HUD’s purchase card program is part of the governmentwide commercial credit card program established to simplify federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services from vendors. According to Federal Acquisition Regulation (FAR) Part 13.201(b), government purchase cards should be used for micropurchases, which are purchases up to $2,500. The Department of the Treasury also requires agencies to establish approved uses and limitations on the types of purchases and spending limits. GSA administers the master contract and HUD’s purchase card policy was derived from the GSA governmentwide credit card program and tailored by HUD to meet its specific needs. During the period of our review—October 2000 through September 2001—HUD was operating under a policy dated October 1995. HUD is currently updating its purchase card policy. HUD’s purchase card policy states that purchase cards are intended to procure general-purpose office supplies and other support needs. The policy requires each approving official to develop a preapproval process to ensure that all purchase card transactions are authorized and in accordance with departmental and other federal regulations. The approving official signifies that a cardholder’s purchases are appropriate by reviewing and signing monthly statements. As required by the Department of the Treasury, HUD’s purchase card policy established approved uses and limitations on the types of purchases and dollar amounts in its purchase card policy. This policy also includes a detailed list of items that cardholders are prohibited from buying with their government purchase cards. For example, purchase or rental of nonexpendable property (generally defined as property of a durable nature with a life expectancy of at least 1 year), meals, drinks, entertainment or lodging, and construction costs exceeding $2,000 are generally prohibited. Fiscal year 2001 single purchase limits for individual cardholders, which are required to be established by the approving officials and approved by the departmental directors, ranged from $100 to $80,000, and their monthly limits ranged from $100 to $300,000. HUD was in the process of reevaluating and where applicable, lowering these limits. Bank One currently services the purchase card program at HUD. Internal control is a major part of managing an organization and is key to ensuring proper use of government resources. As mandated by 31 U.S.C. 3512, commonly known as the Federal Managers’ Financial Integrity Act of 1982, the Comptroller General issues standards for internal control in the federal government. These standards provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives and help ensure that actions are taken to address risks. Control activities are an integral part of an entity’s planning, implementation, review, and accountability for stewardship of government resources and achieving effective results. They include a wide range of diverse activities. Some examples of control activities include controls over information processing, physical control over vulnerable assets, segregation of duties, proper execution of transactions and events, and access restrictions to and accountability for resources and records. To determine whether HUD’s existing controls over the purchase card program provided assurance that improper purchases would be detected or prevented in the normal course of business, we interviewed HUD staff and performed walk-throughs of the process. We reviewed HUD’s policies and procedures and prior GAO reports as well as reports by HUD’s Office of Inspector General (OIG) and independent auditors on this topic. To test the effectiveness of internal controls, we selected a stratified random sample of 222 purchase card transactions made during fiscal year 2001 totaling over $1.8 million from a population of purchase card transactions totaling $10.6 million. To identify potential improper purchases we requested and obtained fiscal year 2001 transaction data from Bank One and used data mining techniques and other computer analyses to identify unusual transactions and payment patterns in HUD’s fiscal year 2001 purchase card transaction data that may be indicative of improper purchases. In order to determine if fiscal year 2001 purchases were adequately supported and for a valid government use, we requested and analyzed supporting documentation for those transactions that we identified as potentially improper and questionable. While we identified some improper, potentially improper, and questionable purchases, our work was not designed to determine the full extent of improper purchases. We requested comments from the Secretary of Housing and Urban Development. We conducted our work from November 2001 through November 2002 in accordance with generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. HUD staff did not comply with key elements of its purchase card policies that would have helped minimize the risk of improper purchases, including (1) obtaining preapproval for purchases, (2) retaining adequate supporting documentation, (3) conducting supervisory review of all purchases, and (4) periodically reviewing purchase card transactions to ensure compliance with key aspects of the department’s policy. This created an environment where improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases we identified through our data mining efforts. GAO’s Standards for Internal Control in the Federal Government states that transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. To address these internal control standards, HUD’s purchase card policy contains fundamental controls designed to minimize the agency’s exposure to improper purchases. HUD’s policy requires each approving official to establish a preapproval process for each cardholder to ensure that all purchases are appropriate and for official government use. Further, HUD’s policy states that the approving official is required to review, certify, and monitor all cardholder purchases to ensure that they have the necessary approvals before purchases are made. Additionally, HUD’s purchase card policy requires that approving officials review each purchase along with the applicable supporting documentation in order to certify that the purchases were appropriate and a valid use of government funds. Based on our review of HUD’s purchase card process, we found that most approving officials had not established a preapproval process to ensure the appropriateness of purchases before they are made. Only the Information Technology Office routinely obtained authorization prior to purchasing items with the purchase card. The approving official’s review of each purchase card transaction is one of the most important controls to ensure that all purchases are a valid use of government funds. We found that this critical control was seriously compromised because of inadequate supervisory review of supporting documentation by approving officials. To test the effectiveness of this key internal control, we selected and tested a stratified random sample of 222 purchase card transactions made during fiscal year 2001. Of the total $1.8 million purchase card transactions selected in the statistical sample, $1.4 million lacked adequate supporting documentation for the approving official to determine the validity of the purchase. Based on the results of this sample, we estimate that $4,753,253 of the total sampled population of purchases ($10,590,461) made during fiscal year 2001 lacked adequate supporting documentation. Our Standards for Internal Control in the Federal Government states that internal control activities help ensure that management’s directives are carried out. One such activity is the appropriate documentation of transactions. Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. All documentation should be properly managed and maintained. We determined that some of HUD’s records supporting the purchase card program were not properly managed or maintained. For instance, HUD could not provide a complete and accurate list of all approving officials. When we attempted to contact cardholders and their respective approving officials to request supporting documentation using the list the agency provided, at least 28 approving officials provided written notification that cardholders assigned to them according to HUD records were not their responsibility. According to HUD officials, the purchase card program administrator is not routinely informed of changes in approving officials and often does not have the time to update the list regularly. Because HUD does not know who should be approving purchases, there is an increased risk of collusion as well as a general lack of accountability for ensuring the proper use of government funds. Another control activity that was available but not being used by HUD is blocking Merchant Category Codes (MCC). Blocking categories of merchants allows agencies to prohibit certain types of transactions that are clearly not business related, such as purchases from jewelry stores or entertainment establishments. During our review, we found that HUD was not blocking any MCCs. These blocks are available as part of HUD’s purchase card task order, under the GSA SmartPay Master Contract with Bank One. Because HUD did not take advantage of this control, there were no restrictions on the types of purchases employees could make during fiscal year 2001—the period of our audit. As a result of our audit work, on March 6, 2002, HUD began using selected MCC blocks. Our Standards for Internal Control in the Federal Government states that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. Internal control monitoring should assess the quality of performance over time and ensure that findings of audits and other reviews are promptly resolved. Program and operational managers should monitor the effectiveness of control activities as part of their regular duties. HUD’s purchase card policy requires the department to perform annual program reviews and report the results, including findings and recommendations, to the purchase card program administrator. However, HUD officials could locate only one such report. This November 2001 report, prepared by a consultant, identified problems that were similar to the findings previously reported by the OIG in February 1999. Both reports documented problems with weak internal controls and insufficient supporting documentation. The consultant’s report also noted that HUD was not performing the periodic program reviews required by its policies and that employees were making improper split purchases. HUD management agreed with the findings in the OIG report and developed and implemented an action plan to address the identified weaknesses. According to HUD OIG staff, its recommendations were implemented and have been closed since September 30, 2000. However, based on our findings, corrective actions taken at that time were not effective. The results of our control testing indicate that HUD’s lack of internal control over the purchase card process allows continued vulnerability to wasteful, fraudulent, or otherwise improper purchases by employees using government purchase cards. Poor internal controls created an environment where improper purchases could be made with little risk of detection. We define improper purchases as those purchases that include errors, such as duplicate charges and miscalculations; charges for services not rendered; multiple charges to the same vendor for a single purchase to circumvent existing single purchase limits—known as split purchases; and purchases resulting from fraud and abuse. We define questionable purchases as those that, while authorized, were for items purchased for a questionable government need as well as transactions for which HUD could not provide adequate supporting documentation to enable us to determine whether the purchases were valid. We identified 88 transactions totaling about $112,000 that were improper split purchases. For example, one cardholder purchased nine personal digital assistants and the related accessories from a single vendor on the same day in two separate transactions just 5 minutes apart. Because the total purchase price of $3,788 exceeded the cardholder’s single purchase limit of $2,500, the purchase was split into two transactions of $2,388 and $1,400, respectively. These improper split purchases violate provisions of the Federal Acquisition Regulation and HUD’s own purchase card policy, which prohibits splitting purchases into more than one transaction to circumvent single purchase limits. We received documentation from some cardholders confirming that they split their purchases because they exceeded their single purchase limits, while one cardholder claimed the vendor independently split the purchases. We identified an additional 465 purchases totaling over $913,000 where HUD employees made multiple purchases from a vendor on the same day. Specifically, cardholders made multiple purchases totaling over $2,500 on the same day from the same vendor. Although we were unable to determine definitively whether these purchases were improper, based on the available supporting documentation, these transactions share similar characteristics with the 88 split purchases, and therefore we consider these transactions to be potentially improper. We also found 2,507 transactions, totaling about $1.3 million, with vendors that would not routinely be expected to engage in commerce with HUD. In order to determine whether these questionable purchases were a valid use of government funds, we requested supporting documentation for each purchase. HUD was able to provide us with adequate supporting documentation for 1,324 transactions totaling about $412,000. The department was unable, however, to provide adequate support for the remaining 1,183 transactions (47 percent of total transactions requested) totaling about $869,000 (67 percent of total dollars requested). Additionally, we found 940 transactions, totaling about $554,000, where the purchases were made either on a weekend or holiday. We requested supporting documentation for each of these transactions. HUD was able to provide us with adequate support for 645 transactions totaling about $189,000. HUD was unable to provide adequate support for the remaining 295 transactions (31 percent of total transactions requested) totaling over $364,000 (66 percent of total dollars requested). In these instances, we were unable to determine what was purchased, for whom, and why. Some examples of the questionable vendor transactions for which we did not receive adequate support included over $27,000 to various department stores such as Best Buy, Circuit City, Dillard’s, JCPenney, Lord & Taylor, Macy’s, and Sears; over $8,900 to several music and audio stores including Sound Craft Systems, J&R’s Music Store, Guitar Source, and Clean Cuts Music; and over $9,700 to various restaurants such as Legal Sea Food, Levis Restaurant, The Cheesecake Factory, and TGI Fridays. Additional examples of questionable or potentially improper purchases we found include $25,400 of “no show” hotel charges for HUD employees who did not attend scheduled training and $21,400 of purchases from vendors who appear to have been out of business prior to the purchase. Because HUD was unable to provide adequate documentation for these purchases, we consider them to be a questionable use of government funds and therefore potentially improper purchases. We also have concerns about HUD’s accountability for computer and related computer equipment bought with purchase cards because of the large volume of transactions for which it did not have appropriate documentation. For example, our testing revealed that HUD employees used their purchase cards to buy portable assets, such as computer equipment and digital cameras, totaling over $74,500 for which they have provided either no support or inadequate support. In HUD’s August 28, 2002, purchase card remedial action plan, discussed in more detail in the next section, HUD acknowledged that items bought with purchase cards were not being consistently entered in the department’s asset management system. As a result, portable assets became vulnerable to loss or theft. In our follow-up work, we plan to determine whether these items are included in HUD’s asset management system and are being appropriately safeguarded. OMB’s April 18, 2002 memorandum, M-02-05, requires all agencies to develop remedial action plans to manage the risk associated with purchase card usage. Agencies were required to submit their plans to the Office of Federal Procurement Policy no later than June 1, 2002. HUD’s remedial action plan was submitted to OMB on May 31, 2002. Our review of HUD’s remedial purchase card action plan found that it did not address all the weaknesses we identified. Although HUD’s plan includes steps for resolving and preventing a number of potential problem areas, including the need for (1) adequate monitoring, (2) more frequent internal audits, (3) accountability and penalties for misuse of cards, (4) updating the agency handbook, (5) spending limits in line with purchasing requirements, (6) adequate program records, including proper approving officials, and (7) entering property purchased with purchase cards in the inventory system, the plan falls short in other key areas. For example, the plan did not include requirements for (1) a robust review and approval function for purchase card transactions, focusing on identifying split purchases and other inappropriate transactions, (2) a process to periodically assess the effectiveness of the review and approval process, and (3) specific documentation and records to support the purchase card transactions. In addition, the remedial plan lacked specifics as to how and when HUD would implement it. On August 16, 2002, OMB returned HUD’s remedial action plan and asked that a timeline be incorporated. HUD submitted a new plan to OMB on August 28, 2002. While the revised remedial action plan includes a broad timeline for completion of each objective, we found that it still does not adequately address key control weaknesses we identified, in part because it lacks specific steps necessary to fully address identified problem areas. In addition, the revised remedial action plan does not require the program administration staff to begin designing a monitoring plan to assess HUD’s compliance with key aspects of its purchase card policy until the second quarter of fiscal year 2003 and does not give an estimated date for when this key internal control will be implemented. Additionally, the revised plan does not specifically identify who is responsible for developing or implementing any of the proposed improvements. The problems we identified with HUD’s purchase card program leave the agency vulnerable to wasteful, fraudulent, or otherwise improper purchases. The remedial action plan prepared by HUD is an important first step toward addressing the control weaknesses we identified. At the same time, much still remains to be done to effectively control the inherent risk in HUD’s purchase card program. HUD management will have to effectively follow through on its implementation plan and expand the plan to improve its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan or HUD will continue to be susceptible to misuse of government funds. To strengthen its internal control over the purchase card program and reduce HUD’s vulnerability to improper purchases, we recommend that the Secretary direct the Assistant Secretary for the Office of Administration to take the following actions: implement the preapproval requirement in the existing purchase card develop and implement a robust review and approval function for purchase card transactions, focusing on identifying split purchases and other inappropriate transactions, and on performing a detailed review of relevant supporting documentation for each purchase; update the list of approving officials and their designated cardholders quarterly to ensure accuracy and completeness; establish specific requirements for documentation and records to support all purchase card purchases; develop and implement a formal monitoring process to periodically assess the effectiveness of the enhanced review and approval process; revise the remedial action plan for purchase cards to include the specific steps necessary to fully implement the above five recommendations; and follow up on the purchases we identified for which cardholders did not provide adequate supporting documentation to determine the validity and the propriety of the purchases. In written comments on a draft of this report, which are reprinted in appendix I, HUD agreed that further improvements are needed to strengthen the department’s purchase card controls. Although HUD did not specifically agree or disagree with our individual recommendations, the actions being taken or planned by the agency address five of our seven recommendations. For example, in response to our recommendation to implement the preapproval requirement in the existing purchase card program, HUD stated that it has always had an effective preapproval process in its field offices through the Automated Client Response System (ACRS). While we agree that this system is available for use, during our review of supporting documentation, we found no evidence that cardholders were utilizing this system. To improve its preapproval process at its headquarters, HUD stated that it has implemented the mandatory use of HUD Form 10.4, Requisition for Supplies, Equipment, Forms, Publications, and Procurement Services. In addition, to enhance its review and approval function, HUD said it had provided mandatory training in January 2003 to approving officials on the procedures for reviewing and approving cardholder statements. HUD also said that it was working with Bank One to provide training to cardholders and approving officials on the use of the automated purchase card system and the monitoring tools available through Bank One. HUD also stated that as of January 2003, a review of the approving officials will be performed and the Agency Program Coordinator will make the necessary changes quarterly to ensure the list is accurate and complete. To ensure proper supporting documentation is maintained for all purchases, HUD also noted that it provided training to cardholders and approving officials starting in January 2003. Additionally, HUD stated that in October 2002, a staff person was assigned to begin performing planned internal reviews and random spot reviews of purchase card transactions with reports to be issued on an interim basis as the reviews are completed to ensure that proper management and internal controls are maintained over the authorization of purchases and use of the purchase card. These actions will be helpful in strengthening the purchase card controls at HUD. HUD did not state what, if any, action it planned to take regarding the two remaining recommendations. Regarding our recommendation to revise its remedial action plan, HUD stated that the plan adequately met the requirements set forth by OMB. While the plan may address the elements required by OMB, we do not believe it lays out an adequate approach for resolving identified control weaknesses. As discussed in the report, the plan lacks the specific steps necessary to fully implement the proposed changes to strengthen internal controls. Concerning follow-up on inadequately supported purchases we identified, HUD stated that it had provided documentation when asked and would provide more if necessary. On July 8, 2002, we provided HUD with a compact disk containing all transactions for which we received either no support or inadequate support during our fieldwork and allowed an additional 3 weeks for the agency to provide the supporting documentation. We have not received any additional supporting documentation since then. It is our view that HUD has a fiduciary duty to follow up on the inadequately supported purchases, which total about $2.1 million and represent 57 percent of the total purchase transactions we tested, to ensure their propriety. HUD offered several additional technical comments, which have been incorporated into this report as appropriate. This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform and Oversight within 60 days of the date of this report. You must also send a written statement to the House and Senate Committees on Appropriations with the agency’s first request for appropriations more than 60 days after the date of this report. We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Governmental Affairs and the House Committee on Government Reform, the Director of Office of Management and Budget; and other interested parties. We also will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-8341 or by E-mail at calboml@gao.gov. In addition to the contact named above, Sharon Byrd, Lisa Crye, Sharon Loftin, and Julie Matta made key contributions to this report. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO Mailing Lists” under “Order GAO Products” heading.

Summary: Due to the Department of Housing and Urban Development's (HUD) increasing use of purchase cards and the inherent risk associated with their use, Congress asked GAO to audit the purchase card program concentrating on assessing internal controls and determining whether purchases being made are a valid use of government funds. Significant internal control weaknesses in HUD's approximately $10.6 million purchase card program resulted in improper, potentially improper, and questionable purchases in fiscal year 2001. Because of these internal control weaknesses, there was often inadequate documentation supporting many purchases GAO reviewed, and as a result, GAO was unable to determine whether these purchases were a valid use of government funds. GAO also found that HUD's remedial action plan for its purchase card program does not adequately address all the control weaknesses we identified. These weaknesses created an environment in which improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases GAO identified. GAO found improper and potentially improper purchases totaling about $1 million where HUD employees either split or appeared to have split purchases into multiple transactions to circumvent cardholder limits. GAO also found that HUD employees lacked adequate supporting documentation for about $1.3 million in questionable purchases including those from vendors not expected to engage in commerce with HUD, purchases made on holidays and weekends, and $74,500 in portable assets such as computer equipment and digital cameras. In these instances, it was not possible to determine what was purchased, for whom, and why. The problems GAO identified with HUD's purchase card program leave the agency vulnerable to wasteful, fraudulent, or otherwise improper purchases. Unless HUD makes specific improvements to its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan, the department remains susceptible to fraud, waste, and abuse.