective roles and responsibilities of cardholders,  approving officials, and agency program managers. Training modules  also provide information on the rules and best practices for the use of the  purchase card, including requirements pertaining to vendor selection,  record maintenance, and prohibited items, among other areas. GSA  reports that, between 2011 and 2015, cardholders completed the  purchase card cardholder training module over 174,000 times, while  agency program managers completed their training module over 20,300  times. As an additional management tool, GSA’s training portal allows  agency program managers to generate reports that enable them to  access and manage their cardholders’ training information, which can  make it easier to ensure cardholders are meeting their training  requirements.
In June 2014, GSA also instituted optional training leading to a new  Charge Card Manager Certification. Agency program managers can earn  the certification by completing required coursework offered by GSA and  the card-issuing banks and by possessing hands-on experience  managing a card program and working with cardholders and managers.  The certification requires the completion of 12 courses and  documentation of a minimum of 6 months of continuous, hands-on  experience managing agency cardholders and accounts. According to  GSA, the certification is intended to help agencies ensure that their card- management personnel have the fundamental training and experience  needed to manage a card program.
section_title: Monitoring and Management Tools
paragraphs: GSA and the purchase card–issuing banks made new monitoring and  management tools available to agencies in the current SmartPay2 master  contract that went into effect in November 2008. In particular, SmartPay2  offered agency program managers additional reporting and account- management capabilities in the bank electronic access systems. These  new features included enabling agency program managers to generate  ad hoc reports; dispute transactions; activate, deactivate, and renew  cards; and block card usage from specific categories of merchants. In  addition, the electronic access systems allow approving officials to  electronically review transaction details and certify invoices and  statements.
In addition to providing increased reporting and account-management  tools, GSA developed a data-analytic system, called the SmartPay Data  Warehouse, which is designed to assist agencies with monitoring and  analyzing their purchase card spending. According to GSA, the Data  Warehouse, which reached initial operating capability in early 2015,  receives a daily feed of transactional data from the banks for two dozen  agencies (covering over 90 percent of purchase and travel card spending)  dating back to 2011. According to GSA officials, the Data Warehouse can  be used to compile aggregate data from banks for each participating  agency and for the government as a whole. The data can be sorted by  various fields, such as vendor, agency, and transaction date. The Data  Warehouse provides data-visualization tools through an online dashboard  that allows agencies to monitor related trends in their use of purchase  cards. Users can access the dashboard through a web-based portal, as  shown in figure 3. As of September 2016, GSA reported that 19 agencies  have access to the Data Warehouse. According to GSA officials, the  performance metrics analyzed include  the number of cardholder accounts with disputed charges,  the number of accounts that have at least 10 transactions and 80  percent or greater of spending at one merchant,  the number of confirmed violations involving misuse of a purchase  card,  the number of transactions and spending amount with merchants that  are listed under merchant category codes that are highly monitored  for government spending, and  the types of data-analytics tool or method used by agencies.
GSA has provided agencies with purchase card management guidance  through a variety of means. For instance, GSA issues periodic information  and guidance on charge card program-management matters through  publications known as Smart Bulletins. According to GSA, Smart  Bulletins are intended to keep agencies and stakeholders informed of  new or updated policies, regulations, statutes related to government  charge cards, program-management practices, and other related matters.  Since 2008, GSA has released over 20 Smart Bulletins on a variety of  issues related to purchase card management, such as record-retention  requirements, best practices for using third-party payment processors,  new training opportunities, and other policy changes.
After the passage of the Charge Card Act in 2012, GSA also developed a  template, known as the Compliance Summary Matrix, to help agencies  ensure that all of the safeguards and internal controls required by the act  are in place. The compliance summary matrix details the internal-control  requirements under the Charge Card Act and can be used to document  the operating effectiveness of existing internal controls, as well as to  document areas of noncompliance and plans to mitigate and correct  those areas. As discussed below, agencies are required by OMB to use  this template when preparing their annual internal-control assessment  and certification.
section_title: OMB Has Revised Its Guidance and Facilitated New Reporting Requirements
paragraphs: As stated previously, OMB issued a revision to Appendix B of Circular  A-123 in January 2009 in response to recommendations that we made in  our 2008 report. This revision included a number of changes, such as  expanded descriptions of erroneous and improper purchases along with  practices for minimizing such purchases; guidance on disciplinary actions  for fraud and abuse of charge cards, including purchase cards; additional  internal controls for managing property obtained using purchase cards;  and additional internal controls for purchases made using convenience  checks. While these 2009 revisions enhanced controls on agencies’  purchase card program, OMB officials stated that OMB does not opine on  a particular approach for agencies to design and implement these  controls, which OMB views as a more appropriate role for the agencies’  Offices of Inspector General (OIG) and GAO. In the fall of 2016, OMB  was in the process of revising Appendix B as part of a larger effort to  revise Circular A-123. OMB officials told us they plan on issuing the  revised Appendix B in 2017.
In addition to making revisions to Appendix B, OMB also started collecting  information from executive agencies and agency OIGs in response to the  Charge Card Act. In September 2013, OMB issued a memorandum that  directed executive agencies and OIGs to submit the information required  by the Charge Card Act to OMB, and provided guidance and clarification  on the requisite information and submission deadlines for different  reports. For example, OMB directed executive agencies to submit  annual assessments and certifications that agencies have the appropriate  policies and controls in place to mitigate the risk of fraud, waste, and  abuse in the purchase card program. OMB further directed agencies to  complete these assessments using the compliance template developed  by GSA. In addition, OMB clarified that agency OIGs should conduct the  periodic risk assessments of agency charge card programs (including  purchase cards) required by the Charge Card Act on at least an annual  basis.
In the September 2013 memorandum, OMB also directed agency OIGs to  submit annual reports to OMB on their respective agency’s progress on  implementing audit recommendations related to purchase card and travel  card programs. OMB uses these OIG reports to provide Congress and  GAO with a summary of the type and nature of all outstanding OIG  recommendations related to purchase and travel card programs across  the government. OMB produced its first government-wide summary in  October 2014. In its next summary—in October 2015—OMB determined  that, in 2 years of reporting, OIGs across the government have identified  70 recommendations pertaining to agency purchase card programs that  remain open.
In the September 2013 memorandum, OMB also required that agencies  with at least $10 million in annual purchase card spending during the prior  fiscal year (beginning with fiscal year 2013) submit semiannual reports on  employee purchase card violations to OMB. These reports—which are  prepared jointly by the agency heads and OIGs—provide a summary of  the number of purchase card violations by category (abuse; fraud; other  loss, waste, or misuse) and the types of actions taken in response (e.g.,  demotion, reprimand, suspension), as well as the number of any pending  violations.
section_title: Documentation of Micropurchases Show Some Weaknesses, but Little Evidence of Improper or Potentially Fraudulent Purchases Found
paragraphs: Our government-wide review found that agencies have not consistently  maintained required documentation of the approval process, which can  increase the risk of purchase card misuse. However, we found little  evidence of improper or potentially fraudulent purchases. On the basis of  our statistical testing of the approval process for purchase card  transactions, we estimated that 22 percent of transactions government- wide, 23 percent of DOD transactions, and 13 percent of VA transactions  had incomplete documentation. The Department of the Interior (DOI) was  not included in our government-wide analysis because the agency did not  require one transaction review requirement in our test of the approval  process, which may increase the risk that fraudulent, improper, and other  abusive activity could occur without detection. In addition, our review of  agency property-management policies found that most agencies in our  sample had policies that at least partially addressed OMB guidance  developed in response to recommendations in our 2008 report for  property acquired with the purchase card, such as requirements for  independent receipt and acceptance. However, we found transactions in  our sample that were not properly documented as received by an  independent party (independent receipt and acceptance) based on each  agency’s policy. For all but two transactions in our sample, the agencies  provided us with full or partial documentation, which we reviewed and  determined that the transactions were not potentially fraudulent. In  addition, we conducted targeted data mining in selected categories and  reviewed documentation of potentially improper purchases, but we found  little evidence of improper or potentially fraudulent purchases.
subsections: section_title: Documentation Weaknesses of Micropurchases Exist
paragraphs: On the basis of our sample, we estimated that 22 percent of transactions  government-wide in fiscal year 2014 had incomplete documentation  associated with the approval process for purchase card transactions.  Incomplete documentation can limit the ability of the agency and GAO to  provide effective oversight of the purchase card program and increases  the risk that fraud, charge card misuse, and other abusive activity could  occur without detection. GAO has previously found that requiring  documentation of transactions is a preventive control, which is a key  element of strategically managing fraud risks. Preventive activities  generally offer the most cost-efficient use of resources, since they enable  managers to avoid a costly and inefficient “pay-and-chase” model. We  did not include DOI in the government-wide results because of a  difference in the agency’s purchase card policies, as discussed below.  Additionally, we estimated that 23 percent of DOD transactions and 13  percent of VA transactions had incomplete documentation, as shown in  table 2.
To ensure the government ultimately only pays for valid charges, the  Charge Card Act requires that purchase cardholders and their AOs verify  the accuracy of charges that appear on monthly statements using  receipts and other supporting documentation and resolve any  discrepancies. To that end, we tested three transaction review elements  of the approval process:  1.  Presence of a purchase receipt that contained the date of purchase, a  description of the goods or services received, the price, and the  quantity.  2.  Presence of other supporting documentation that, according to OMB  guidance, includes documentation of the purchase request or  preapproval for self-generated purchases. We also accepted  preauthorization for purchases of certain items as reasonable  evidence of preapproval. For example, one agency provided a  purchase cardholder with an annual preauthorization for a range of  purchases as follows: engineering supplies, road crew supplies, and  simple services.  3.  Presence of approval by the AO after the transaction posted to the  bank.
We estimated that government-wide transactions had incomplete  documentation rates of 6 percent for purchase receipt, 12 percent for  other supporting documentation, and 11 percent for AO approval, as  shown in figure 4. These estimates have a margin of error of +/-5  percentage points or less at the 95 percent confidence level. DOD has  levels of incomplete documentation similar to that of the government-wide  rate, while VA had fewer instances of transactions with incomplete  documentation compared to the aggregate of the agencies in rest of our  sample.
Transactions with incomplete documentation included those where  1.  the agency was missing documentation and therefore unable to  provide at least one piece of documentation; or  2.  the agency provided documentation that was insufficient, inaccurate,  or not completed in an appropriate time frame.
According to agency officials, missing documentation generally occurred  because the cardholder or AO failed to maintain sufficient documentation,  the cardholder or AO no longer worked for the agency, or the cardholder  failed to document requests in writing. One example of insufficient or  inaccurate documentation that we encountered was when agency officials  provided an e-mail purchase request and approval for one transaction  that did not match the final transaction. The billing amount and the items  in the request were inaccurate for the sample transaction. Examples of  documentation that was not completed in an appropriate time frame  included several transactions that were approved by the AO after we had  submitted our request for documentation of AO approval.
Of the 60 transactions with incomplete documentation in our sample, 11  were transactions with GO!cards, which are purchase cards used to  distribute transit benefits and include additional control functions to  ensure cardholders only make transit-related purchases. The  Department of Health and Human Services (HHS) Program Support  Center (PSC) manages the GO!card program and offers the service to  HHS and other federal agencies for a fee. According to HHS officials, the  GO!card is designed so that it can only be used to purchase transit fare  media through transit providers identified in a limited list of merchant  category codes approved by HHS. Additionally, transit beneficiaries are  provided a GO!card with a monthly credit limit equal to the cardholder’s  approved transit benefit so that the cardholder is unable to charge more  than the monthly benefit. In a previous report, we concluded that a similar  transit benefit program administered by the Department of Transportation  contained appropriate control functions to provide reasonable assurance  that non-transit-related purchases can be identified and denied.
While the GO!card has additional controls and does not function as a  traditional purchase card, we included the transactions in our sample  because they were subject to OMB Circular A-123, Appendix B, in fiscal  year 2014, according to GSA officials, and therefore in the scope of our  review. According to HHS officials, PSC program administrators reviewed  the monthly statements for anomalies and occurrences of potentially  fraudulent purchases, but at the time of our review the agency did not  have a formal process of AO approval after the transaction posted to the  bank. Therefore, the transactions we identified had incomplete  documentation due to missing documentation of AO approval. As of  October 2016, HHS had produced a draft policy for the GO!card program  that included AO approval of the monthly bank statements and that the  agency estimated would be finalized in May 2017.
Officials from two agencies in our sample initially were unable to provide  documentation of final AO approval made through one of the three  SmartPay banks because the agencies relied on the bank to maintain the  records for 3 years. While the bank’s online purchase card management  system enabled AOs to electronically approve transactions, the bank’s  system did not retain transaction approval history information, including  final approval by the AO, beyond 2 years of the transaction. According to  the GSA SmartPay2 master contract and the FAR, in fiscal year 2014  contractors were required to maintain electronic records for a minimum of  3 years after payment. However, according to a bank official, the bank  did not consider the transaction approval process part of the transaction  but rather information appended through the online system. Under the  SmartPay2 master contract, the bank was only required to allow access  to that online system for 18 months. Failure to retain records for 3 years  after final payment limits the ability of the agency, GAO, and other  oversight groups to provide oversight of the program as part of an overall  effort to reduce instances of fraudulent, improper, and abusive purchase  card activity.
As a result of our current review, GSA worked with the bank used by  these two agencies to develop short- and long-term solutions for the  retention of AO approval records. In the short term, the bank developed a  transaction-specific manual process to locate and produce AO approval  records for transactions that had aged out of the online system. The bank  also agreed to provide this manual service on a case-by-case basis for  audits and investigations for the duration of the SmartPay2 master  contract. In the longer term, GSA will pursue a contract modification in the  SmartPay2 master contract in fiscal year 2017 to further clarify review  and approval record-retention requirements, according to a GSA official.  In the SmartPay3 master contract, according to a GSA official, the agency  will require a 6-year retention period for this information to conform with  updated FAR requirements, which reflect the revised National Archives  and Records Administration General Records Schedule.
section_title: Lack of a Review Requirement at the Department of the Interior Increases the Risk of Fraud and Abuse in Its Purchase Card Program
paragraphs: DOI was not included in our government-wide analysis of the approval  process because the agency did not require the second transaction  review requirement, which was other supporting documentation. By  policy, DOI granted blanket purchase authority for cardholders to use the  purchase card for most transactions within the micropurchase limit in  fiscal year 2014. DOI updated its purchase card policy in August 2015 but  did not change its policies regarding other supporting documentation.  According to officials from DOI’s Office of Acquisition and Property  Management, the agency does not require cardholders to obtain  preapproval or otherwise document a micropurchase request before  making the purchase, in order to minimize delays in obtaining needed supplies in fieldwork environments and to save administrative costs in  offices, which they stated is the intent of the integrated card. However,  not requiring cardholders to obtain appropriate authorization and lack of  management oversight may increase the risk that fraudulent, improper,  and other abusive activity could occur without detection. DOI was the one  agency out of 16 in our sample that did not require other supporting  documentation. DOI also spent about $395 million on micropurchase  transactions, using purchase cards, in fiscal year 2014.
As part of the approval process for purchase card transactions, the  Charge Card Act requires that heads of agencies establish controls to  ensure that purchase cardholders and their AOs verify the accuracy of  charges that appear on monthly statements using receipts and other  supporting documentation, although the exact type of this additional  documentation is not specified. According to OMB guidance,  documentation that a purchase cardholder should maintain to minimize  erroneous and improper purchases includes documentation of the  purchase request and preapproval for self-generated purchases. DOI  officials noted that the OMB guidance specifies that such documentation  should be maintained “to the maximum extent possible” and that the  nature of DOI’s mission makes it impractical to require these actions  agency-wide. According to OMB officials, OMB does not prescribe a  particular approach for agencies to design and implement internal  controls based on its policy.
Because DOI policy does not require supporting documentation on the  purchase request or preapproval for a self-generated purchase, DOI did  not provide this documentation for 17 of 21 transactions included in our  random sample. Additionally, 2 of 21 transactions from DOI had  incomplete documentation due to a missing receipt.
section_title: The Department of Defense Level of Incomplete Documentation and the Government-Wide Rate Are Similar, while the Department of Veterans of Affairs Had More Complete Documentation
paragraphs: On the basis of our samples, we estimated that 23 percent of DOD  transactions and 13 percent of VA transactions had incomplete  documentation associated with the approval process for purchase card  transactions. Together, DOD and VA accounted for over three-fourths of  all purchase card spending and about two-thirds of all micropurchase  spending in fiscal year 2014. Therefore, we designed our stratified  sample to include 100 transactions from DOD and 100 transactions from  VA, which allowed us to provide estimates specific to each agency for  fiscal year 2014.
DOD accounted for about 29 percent of all purchase card spending and  about 35 percent of all micropurchase spending in fiscal year 2014. As  shown in figure 5, DOD had incomplete documentation rates of an  estimated 6 percent for purchase receipt, 16 percent for other supporting  documentation, and 11 percent for AO approval, which are  commensurate with the government-wide rates. These estimates have a  margin of error of +/-8 percentage points or less at the 95 percent  confidence level.
VA accounted for about 49 percent of all purchase card spending and  about 32 percent of all micropurchase spending in fiscal year 2014. Of the  100 VA transactions in our sample, 99 were within the Veterans Health  Administration. VA transactions in our sample included purchases such  as eyeglasses for a veteran and bandages for use at a Veterans Affairs  Medical Center. As shown in figure 6, VA had incomplete documentation  rates of an estimated 7 percent for purchase receipt and 6 percent for AO  approval. VA provided complete and accurate other supporting  documentation for all of the transactions in our sample. These estimates  have a margin of error of +/-7 percentage points at the 95 percent  confidence level. In addition, according to the transactions in our sample,  we project that VA had fewer instances of transactions with incomplete  documentation compared to the aggregate of the agencies in the rest of  our sample. VA uses an online system that tracks the purchase  throughout the life cycle of the transaction, which may account for its  lower number of transactions with incomplete documentation. This  transaction information, including the purchase order number and AO  approval, can be produced in a summary report.
section_title: Most Federal Agency Policies Generally Met Requirements for Management of Property Acquired by Purchase Card but Differed in Implementation
paragraphs: Most of the agencies in our sample had policies that at least partially  covered OMB’s guidelines specific to property acquired with a purchase  card, such as the documentation of independent receipt and acceptance,  when appropriate, and the determination of items to be classified as  sensitive or accountable property. OMB added these guidelines as part of  its revision to Appendix B in response to recommendations in our 2008  report. OMB detailed five areas that agency policy must address to  ensure effective property management: (1) definition of “sensitive” and  “accountable” property; (2) a process for notifying the property- management activity of property receipt; (3) the process for recording and  tracking such property; (4) the documentation of independent receipt and  acceptance, when appropriate; and (5) procedures for addressing  missing, stolen, or damaged property.
We reviewed the fiscal year 2014 policy documents of the agencies  included in our random sample to assess their compliance with these  guidelines. The Department of Justice was the one agency in our sample  unable to provide policies that addressed, even partially, two of the areas  specified by OMB. For a summary of our analysis of agency policy on  property acquired with a purchase card, see table 3. For details, see  appendix II.
To assess agency program controls related to property management, we  also requested additional documentation from agencies when the sample  items included purchases of accountable or sensitive property or required  independent receipt and acceptance, according to agency policy  documents.
Sensitive or accountable property. While OMB guidance directs each  agency to develop its own definitions of “sensitive” and “accountable”  property, OMB provides guidance to agencies on how to define this  property. According to OMB guidance, sensitive property includes items,  regardless of cost, that have an unusual rate of loss, theft, or misuse, or  require additional controls due to national security. OMB guidance defines  accountable property as items with an acquisition value defined by each  agency that have a useful life of 2 years or longer. Using each agency’s  definition for accountable or sensitive property, we identified 4  transactions in our sample of 300 that contained sensitive or accountable  property. This number of transactions is too small to make conclusions on  government handling of accountable or sensitive property.
Independent receipt and acceptance. On the basis of our sample, we  estimated that 28 percent of transactions government-wide failed  independent receipt and acceptance, that is, goods or services ordered  and charged to a government purchase card account were either  received by the cardholder or are missing documentation of receipt by a  third party. In our random sample of 300 transactions, we identified 184  transactions that required independent receipt and acceptance, according  to agency policy requirements. Agency policies differed on when the  documentation of independent receipt and acceptance was required.  Several agencies did not require someone other than the cardholder to  receive micropurchases made with the government purchase card,  regardless of the item purchased. Other agencies required independent  receipt and acceptance for all purchase card transactions, while others  detailed specific restrictions based on, for example, purchase price or  type of purchase.
Almost all of the DOD transactions in our sample required independent  receipt and acceptance; DOD transactions accounted for 97 of the 184  transactions we reviewed. Of these 97, DOD provided evidence of  independent receipt and acceptance for 59 transactions and did not  provide documentation of independent receipt and acceptance for 38  transactions. Of those 38 transactions
23 transactions were missing documentation,
8 transactions had insufficient documentation, and
7 transactions were received by the cardholder.
section_title: Little Evidence of Improper or Potentially Fraudulent Purchases Found among Micropurchases
paragraphs: Our review found little evidence of improper or potentially fraudulent  purchases. While 22 percent of transactions government-wide had  incomplete documentation, we estimated that only 2 percent of  transactions in fiscal year 2014 were improper purchases, which  according to OMB guidance include those that should not have been  made or that were made in an incorrect amount under statutory,  contractual, administrative, or other legally applicable requirements, as  well as fraudulent purchases. While fraudulent purchases are  considered improper purchases, we found little evidence of potentially  fraudulent purchases, such as those for personal use. We obtained at  least some documentation from agencies for all but 2 transactions. We  reviewed this documentation and determined that the transactions were  not potentially fraudulent. For example, one transaction missing a receipt  was for a $3.55 shipping purchase. The agency was able to provide the  preapproval for the monthly shipping charges and a list of monthly  charges that included this transaction, but the receipt for the specific  transaction was lost during an office move, according to an agency  official.
We found 5 improper purchases in our sample that included
1 transaction for $2.00 that was approved in error;
1 split purchase, which we defined as purchases made from the same  vendor that appeared to circumvent single-purchase limits;
1 transaction for uniform items made by the requestor instead of the
2 transactions for which agency officials were unable to provide any  documentation.
We considered the 2 transactions in our sample that were missing all  three pieces of documentation to be improper purchases because without  any documentation we were unable to verify that the transactions were  authorized and correct. Without any documentation, we were unable to  make a determination of potential fraud for these 2 transactions. While  the $2.00 transaction approved in error, the split purchase, and the  purchase made by the requestor were improper, we determined that they  were not potentially fraudulent because they were not for personal use.
Additionally, our targeted data mining of selected categories for  potentially improper purchases found little evidence of improper  purchases, including potentially fraudulent purchases, among  micropurchase transactions made using government purchase cards.  Our prior work identified numerous instances of fraud, waste, and abuse  related to the purchase card program at dozens of agencies across the  government. We reviewed fiscal year 2014 purchases in several of the  same categories identified in our 2008 report, but we did not identify any  improper purchases. However, as discussed in appendix I, our targeted  data mining was not designed to identify all instances of improper  government purchase card activity or estimate their full extent  government-wide. Rather, we focused our data mining on selected  categories that we identified as potentially high risk for improper  purchases to illustrate the potential for improper purchases in the  population of transactions, develop a better understanding of the types of  purchase card transactions within each category, and determine whether  purchases that initially appeared to be problematic were improper. We  used targeted data mining to identify 20 potentially improper purchases  for further review in four selected categories: (1) high-risk merchants, (2)  wireless services, (3) convenience checks, and (4) split purchases. While  overall we identified 20 purchases, three of the wireless purchases and  the two convenience checks purchases were also possible split  purchases. Therefore, the sum of the purchases we reviewed by category  is 25. Figure 7 further describes these categories and shows the number  of purchases per category we reviewed.
We requested and analyzed source documentation for the 20 potentially  improper purchases within these categories against OMB’s definition of  an improper purchase and determined that none of the 20 purchases  reviewed were “improper.” It is difficult to determine whether a transaction  is improper without examining the source documentation, and in some  instances talking to agency officials or the cardholder. For example, as  discussed in table 4, we discovered that many of the transactions within  the Department of Housing and Urban Development’s (HUD) Real Estate  Assessment Center (REAC) office were transactions where the  cardholder name closely matched the merchant name. While these  transactions appeared suspicious, we were unable to determine the  nature of these transactions without further evidence. Thus we requested  source documentation for a transaction and additional documentation on  the REAC program, and interviewed HUD officials. HUD officials  explained that this method of using purchase card accounts to pay  inspectors was established in 2005 so that the inspectors, who are often  part of a small business, are paid quickly and directly. The contracted  inspectors do not possess physical purchase cards—which are  maintained by the REAC office—and are unable to initiate a payment for  more than the approved amount. Table 4 summarizes the types of  purchases we reviewed, why we reviewed the purchase, and the results  of our assessment.
We also used targeted data mining to examine purchases related to child  care, online dating, alcohol, and, in addition to those assessed above,  other merchants providing goods or services at high-risk of being used for  personal benefit. However, we did not find indicators of improper or  potentially fraudulent purchases within these categories and did not  request supplemental documentation from the agencies. For example, in  our 2008 report, we identified an example where a cardholder used a  government purchase card to fraudulently subscribe to two Internet dating  services. We conducted targeted data mining for purchases from potential  Internet dating services to determine whether these types of purchases  were still occurring. However, our searches of the fiscal year 2014 data  revealed only a few purchases from providers of Internet dating services  and these charges had been refunded to the agency.
section_title: Conclusions
paragraphs: Given that the federal government spent nearly $8.7 billion in  micropurchases in fiscal year 2014 using purchase cards, it is critical to  monitor program activity closely. Since 2008, GSA, OMB, and federal  agency purchase card managers have taken many steps to enhance their  oversight capabilities. New training and tools from GSA, and ongoing  guidance from GSA and OMB, provide agency purchase card managers  the opportunity to enhance their oversight of purchase card activity within  their agencies. While we found little evidence of potentially fraudulent  purchases in our current review—which is an improvement from the  past—documentation issues exist. We estimated that agencies had  incomplete documentation of the transaction approval process for 22  percent of fiscal year 2014 micropurchases. Maintaining sufficient  documentation as required by the Charge Card Act is an important  element of effective oversight of the purchase card program. The key  elements in managing the approval process of purchase card activity are  written documentation of the purchase request, including preapproval for  self-generated purchases; maintaining a receipt of the purchase; and  reconciling/approving the charge on the monthly bank statement. Absent  continued vigilance to ensure that data for all three elements are  consistently collected and maintained, agencies will not be able to confirm  the integrity of their purchase card programs. While federal government  purchases are vast and varied, of the agencies we reviewed only DOI  granted blanket purchase authority for cardholders for most transactions  under the micropurchase limit in fiscal year 2014. This blanket authority  increases the risk that fraudulent, improper, and other abusive activity  could occur for DOI’s micropurchase spending, which was about $395  million in fiscal year 2014.
section_title: Recommendations for Executive Action
paragraphs: To help strengthen the documentation of the purchase card transaction  approval process, which can help to prevent improper and fraudulent  micropurchases, we recommend that  1.  the Administrator of GSA direct the head of the Center for Charge  Card Management to provide guidance to agency purchase card  managers reemphasizing the need to obtain and retain complete  documentation in support of purchase card transactions, per OMB  specifications and  2.  the Secretary of the Interior direct the head of Office of Acquisition  and Property Management to reexamine the agency’s Integrated Card  Program policy to require that cardholders maintain documentation of  purchase requests and preapproval for self-generated purchases for  purchase card transactions.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of our report to the Administrator of GSA and the  Secretaries of the Interior, Defense, and Veterans Affairs, as well as the  Director of OMB. GSA and DOI both provided comments. DOD and VA  stated by e-mail that they had no comments on the draft of our report, and  OMB did not respond to our request for comments.
In written comments (reproduced in app. III), GSA agreed with our  findings and concurred with our recommendation to provide guidance  reemphasizing complete documentation for purchase card transactions.  GSA noted that it is developing a comprehensive plan to address this  recommendation.
In an e-mail from the DOI liaison for GAO and Office of Inspector General  audits, DOI commented that it partially concurs with our recommendation  to direct the head of the Office of Acquisition and Property Management  to reexamine DOI’s Integrated Card Program policy to require that  cardholders maintain documentation of purchase requests and  preapproval for self-generated purchases. Specifically, DOI noted that it  understands that risk assessment and mitigation is an ongoing process.  DOI said the department will continue evaluating its charge card policies  and procedures and update them as appropriate to maintain effective  controls that reduce the risk of fraud, waste, and misuse. However, in its  comments, DOI indicated that its current policy includes sufficient  requirements for supporting documentation and transaction monitoring.     DOI noted that, as a field-based agency, its mission is carried out in many  remote locations outside of the traditional office environment (e.g.,  wildland fire fighting, law enforcement, and emergency response). As  such, according to DOI, it is not always possible or practical for  employees to obtain preapproval to make micropurchases. As discussed  in the report, we recognize that challenges may arise with obtaining  preapproval under some circumstances in the field. However, rather than  forgoing the preapproval process by granting blanket purchase authority,  we believe agencies can balance flexibility and management oversight in  the Integrated Card Program by defining broad, but not unlimited,  preauthorizations. For example, one agency in our review provided a  purchase cardholder with an annual preauthorization for a range of  purchases including engineering supplies, road crew supplies, and simple  services. After reexamining its policy, DOI could, for example, also  potentially exclude emergency situations from the preapproval  requirement. Doing so could help mitigate the risk that fraudulent,  improper, and other abusive activity could occur without detection.
If you or your staff have any questions about this report, please contact  me at (202) 512-5045 or LarinK@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: This report examines (1) what actions the General Services  Administration (GSA) and the Office of Management and Budget (OMB)  have taken since 2008 to enhance program controls over micropurchases  made using government purchase cards, and (2) whether weaknesses  exist in the approval process for micropurchase transactions and, if so,  whether there are indicators of improper or potentially fraudulent  purchases.
To determine what actions GSA and OMB may have taken to enhance  program controls over micropurchases in the federal purchase card  program, we reviewed purchase card policies and guidance issued by  OMB and GSA since 2008. We also reviewed GSA’s SmartPay2 master  contract to identify additional monitoring and management tools made  available to agencies and examined GSA’s SmartPay Data Warehouse.  In addition, we obtained and analyzed purchase card training data from  2011 to 2015 from GSA, which were the most recently available data at  the time of our review. We determined that the training data were  sufficiently reliable for the purpose of reporting on the total number of  completed trainings per year. We also reviewed agency documentation  submitted to OMB, including purchase card violation reports for 2014, the  most recently available at the time of our review, and summaries of  outstanding Office of Inspector General recommendations related to  purchase card programs. We also interviewed GSA and OMB officials  and requested documents and reports these agencies produced to  implement and comply with program requirements.
To determine the extent to which weaknesses exist in the approval  process for micropurchase transactions and whether there are indicators  of improper or potentially fraudulent purchases, we (1) conducted  statistical testing of transaction review elements within the approval  process, (2) assessed various agency property-management policies  against OMB guidance and reviewed transactions with an independent  receipt and acceptance requirement or that contained sensitive or  accountable property according to agency policy, and (3) conducted  targeted data mining. Additionally, we reviewed applicable federal  statutes and regulations related to the purchase cards, including the  Government Charge Card Abuse Prevention Act of 2012 (Charge Card  Act) and the Federal Acquisition Regulation (FAR). We also identified  and applied the internal-control activities contained in Standards for  Internal Control in the Federal Government and agencies’ purchase card  policies and procedures.
We obtained purchase card transaction data for all transactions posted  during fiscal year 2014 from the three purchase card–issuing banks. This  was the most recently available and complete fiscal year of data at the  time of our review. During the time frame of our audit, the micropurchase  threshold for most purchases was $3,000, with exceptions for some  construction, service, or other specific types of contracts. We assessed  the reliability of the data by: (1) performing electronic testing of key data  elements, including checks for missing, out-of-range, or logically  inaccurate data; (2) reviewing documents for information about the data  and the banks’ systems; and (3) interviewing bank officials  knowledgeable about the data to discuss any limitations. We also  compared the bank transaction data to source documentation from  agencies. We determined that the data were sufficiently reliable for the  purposes of our report.
From these data, we extracted and tested a random, stratified statistical  sample of 300 transactions from a population of over 17 million  micropurchases that were posted during fiscal year 2014. We interviewed  agency officials to discuss specific sample transactions. The random,  stratified sample consisted of 100 transactions each from the Department  of Defense (DOD), Department of Veterans Affairs (VA), and all other  executive agencies within our scope. Our sample examined DOD and the  VA separately because, together, both agencies accounted for over  three-fourths of all purchase card spending and about two-thirds of all  micropurchase spending in fiscal year 2014. Agencies present in our  random sample were the
Department of Agriculture,
Department of Commerce,
Department of Defense,
Department of Health and Human Services,
Department of Homeland Security,
Department of Housing and Urban Development,
Department of Justice,
Department of State,
Department of the Interior,
Department of Veterans Affairs,
Environmental Protection Agency,
National Aeronautics and Space Administration,
National Archives and Records Administration,
National Science Foundation,
Smithsonian Institution, and
Social Security Administration.
The statistical sample allowed us to provide estimates for fiscal year 2014  for the entire population of government agencies in our sample frame  (i.e., government-wide), as well as separate estimates specific to DOD  and VA. With our statistical sample, each transaction in the population  had a nonzero probability of being included, and that probability could be  computed for any transaction. Each sample element was subsequently  weighted in the analysis to account statistically for all the transactions in  the population, including those that were not selected. Because we  followed a probability procedure based on random selection, our sample  is only one of a large number of samples that we might have drawn.  Since each sample could have provided different estimates, we express  our confidence in the precision of our particular sample’s results as a 95  percent interval (e.g., +/-5 percentage points). Percentage estimates for  the government-wide, VA, and DOD results have sampling errors  (confidence interval widths) of +/-5, 7, and 8 percentage points or less,  respectively.
To test the approval process, we obtained source documentation from  agencies for each sample item and evaluated it against the requirements  of the Charge Card Act and OMB guidance to determine whether review  elements of the transaction approval process were effective. We also  evaluated the source documentation for each sample item against OMB  guidance to determine whether there were any indicators of improper or  potentially fraudulent purchases. We asked agencies to provide us the  following source documentation for each sample item:  1.  A receipt for the transaction. The receipt should include the date of  purchase, a description of the good/service received, the price, and  the quantity.  2.  All other supporting documentation for the transaction, including a  written request for the item/service; or documentation by the  cardholder of a nonwritten request that includes the requester’s name,  item description, quantity, estimated cost, and date of request; or,  documentation of prior approval in the event that a purchase/need  was self-generated by the cardholder, which may include  preauthorization for certain purchases.  3.  A record that the transaction was approved by the approving official. If  the transaction was unauthorized, incomplete, damaged, or returned;  or if the transaction was reversed in part or in whole, supporting  documentation should be provided.
When determining whether a transaction passed our test for Approving  Official (AO) approval, we also included cardholder reconciliation of the  transaction, within the scope of our test. Additionally, if we determined  that a cardholder or other agency official took actions on a sample item in  response to our review—such as approving a transaction after our  request for documentation of AO approval—then we failed the sample  item on that particular test. We also reviewed transactions for which  agencies provided full or partial documentation to determine whether the  transactions were potentially fraudulent. Additionally, we determined that  if a transaction was missing documentation for all three elements of the  approval process, we would classify the transaction as improper.
We reviewed the fiscal year 2014 policy documents of the agencies  included in our random sample to assess their compliance with OMB’s  guidance on ensuring effective agency asset management. OMB’s  guidance detailed five areas that agency policy must address: (1)  definition of “sensitive” and “accountable” property; (2) a process for  notifying the property-management activity of property receipt; (3) the  process for recording and tracking such property; (4) the documentation  of independent receipt and acceptance, when appropriate; and (5)  procedures for addressing missing, stolen, or damaged property. For  each of these requirements, we determined whether agency policy  “passed,” “partially passed,” or “failed.” When necessary, we interviewed  agency officials to discuss specific purchase card policies.
To test agency program controls related to asset management, we  reviewed agency policies and assessed each transaction in the sample to  determine whether there was an independent receipt and acceptance  requirement according to agency policy. Of the 300 transactions in our  sample, we identified a generalizable selection of 184 transactions where  agency policy required independent receipt and acceptance. We  reviewed agency policy on what actions and documentation were  required to meet independent receipt and acceptance requirements. We  assessed the source documentation provided by the agency to determine  whether the transaction met the agency’s requirements for independent  receipt and acceptance. The percentage estimates for the government- wide independent receipt and acceptance results have a sampling error  of +/-7 percentage points or less at the 95 percent confidence interval.
Purchase card data provided by the banks did not always contain  adequate details on the items purchased to enable us to identify  transactions with likely sensitive or accountable property. Because we  were not able to draw a statistical sample of these transactions, we were  not able to project failure rates for accountable or sensitive property.  Consequently, our tests on accountable property were performed on a  nonrepresentative population of transactions that we identified when  agency documentation showed that a transaction selected in our random  sample contained accountable or sensitive items. When we found that a  sample item was “sensitive” or “accountable” property according to the  agency’s policies, we requested evidence that the property was currently  in the agency’ s possession and being tracked in the agency’s property - tracking system. Because we identified only four transactions from our  sample and data mining with accountable or sensitive items, we were  unable to make any conclusions on government handling of sensitive or  accountable property.
To identify indicators of improper or potentially fraudulent purchases, we  performed targeted data mining of micropurchase transactions that  posted in fiscal year 2014. We identified categories that were potentially  high risk for improper purchases by reviewing prior GAO reports on  purchase cards, reports on agency purchase card programs from their  inspectors general, and congressional testimony. Additionally, we  identified categories of transactions for which we wished to develop a  better understanding of the nature of such transactions. For example, we  wished to better understand transactions made using third-party payment  systems such as PayPal that we categorized as part of a high-risk  merchant category. We queried the data to identify potentially improper  purchases and requested source documentation from agencies for 20 of  these purchases within the following categories: (1) high-risk merchants,  (2) wireless transactions, (3) convenience checks, and (4) split  purchases. We reviewed the source documentation for these 20  potentially improper purchases to determine whether they were improper  purchases according to OMB guidance. When necessary, we interviewed  agency officials to discuss these transactions and requested additional  documentation. We also performed data mining for potentially improper  purchases in a broad range of categories such as (1) alcohol, wine, and  beer purchases, (2) adult entertainment, (3) online dating, (4) child care,  and (5) spa, hair, and makeup. We did not request source documentation  for transactions within these categories, as we did not find indicators of  improper of potentially fraudulent purchases. Our data-mining work was  not designed to identify and we cannot determine the extent of improper  or fraudulent purchases occurring in the population of government-wide  purchase card transactions.
We conducted this performance audit from January 2015 to February  2017 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Detailed Analysis of Agency Policies and Procedures for Management of Property Acquired with a Purchase Card
paragraphs: Included in this appendix are details of our assessment of the extent to  which the 16 agencies that we reviewed had policies and procedures in  effect for fiscal year 2014 that complied with the Office of Management  and Budget’s (OMB) guidance on property acquired with a purchase card.  OMB detailed five areas that agency policy must address in its Appendix  B of Circular A-123, Improving the Management of Government Charge  Card Programs:  1.  “The determination of items to be classified as ‘sensitive,’ and the  establishment of dollar value thresholds for accountable property,  taking into account the risk of loss of data or sensitive information on  electronic items.  2.  “A process of notifying the agency property management activity of  property receipt, including situations where property is delivered at  locations other than a central receiving facility.  3.  “The process for the agency to record property in the agency property  tracking system and financial systems, including the designation of  property as sensitive or accountable, when applicable.  4.  “The documentation of independent receipt and acceptance, when  appropriate, to ensure that items purchased were actually received,  including procedures addressing remote locations and  emergency/urgent purchases where independent acceptance may be  difficult or impossible.  5.  “Procedures for cardholders and/or custodians of the property to  follow when property is determined to be missing, stolen, or  damaged.”
Table 5 includes assessments of the five areas for each agency that was  included in our 300-transaction random sample. Following the table are  summaries of our analysis on the areas where the agency’s policies and  procedures did not address all aspects of the guidance.
subsections: section_title: Department of Agriculture
paragraphs: The Department of Agriculture policy set the dollar-value threshold for  accountable property at $5,000 and delegated responsibility for defining a  list of sensitive items to its components. Our random sample included  transactions from four components that we then reviewed. The Farm  Service Agency, the Agricultural Research Service, and the Forest  Service provided a list of sensitive items. The other component we  reviewed, the Food Safety and Inspection Service, reported that it does  not have a list of sensitive items and does not classify items as sensitive.
For the first part of fiscal year 2014, the agency’s policy required  independent receipt and acceptance for purchases above $300; however,  the policy did not specify procedures for items received in remote  locations or during emergency or urgent conditions. The agency revised  its purchase card policy in April 2014, including a change to the  independent receipt and acceptance requirement, among other changes.  The new policy did not require independent receipt and acceptance for  purchases, but encouraged the separation of duties.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of Commerce
paragraphs: The Department of Commerce policy did not have an agency-wide  requirement of independent receipt and acceptance for transactions,  though it encouraged the separation of duties. The agency policy  delegated responsibility for establishing independent receipt and  acceptance or subsequent review of purchases to its components. Our  random sample included transactions from two components that we then  reviewed—the Office of the Secretary and the National Oceanic and  Atmospheric Administration. These components did not have separate  policies and followed the agency-wide policy.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of Defense
paragraphs: The Department of Defense policies and procedures addressed all  aspects of the OMB guidance.
section_title: Department of Health and Human Services
paragraphs: The Department of Health and Human Services policies and procedures  addressed all aspects of the OMB guidance.
section_title: Department of Homeland Security
paragraphs: The Department of Homeland Security policy required independent third- party receipt for purchases, except for shipping, subscriptions, training, or  similar purchases; however, it did not specify procedures for items  received in remote locations or during emergency or urgent conditions.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of Housing and Urban Development
paragraphs: The Department of Housing and Urban Development policy instructed the  cardholder to provide clear and precise shipping instructions and to retain  proof of receipt documentation, but did not specifically mention  independent receipt and acceptance. An agency official confirmed that  the Department of Housing and Urban Development policy did not require  independent receipt and acceptance for purchases in fiscal year 2014.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of Justice
paragraphs: The Department of Justice was unable to provide policies and procedures  in effect for fiscal year 2014 that addressed two of the five areas: (1) the  process of notifying the agency property-management activity of property  receipt and (2) the process for recording and tracking such property.
Additionally, the agency’s policies addressed only some aspects of two  other areas: (1) the documentation of independent receipt and  acceptance, when appropriate, and (2) procedures for addressing  missing, stolen, or damaged property. The agency’s policies noted that  the purchase must be received in “accordance with the Government’s  requirements,” but did not provide additional details on independent  receipt and acceptance, including procedures for items received in  remote locations or during emergency or urgent conditions. According to  agency officials, independent receipt and acceptance was required for  most of the Department of Justice transactions in our random sample.
Further, the Department of Justice policies noted that during annual and  biennial physical inventories of agency property every effort must be  made to locate missing property. However, the policy did not address the  procedures for addressing property once it had been determined to be  missing, stolen, or damaged.
section_title: Department of State
paragraphs: The Department of State policy required cardholders to complete a  receiving report for accountable or sensitive property and affix a bar- coded property sticker to the item, but did not further detail the process  for recording the property in the property tracking and financial systems.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of the Interior
paragraphs: The Department of the Interior policy did not specifically mention  independent receipt and acceptance. The agency’s policy documents  provided instructions when someone other than the cardholder received  the purchase, implying that independent receipt and acceptance was not  required for purchases. Agency officials confirmed that the agency policy  did not require independent receipt and acceptance for purchases in  fiscal year 2014. The agency’s policy does require that an authorized  recipient sign a property receipt for accountable or sensitive property after  the cardholder initially receives the purchase.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Department of Veterans Affairs
paragraphs: The Department of Veterans Affairs required independent receipt and  acceptance for certain types of purchases. For the first part of fiscal year  2014, the agency’s policy assigned cardholders as authorized signers for  purchases so that the cardholder’s electronic signature in the  computerized accountability system served as documentation of receipt.  In May 2014, the agency clarified that all self-generated transactions  made with a purchase card required independent verification of receipt.  However, the Department of Veterans Affairs policy did not address  independent receipt procedures for items received in remote locations or  during emergency or urgent conditions.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Environmental Protection Agency
paragraphs: The Environmental Protection Agency policy required third-party  verification of delivery for all purchase card transactions; however, it did  not specify procedures for items received in remote locations or during  emergency or urgent conditions.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: National Aeronautics and Space Administration
paragraphs: National Aeronautics and Space Administration policy required  independent receipt and acceptance for purchases above $500; however,  it did not specify procedures for items received in remote locations or  during emergency or urgent conditions.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: National Archives and Records Administration
paragraphs: National Archives and Records Administration policy did not specifically  mention independent receipt and acceptance, though the policy  encouraged the separation of duties. An agency official confirmed that the  agency’s policy did not require independent receipt and acceptance for  purchases in fiscal year 2014.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: National Science Foundation
paragraphs: The National Science Foundation’s policies and procedures addressed all  aspects of the OMB guidance.
section_title: Smithsonian Institution
paragraphs: The Smithsonian Institution’s policies and procedures addressed all  aspects of the OMB guidance.
section_title: Social Security Administration
paragraphs: The Social Security Administration policy required independent receipt  and acceptance for purchases where the cardholder and requestor were  the same; however, it did not specify procedures for items received in  remote locations or during emergency or urgent conditions.
The agency’s policies and procedures addressed all other aspects of the  OMB guidance.
section_title: Appendix III: Comments from the General Services Administration
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact name above, individuals making contributions to  this report include Philip Reiff (Assistant Director), Katherine Carter,  Charles Culverwell, Carrie Davidson, Colin Fallon, Justin Fisher, Amber  D. Gray, Samuel Harris, Robert Heilman, Olivia Lopez, Daniel McKenna,  Maria McMullen, Madeline Messick, Kevin Metcalfe, James Murphy, Anna  Maria Ortiz, Daniel Purdy, Michael Rebman, Thomas Twambly, Ariel  Vega, and Nick Weeks.