Misuse of Government Purchase Cards: Background, Legislation, and Analysis
Released: 2019-12-06T00:00:00

Background

The government's purchase card program has its origins in Executive Order (E.O.) 12352, issued by President Ronald Reagan in 1982. E.O. 12352 directed agencies to develop programs that simplified procedures and reduced the administrative costs of procurement, particularly with regard to "small" purchases ($25,000 or less). Several agencies subsequently participated in a pilot program that evaluated the use of a commercial credit card, called a purchase card, as an acquisition tool. At the time, even a routine order for widely available items, such as office supplies, typically required agency program staff to submit a written procurement request to a contracting officer, who reviewed it, obtained the necessary signatures, made the actual purchase, and processed the associated paperwork. To critics, this process was inefficient, especially for small purchases. Not only was it time-consuming for both program and procurement personnel, but it also prevented program offices from quickly filling immediate needs. Under the pilot program, nonprocurement staff used purchase cards to conduct small-dollar transactions directly with local suppliers, thus bypassing procurement officers entirely. A report on the pilot program concluded that purchase cards could reduce administrative costs and improve delivery time, and in 1989 the Office of Management and Budget (OMB) tasked the General Services Administration (GSA) with making purchase cards available government-wide.

Participation in GSA's purchase card program was not mandatory, and card use did not initially grow as rapidly as some had expected. In 1993, however, a report issued by the National Performance Review (NPR) sparked a number of legislative and regulatory reforms intended to increase purchase card use. The NPR was a Clinton Administration initiative that sought to "reinvent" the federal government by making government operations both less expensive and more efficient. One of the NPR's objectives was to identify opportunities to streamline a number of government-wide processes, including procurement. Drawing on input from experts in the public and private sectors, the NPR's initial report recommended expanding the use of purchase cards across the government, a step it said would "lower costs and reduce bureaucracy in small purchases." In a separate report that focused solely on procurement, the NPR estimated that if half of all small acquisitions were made using purchase cards, the government would realize $180 million in savings annually. The report further recommended amending the Federal Acquisition Regulation (FAR)âthe government's primary source of procurement guidanceâto promote the use of purchase cards for small purchases.

Building on the NPR's recommendations, Congress passed the Federal Acquisition Streamlining Act (FASA; P.L. 103-355 ) in 1994. FASA introduced several reforms that increased the use of purchase cards. Among these, Title IV of FASA established a simplified acquisition threshold (SAT) of $100,000 (increased to $250,000 in 2017). Purchases at or below the threshold were exempted from the provisions of a number of procurement laws. This reform obviated the need for procurement officials to make small purchases. To further streamline procedures for the smallest acquisitions, Title IV also established a "micro-purchase" threshold of $2,500 (which was increased to $3,000 in 2006, and again to $10,000 in 2017). FASA further exempted micro-purchases from sections of the Buy American Act and the Small Business Act, and they could be made without obtaining a competitive bid, if the cost was deemed reasonable by the cardholder.

At the same time, the Clinton Administration took steps to increase the use of purchase cards. Citing the need to make agency procurement procedures "more consistent with recommendations of the National Performance Review," President Clinton issued Executive Order 12931 on October 13, 1994. E.O. 12931 directed agency heads to (1) expand purchase card use; and (2) delegate the micro-purchasing authority provided in FASA to program offices, which would enable them to make purchases whose value did not exceed the micro-purchase threshold. E.O. 12931 also directed agency heads to streamline procurement policies and practices that were not mandated by statute, and to ensure that their agencies were maximizing their use of the new simplified acquisition procedures. In addition, the FAR was amended in 1994 to designate the purchase card as the "preferred method" for making micro-purchases.

Card use increased sharply as agencies implemented these reforms. The dollar value of goods and services acquired with purchase cards increased from $527.0 million in FY1993 to $19.5 billion in FY2011. During that same time span, the number of cardholders nearly tripled to 278,000, and the number of purchase card transactions increased from 1.5 million to just under 22.8 million in FY2011. The flexibility of the purchase card may have contributed to its growth: it could be used for in-store purchases, which allowed the cardholder to take immediate possession of needed goods, or it could be used to place orders by telephone or over the internet and have goods delivered. According to GSA, the use of purchase cards now saves the government $1.7 billion a year in administrative costs.

Structure

The federal purchase card program is implemented by individual agencies, with the involvement of GSA and OMB. In broad terms, agencies establish and maintain their own programs, but they select pu rchase card services from contracts that GSA negotiates with selected banks, and their programs must conform to the government-wide guidance issued by OMB.

Agencies

Each agency is responsible for establishing its own purchase card program. The agency, within the framework of OMB guidance, establishes internal rules and regulations for purchase card use and management, decides which of its employees are to receive purchase cards, and handles billing and payment issues for agency purchase card accounts. Two levels of supervision generally exist within an agency's purchase card program. Individual cardholders are assigned to an Approving Official (AO). The AO is considered the "first line of defense" against card misuse, and agency policies often require the AO to ensure that all purchases comply with statutes, regulations, and agency policies. To that end, the AO is responsible for authorizing cardholder purchases, either by approving purchases before they are made or by verifying their legitimacy through reviews of cardholder statements and supporting documentation, such as receipts. The AO may also be required to ensure that statements are reconciled and submitted to the billing office in a timely manner.

Each agency also appoints an Agency Program Coordinator (APC) to serve as the agency's liaison to the bank and to GSA. At some agencies, each major component has an APC, one of whom is chosen to serve as the agency's liaison. The APCs are also usually responsible for agency-wide activities, such as developing internal program guidelines and procedures, sampling cardholder transactions to identify fraudulent or abusive purchases, setting up and deactivating accounts, and ensuring that officials and cardholders receive proper training.

GSA

GSA's primary responsibility is to award and administer contracts with card vendors on behalf of the government. In November 1998, agency purchase card programs began operating under GSA's SmartPay initiative. SmartPay permitted agencies to select a range of credit card products from five banks with which GSA had negotiated contracts. The SmartPay contracts established prices, terms, and conditions for credit card products and services from these five banks. Purchase cards were established as centrally billed accounts under the contracts, which meant that agencies, and not individual cardholders, were billed for purchases. The contracts required agencies to make payment in full at the end of each billing cycle. New purchase card contractsâknown collectively as SmartPay2âtook effect government-wide in November 2008. In November 2018, all federal agencies began operating under SmartPay3 contracts.

OMB

OMB issues charge card management guidance that all agencies must follow. This guidance, located in Appendix B of OMB Circular A-123, establishes agencies' responsibilities for implementing their purchase, travel, and fleet card programs. Chapter 4 of Appendix B identifies the responsibilities of charge card managers in developing and implementing risk management controls, policies, and practices (often referred to collectively as "internal controls") that mitigate the potential for charge card misuse. Agency charge card managers must ensure that

cardholder statements, supporting documentation, and other data are reviewed to detect delinquency and misuse; key duties are separated, such as making purchases, authorizing purchases, and reviewing and auditing purchase documentation; records are maintained for training, appointment of cardholders and authorizing officials, cardholder purchase limits, and related information; disciplinary actions are initiated when cardholders or other program participants misuse their cards; appropriate training is provided for cardholders, approving officials, and other relevant staff; employees are asked about questionable or suspicious transactions; and charge card statement reconciliation occurs in a timely manner.

Chapter 4 also identifies administrative and disciplinary actions that may be imposed for charge card misuse, such as deactivation of employee accounts, and it requires managers to refer suspected cases of fraud to the agency's Office of Inspector General or the Department of Justice.

Circular A-123 provides OMB with oversight tools by requiring agencies to submit to OMB each year a charge card management plan that details their efforts to implement and maintain effective internal controls and minimize the risk of card misuse and payment delinquency. It also requires agencies to report the number of AOs it has appointed, the average number of monthly purchase card transactions each AO reviews, the number of reported cases of misuse, and the number of disciplinary actions taken in response to misuse.

Purchase Card Program Weaknesses

Audits of agency purchase card programs conducted by the Government Accountability Office (GAO) and agency inspectors general (IGs) through FY2011 attracted congressional attention with their revelations of abusive purchases made by government employees. Among the many cases of abuse cited by auditors were a Department of Agriculture (USDA) employee who, over a period of six years, used her purchase card to funnel $642,000 to her boyfriend; a Forest Service employee who charged $31,342 to his purchase card for personal items, including Sony PlayStations, cameras, and jewelry; and a Coast Guard cardholder who used his purchase card to buy a beer brewing kitâand then brewed alcohol while on duty. Congress held several hearings to address purchase card misuse and the underlying internal control weaknesses that auditors said allowed it to occur. The following section examines the weaknesses identified in audit reports published between 2002 and 2011, which highlight the issues that led to the passage of the Charge Card Act.

Ineffective Transaction Review and Approval Processes

One of the primary safeguards against improper use of government purchase cards is the review and approval of cardholder transactions by someone other than the cardholder. As noted, purchase card AOs are usually responsible for reviewing the cardholder's monthly statement. Given that the AO is often the only person other than the cardholder to assess the validity of a purchase before payment is made to the purchase card vendor, the review and approval process is considered one of the most critical components of an agency's purchase card control environment. Steven Kutz, GAO's Managing Director of Forensic Audits and Special Investigations, stated in testimony before the Senate,

Basic fraud prevention concepts and our previous audits of purchase card programs have shown that opportunities for fraud and abuse arise if cardholders know that their purchases are not being properly reviewed.

Despite the importance of the AO's role in preventing and detecting improper purchases, some agencies failed to ensure that cardholder statements were carefully reviewed prior to their approval. At the Department of Education, auditors estimated that 37% of monthly cardholder statements they reviewed had not been approved by the AO. GAO also estimated that nearly one of every six purchase card transactions government-wide had not been properly authorized.

Even when AOs did conduct reviews, they sometimes failed to meet government standards. Agencies are required by OMB to ensure that cardholder statements are compared with supporting documentation, such as invoices and receipts, as part of the review process. This is necessary because purchase card statements are rarely itemized; they usually provide only the store or contractor name and the amount charged. For AOs, receipts and invoices are the principal means of verifying what items were purchased and determining whether those items were for legitimate program purposes. According to GAO, many agencies have not ensured that supporting documentation is available and examined as part of the review and approval process. An audit of the Department of Housing and Urban Development's (HUD's) purchase card program found that the agency did not have adequate documentation for 47% of transactions auditors deemed questionableâpurchases from merchants that are not normally expected to do business with HUDâwhich meant auditors "were unable to determine what was purchased, for whom, and why." Similarly, an audit of the Veterans Health Administration's (VHA's) purchase card program estimated that $313 million of its transactions lacked key supporting documentation.

One consequence of these weaknesses was that fraudulent and abusive transactions slipped through the review process unnoticed. For instance, GAO found that AOs at agencies across the government approved cardholder statements that included questionable transactions, such as purchases of jewelry, home furnishings, cruise tickets, electronics, and other consumer goods. At the Forest Service, one employee used her purchase card over a period of years to accumulate more than $31,000 in jewelry and electronics. Similarly, HUD cardholders spent $27,000 at department stores like Macy's and J.C. Penney in a single year. In one egregious case, a Federal Aviation Authority (FAA) employee had his statement approved even though it showed he violated agency policy by charging cash advances to his purchase cardâwhile at a casino.

The lack of adequate oversight is also evident where AOs have approved duplicate transactionsâvendors charging the government twice for the same goods or servicesâand purchases made by someone other than the cardholder. One audit identified an estimated $177,187 in duplicate charges at one agency. An audit at FAA discovered that a cardholder had allowed unauthorized individuals to charge over $160,000 to her purchase card account. When an AO identifies unauthorized and duplicate transactions, the agency should use the process described in the SmartPay master contract to dispute the charges. When AOs fail to identify and dispute fraudulent charges, the government often pays them in full or fails to obtain a refund from the purchase card vendor.

Inconsistent Program Monitoring

GAO further found that many agencies failed to monitor and evaluate the effectiveness of their purchase card controls, a responsibility that is often assigned to the APC. Monitoring and evaluation may include sampling purchase card transactions for potentially improper purchases, ensuring purchase card policies are being properly implemented across the agency or component, and assessing program results. These duties are often unfulfilled. At FAA, for example, an audit found that APCs "generally were not" utilizing available reports to detect misuse and fraud, nor was the headquarters APC taking steps to assess the overall program. Similarly, an audit of the Forest Service purchase card program found that the agency's APCs failed to review sampled transactions for erroneous or abusive purchases, as required by USDA regulations.

Lack of Separation of Duties

Agencies are required to ensure that key procurement functions are handled by different individuals. When having goods shipped, for example, the same person should not approve and place the order, or place the order and receive the goods. At many agencies, however, the cardholder may perform two functions that should be separated, which increases the possibility that items may be purchased for personal use, lost, or stolen. In March 2008, GAO estimated that agencies were unable to document separation of duties for one of every three purchase card transactions. Three Navy cardholders ordered and received $500,000 of goods for themselves with their purchase cards before getting caught. In this way, inadequate separation of duties may result in millions of dollars of items that cannot be located. Items that are easily converted to personal useâcommonly referred to as "pilferable property"âare particularly vulnerable to loss and theft. The Department of Education, for example, could not account for 241 personal computers bought with purchase cards at a cost of $261,500. An audit of the Federal Emergency Management Agency's (FEMA's) spending on items related to hurricane recovery found that $170,000 worth of electronics equipment acquired with purchase cards had not been recorded in FEMA's property records and could not be found.

Inadequate Training

Given the complexities of federal procurement policies and procedures, training on the proper use and management of purchase cards is considered an important component of an agency's internal control environment. Through training, cardholders, approving officials, and program managers learn their roles in ensuring compliance with applicable regulations and statutes, and in reducing the risk of improper card use. To that end, OMB requires all agencies to train everyone who participates in a purchase card program. Cardholder training covers federal procurement laws and regulations, agency policies, and proper card use. Approving officials are required to receive the same training as cardholders, in addition to training in their duties as AOs. Program managers are required to be trained in cardholder and AO responsibilities, as well as management, control, and oversight tools and techniques. In addition, all purchase card program participants are supposed to complete their initial training prior to appointment (e.g., becoming a cardholder, or being designated as an AO or program manager) and receive refresher training at least every three years.

Agency audits published between 2002 and 2011 revealed a number of agencies had not fully implemented OMB's training requirements. A report by the inspector general at the Department of the Interior (DOI), for example, noted that DOI had not provided any training to its AOs, and concluded that many of those officials were not performing adequate reviews. The AOs themselves reportedly said that they did not know how to conduct a proper review of purchase card transactions, or how and why to review supporting documentationâboth subjects that are normally included in AO training.

Similarly, an audit at FAA concluded that the agency's failure to provide refresher training for cardholders and AOs may have contributed to violations of statutory sourcing requirements. The failure to comply with sourcing statutes, which require agencies to purchase certain goods and services from specified vendor categories, may undermine congressional procurement objectives. The Javits-Wagner-O'Day Act (JWOD), for example, requires the government to buy office supplies and services from nonprofits that employ blind and disabled Americans. Cardholder failure to comply with the provisions of JWOD and other sourcing statutes was widespread enough that GAO estimated that tens of millions of dollars of purchase card transactions may have been conducted with vendors other than the ones Congress intended.

Excessive Number of Cards Issued and High Credit Limits

The number of cardholders grew from under 100,000 in FY1993 to 680,000 in FY2000. After auditors expressed concerns that the government had issued too many credit cards and provided excessive credit limitsâfactors that raised the risk of card misuseâOMB issued a memorandum in April 2002 that required agencies to examine the number of purchase cards they issued and to consider deactivating all cards that were not a "demonstrated necessity." That same year, provisions in the Bob Stump National Defense Authorization Act for FY2003 ( P.L. 107-314 ) required the Department of Defense (DOD) to establish policies limiting both the number of purchase cards it issued and the credit available to cardholders. These reforms contributed to a net decrease of 392,000 government purchase cards between FY2000 and FY2011.

Despite this decrease in the total number of purchase card users, audits through FY2011 indicated that a number of agencies, including some with relatively large purchase card programs, did not establish appropriate controls over card issuance and credit limits. A 2006 GAO report on purchase cards at the Department of Homeland Security (DHS), for example, identified 2,468 cardholdersâabout 20% of all DHS cardholdersâwho had not made any purchases in over a year. Similarly, a congressionally directed audit of the Veterans Health Administration's (VHA's) $1.4 billion purchase card program found that VHA had issued cards with credit limits up to 11 times greater than the cardholders' historical spending levels, thereby exposing its program to unnecessary risk.

Government Charge Card Abuse Prevention Act

In response to these findingsâand evidence of similar abuse in agency travel card programsâCongress passed the Government Charge Card Abuse Prevention Act of 2012 (Charge Card Act; P.L. 112-194 ). The Charge Card Act established new internal control and reporting requirements for both purchase cards (Â§2), and travel cards (Â§3 and Â§4). The following paragraphs examine the Charge Card Act's requirements for purchase cards. Given that the Charge Card Act directly amends the U.S. Code, the requirements are identified by their location in code rather than in the act itself.

Management of Purchase Cards

Statutory purchase card requirements for civilian agencies are located in a different title of the U.S. Code than those for DOD. The Charge Card Act therefore amended Title 41 to codify the civilian agency provisions and Title 10 to codify DOD's provisions. In addition, the Charge Card Act establishes similar, but not identical, requirements for civilian agencies and DOD.

Civilian Purchase Card Program Requirements

Section (2)(a)(1) of the Charge Card Act added civilian agency purchase card requirements to Chapter 19, Title 41, of the U.S. Code. The new requirements are found in 41 U.S.C. Â§1909(a) through (e).

41 U.S.C. Â§1909(a), Required Safeguards and Internal Controls, requires executive agencies to ensure

1. There is a record of each cardholder that includes the applicable limitations on single transaction and total transactions. 2. Each cardholder is assigned an AO other than the cardholder. 3. Each cardholder and AO are responsible for (a) reconciling the charges appearing on the cardholder's statements with receipts and other supporting documentation; and (b) forwarding a summary report to the certifying official. 4. Any disputed charges or discrepancies between the cardholder's receipts and bank statements are resolved in accordance with the terms of GSA's purchase card contract with the card issuer. 5. Payments on purchase card accounts are made by the prescribed deadlines to avoid interest penalties. 6. Rebates and refunds are reviewed for accuracy and recorded as receipts. 7. Records of each transaction are retained in accordance with record disposition policies. 8. Periodic reviews are performed to determine whether each cardholder needs a purchase card. 9. Appropriate training is provided to each purchase card holder and official responsible for overseeing purchase cards in the agency. 10. The agency has specific policies that establish the number of purchase cards issued by various component organizations and the authorized credit limits for those cards. 11. The agency uses effective systems, techniques, and technologies to identify illegal, improper, or erroneous purchases. 12. The agency invalidates the purchase card of each employee who (a) ceases to be employed by the agency, immediately upon termination, or (b) transfers to another unit of the agency, immediately upon transfer, unless both units are covered by the same purchase card authority. 13. The agency takes steps to recover the cost of any illegal, improper, or erroneous purchases made with a purchase card, including through salary offsets.

41 U.S.C. Â§1909(b), Guidance, requires the OMB Director to provide guidance on the implementation of the requirements of subsection (a).

41 U.S.C. Â§1909(c), Penalties and Violations, requires agencies to establish adverse personnel actions or other punishment for cases where a cardholder violates agency purchase card policies or otherwise makes illegal, improper, or erroneous purchases with a card. The prescribed penalties must include dismissal of the employee, as appropriate. In addition, subsection (c) requires the head of each agency with more than $10 million in annual purchase card expenditures to issue a semiannual report on purchase card violations by its employees. The report must be issued jointly with the agency IG and submitted to the OMB Director.

41 U.S.C. Â§1909(d), Risk Assessment and Audits, requires the IG of each agency to

1. Conduct periodic assessments of agency purchase card programs to identify and analyze the risks of misuse and to use these assessments to develop an audit plan. 2. Audit purchase card transactions in order to identify potential misuse, patterns of misuse, and categories of purchases that could be made with another payment method in order to obtain lower prices. 3. Report the audit results to the agency head, along with recommendations for addressing any findings. 4. Report to the OMB Director on the implementation of the IG's recommendations. The OMB Director must compile the IG reports and transmit them to Congress and the Comptroller General.

41 U.S.C. Â§1909(e), Relationship to Department of Defense Purchase Card Regulations, clarifies that subsections (a) through (d) do not apply to DOD.

DOD Purchase Card Program Requirements

Section 2(a)(2) of the Charge Card Act amended 10 U.S.C. Â§2784(b) to codify new purchase card management requirements for DOD. Only the Charge Card Act requirements are listed below.

10 U.S.C. Â§2784(b)(2) requires DOD to ensure that each cardholder is assigned an approving official other than the cardholder. 10 U.S.C. Â§2784(b)(11) requires DOD to use effective systems, techniques, and technologies to prevent or identify potential fraudulent transaction. 10 U.S.C. Â§2784(b)(12) requires DOD to invalidate the purchase card of each employee who (a) ceases to be employed by DOD, immediately upon termination, (b) transfers to another unit of DOD, immediately upon transfer, unless both units are covered by the same purchase card authority, or (c) is separated or released from active duty or full-time National Guard duty. 10 U.S.C. Â§2784(b)(13) requires DOD to take steps to recover the cost of any illegal, improper, or erroneous purchases made with a purchase card, including through salary offsets. 10 U.S.C. Â§2784(b)(15) requires DOD to conduct periodic assessments of agency purchase card programs in order identify and analyze the risks of misuse and to report the results to the OMB Director and Congress.

Implementation of the Charge Card Act

In an effort to assess compliance with the Charge Card Act and other purchase card requirements across the government, GAO reviewed agency policies and data from FY2014 and released its analysis in 2017. More recently, the Council of the Inspectors General on Integrity and Efficiency (CIGIE) launched a coordinated audit of FY2017 purchase card data. The IGs at 20 agencies sampled a total of 1,255 "high-risk" transactionsâpurchases that potentially violated program policies or proceduresâfrom and shared their findings with CIGIE. By July 2018, the IGs had released their own reports and CIGIE had issued a summary and analysis of the findings. According to the CIGIE analysis, while there were few examples of fraud at the 20 agencies that participated in the project, nearly 51% (501) of the purchases sampled failed to comply with at least one purchase card policy. Patterns of noncompliance, with examples and analysis from the GAO report, individual agency audits, and the CIGIE report are discussed below.

Purchases from Prohibited or Questionable Merchants

Federal statutes and regulations, including agency-specific regulations, may prohibit the purchase of supplies and services from certain merchants or for certain items. USDA's purchase card guidance, for example, prohibits employees from using their purchase cards to obtain cash advances, bail bonds, personal items, or escort services. Agencies are often able to block merchants of certain categoriesâsuch as cruise lines or casinosâthrough the card-issuing bank. Some merchants, while not prohibited, are considered "questionable" because the items or services they offer may be allowed by agency policies, only if certain conditions are met. A purchase card may be used at a catering company, for example, but only under certain circumstances. Exceptions may be permitted for transactions with prohibited or questionable merchants under limited circumstances, but they must be justified by the cardholder and approved by the AO.

The CIGIE analysis found that nearly 8% of high-risk purchases violated agency policies regarding prohibited or questionable merchants. Of those, nearly one-half lacked a written justification and/or authorization from the AO. An IG at one agency found an employee had used his purchase card to lease multiple vehicles at a cost of more than $5,700, and had provided no documentation to support the need and appropriateness of the transaction. In addition, agencies often failed to block merchant categories; one agency permitted transactions at seven types of prohibited businesses. Even when agencies attempted to block certain merchant categories, the technology did not work consistently. The EPA IG found 20 purchase card transactions at merchants who had been blocked by the agencyâthe cards had not been declined at the point of sale.

Purchases from Nonmandatory Sources

Purchase card holders are required to use mandatory sources to obtain needed supplies, when possible. Cardholders may use other sources only after confirming that the supplies or services they need are not available from a mandatory source. Auditors found, however, that in nearly one out of every five transactions (19.9%), cardholders purchased supplies and services from nonmandatory sources when they could have acquired them from mandatory sources. As a consequence, agencies not only failed to support certain categories of merchants that are mandatory sources, such as people who are blind or severely disabled, but they also may not obtain the best available price and thereby reduce potential cost savings. One cardholder, for example, purchased batteries from a nonmandatory source for $64.49 when they were available from a mandatory source for $11.42âmeaning the agency overpaid by 565%. Similarly, a cardholder at USDA purchased a used Global Positioning System (GPS) device from a nonmandatory source when a new model was available from a mandatory source for 15% less.

Purchases from nonmandatory sources may be authorized if a written justification is provided, but cardholders frequently failed to provide one. Auditors at the Department of the Interior (DOI), for example, determined that cardholders had failed to justify purchases from nonmandatory sources 65% of the time. Overall, the CIGIE reported that cardholders provided no justification for a majority of transactions with nonmandatory sources. Other documentation policies were violated as well. The CIGIE data showed that 36% of nonmandatory purchases lacked a requisition request, 32% lacked evidence of receipt, and 6% had no documentation at all.

Purchases that Included Sales Tax

Generally, federal purchase card transactions are exempt from state and local sales taxes. Cardholders are responsible for ensuring that their transactions do not include sales taxes, and attempting to recover sales taxes if they are paid erroneously. IGs at 20 federal agencies found many instances of purchase card holders paying sales taxesâmore than 5% of the high-risk transactions in the CIGIE study included charges for sales taxes. Of the transactions that included sales tax, 58% lacked a written justification for paying the taxes and 20% of the items may not have been needed by the government. In many cases, agencies did not track whether the sales taxes were recovered. The USDA IG investigated seven transactions that included sales taxes, and none of the cardholders provided any documentation as to whether they attempted to recover the tax charges. An audit of NASA's purchase card transactions found that 7% of all high-risk purchases included sales tax, and that there was no evidence that the cardholders had attempted to reclaim those costs. While sales tax on any single transaction may not be considered significant, the cumulative amount in a fiscal year may total in the hundreds of thousands of dollars. The DOI IG obtained actual tax-paid data from the agency's purchase card program and determined that in the first six months of FY2017, DOI paid $338,212 in sales taxes involving 19,716 transactions. The IG for HUD found the agency expended $42,944 in sales tax on purchase card transactions during FY2018.

Purchases that Split Transactions

Each purchase card holder is assigned a dollar amount, or threshold, which may not be exceeded on a single transaction. This threshold is known as the single purchase limit. Cardholders may not split a large purchase into smaller ones in order to circumvent the single purchase limit. Auditors typically flag an account that shows multiple purchases from the same vendor on the same day where the total costs exceed the cardholder's single purchase limitâthis pattern is often associated with split transactions.

The CIGIE report estimated that 6.6% of all high-risk transactions involved split transactions. The USDA IG, for example, identified a series of transactions on the same day, with the same vendor, for the same product, where the sum of the charges was more than double the cardholder's single purchase limit. Similarly, the NASA IG determined that an employee had tried to circumvent the single transaction limit by making three purchases from the same vendor on the same day. Auditors at the Social Security Administration (SSA) identified split transactions in 6.5% of its sample. The agency suggested that its staff lacked the time to investigate these purchases and determine if they were inappropriate.

Implications for Agency Internal Controls

Although the CIGIE initiative did not assess the implementation status of every requirement in the Charge Card Act, the IGs' findings indicated weaknesses remain in many agencies' internal controls. In particular, the audit results showed that AOs did not adequately monitor cardholder purchases; employee training on purchase card policies and procedures is insufficient; and agency policies and procedures have gaps.

Lack of Adequate Oversight from AOs

The Charge Card Act required agencies to strengthen AOs' capacity to monitor cardholder activity. AOs play a central role in preventing and detecting purchase card misuse, as they review cardholder statements to verify any suspicious or questionable transactions. In addition, AOs reconcile transaction records with supporting documentation to ensure that all purchases were appropriate.

Audit findings highlighted the ongoing need for AOs to carefully review cardholder transactions. Many transactions that violated agency purchase card policies had not been reviewed and approved by an AO. GAO found that 11% of all the transactions it sampled from FY2014 had not been reviewed and approved by an AO. Similarly, the CIGIE report found that 44% of the transactions involving questionable or prohibited sources and 38% of split transactions had not been reviewed by the AO. These charges may have been questioned had the AOs thoroughly reviewed the purchases.

In many cases, AOs approved transactions that lacked complete supporting documentation. GAO estimated that 22% of all purchase card transactions in FY2014 lacked complete documentation.

IGs reported that 59% of the purchases that violated agency policies on the use of mandatory sources lacked written justification, as did 58% of the purchases that violated policies prohibiting the payment of sales taxes. In many cases, AOs approved transactions where there was no documentation that the goods or services had been received. The CIGIE report estimated that of the total number of transactions that violated an agency purchase card policy, 27% were approved without a receipt.

Lack of Proper Training

The Charge Card Act specifies that agencies are to ensure that cardholders and AOs receive appropriate training on their duties. IGs found that at many agencies, purchase card training programs did not cover some policies or refresher training had not occurred within the past three yearsâconditions which are inconsistent with OMB training requirements. Auditors considered the lack of proper training to be a significant weakness with wide-ranging effects. As the EPA IG's office wrote, "cardholder noncompliance primarily resulted from ineffective training and/or a lack of monitoring and control activities."

The CIGIE report found, for example, that agency training programs often lacked adequate explanations of the rules governing split transactions, which meant that AOs did not know how to properly identify such purchases and cardholders were unaware that split purchases were violations of policy. The NASA IG recommended that the agency revise its purchase card training program to emphasize minimum documentation requirements, which constituted NASA's largest category of policy violations. Multiple agencies were unable to provide complete training records. The HUD IG found, for example, that the agency had not maintained records of the cardholders and managers who had completed the required training, as did the IG at the Small Business Administration (SBA).

Lack of Clear and Complete Policies

Agencies develop their own policies to implement government-wide and agency-specific purchase card requirements. The CIGIE report found that agency guidance was often unclear. Consequently, cardholders and managers did not always understand and properly follow purchase card policies. The IG at the Department of State recommended that the agency reissue its purchase card guidance to specify the frequency with which "refresher training" must be completedâa policy which was inconsistently represented at different components. The NASA IG linked one particular weaknessâthe absence of supporting documents for purchase card transactionsâto agency guidance, which was unclear about the document requirements for purchases below $500. The EPA IG recommended that the agency revise its guidance on the use of mandatory sources to make it easier to understand. More than 39% of EPA's noncompliant transactions were related to the inappropriate use of nonmandatory sources.

In some cases, agency policies did not provide sufficient information about purchase card requirements. GAO found that several agencies did not require someone other than the cardholder to receive purchases. In addition, the CIGIE report found that while split transactions were a common violation, many agencies "lacked the policies necessary to identify split purchases." The USDA IG identified 1,410 transactions in FY2018 where the agency paid sales taxes and could not determine if any efforts had been made to recover those charges. The IG wrote that

This occurred because USDA does not have a policy requiring cardholders to document reasons for paying or attempting to recover sales tax, such as documenting on the receipt or using the AXOL system to describe the transaction. As a result, cardholders are improperly paying sales tax and not documenting why sales taxes were paid or if recovered, making it difficult for approving officials to determine why State and local sales taxes were paid or if any recovery was attempted.

Auditors at EPA determined that the agency did not have adequate controls over its purchase card program, in part because the agency lacked a specific policy for the appropriate number of cardholders needed to make purchases at its various components.

Concluding Observations

Oversight of agency purchase card programs is limited by the availability of data. While the CIGIE report identified areas where implementation of the Charge Card Act is incomplete, not all agencies had provided data and the data provided did not reflect or represent all of the law's requirements. Moreover, implementation of the Charge Card Act is ongoing and some agencies may have already addressed the weaknesses identified in the CIGIE initiative, which analyzed FY2017 data.

Going forward, Congress has the option of requesting a study of the implementation of the Charge Chard Act. If GAO were to examine implementation of the Charge Card Act, it would possibly be able to use more recent data and it could target agencies with the highest risk of card misuse, as determined by dollar volume or history of violations, among other criteria. GAO might be asked to evaluate specific requirements, particularly in areas that were cited by auditors prior to the Charge Card Act. Have agencies implemented policies that require separation of duties? Have agencies established appropriate dollar thresholds for various categories of cardholders? Are agencies invalidating purchase cards when an employee terminates employment or is transferred to another component? The CIGIE report noted another potential weaknessâapproximately 8.6% of the high-risk transactions sampled involved purchase card activity on closed accounts. The extent of agency compliance with these and other purchase card requirements will not be known without additional, timely information.

In addition to agency efforts, an evaluation of the effectiveness of SmartPay bank services and tools might be useful. As noted, agencies have reported that merchant block codes do not always prevent transactions from being approved at prohibited merchants. In addition, GAO found that SmartPay banks did not always retain records for the amount of time required by their contracts, in part due to confusion over which records were considered part of the transaction. An evaluation of bank services might identify additional issues that need to be addressed. It also might include a comparison of the technologies different agencies utilize and discuss what benefits they have realized. Given the potential for technology to enhance oversight, reduce administrative burden, and mitigate the risk of improper purchases, an assessment of SmartPay bank services may help agencies identify potentially useful technologies they have not yet incorporated into their charge card programs.