Government Purchase Cards: Control Weaknesses Expose Agencies to Fraud and Abuse
Released: 2002-05-01T00:00:00

Letter

Inadequate Review and Approval Processes

According to our Standards for Internal Control in the Federal Government, transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. Although review of transactions by persons in authority is the principal means of assuring that transactions are valid, we found that the review and approval process for purchase card purchases was inadequate in all the agencies reviewed.

At the Department of Education, we found that 10 of its 14 offices did not require cardholders to obtain authorization prior to making some or all purchases, although Education’s policy required that all requests to purchase items over $1,000 be made in writing to the applicable department executive officer. We also found that approving officials did not use monitoring reports that were available from Bank of America to identify unusual or unauthorized purchases.

Additionally, Education’s 1990 purchase card policy, which was in effect during the time of our review (May 1998 through September 2000), stated that an approving official was to ensure that all purchase card transactions were for authorized Education purchases and in accordance with departmental and other federal regulations. The approving official signified that a cardholder’s purchases were appropriate by reviewing and signing monthly statements. To test the effectiveness of Education’s approving officials’ review, we analyzed 5 months of cardholder statements and found that 37 percent of the 903 monthly cardholder statements we reviewed were not approved by the appropriate official. The unapproved statements totaled about $1.8 million. Further, we found that Education employees purchased computers using their purchase cards, which was a violation of Education’s policy prohibiting the use of purchase cards for this purpose. As I will discuss later, several of the computers that were purchased with purchase cards were not entered in property records, and we could not locate them. If approving officials had been conducting a proper review of monthly statements, the computer purchases could have been identified and the practice halted, perhaps eliminating this computer accountability problem. Education implemented a new approval process during our review. We assessed this new process and found that while approving officials were generally reviewing cardholder statements, those officials were not ensuring that adequate supporting documentation existed for all purchases.

Weaknesses in the approval process also existed at the two Navy units we reviewed. During our initial review, approving officials in these two units told us that they did not review support for transactions before certifying monthly statements for payment because (1) they did not have time and (2) Navy policy did not specifically require that approving officials review support. At one of the Navy units, one approving official was responsible for certifying summary billing statements covering an average of over 700 monthly statements for 1,153 cardholders. Further, Navy’s policy allows the approving official to presume that all transactions are proper unless notified to the contrary by the cardholder. The policy appears to improperly assign certifying officer accountability to cardholders and is inconsistent with Department of Defense regulations, which state that certifying officers are responsible for assuring that payments are proper.

During our follow-up review, we found that throughout fiscal year 2001, approving officials in the two units still did not properly review and certify the monthly purchase card statements for payment. Although the Department of Defense Purchase Card Program Management Office issued new guidance in July 2001 that would reduce the number of cardholders for which each approving official was responsible, neither of the two units met the suggested ratio of five to seven cardholders to one approving official until well after the start of fiscal year 2002. Further, the Department of Defense agreed with our recommendation that Navy revise its policy to assure that approving officials review the monthly statements and the supporting documentation prior to certifying the statements for payment. However, for the last quarter of fiscal year 2001, one of the Navy units continued to inappropriately certify purchase card statements for payment. The other unit issued local guidance that partially implements our recommendation.

IGs at the Departments of Agriculture, the Interior, and Transportation also identified weaknesses in the review and approval processes at these agencies. For example, Agriculture’s IG reported that the department has not effectively implemented an oversight tool in its Purchase Card Management System (PCMS), the system that processes purchase card transactions. This tool is an alert system that monitors the database for pre-established conditions that may indicate potential abuse by cardholders. Responsible officials are to periodically access their alert messages and review the details for questionable transactions. These reviewing officials should contact cardholders, if necessary, so that cardholders can verify any discrepancies or provide any additional information in order to resolve individual alert messages. In order to close out alert messages, reviewers must change the message status to “read” and explain any necessary details to resolve the alerts. According to Agriculture’s IG, only about 29,600 out of 50,500 alerts in the database during fiscal years 1999 and 2000 had been read as of January 9, 2001, and only about 6,100 of the alerts that were read contained responses. The inconsistent use of this oversight tool means that Agriculture management has reduced assurance that errors and abuse are promptly detected and that cardholders are complying with purchase card and procurement regulations.

Interior’s IG reported that it reviewed the work of 53 reviewing officials and found that 42 of them performed inadequate reviews. The IG defined an adequate review as one in which the reviewing official, on a monthly basis, reconciled invoices and receipts to the purchase card statements to ensure that all transactions were legitimate and necessary. The IG found that several reviewing officials signed off on monthly statements indicating completed reviews where supporting documentation was not available.

Lack of Training

Another common internal control weakness we identified was lack of or inadequate training related to the use of purchase cards. Our Standards for Internal Control in the Federal Government emphasize that effective management of an organization’s workforce—its human capital—is essential to achieving results and is an important part of internal control.

Training is key to ensuring that the workforce has the skills necessary to achieve organizational goals. Lack of or inadequate training contributed to the weak control environments at several agencies.

Navy’s policies required that all cardholders and approving officials must receive initial purchase card training and refresher training every 2 years. We determined that the two Navy units lacked documentation to demonstrate that all cardholders and approving officials had received the required training. We tested $68 million of fiscal year 2000 purchase card transactions at the two Navy units and estimated that at least $17.7 million of transactions were made by cardholders for whom there was no documented evidence they had received either the required initial training or refresher training on purchase card policies and procedures. Although we found during our follow-up work that the two Navy units had taken steps to ensure cardholders receive training and to document the training, many cardholders at one of the units still had not completed the initial training or the required refresher training. Similarly, at Education, we found that although the policy required each cardholder and approving officials to receive training on their respective responsibilities, several cardholders and at least one approving official were not trained.

Interior’s IG also reported a lack of training related to the purchase card program. Specifically, the IG reported that although Interior provided training to individual cardholders, it did not design or provide training to reviewing officials. According to the IG, several reviewing officials said that they did not know how to conduct a review of purchase card transactions, nor did they understand how and why to review supporting documentation. As previously mentioned, the IG found that many reviewing officials were not performing adequate reviews.

Ineffective Monitoring

Our Standards for Internal Control in the Federal Government state that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. Internal control monitoring should assess the quality of performance over time and ensure that findings of audits and other reviews are promptly resolved. Program and operational managers should monitor the effectiveness of control activities as part of their regular duties.

At the two Navy units we reviewed, we found that management had not established an effective monitoring and internal audit function for the purchase card program. The policies and procedures did not require that the results of internal reviews be documented or that corrective actions be monitored to help ensure they are effectively implemented. The NAVSUP Instruction calls for semiannual reviews of purchase card programs, including adherence to internal operating procedures, applicable training requirements, micro-purchase procedures, receipt and acceptance procedures, and statement certification and prompt payment procedures. These reviews are to serve as a basis for initiating appropriate action to improve the program and correct problem areas.

Our analysis of fiscal year 2000 agency program coordinator reviews at one of the Navy units showed that the reviews identified problems with about 42 percent of the monthly cardholder statements that were reviewed. The problems identified were consistent with the control weaknesses we found. Unit management considered the findings but directed that corrective actions not be implemented because of complaints about the administrative burden associated with the procedural changes that would be needed to address the review findings. These reviews generally resulted in the reviewer counseling the cardholders or in some instances, recommending that cardholders attend purchase card training. As a result, the agency program coordinator had not used the reviews to make systematic improvements in the program. During our follow-up work, we noted that this unit had recently made some efforts to implement new policies directed at improving internal review and oversight activities. However, these efforts are not yet complete.

At the time of our review, Education did not have a monitoring system in place for purchase card activity. However, in December 2001, the department issued new policies and procedures that, among other things, establish a quarterly quality review of a sample of purchase card transactions to ensure compliance with key aspects of the department’s policy.

Transportation’s IG reported that the Federal Aviation Administration (FAA) had not performed required internal follow-up reviews on purchase card usage since 1998. A follow-up review is to consist of an independent official (other than the approving official) reviewing a sample of purchase card transactions to determine whether purchases were authorized and that cardholders and approving officials followed policies and procedures.

The types of weaknesses that I have just described create an environment where improper purchases could be made with little risk of detection. I will now provide a few examples of how employees used their purchase cards to make fraudulent, improper, abusive, and questionable purchases. We also found that property purchased with the purchase cards was not always recorded in agencies’ property records, which could have contributed to missing or stolen property.

Poor Controls Resulted in Fraudulent, Improper, Abusive, and Questionable Purchases

In a number of cases, the significant control weaknesses that we and the IGs identified resulted in or contributed to fraudulent, improper, abusive, and questionable purchases. We considered fraudulent purchases to be those that were unauthorized and intended for personal use. Improper purchases included those for government use that were not, or did not appear to be, for a purpose permitted by law or regulation. We defined abusive or questionable transactions as those that, while authorized, were for items purchased at an excessive cost, for a questionable government need, or both. Questionable purchases also include those for which there was insufficient documentation to determine whether they were valid.

For example, at Education, we found an instance in which a cardholder made several fraudulent purchases from two Internet sites for pornographic services. The name of one of the sites—Slave Labor Productions.com—should have caused suspicion when it appeared on the employee’s monthly statement. We obtained the statements containing the charges and noted that they contained handwritten notes next to the pornography charges indicating that these were charges for transparencies and other nondescript items. According to the approving official, he was not aware of the cardholder’s day-to-day responsibilities, and therefore, could not properly review the statements. The approving official stated that the primary focus of his review was to ensure there was enough money available in that particular appropriation to pay the bill. As a result of investigations related to these pornography purchases, Education management issued a termination letter, prompting the employee to resign.

We also identified questionable charges by an Education employee totaling $35,760 over several years for herself and a coworker to attend college. Some of the classes the employees took were apparently prerequisites to obtain a liberal arts degree, but were unrelated to Education’s mission. The classes included biology, music, and theology, and represented $11,700 of the $35,760. These classes costing $11,700 were improper charges. The Government Employees Training Act, 5 U.S.C. 4103 and 4107, requires that training be related to an employee’s job and prohibits expenditures to obtain a college degree unless necessitated by retention or recruitment needs, which was not the case here. We also identified as questionable purchases totaling more than $152,000 for which Education could not provide any support and did not know specifically what was purchased, why it was purchased, or whether these purchases were appropriate.

The breakdown of controls at the two Navy units we reviewed made it difficult to detect and prevent fraudulent purchases made by cardholders. We identified over $11,000 of fraudulent purchases including gifts, gift certificates, and clothing from Macy’s West, Nordstrom, Mervins, Lees Men’s Wear, and Footlocker, and a computer and related equipment from Circuit City.

During our follow-up work, we also identified a number of improper, questionable, and abusive purchases at the Navy units, including food for employees costing $8,500; rentals of luxury cars costing $7,028; designer and high-cost leather briefcases, totes, portfolios, day planners, palm pilot cases, wallets, and purses from Louis Vuitton and Franklin Covey costing $33,054; and questionable contractor payments totaling $164,143.

The designer and high-cost leather goods from Franklin Covey included leather purses costing up to $195 each and portfolios costing up to $135 each. Many of these purchases were of a questionable government need and should have been paid for by the individual. To the extent the day planners and calendar refills were proper government purchases, they were at an excessive cost and should have been purchased from certified nonprofit agencies under a program that is intended to provide employment opportunities for thousands of people with disabilities. Circumventing the requirements to buy from these nonprofit agencies and purchasing these items from commercial vendors is not only an abuse and waste of taxpayer dollars, but shows particularly poor judgment and serious internal control weaknesses.

The contractor payments in question were 75 purchase card transactions with a telecommunications contractor that appeared to be advance payments for electrical engineering services. Paying for goods and services before the government has received them (with limited exceptions) is prohibited by law and Navy purchase card procedures. Navy employees told us the purchase card was used to expedite the procurement of goods and services from the contractor because the preparation, approval, and issuance of a delivery order was too time-consuming in certain circumstances. For all 75 transactions, we found that the contractor’s estimated costs were almost always equal or close to the $2,500 micro- purchase threshold. Because we found no documentation of independent receipt and acceptance of the services provided or any documentation that the work for these charges was performed, these charges are potentially fraudulent, and we have referred them to our Office of Special Investigations for further investigation.

IGs also identified fraudulent purchases. The Transportation Department’s IG reported on two cases involving employees’ fraudulent use of their purchase cards. In one case, a cardholder used a government purchase card to buy computer software and other items costing over $80,000 for a personal business. In the other case, a cardholder made numerous unauthorized charges totaling more than $58,000, including a home stereo system and a new engine for his car. Additionally, Interior’s IG identified fraudulent purchases such as payments for monthly rent and phone bills, household furnishings, jewelry, and repairs to personal vehicles.

One type of improper purchase we identified is the “split purchase,” which we defined as purchases made on the same day from the same vendor that appear to circumvent single purchase limits. The Federal Acquisition Regulation prohibits splitting a transaction into more than one segment to avoid the requirement to obtain competitive bids for purchases over the $2,500 micro-purchase threshold or to avoid other established credit limits. For example, one cardholder from Education purchased two computers from the same vendor at essentially the same time. Because the total cost of these computers exceeded the cardholder’s $2,500 single purchase limit, the total of $4,184.90 was split into two purchases of $2,092.45 each. We found 27 additional purchases totaling almost $120,000 where Education employees made multiple purchases from a vendor on the same day.

Similarly, our analysis of purchase card payments at the two Navy units identified a number of purchases from the same vendor on the same day. To determine whether these were, in fact, split purchases, we obtained and analyzed supporting documentation for 40 fiscal year 2000 purchases at the two Navy units. We found that in many instances, cardholders made multiple purchases from the same vendor within a few minutes or a few hours for items such as computers, computer-related equipment, and software, that involved the same, or sequential or nearly sequential purchase order and vendor invoice numbers. Based on our analysis, we concluded that 32 of the 40 purchases were split into two or more transactions to avoid the micro-purchase threshold. During our follow-up work, we found that 23 of 50 fiscal year 2001 purchases by the two Navy units were split into two or more transactions to avoid the micro-purchase threshold.

Split purchases were also identified by the IGs at the Departments of Agriculture and Transportation. For example, Agriculture’s IG reported that it investigated two employees who intentionally made multiple purchases of computer equipment with the same merchant in amounts exceeding their established single purchase limits. During 3 different months, these employees purchased computer systems totaling $121,123 by structuring their individual purchases of components in amounts less than the individual single purchase limit of $2,500. In September 1999, a computer procurement totaling $47,475 was made using 20 individual purchase card transactions during a 4-day period. Other computer purchases were made in November 1999 involving 15 purchase card transactions over a 3-day period totaling $36,418 and in June 2000 involving 15 individual transactions over a 5-day period totaling $37,230. The IG reported that these procurements should have been made by a warranted contracting officer. Similarly, Transportation’s IG reported that it identified 13 transactions totaling about $106,000 that violated the department’s policies against splitting purchases.

Missing Property

Another problem we and the IGs identified is that some property purchased with purchase cards was not entered in agency property records. According to our Standards for Internal Control in the Federal Government, an agency must establish physical control to secure and safeguard vulnerable assets. Such assets should be periodically counted and compared to control records. Recording the items purchased in property records is an important step to ensure accountability and financial control over these assets and, along with periodic inventory counts, to prevent theft or improper use of government property. At Education and the Navy units, we identified numerous purchases of computers and computer-related equipment, cameras, and palm pilots that were not recorded in property records and for which the agencies could not provide conclusive evidence that the items were in possession of the federal government.

For example, the lack of controls at Education contributed to the loss of 179 pieces of computer equipment costing over $200,000. We compared serial numbers obtained from a vendor where the computers were purchased to those in the department’s asset management system and found that 384 pieces of computer equipment were not listed in the property records. We conducted an unannounced inventory to determine whether the equipment was actually missing or inadvertently omitted from the property records. We found 205 pieces of equipment. Education officials have been unable to locate the remaining 179 pieces of missing equipment. They surmised that some of these items may have been surplused; however, there is no documentation to determine whether this assertion is valid.

At the Navy units, our initial analysis showed that the Navy did not record 46 of 65 sampled items in their property records. When we asked to inspect these items, the Navy units could not provide conclusive evidence that 31 of them—including laptop computers, palm pilots, and digital cameras— were in the possession of the government. For example, for 4 items, the serial numbers of the property we were shown did not match purchase or manufacturer documentation. In addition, we were told that 5 items were at other Navy locations throughout the world. Navy officials were unable to conclusively demonstrate the existence and location of these 5 items. We were unable to conclude whether any of these 31 pieces of government property were stolen, lost, or being misused.

We and the IGs have made recommendations to the various agencies that, if fully implemented, will help improve internal controls over the purchase card programs so that fraudulent and improper payments can be prevented or detected in the future and vulnerable assets can be better protected. These recommendations include (1) emphasizing policies on appropriate use of the purchase card and cardholder and approving official responsibilities, (2) ensuring that approving officials are trained on how to perform their responsibilities, and (3) ensuring that approving officials review purchases and their supporting documentation before certifying the statements for payment. Agencies have taken actions to respond to the recommendations made. However, during our follow-up work at Education and the Navy units, we found that weaknesses remain that continue to leave them vulnerable to fraudulent and improper payments and lost assets. Management’s ongoing commitment to improving internal controls is necessary to minimize this vulnerability.