Governmentwide Purchase Cards: Actions Needed to Strengthen Internal Controls to Reduce Fraudulent, Improper, and Abusive Purchases
Published: 2008-03-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Over the past several years, GAO has issued numerous reports and testimonies on internal control breakdowns in certain individual agencies' purchase card programs. In light of these findings, GAO was asked to analyze purchase card transactions governmentwide to (1) determine whether internal control weaknesses existed in the government purchase card program and (2) if so, identify examples of fraudulent, improper, and abusive activity. GAO used statistical sampling to systematically test internal controls and data mining procedures to identify fraudulent, improper, and abusive activity. GAO's work was not designed to determine the overall extent of fraudulent, improper, or abusive transactions.
section_title: What GAO Found
paragraphs: Internal control weaknesses in agency purchase card programs exposed the federal government to fraud, waste, abuse, and loss of assets. When testing internal controls, GAO asked agencies to provide documentation on selected transactions to prove that the purchase of goods or services had been properly authorized and that when the good or service was delivered, an individual other than the cardholder received and signed for it. Using a statistical sample of purchase card transactions from July 1, 2005, through June 30, 2006, GAO estimated that nearly 41 percent of the transactions failed to meet either of these basic internal control standards. Using a second sample of transactions over $2,500, GAO found a similar failure rate--agencies could not demonstrate that 48 percent of these large purchases met the standard of proper authorization, independent receipt and acceptance, or both. Breakdowns in internal controls, including authorization and independent receipt and acceptance, resulted in numerous examples of fraudulent, improper, and abusive purchase card use. These examples included instances where cardholders used purchase cards to subscribe to Internet dating services, buy video iPods for personal use, and pay for lavish dinners that included top-shelf liquor. GAO identified some of the case studies, including one case where a cardholder used the purchase card program to embezzle over $642,000 over a period of 6 years from the Department of Agriculture's Forest Service firefighting fund. This cardholder was sentenced to 21 months in prison and ordered to pay full restitution. In addition, agencies were unable to locate 458 items of 1,058 total accountable and pilferable items totaling over $2.7 million that GAO selected for testing. These missing items, which GAO considered to be lost or stolen, totaled over $1.8 million and included computer servers, laptop computers, iPods, and digital cameras. For example, the Department of the Army could not adequately account for 256 items making up 16 server configurations, each of which cost nearly $100,000.

section_title: Letter
paragraphs: The serious fiscal challenges facing the federal government demand that  agencies do everything they can to operate as efficiently as possible. The  federal government spends billions annually through its purchase card  programs, using purchase cards and convenience checks to acquire  millions of items—everything from paper and pencils to computers—and  to make payments on government contracts for a variety of goods and  services, such as vehicles and relocation services. The primary  responsibility for purchasing these items rests with cardholders and the  officials who approve their purchases. Because of the position of public  trust held by federal employees, Congress and the American people expect  cardholders and approving officials to maintain stewardship over the  federal funds at their disposal. Specifically, purchase cardholders and  approving officials are expected to follow published acquisition  requirements and exercise a standard of care in acquiring goods and  services that is necessary and reasonable (i.e., not extravagant or  excessive) for the proper operation of an agency. Because every federal  dollar that is spent on fraudulent, improper, and abusive purchases is a  dollar that cannot be used for necessary government goods and services,  ensuring that purchase cards are used responsibly is of particular concern  at a time when the United States is experiencing substantial fiscal  challenges.
Our previous work has shown that using the purchase card for small  purchases has reduced administrative costs and increased the flexibility to  meet a variety of government needs. If properly used, purchase cards can  also help to fulfill other objectives, such as providing opportunities for  small, disadvantaged businesses. The Federal Acquisition Regulation  (FAR) designates the purchase card as the preferred method for making  micropurchases. At the time of our audit, a micropurchase was defined as  any purchase under $2,500. In addition to making micropurchases,  government purchase cards may also be used to make payments under  established contracts. According to the General Services Administration  (GSA), the purchase card program had substantially improved  procurement efficiencies, which resulted in about $1.8 billion in annual  savings, as compared to prior paper-based procurement processes. GSA  also asserted that in fiscal year 2007, the five credit card banks provided  government agencies with refunds exceeding $170 million from card  activity.
The purchase card program had brought substantial cost reduction to the  federal procurement process. However, since calendar year 2001, we have  testified and reported on the purchase card programs at a number of  agencies, which demonstrated that if not properly managed and  controlled, use of the purchase card results in fraud, waste, and abuse (see  app. I for previous GAO reports). For example, in September 2006, we  reported that weaknesses in the Department of Homeland Security’s  (DHS) purchase card program resulted in over 100 lost (and presumed  stolen) laptop computers; unauthorized acquisition and excessive cost  related to the purchase of 20 flat-bottom boats, 12 of which were missing;  and thousands of meals ready-to-eat stored in a warehouse in El Paso,  Texas, more than 7 months after they were purchased for DHS employees  assisting with the response to hurricanes Katrina and Rita.
In response to our findings of fraud, waste, and abuse at the Department  of Defense (DOD), Congress enacted legislation specifically directed at  improving the management of DOD’s purchase card program. However,  concerns remain over whether purchase card usage continues to expose  the federal government to increased risk of fraud, waste, and abuse.  Therefore, you asked us to (1) determine whether internal control  weaknesses in the purchase card program existed governmentwide and  (2) if so, identify specific examples of fraudulent, improper, and abusive  activity.
To identify control weaknesses and specific examples of fraudulent,  improper, and abusive activity, we reviewed applicable federal laws and  regulations related to the FAR and purchase card uses. We also identified  and applied the internal control principles contained in Standards for  Internal Control in the Federal Government, Audit Guide: Auditing and  Investigating the Internal Control of Government Purchase Card  Programs, and selected agencies’ purchase card policies and  procedures. We then obtained purchase card transaction data from the  five banks that supplied purchase cards governmentwide. Using these  data, we selected two probability (statistical) samples of purchase card  activities—one covering the population of purchase card activity over $50  from July 1, 2005, through June 30, 2006, totaling almost $14 billion, and a  second sample covering acquisitions over the micropurchase threshold  during the same time period. In our statistical samples, we included  purchase card transactions from federal agencies that are required to  follow the FAR, including executive departments, independent  establishments, and wholly owned federal government corporations as  defined by the United States Code. We refer to these entities as executive  agencies. We excluded transactions from the legislative and judicial  branches, entities under treaty with the United States, and federal agencies  with specific authority over their own purchase card programs. We tested  these samples for proper authorization and independent receipt and  acceptance. Where the purchase involved the acquisition of accountable  or highly pilferable items that can easily be converted to personal use,  such as cameras, laptops, cell phones, and iPods, we performed work to  verify that the government could account for or had possession of these  items.
To identify additional examples of fraudulent, improper, and abusive  purchase card activity, we data mined purchase card transactions from  July 1, 2005, through September 30, 2006. This period included an  additional 3 months of data subsequent to the period included in our  statistical samples. We data mined using a number of criteria, including  identifying vendors of goods or services prohibited by the agency or likely  to be for personal use, split purchases, year-end purchases, and pilferable  and accountable property purchases, among others. We also data mined  transactions from federal agencies that had been granted specific  authority over their own purchase card programs, such as the U.S. Postal  Service (USPS). For these transactions, we requested and reviewed  supporting documentation provided by the agency and conducted  investigative work. Where a data-mining transaction was related to the  acquisition of accountable and pilferable property, we also performed  work to verify that the government had possession of the purchased items.  While we identified fraudulent, improper, and abusive transactions, our  work was not designed to identify, and we cannot determine, the extent of  fraud, waste, and abuse occurring in the population of governmentwide  purchase card transactions.
We conducted this performance audit from September 2006 through  February 2008 in accordance with U.S. generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives. We performed our  investigative work in accordance with standards prescribed by the  President’s Council on Integrity and Efficiency. Appendix II provides  further detail on our scope and methodology.
subsections: section_title: Background
paragraphs: GSA administers the federal government’s SmartPay® purchase card  program, which has been in existence since the late 1980s. The purchase  card program was created as a way for agencies to streamline federal  acquisition processes by providing a low-cost, efficient vehicle for  obtaining goods and services directly from vendors. The purchase card  can be used for simplified acquisitions, including micropurchases, as well  as to place orders and make payments on contract activities. The FAR  designated the purchase card as the preferred method of making  micropurchases. In addition, part 13 of the FAR, “Simplified Acquisition  Procedures,” establishes criteria for using purchase cards to place orders  and make payments. Figure 1 shows the dramatic increase in purchase  card use since the inception of the SmartPay® program.
As shown in figure 1, during the 10-year period from fiscal year 1996  through 2006, acquisitions made using purchase cards increased almost  fivefold—from $3 billion in fiscal year 1996 to $17.7 billion in fiscal year  2006. Figure 2 provides further information on the number of purchase  cardholder accounts. As shown, the number of purchase cardholder  accounts peaked in 2000 at more than 670,000, but since then the number  of purchase cardholder accounts has steadily decreased to around 300,000.
Cardholder (in thouand)
As the contract administrator of the program, GSA contracts with five  different commercial banks in order to provide purchase cards to federal  employees. The five banks with purchase card contracts are (1) Bank of  America, (2) Citibank, (3) Mellon Bank, (4) JPMorgan Chase, and (5) U.S.  Bank. GSA also has created several tools, such as the Schedules Program,  so that cardholders can take advantage of favorable pricing for goods and  services. Oversight of the purchase card program is also the responsibility  of OMB. OMB provides overall direction for governmentwide procurement  policies, regulations, and procedures to promote economy, efficiency, and  effectiveness in the acquisition processes. Specifically, in August 2005,  OMB issued Appendix B to Circular No. A-123, Improving the  Management of Government Charge Card Programs, that established  minimum requirements and suggested best practices for government  charge card programs.
From July 1, 2005, through June 30, 2006, GSA reported that federal  agencies purchased over $17 billion of goods and services using  government purchase cards. Our analysis of transaction data provided by  the five banks found that micropurchases represented 97 percent of  purchase card transactions and accounted for almost 57 percent of the  dollars expended. Using purchase cards for acquisitions and payments  over the micropurchase limit of $2,500 represented about 3 percent of  purchase transactions and accounted for more than 44 percent of the  dollars spent from July 1, 2005, through June 30, 2006.
section_title: Key Internal Controls Were Ineffective
paragraphs: Internal control weaknesses in agency purchase card programs exposed  the federal government to fraudulent, improper, and abusive purchases  and loss of assets. Our statistical testing of two key transaction-level  controls over purchase card transactions over $50 from July 1, 2005,  through June 30, 2006, found that both controls were ineffective. In  aggregate, we estimated that 41 percent of purchase card transactions  were not properly authorized or purchased goods or services were not  properly received by an independent party (independent receipt and  acceptance). We also estimated that 48 percent of purchases over the  micropurchase threshold were either not properly authorized or  independently received. Further, we found that agencies could not provide  evidence that they had possession of, or could otherwise account for, 458  of 1,058 accountable and pilferable items.
subsections: section_title: Overall Results of Transaction-Based Internal Control Testing
paragraphs: According to Standards for Internal Control in the Federal Government,  internal control activities help ensure that management’s directives are  carried out. The control activities should be effective and efficient in  accomplishing the agency’s control objectives and should occur at all  levels and functions of an agency. The controls include a wide range of  activities, such as approvals, authorizations, verifications, reconciliations,  performance reviews, and the production of records and documentation.
For this audit, we tested those control activities that we considered to be  key in creating a system that prevents and detects fraudulent, improper,  and abusive purchase card activity. To this end, we tested whether (1)  cardholders were properly authorized to make their purchases and (2)  goods and services were independently received and accepted. As shown  in table 1, we estimated that the overall failure rate for the attributes we  tested was 41 percent, with failure rates of 15 percent for authorization  and 34 percent for receipt and acceptance.
Lack of proper authorization. As shown in table 1, 15 percent of all  transactions failed proper authorization. According to Standards for  Internal Control in the Federal Government, transactions and other  significant events should be authorized and executed only by persons  acting within the scope of their authority, as this is the principal means of  assuring that only valid transactions to exchange, transfer, use, or commit  resources and other events are initiated or entered into. To test  authorization, we accepted as reasonable evidence various types of  documentation, such as purchase requests or requisitions from a  responsible official, e-mails, and other documents that identify an official  government need, including blanket authorizations for routine purchases  with subsequent review by an approving official.
The lack of proper authorization occurred because (1) the cardholder  failed to maintain sufficient documentation, (2) the agency’s policy did not  require authorization, or (3) the agency lacked the internal controls and  management oversight to identify purchases that were not authorized— increasing the risk that agency cardholders will misuse the purchase card.  Failure to require cardholders to obtain appropriate authorization and lack  of management oversight increase the risk that fraudulent, improper, and  other abusive activity will occur without detection.
Lack of independent receipt and acceptance. As depicted in table 1, our  statistical sampling of executive agency purchase card transactions also  found that 34 percent of transactions failed independent receipt and  acceptance, that is, goods or services ordered and charged to a  government purchase card account were not received by someone other  than the cardholder. According to Standards for Internal Control in the  Federal Government, the key duties and responsibilities need to be  divided or segregated among different people to reduce the risk of error or  fraud. Segregating duties entails separating the responsibilities for  authorizing transactions, processing and recording them, reviewing the  transactions, and handling related assets. The standards further state that  no one individual should control all key aspects of a transaction or event.
As evidence of independent receipt and acceptance, we accepted any  signature or initials of someone other than the cardholder on the sales  invoice, packing slip, bill of lading, or any other shipping or receiving  document. We found that lack of documented, independent receipt  extended to all types of purchases, including pilferable items such as  laptop computers. Independent receipt and acceptance helps provide  assurance that purchased items are only acquired for legitimate  government need and not for personal use.
subsections: section_title: Historical Results of Transaction-Based Internal Control Testing
paragraphs: Although we did not test the same number of attributes as in previous  audits of specific agencies’ purchase card programs, for those attributes  we tested, the estimated governmentwide failure rates shown in this  report are lower than the failure rates we have previously reported for  certain individual agencies. Table 2 provides failure rates from our prior  work related to proper approval and independent receipt and acceptance  for certain individual agencies.
As shown, estimated failure rates for independent receipt and acceptance  from previous audits were as high as 87 percent for one Army location (as  reported in 2002)  and, most recently, 63 percent for DHS (as reported in  2006). In contrast, we are estimating a 34 percent failure rate for this audit.  Because prior audits have been restricted to individual agencies, we  cannot state conclusively that the lower failure rate is attributable to  improvements in internal controls governmentwide. However, some  agencies with large purchase card programs, such as DOD, have  implemented improved internal controls in response to our previous  recommendations. Further, in 2005, OMB also issued Appendix B to  Circular No. A-123 prescribing purchase card program guidance and  requirements. These changes are positive steps in improving internal  controls over the purchase card program.
section_title: Results of Transaction- Based Internal Control Testing Exceeding Micropurchase Limit
paragraphs: While only 3 percent of governmentwide purchase card transactions from  July 1, 2005, through June 30, 2006, were purchases above the  micropurchase threshold of $2,500, these transactions accounted for 44  percent of the dollars spent during that period. Because of the large dollar  amount associated with these transactions, and additional requirements  related to authorization than are required for micropurchases, we drew a  separate statistical sample to test controls over these larger purchases.  Specifically, we tested (1) proper purchase authorization and (2)  independent receipt and acceptance. As part of our test of proper  purchase authorization, we looked for evidence that adequate competition  was obtained. If competition was not obtained, we asked for supporting  documentation showing that competition was not required, for example,  that the purchase was acquired from sole-source vendors.
We estimated that 48 percent of the purchase card transactions over the  micropurchase threshold failed our attribute tests. As shown in table 3, for  35 percent of purchases over the micropurchase threshold, cardholders  failed to obtain proper authorization. Additionally, in 30 percent of the  transactions, cardholders failed to provide sufficient evidence of  independent receipt of the goods or services.
Lack of proper authorization for purchases over the micropurchase  limit. As table 3 indicates, 35 percent of purchases over the  micropurchase limit were not properly authorized. To test for proper  authorization, we looked for evidence of prior approval, such as a contract  or other requisition document. For purchases above the micropurchase  threshold, we also required evidence that the cardholder either solicited  competition or provided reasonable evidence for deviation from this  requirement, such as sole source justification.
Of the 34 transactions that failed proper authorization, 10 transactions  lacked evidence of competition. For example, one Army cardholder  purchased computer equipment totaling over $12,000 without obtaining  and documenting price quotes from three vendors as required by the FAR.  The purchase included computers costing over $4,000 each, expensive  cameras that cost $1,000 each, and software and other accessories—items  that are supplied by a large number of vendors. In another example of  failed competition, one cardholder at DHS purchased three personal  computers totaling over $8,000. The requesting official provided the  purchase cardholder with the computers’ specifications and a request that  the item be purchased from the requesting official’s preferred vendor. We  found that the cardholder did not apply due diligence by obtaining  competitive quotes from additional vendors. Instead, the cardholder asked  the requesting official to provide two “higher priced” quotes from  additional vendors in order to justify obtaining the computers from the  requesting official’s preferred source. In doing so, the cardholder  circumvented the rules and obtained the items without competitive  sourcing as required by the FAR.
Lack of independent receipt and acceptance. As shown in table 3, we  projected that 30 percent of the purchases above the micropurchase  threshold did not have documented evidence that goods or services  ordered and charged to a government purchase card account were  received by someone other than the cardholder.
section_title: Failure to Maintain Accountability over Physical Assets
paragraphs: Our testing of a nonrepresentative selection of accountable and pilferable  property acquired with government purchase cards found that agencies  failed to account for 458 of the 1,058 accountable and pilferable property  items we tested. The total value of the items was over $2.7 million, and the  purchase amount of the missing items was over $1.8 million. We used a  nonrepresentative selection methodology for testing accountable property  because purchase card data did not always contain adequate detail to  enable us to isolate property transactions for statistical testing. Because  we were not able to take a statistical sample of these transactions, we  were not able to project inventory failure rates for accountable and  pilferable property. Similarly, because the scope of our work was  restricted to purchase card acquisitions, we did not audit agencies’  controls over accountable property acquired using other procurement  methods. However, the extent of the missing property we are reporting on  may not be restricted to items acquired with the government purchase  cards, but may reflect control weaknesses in agencies’ management of  accountable property governmentwide.
The lost or stolen items included computer servers, laptop computers,  iPods, and digital cameras. Our prior reports have shown that weak  controls over accountable property purchased with government purchase  cards increases the risk that items will not be reported and accounted for  in property management systems. We acknowledge agency officials’  position that the purchase card program was designed to facilitate  acquisition of goods and services, including property, and not specifically  to maintain accountability over property. However, the sheer number of  accountable property purchases made “over the counter” or directly from  a vendor increases the risk that the accountable or pilferable property  would not be reported to property managers for inclusion in the property  tracking system. Unrecorded assets decrease the likelihood of detecting  lost or stolen government property. In addition, if these items were used to  store sensitive data, this information could be lost, stolen, or both without  the knowledge of the government. Failure to properly account for  pilferable and accountable property also increases the risk that agencies  will purchase property they already own but cannot locate—further  wasting tax dollars.
Although each agency establishes its own threshold for recording and  tracking accountable property, additional scrutiny is necessary for  sensitive items (such as computers and related equipment) and items that  are easily pilfered (such as cameras, iPods, and personal digital assistants  (PDA)). Consequently, for this audit, we selected $350 as the threshold for  our accountable property test. Standards for Internal Control in the  Federal Government provides that an agency must establish physical  control to secure and safeguard vulnerable assets. Examples include  security for, and limited access to, assets such as cash, securities,  inventories, and equipment, which might be vulnerable to risk of loss or  unauthorized use. Failure to maintain accountability over property,  including highly pilferable items, increases the risk of unauthorized use  and lost and stolen property.
Our accountable asset work consisted of identifying accountable and  pilferable properties associated with transactions from both the statistical  sample and data-mining transactions, requesting serial numbers from the  agency and vendors, and obtaining evidence—such as a photograph  provided by the agency—that the property was recorded, could be located,  or both. In some instances, we obtained the photographs ourselves. We  then evaluated each photograph to determine whether the photograph  represented the accountable or pilferable item we selected for testing.  Property items failed our physical property inventory tests for various  reasons, including the following:  the agency could not locate the item upon request and reported the  item as missing,  the agency failed to provide photographs, or  the agency provided photographs of items where the serial numbers  did not match the items purchased.
In many instances, we found that agencies failed to provide evidence that  the property was independently received or entered into the agency  property book. Weak controls over accountable and pilferable property  increase the risk that property will be lost or stolen and also increase the  chance that the agency will purchase more of the same item because it is  not aware that the item has already been purchased. The following  descriptions further illustrate transactions that failed our property tests:    The Army could not properly account for 16 server configurations  containing 256 items that it purchased for over $1.5 million dollars.  Despite multiple inquiries, the Army provided photographs of only 1  configuration out of 16, but did not provide serial numbers for that  configuration to show that the photograph represented the items  acquired as part of the transaction we selected for testing. Further,  when we asked for inventory records as an acceptable alternative, the  Army could not provide us evidence showing that it had possession of  the 16 server configurations.
A Navy cardholder purchased general office supplies totaling over  $900. As part of this purchase, the cardholder bought a Sony digital  camera costing $400 and an iPod for $200. In supporting  documentation provided, the Navy stated that the cardholder,  approving official, and requester had no recollection of requesting or  receiving the iPods. To find out whether these pilferable items could  have been converted for personal use and effectively stolen, we asked  the Navy to provide a photograph of the camera and iPod, including the  serial number. However, the Navy informed us that the items were not  reported on a property tracking system and therefore could not be  located.
section_title: Fraudulent and Potentially Fraudulent, Improper, and Abusive Transactions
paragraphs: We found numerous instances of fraud, waste, and abuse related to the  purchase card program at dozens of agencies across the government.  Internal control weaknesses in agency purchase card programs directly  increase the risk of fraudulent, improper, and abusive transactions. For  instance, the lack of controls over proper authorization increases an  agency’s risk that cardholders will improperly use the purchase card. As  discussed in appendix II, our work was not designed to identify all  instances of fraudulent, improper, and abusive government purchase card  activity or estimate their full extent. Therefore, we did not determine and  make no representations regarding the overall extent of fraudulent,  improper, and abusive transactions governmentwide. The case studies  identified in the tables that follow represent some of the examples that we  found during our audit and investigation of the governmentwide purchase  card program.
subsections: section_title: Fraudulent and Potentially Fraudulent Activities
paragraphs: We found numerous examples of fraudulent and potentially fraudulent  purchase card activities. For the purpose of this report, we define  fraudulent transactions as those where a fraud case had been adjudicated  or was undisputed or a purchase card account had been compromised.  Potentially fraudulent transactions are those transactions where there is a  high probability of fraud, but where sufficient evidence did not exist for us  to determine that fraud had indeed occurred. As shown in table 4, these  transactions included (1) acquisitions by cardholders that were  unauthorized and intended for personal use and (2) purchases  appropriately charged to the purchase card but involving potentially  fraudulent activity that went undetected because of the lack of integration  among the processes related to the purchase, such as travel claims or  missing property.
In a few instances, agencies have taken actions on the fraudulent and  potentially fraudulent transactions we identified. For example, some  agency officials properly followed policies and procedures and filed  disputes with the bank against fraudulent purchases that appeared on the  card, and subsequently obtained refunds. However, in the most egregious  circumstances, such as repeated fraudulent activities by the cardholders,  sometimes over several years, the agencies did not take actions until  months after the fraudulent activity occurred, or after we selected the  transactions and requested documentation from the agencies for the  suspicious transactions. Table 4 illustrates instances where we found  fraud, or indications of fraud, from our data mining and investigative  work.
The following text further describes three of the fraudulent cases from  table 4:    Case 1 involves a cardholder who embezzled over $642,000 from the  Forest Service’s national fire suppression budget from October 10,  2000, through September 28, 2006. This cardholder, a purchasing agent  and agency purchase card program coordinator, wrote approximately  180 checks to a live-in boyfriend with whom the cardholder shared a  bank account. Proceeds from the checks were used for personal  expenditures, such as gambling, car and mortgage payments, dinners,  and retail purchases. Although the activities occurred repeatedly over a  6-year period, the embezzled funds were undetected by the agency until  USDA’s Office of Inspector General received a tip from a whistleblower  in 2006. In June 2007, the cardholder pled guilty to one count of  embezzlement and one count of tax fraud. As part of the plea  agreement, the cardholder agreed to pay restitution of $642,000.  Further, in November 2007, the cardholder was sentenced to 21 months  imprisonment followed by 36 months supervised release.
Case 2 involves a potential theft of government property. A Navy  cardholder purchased 19 pilferable items totaling $2,200 from  CompUSA without proper authorization or subsequent review of the  purchase transaction. After extensive searches, the Navy provided  evidence that only 1 of the 19 items listed on the invoice—an HP  LaserJet printer purchased for $150—was found. Other items that were  lost or stolen included five iPods; a PDA; iPod travel chargers,  adapters, flash drives, leather accessories, and two 17-inch LCD  monitors—all highly pilferable property that can be easily diverted for  personal use. According to officials from the Navy, at the time of the  purchase, the command did not have a requirement for tracking highly  pilferable items. Additionally, all members involved in the transaction  had since transferred and the agency did not have the capability to  track where the items might have gone. Navy officials also informed us  that the command issued a new policy requiring that pilferable items be  tracked.
Case 4 involves a USPS postmaster who fraudulently used the  government purchase card for personal gain. Specifically, from April  2004, through October 2006, the cardholder made more than 15  unauthorized charges from various online dating services totaling more  than $1,100. These were the only purchases made by this cardholder  during our audit period, yet the cardholder’s approving official did not  detect any of the fraudulent credit card activity. According to USPS  officials, this person was also under an internal administrative  investigation for viewing pornography on a government computer.  Based on the administrative review, the cardholder was removed from  his position in November 2006 after working out an agreement with  USPS in which he was authorized to remain on sick leave until his  retirement date in May 2007. In April the USPS Office of Inspector  General issued a demand letter and recovered the fraudulent Internet  dating service charges.
section_title: Improper and Abusive Purchases
paragraphs: Our data mining identified numerous examples of improper and abusive  transactions. Improper transactions are those purchases that although  intended for government use, are not permitted by law, regulation, or  government/agency policy. Examples we found included (1) purchases  that were prohibited or otherwise not authorized by federal law,  regulation, or government/agency policy and (2) split purchases made to  circumvent the cardholder single-purchase limit or to avoid the need to  obtain competition on purchases over the $2,500 micropurchase  threshold. Abusive purchases are those where the conduct of a  government organization, program, activity, or function fell short of  societal expectations of prudent behavior. We found examples of abusive  purchases where the cardholder (1) purchased goods or services at an  excessive cost (e.g., gold plated) or (2) purchased an item for which  government need was questionable. Table 5 identifies examples of  improper and abusive purchases.
The following text further describes four of the cases in table 5:    Case 2 relates to a cardholder who is a 20-year veteran at FAS, a unit  within USDA. At the end of fiscal year 2006, the cardholder purchased  two vehicles—a Toyota Land Cruiser and Toyota Sienna—on two  separate days for two separate USDA offices overseas. Although the  vehicles appeared to have been shipped overseas for a legitimate  government need, our investigative work found that these purchases  were made in violation of USDA purchase card policies and with the  implicit agreement by FAS policyholders as follows:    According to written communications at FAS, the requester for one  of the cars had a “large chunk of money that needed to be used  before the end of the fiscal year (2006).” The requester requested  that the vehicle be purchased in the United States, and then shipped  overseas because it was not possible to finalize the purchase during  fiscal year 2006 if the agency was to purchase the vehicle in the  country where the office was located.
The cardholder stated that he wrote three checks (two at $25,000  each and a third at $7,811) to purchase the Land Cruiser because  the checks have a $25,000 limit printed on them. The convenience  check fee on the three checks was over $1,000.
Pursuant to our investigation, the cardholder informed his  supervisor that he intentionally violated agency policy, which  requires that vehicles be acquired through the GSA unless a waiver  is obtained. The cardholder stated that he disagreed with USDA  policy requiring GSA involvement in car acquisition because it was  too cumbersome and that USDA needed to issue new policies.
We reviewed supporting documentation showing that the vehicles  were shipped overseas to the units that purchased them, but we did  not perform work to determine whether the year-end purchase was  necessary.
Agency management did not take action when they were made  aware of the cardholder’s significant violation of agency policy.
In case 3, four DOD cardholders purchased over $77,000 in clothing  and accessories at high-end clothing and other sporting goods stores,  including over $45,000 at high-end retailers such as Brooks Brothers.  The Brooks Brothers invoices showed that the cardholders paid about  $2,300 per person for a number of servicemembers for tailor-made suits  and accessories—$7,000 of which were purchased a week before  Christmas. According to the purchase card holder, DOD purchased  these items to provide servicemembers working at American embassies  with civilian attire. While the Department of Defense Financial  Management Regulation authorizes a “civilian clothing allowance”  when servicemembers are directed to dress in civilian clothing when  performing official duty, the purchase card transactions made by these  individuals are far greater than the maximum allowable initial civilian  clothing allowance of $860 per person.
Case 7 relates to the $13,500 that USPS spent on food at the National  Postal Forum in Orlando, Florida, in 2006. For this occasion, USPS paid  for 81 dinners averaging over $160 per person for customers of the  Postal Customer Council at an upscale steak restaurant. Further,  USPS paid for over 200 appetizers and over $3,000 of alcohol, including  more than 40 bottles of wine costing more than $50 each and brand- name liquor such as Courvoisier, Belvedere, and Johnny Walker Gold.
In case 9, a NASA cardholder purchased two 60GB iPods for official  data storage. During the course of our audit, we found that the iPods  were used for personal use, such as to store personal photos, songs,  and video clips. Further, we question the federal government’s need to  purchase iPods for data storage when other data storage devices  without audio and video capabilities were available at lower cost.
section_title: Conclusions
paragraphs: The purchase card continues to be an effective tool that helps agencies  reduce transaction costs for small purchases and provides flexibility in  making acquisitions. While the overall failure rates associated with  governmentwide purchase card transactions have improved in comparison  to previous failure rates at specific agencies, breakdowns in internal  controls over the use of purchase cards leave the government highly  vulnerable to fraud, waste, and abuse. Problems continue to exist in the  area of authorization of transactions, receipt and acceptance, and  accountability of property bought with purchase cards. This audit  demonstrates that continued vigilance over purchase card use is necessary  if agencies are to realize the full potential of the benefits provided by  purchase cards.
section_title: Recommendations for Executive Action
paragraphs: We are making the following 13 recommendations to improve internal  control over the government purchase card program and to strengthen  monitoring and oversight of purchase cards as part of an overall effort to  reduce instances of fraudulent, improper, and abusive purchase card  activity.
We recommend that the Director of OMB:  Issue a memorandum reminding agencies that internal controls over  purchase card activities, as detailed in Appendix B of OMB Circular No.  A-123, extend to the use of convenience checks.
Issue a memorandum to agency heads requesting the following:    Cardholders, approving officials, or both reimburse the government  for any unauthorized or erroneous purchase card transactions that  were not disputed.
When an official directs a cardholder to purchase a personal item  for that official, and management later determines that the purchase  was improper, the official who requested the item should reimburse  the government for the cost of the improper item.
Consistent with the goals of the purchase card program, to streamline the  acquisition process, we recommend that the Administrator of GSA, in  consultation with the Department of the Treasury’s Financial Management  Service:    Provide agencies guidance on how cardholders can document  independent receipt and acceptance of items obtained with a purchase  card. The guidelines should encourage agencies to  identify a de minimis amount, types of purchases that do not require  documenting independent receipt and acceptance, or both and  indicate that the approving official or supervisor took the necessary  steps to ensure that items purchased were actually received.
Provide agencies guidance regarding what should be considered  sensitive and pilferable property. Because purchase cards are  frequently used to obtain sensitive and pilferable property, remind  agencies that computers, palm pilots, digital cameras, fax machines,  printers and copiers, iPods, and so forth are sensitive and pilferable  property that can easily be converted to personal use.
Instruct agencies to remind government travelers that when they  receive government-paid-for meals at conferences or other events, they  must reduce the per diem claimed on their travel vouchers by the  specified amount that GSA allocates for the provided meal.
Provide written guidance or reminders to agencies:    That cardholders need to obtain prior approval or subsequent  review of purchase activity for purchase transactions that are under  the micropurchase threshold.
That property accountability controls need to be maintained for  pilferable property, including those items obtained with a purchase  card.
That cardholders need to timely notify the property accountability  officer of pilferable property obtained with the purchase card.
That property accountability officers need to promptly record, in  agency property systems, sensitive and pilferable property that is  obtained with a purchase card.
That, consistent with the guidance on third-party drafts in the  Department of the Treasury’s Treasury Financial Manual, volume  5, chapter 4-3000, convenience checks issued on the purchase card  accounts should be minimized, and that convenience checks are  only to be used when (1) a vendor does not accept the purchase  cards, (2) no other vendor that can provide the goods or services  can reasonably be located, and (3) it is not practical to pay for the  item using the traditional procurement method.
That convenience check privileges of cardholders who improperly  use convenience checks be canceled.
section_title: Agency Comments and Our Evaluation
paragraphs: We received written comments on a draft of this report from the Acting  Controller of OMB (see app. III) and the Administrator of GSA (see app.  IV).
subsections: section_title: Response from OMB and Our Evaluation
paragraphs: In response to a draft of our report, OMB agreed with all three  recommendations. OMB agreed that the efficiencies of the purchase card  program are not fully realized unless federal agencies implement strong  and effective controls to prevent purchase card waste, fraud, and abuse.  To that end, OMB noted that it had proactively designated government  charge card management as a major focus area under Appendix B of  Circular No. A-123, Improving the Management of Government Charge  Card Programs. With respect to the recommendations contained in this  report, OMB is proposing to issue further guidance reminding agencies  that Appendix B extends to convenience checks as well as government  charge cards, and that agency personnel have financial responsibility with  regard to unauthorized and erroneous purchase card transactions.
section_title: Response from GSA and Our Evaluation
paragraphs: While GSA wholly or partially concurred with four recommendations, GSA  generally disagreed with the majority of our recommendations.  Specifically, GSA stated that it was not within the scope of its authority to  issue guidance to agencies with respect to asset accountability and receipt  and acceptance of items purchased with government purchase cards, as  these are not strictly purchase card issues. Further, GSA stated that there  are more effective ways to deal with purchase card misuse or abuse than  issuing “redundant” policy reminders or guidance. It also took exception  to our testing methodology. We agree with GSA that the problems we  identified with property accountability and receipt and acceptance go  beyond the bounds of strictly purchase card issues. However, our work  over the last several years has consistently shown substantial problems  with property accountability and independent receipt and acceptance of  goods and services, problems that arose because of the flexibility provided  by the purchase card program. We do not believe that our  recommendations related to policy guidance and reminders to strengthen  internal controls are redundant—our previous recommendations in this  area had been targeted at specific agencies we audited. With respect to  governmentwide purchase card issues, GSA’s role as the purchase card  program manager puts it in a unique position to identify challenges to  agency internal control systems and assist agencies with improving their  internal controls governmentwide. We are encouraged by OMB’s support  for aggressive and effective controls over purchase cards, and believe that  GSA can seek OMB support to overcome the perceived lack of authority.  We believe that GSA has a number of tools already at its disposal, such as  online training and annual conferences, where GSA could easily remind  cardholders and approving officials to pay particular attention to  governmentwide issues, including asset accountability and independent  receipt and acceptance of goods and services identified in this report. We  also reiterate support for our testing methodology, which included  systematic testing of key internal controls through statistical sampling.  The following contains more detailed information on GSA’s comments,  along with our response.
GSA concurred with 3 of 10 recommendations. Specifically, GSA  concurred with 2 recommendations to improve controls over convenience  checks and 1 recommendation related to approval of purchases below the  micropurchase threshold. Specifically, GSA agreed to provide written  guidance to agencies that convenience check use should be minimized,  and that improper use of convenience checks would result in cancellation  of convenience check privileges. As part of its concurrence, GSA provided  that it is not practical to strictly prohibit the use of convenience checks  given the unique nature of some suppliers or services acquired by agencies  and vendor refusal to accept purchase cards. It was not our intent to  completely eliminate the use of convenience checks. As such, we clarified  our recommendation to require only that the cardholder make a  “reasonable”—not absolute—effort to locate other vendors that can  provide the same goods and services and that accept the purchase card  prior to using convenience check. The requested revision is consistent  with our intent and therefore we have made the necessary change to our  recommendations. With respect to the third recommendation related to  approval of micropurchases, GSA agreed that cardholders need to obtain  prior approval or subsequent review of purchase card activity for purchase  transactions that are under the micropurchase threshold. However, GSA  believed that OMB needed to take the lead and incorporate this change in  its Circular No. A-123. GSA offered to help OMB revise Circular No. A-123  in this regard.
GSA stated that it partially concurred with our recommendation to remind  travelers to reduce the per diem claims on their travel vouchers when  meals are provided by the government. However, based on its response, it  appears that GSA substantially agrees with our recommendation, and that  the GSA Office of Governmentwide Policy will issue this guidance. In  actuality, GSA concurred with our recommendation but disagreed that this  was a purchase card issue. Further, GSA took exception as to whether the  requirement to deduct per diem applies to continental breakfasts, stating  that continental breakfasts did not constitute “full breakfasts.” Thus, GSA  stated that it needs to convene stakeholders in the GSA travel policy  community to consider whether the requirement for deducting per diem  should be applied to continental breakfasts. We disagree with this  assessment. If the costs of the continental breakfasts were in fact not  significant, we would not have reported on this finding; however, the basis  of our recommendation rests primarily on the fact that GSA itself paid for  continental breakfasts costing $23 per person, which was greater than the  portion of government per diem established by GSA for breakfast in any  city in the United States. GSA then proceeded to reimburse the same  employees the breakfast portion of per diem—in effect paying twice for  breakfasts. We disagree with GSA that this is an appropriate treatment of  continental breakfast, as it implies that it is appropriate for taxpayers to  pay twice for a government traveler’s meal. Consequently, we reiterate the  need for GSA to promote prudent management of taxpayer’s money, and  our support for requiring travelers to reduce their per diem if they took  advantage of the continental breakfasts provided.
GSA disagreed with all of our recommendations related to receipt and  acceptance and controls over accountable and pilferable property. GSA  stated that these issues were not within the purview of the GSA  SmartPay® program or the scope of GSA SmartPay® contracts. Further,  GSA stated that other approaches would be more effective at addressing  purchase card abuse and misuse than issuing “redundant” policy guidance  and reminders. With respect to receipt and acceptance, GSA stated that it  did not have the authority to encourage agencies to identify a de minimis  amount, types of items that do not require receipt and acceptance, or both,  or to determine how approving officials should document receipt and  acceptance. With respect to accountable property, GSA did not believe  that it should provide reminders to agencies that computers and similar  items are sensitive and pilferable property that can easily be converted to  personal use. GSA argued that what constitutes sensitive and pilferable  property is defined by agencies and is not within its purview. GSA also  believes that it does not have authority to remind cardholders to maintain  accountability of, and notify property managers when, pilferable property  is acquired with purchase cards. Finally, GSA does not believe that it can  issue reminders to property managers to record, in a timely manner,  pilferable property acquired with purchase cards in their property  management systems. GSA suggested we modify these recommendations  accordingly.
With respect to receipt and acceptance, we agree that GSA alone should  not issue guidance concerning agencies’ internal controls over purchase  cards and related payment process. We reiterate that we did not ask GSA  to take actions in isolation—instead, we recommended that GSA work  with the Department of the Treasury’s Financial Management Service to  provide guidance on improving internal controls while at the same time  streamlining the acquisition process. After all, streamlining the acquisition  process is a key objective of the purchase card program. We believe this  could be achieved, in part, by requiring independent receipt and  acceptance only for items above a de minimis amount. Further,  governmentwide guidance in this area would not be redundant—the fact  that no current guidance exists demonstrates the need for consistent  policy governmentwide that all agencies can follow. Consistent guidance  is crucial to engendering taxpayers’ confidence in the purchase card  program—as we stated above, our previous audits and our current work  showed that ineffective receipt and acceptance of goods and services  acquired with the purchase card is a widespread, governmentwide  problem. Furthermore, OMB indicated that it was extremely concerned  about purchase card abuse and supported our recommendations designed  to improve internal controls over the program. We believe that GSA can  adopt a proactive approach and coordinate with OMB to obtain its support  to overcome the perceived obstacles. In our opinion, the purchase card  program will continue to expose the federal government—and the  taxpayers—to fraud, waste, and abuse, unless GSA helps facilitate a  governmentwide solution.
Similarly, GSA argued that it did not have the authority to take the  recommended actions with respect to property accountability. As with  independent receipt and acceptance, our work continues to demonstrate  that accountability for property acquired with purchase cards is ineffective  across many agencies. For example, the purchase card program provides  cardholders the ability to acquire sensitive and pilferable items directly  from vendors. This process results in cardholders bypassing the normal  property receipt and acceptance procedures, which increases the risk that  the item will not be recorded in an agency’s list of accountable property.  GSA needs to recognize this risk (and other inherent risks) created by  purchase card use and proactively work with agencies to improve the  accountability of property acquired with government purchase cards. We  also believe that our recommendations fully take into account the extent  of GSA’s authority—to that end, our recommendation called for GSA to  provide agencies guidance and reminders to improve internal controls  over asset accountability. Even though GSA already issued guidance  related to the proper use of the purchase card program through online  training, refresher courses, and annual conferences, GSA should go a step  further and address control weaknesses related to property accountability  and receipt and acceptance. GSA’s position contrasted sharply with OMB,  which, in its comments on our report, expressed support for aggressive  and effective controls over purchase cards. We believe that GSA can take  advantage of the diverse tools already at its disposal, such as online  training and annual conferences, with which GSA could easily remind  cardholders and approving officials to pay particular attention to  governmentwide issues, including asset accountability and independent  receipt and acceptance of goods and services identified in this report.
Overall, our recommendations are focused on GSA taking a proactive  approach to improve the success of the purchase card program. Last year,  the federal government spent nearly $18 billion using purchase cards.  While the purchase card program has achieved significant savings, a  program of this magnitude needs to focus on both preventive and  detective controls to prevent fraud, waste, and abuse. In its response, GSA  also pointed out that the new SmartPay® 2 contract should provide better  management tools to agencies. However, the changes GSA identified in  SmartPay® 2 were mostly related to data mining for fraud, waste, and  abuse after a potentially fraudulent or improper transaction had taken  place, but did not address the issues we raised in this report. As our  previous work indicated, while detection can help reduce fraud, waste,  and abuse, preventive controls are a more effective and less costly means  to minimize fraud, waste, and abuse. The recommendations we made, to  which GSA took exception, were meant to improve these up-front  controls.
GSA also took exception to our methodology, arguing that we improperly  failed items as part of our control testing. GSA argued that some  unauthorized purchases were still appropriate purchases. We believe that  this argument is flawed. Standards for Internal Control in the Federal  Government states that transactions should be authorized and executed  only by persons acting within the scope of their authority. In other words,  authorization is the principal means of assuring that only valid  transactions are initiated or entered into and, consequently, without  authorization, adequate assurance does not exist that the items purchased  were for authorized purposes only. Our statistical sampling was designed  to test authorization control, and the results we reported reflected items  that did not pass this attribute. Such attribute testing is a widely accepted  and statistically valid methodology for internal control evaluations. GSA  also stated that our report did not adequately address the areas of personal  responsibility and managerial oversight. We disagree. We recommended  that OMB require agencies to hold cardholders financially responsible for  improper and wasteful purchases, and OMB agreed to implement our  recommendations; we believe that this would contribute to holding  cardholders accountable to management for their actions. Further, our  past reports on purchase card management have always focused on  managerial oversight. However, it is not feasible within the scope of a  governmentwide audit to test managerial oversight at every government  agency. Consequently, we focused on providing GSA, the manager of the  governmentwide purchase card program, with recommendations that  could contribute to improving management oversight at the agencies.
Finally, GSA disagreed with our characterization that travelers who did  not reduce the per diem claimed on their travel voucher when dinners  were provided may be engaging in potentially fraudulent activities.  Because we are unable to establish that these travelers acted with the  requisite knowledge and willfulness necessary to establish either a false  statement under 18 U.S.C. §1001 or a false claim, we have characterized  such activities as potentially fraudulent.
GSA’s and OMB’s comments are reprinted in appendixes III and IV.
As agreed with your offices, unless you announce the contents of this  report earlier, we will not distribute it until 30 days from its date. At that  time, we will send copies of this report to the Director of OMB and the  Administrator of GSA. We will make copies available to others upon  request. In addition, this report will be available at no charge on GAO’s  Web site at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. GAO staff who made major contributions to this  report are listed in appendix V.
section_title: Appendix I: Prior GAO Purchase Card Audits
paragraphs: Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to  Fraudulent, Improper, and Abusive Activity. GAO-06-1117. Washington,  D.C.: September 28, 2006.
Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to  Fraudulent, Improper, and Abusive Activity. GAO-06-957T. Washington,  D.C.: July 19, 2006.
Lawrence Berkeley National Laboratory: Further Improvements Needed  to Strengthen Controls Over the Purchase Card Program.   GAO-04-987R. Washington, D.C.: August 6, 2004.
Lawrence Livermore National Laboratory: Further Improvements  Needed to Strengthen Controls Over the Purchase Card Program.   GAO-04-986R. Washington, D.C.: August 6, 2004.
Pacific Northwest National Laboratory: Enhancements Needed to  Strengthen Controls Over the Purchase Card Program.   GAO-04-988R. Washington, D.C.: August 6, 2004.
Sandia National Laboratories: Further Improvements Needed to  Strengthen Controls Over the Purchase Card Program.   GAO-04-989R. Washington, D.C.: August 6, 2004.
VHA Purchase Cards: Internal Controls Over the Purchase Card  Program Need Improvement. GAO-04-737. Washington, D.C.: June 7, 2004.
Purchase Cards: Increased Management Oversight and Control Could  Save Hundreds of Millions of Dollars. GAO-04-717T. Washington, D.C.:  April 28, 2004.
Purchase Cards: Steps Taken to Improve DOD Program Management,  but Actions Needed to Address Misuse. GAO-04-156. Washington, D.C.:  December 2, 2003.
Forest Service Purchase Cards: Internal Control Weaknesses Resulted in  Instances of Improper, Wasteful, and Questionable Purchases.   GAO-03-786. Washington, D.C.: August 11, 2003.
HUD Purchase Cards: Poor Internal Controls Resulted in Improper and  Questionable Purchases. GAO-03-489. Washington, D.C.: April 11, 2003.
FAA Purchase Cards: Weak Controls Resulted in Instances of Improper  and Wasteful Purchases and Missing Assets. GAO-03-405. Washington,  D.C.: March 21, 2003.
Purchase Cards: Control Weaknesses Leave the Air Force Vulnerable to  Fraud, Waste, and Abuse. GAO-03-292. Washington, D.C.: December 20,  2002.
Purchase Cards: Navy is Vulnerable to Fraud and Abuse but Is Taking  Action to Resolve Control Weaknesses. GAO-02-1041. Washington, D.C.:  September 27, 2002.
Purchase Cards: Control Weaknesses Leave Army Vulnerable to Fraud,  Waste, and Abuse. GAO-02-732. Washington, D.C.: June 27, 2002.
Government Purchase Cards: Control Weaknesses Expose Agencies to  Fraud and Abuse. GAO-02-676T. Washington, D.C.: May 1, 2002.
Purchase Cards: Control Weaknesses Leave Two Navy Units Vulnerable  to Fraud and Abuse. GAO-02-32. Washington, D.C.: November 30, 2001.
section_title: Appendix II: Objectives, Scope, and Methodology
paragraphs: We performed a forensic audit of executive agencies’ purchase card  activity for the 15 months ending September 30, 2006. Specifically, we (1)  determined the effectiveness of internal controls intended to minimize  fraudulent, improper, and abusive transactions by testing two internal  control attributes related to transactions taken from two statistical  samples and (2) identified specific examples of potentially fraudulent,  improper, and abusive transactions through data mining and  investigations.
subsections: section_title: Statistical Sample of Internal Control Procedures
paragraphs: We obtained the databases containing agency purchase and other  government charge card transactions for the 12-month period ending June  30, 2006, from Bank of America, Citibank, JP Morgan Chase, Mellon Bank,  and U.S. Bank. The databases contained purchase, travel, and fleet card  transactions. Using information provided by the banks, we queried the  databases to identify transactions specifically related to purchase cards.  We performed other procedures—including reconciliation to purchase  card data that the General Services Administration (GSA) published—to  confirm that the data were sufficiently reliable for the purposes of our  report.
Our statistical sampling work covered purchase card activity at executive  agencies. We define executive agencies as federal agencies that are  required to follow the Federal Acquisition Regulation (FAR), including  executive departments, independent establishments, and wholly owned  federal government corporations as defined by the United States Code.  We excluded transactions from the legislative and judicial branches,  entities under treaty with the United States, and federal agencies with  specific authority over their own purchase card programs.
To assess compliance with key internal controls, we extracted and tested  two statistical (probability) samples of 96 transactions each. The first  sample consisted of transactions exceeding $50 taken from a population of  over 16 million purchase card transactions totaling almost $14 billion. We  also selected a second sample from the population of over 600,000  transactions totaling nearly $6 billion that exceeded the $2,500  micropurchase threshold. We selected this second sample because of  additional acquisition requirements associated with purchases over the  micropurchase threshold, and the high dollar amount associated with  these transactions. Specifically, while only 3 percent of governmentwide  purchase card transactions from July 1, 2005, through June 30, 2006, were  over the micropurchase threshold, they accounted for 44 percent of the  total dollars spent during that period.
With our probability sample, each transaction in the population had a  nonzero probability of being included, and that probability could be  computed for any transaction. Each sample element was subsequently  weighted in the analysis to account statistically for all the transactions in  the population, including those that were not selected. Because we  followed a probability procedure based on random selection, our sample is  only one of a large number of samples that we might have drawn. Since  each sample could have provided different estimates, we express our  confidence in the precision of our particular sample’s results as a 95  percent interval (e.g., plus or minus 10 percentage points). This is the  interval that would contain the actual population value for 95 percent of  the samples we could have drawn. As a result, we are 95 percent confident  that each of the confidence intervals in this report will include the true  values in the study population. All percentage estimates from the samples  of executive agency purchase card activity have sampling errors  (confidence interval widths) of plus or minus 10 percentage points or less.
subsections: section_title: Internal Control Testing
paragraphs: Our audit of key internal controls focused on whether agencies provided  adequate documentation to substantiate that (1) purchase card  transactions were properly authorized and (2) goods and services acquired  with purchase cards were independently received and accepted. As part of  our tests of internal controls, we reviewed applicable federal laws and  regulations related to the FAR and purchase card uses. We also identified  and applied the internal control principles contained in Standards for  Internal Control in the Federal Government, Audit Guide: Auditing and  Investigating the Internal Control of Government Purchase Card  Programs, and agencies’ purchase card policies and procedures.  Furthermore, for purchases exceeding the micropurchase threshold of  $2,500, we tested FAR requirements that the cardholder use required  vendors and promote competition by soliciting bids—or justify the  departure from this requirement in writing.
subsections: section_title: Proper Authorization
paragraphs: To determine whether a transaction was properly authorized, we reviewed  documentation to ascertain if an individual other than the cardholder was  involved in the approval of the purchase. To determine that proper  authorization existed, we used reasonable evidence for authorization of  micropurchases from $50 to $2,500, such as purchase requests from  responsible officials, requisitions, e-mails, and other documents that  identify an official government need, including blanket authorizations for  routine purchases with subsequent approval. For purchase card  transactions exceeding the micropurchase threshold of $2,500, we  required prior purchase authorization, such as a contract, a requisition, or  other approval document. Additionally, we looked for evidence that the  cardholder used required vendors (as required by the Javits-Wagner-O’Day  Act (JWOD)) and solicited quotes to promote competition (or provided  evidence justifying departure from this requirement, such as an annotation  justifying the use of a sole source).
section_title: Receipt and Acceptance
paragraphs: To determine whether goods or services were independently received and  accepted, we reviewed supporting documentation provided by the agency.  For each transaction, we compared the quantity, price, and item  descriptions on the vendor invoice and shipping receipt to the purchase  requisition to verify that the items received and paid for were actually the  items ordered. We also determined whether evidence existed that a person  other than the cardholder was involved in the receipt of the goods or  services purchased. We concluded that independent receipt and  acceptance existed if the vendor invoice, shipping documents, and receipt  materially matched the transaction data, and if the signature or initial of  someone other than the cardholder was on the sales invoice, packing slip,  bill of lading, or any other shipping or receiving document indicating  receipt.
section_title: Accountable Property
paragraphs: For statistical sample and data-mining transactions containing  accountable or highly pilferable property, we performed an inventory to  determine whether executive agencies maintained accountability over the  physical property items obtained with government purchase cards.  Because each agency had its own threshold for accountable property, we  were not able to test accountable property against each agency’s threshold  for this governmentwide audit. Consequently, we defined accountable  property as any property item exceeding a $350 threshold and containing a  serial number. We defined highly pilferable items as items that can be  easily converted to personal use, such as cameras, laptops, cell phones,  and iPods. We selected highly pilferable property at any price if it was  easily converted to personal use.
The purchase card data provided by the banks did not always contain  adequate details to enable us to isolate property transactions for statistical  testing. Because we were not able to take a statistical sample of these  transactions, we were not able to project failure rates for accountable and  pilferable property. Consequently, our tests of property accountability  were performed on a nonrepresentative selection of property that we  identified when a transaction selected for statistical sampling or data  mining contained accountable and pilferable property. For these property  items, we identified serial numbers from supporting documentation  provided by the agency and, in some cases, by contacting the vendors  themselves. To minimize travel costs associated with conducting a  physical inventory governmentwide, we requested that each agency  provide photographs of the property items, which we compared against  the serial numbers originally provided. When we were unable to obtain  serial numbers from supporting documentation or from the vendors, we  gave the agency the benefit of the doubt and accepted the serial numbers  shown in agency-provided photographs as long as the product(s) and  quantity matched. In some isolated instances, we performed the physical  inventory ourselves.
section_title: Data Mining
paragraphs: To identify examples of fraudulent, improper, and abusive purchase card  activity, we data mined purchase card transactions from July 1, 2005,  through September 30, 2006. This period contained an additional 3 months  of data subsequent to the period included in our statistical samples. For  data-mining purposes, we also included transactions from federal agencies  that had been granted specific authority over their own purchase card  programs, such as the U.S. Postal Service.
In general, we analyzed purchase card data for merchant category codes  and vendor names that were more likely to offer goods, services, or both  that are on executive agencies’ restricted/prohibited lists, personal in  nature, or of questionable government need. We identified split purchases  by extracting multiple purchase transactions made by the same cardholder  at the same vendor on the same day. For year-end purchases, we identified  transactions from purchase card accounts where year-end activity is high  compared to the rest of the year. With respect to convenience checks, we  used various criteria, including identifying instances where convenience  checks were written to cash or payees not normally associated with  procurement needs and where a large number of convenience checks  were written to a single payee, among others. We analyzed the banks’  databases for detailed transaction data, whenever available, for  accountable property and highly pilferable items.
We then requested and reviewed supporting documentation for over 550  transactions among the thousands we identified. We conducted  investigative work, which included additional inquiries and data analysis,  when applicable. While we identified fraudulent, improper, and abusive  transactions, our work was not designed to identify and we cannot  determine the extent of fraudulent, improper, or abusive transactions  occurring in the population of governmentwide purchase card  transactions.
section_title: Data Reliability
paragraphs: We assessed the reliability of the data provided by (1) performing various  testing of required data elements, (2) reviewing financial statements of the  five banks for information about the data and systems that produced them,  and (3) interviewing bank officials knowledgeable about the data. In  addition, we verified that totals from the databases agreed with the total  purchase card activity provided by GSA and published on its Web site, in  totality and for selected agencies. We determined that the data were  sufficiently reliable for the purposes of our report.
We conducted this performance audit from September 2006 through  February 2008, in accordance with U.S. generally accepted government  auditing standards. Those standards require that we plan and perform the  audit to obtain sufficient, appropriate evidence to provide a reasonable  basis for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives. We performed our  investigative work in accordance with standards prescribed by the  President’s Council on Integrity and Efficiency.
section_title: Appendix III: Comments from the Office of Management and Budget
section_title: Appendix IV: Comments from the General Services Administration
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
paragraphs: Gregory D. Kutz, (202) 512-6722 or kutzg@gao.gov.
subsections: section_title: Acknowledgements
paragraphs: In addition to the contact above, Tuyet-Quan Thai, Assistant Director;  James Ashley; Beverly Burke; Bruce Causseaux; Sunny Chang; Dennis  Fauber; Danielle Free; Jessica Gray; Ryan Guthrie; Ken Hill; Ryan Holden;  Aaron Holling; John Kelly; Delores Lee; Barbara Lewis; Andrew McIntosh;  Richard McLean; Aaron Piazza; John Ryan; Barry Shillito; Chevalier  Strong; Scott Wrightson; Tina Wu; and Michael Zola made key  contributions to this report.