GSA administers the federal government’s SmartPay® purchase card program, which has been in existence since the late 1980s. The purchase card program was created as a way for agencies to streamline federal acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. The purchase card can be used for simplified acquisitions, including micropurchases, as well as to place orders and make payments on contract activities. The FAR designated the purchase card as the preferred method of making micropurchases. In addition, part 13 of the FAR, “Simplified Acquisition Procedures,” establishes criteria for using purchase cards to place orders and make payments. Figure 1 shows the dramatic increase in purchase card use since the inception of the SmartPay® program. As shown in figure 1, during the 10-year period from fiscal year 1996 through 2006, acquisitions made using purchase cards increased almost fivefold—from $3 billion in fiscal year 1996 to $17.7 billion in fiscal year 2006. Figure 2 provides further information on the number of purchase cardholder accounts. As shown, the number of purchase cardholder accounts peaked in 2000 at more than 670,000, but since then the number of purchase cardholder accounts has steadily decreased to around 300,000. Cardholder (in thouand) As the contract administrator of the program, GSA contracts with five different commercial banks in order to provide purchase cards to federal employees. The five banks with purchase card contracts are (1) Bank of America, (2) Citibank, (3) Mellon Bank, (4) JPMorgan Chase, and (5) U.S. Bank. GSA also has created several tools, such as the Schedules Program, so that cardholders can take advantage of favorable pricing for goods and services. Oversight of the purchase card program is also the responsibility of OMB. OMB provides overall direction for governmentwide procurement policies, regulations, and procedures to promote economy, efficiency, and effectiveness in the acquisition processes. Specifically, in August 2005, OMB issued Appendix B to Circular No. A-123, Improving the Management of Government Charge Card Programs, that established minimum requirements and suggested best practices for government charge card programs. From July 1, 2005, through June 30, 2006, GSA reported that federal agencies purchased over $17 billion of goods and services using government purchase cards. Our analysis of transaction data provided by the five banks found that micropurchases represented 97 percent of purchase card transactions and accounted for almost 57 percent of the dollars expended. Using purchase cards for acquisitions and payments over the micropurchase limit of $2,500 represented about 3 percent of purchase transactions and accounted for more than 44 percent of the dollars spent from July 1, 2005, through June 30, 2006. Internal control weaknesses in agency purchase card programs exposed the federal government to fraudulent, improper, and abusive purchases and loss of assets. Our statistical testing of two key transaction-level controls over purchase card transactions over $50 from July 1, 2005, through June 30, 2006, found that both controls were ineffective. In aggregate, we estimated that 41 percent of purchase card transactions were not properly authorized or purchased goods or services were not properly received by an independent party (independent receipt and acceptance). We also estimated that 48 percent of purchases over the micropurchase threshold were either not properly authorized or independently received. Further, we found that agencies could not provide evidence that they had possession of, or could otherwise account for, 458 of 1,058 accountable and pilferable items. According to Standards for Internal Control in the Federal Government, internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives and should occur at all levels and functions of an agency. The controls include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, and the production of records and documentation. For this audit, we tested those control activities that we considered to be key in creating a system that prevents and detects fraudulent, improper, and abusive purchase card activity. To this end, we tested whether (1) cardholders were properly authorized to make their purchases and (2) goods and services were independently received and accepted. As shown in table 1, we estimated that the overall failure rate for the attributes we tested was 41 percent, with failure rates of 15 percent for authorization and 34 percent for receipt and acceptance. Lack of proper authorization. As shown in table 1, 15 percent of all transactions failed proper authorization. According to Standards for Internal Control in the Federal Government, transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority, as this is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. To test authorization, we accepted as reasonable evidence various types of documentation, such as purchase requests or requisitions from a responsible official, e-mails, and other documents that identify an official government need, including blanket authorizations for routine purchases with subsequent review by an approving official. The lack of proper authorization occurred because (1) the cardholder failed to maintain sufficient documentation, (2) the agency’s policy did not require authorization, or (3) the agency lacked the internal controls and management oversight to identify purchases that were not authorized— increasing the risk that agency cardholders will misuse the purchase card. Failure to require cardholders to obtain appropriate authorization and lack of management oversight increase the risk that fraudulent, improper, and other abusive activity will occur without detection. Lack of independent receipt and acceptance. As depicted in table 1, our statistical sampling of executive agency purchase card transactions also found that 34 percent of transactions failed independent receipt and acceptance, that is, goods or services ordered and charged to a government purchase card account were not received by someone other than the cardholder. According to Standards for Internal Control in the Federal Government, the key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. Segregating duties entails separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling related assets. The standards further state that no one individual should control all key aspects of a transaction or event. As evidence of independent receipt and acceptance, we accepted any signature or initials of someone other than the cardholder on the sales invoice, packing slip, bill of lading, or any other shipping or receiving document. We found that lack of documented, independent receipt extended to all types of purchases, including pilferable items such as laptop computers. Independent receipt and acceptance helps provide assurance that purchased items are only acquired for legitimate government need and not for personal use. Although we did not test the same number of attributes as in previous audits of specific agencies’ purchase card programs, for those attributes we tested, the estimated governmentwide failure rates shown in this report are lower than the failure rates we have previously reported for certain individual agencies. Table 2 provides failure rates from our prior work related to proper approval and independent receipt and acceptance for certain individual agencies. As shown, estimated failure rates for independent receipt and acceptance from previous audits were as high as 87 percent for one Army location (as reported in 2002) and, most recently, 63 percent for DHS (as reported in 2006). In contrast, we are estimating a 34 percent failure rate for this audit. Because prior audits have been restricted to individual agencies, we cannot state conclusively that the lower failure rate is attributable to improvements in internal controls governmentwide. However, some agencies with large purchase card programs, such as DOD, have implemented improved internal controls in response to our previous recommendations. Further, in 2005, OMB also issued Appendix B to Circular No. A-123 prescribing purchase card program guidance and requirements. These changes are positive steps in improving internal controls over the purchase card program. While only 3 percent of governmentwide purchase card transactions from July 1, 2005, through June 30, 2006, were purchases above the micropurchase threshold of $2,500, these transactions accounted for 44 percent of the dollars spent during that period. Because of the large dollar amount associated with these transactions, and additional requirements related to authorization than are required for micropurchases, we drew a separate statistical sample to test controls over these larger purchases. Specifically, we tested (1) proper purchase authorization and (2) independent receipt and acceptance. As part of our test of proper purchase authorization, we looked for evidence that adequate competition was obtained. If competition was not obtained, we asked for supporting documentation showing that competition was not required, for example, that the purchase was acquired from sole-source vendors. We estimated that 48 percent of the purchase card transactions over the micropurchase threshold failed our attribute tests. As shown in table 3, for 35 percent of purchases over the micropurchase threshold, cardholders failed to obtain proper authorization. Additionally, in 30 percent of the transactions, cardholders failed to provide sufficient evidence of independent receipt of the goods or services. Lack of proper authorization for purchases over the micropurchase limit. As table 3 indicates, 35 percent of purchases over the micropurchase limit were not properly authorized. To test for proper authorization, we looked for evidence of prior approval, such as a contract or other requisition document. For purchases above the micropurchase threshold, we also required evidence that the cardholder either solicited competition or provided reasonable evidence for deviation from this requirement, such as sole source justification. Of the 34 transactions that failed proper authorization, 10 transactions lacked evidence of competition. For example, one Army cardholder purchased computer equipment totaling over $12,000 without obtaining and documenting price quotes from three vendors as required by the FAR. The purchase included computers costing over $4,000 each, expensive cameras that cost $1,000 each, and software and other accessories—items that are supplied by a large number of vendors. In another example of failed competition, one cardholder at DHS purchased three personal computers totaling over $8,000. The requesting official provided the purchase cardholder with the computers’ specifications and a request that the item be purchased from the requesting official’s preferred vendor. We found that the cardholder did not apply due diligence by obtaining competitive quotes from additional vendors. Instead, the cardholder asked the requesting official to provide two “higher priced” quotes from additional vendors in order to justify obtaining the computers from the requesting official’s preferred source. In doing so, the cardholder circumvented the rules and obtained the items without competitive sourcing as required by the FAR. Lack of independent receipt and acceptance. As shown in table 3, we projected that 30 percent of the purchases above the micropurchase threshold did not have documented evidence that goods or services ordered and charged to a government purchase card account were received by someone other than the cardholder. Our testing of a nonrepresentative selection of accountable and pilferable property acquired with government purchase cards found that agencies failed to account for 458 of the 1,058 accountable and pilferable property items we tested. The total value of the items was over $2.7 million, and the purchase amount of the missing items was over $1.8 million. We used a nonrepresentative selection methodology for testing accountable property because purchase card data did not always contain adequate detail to enable us to isolate property transactions for statistical testing. Because we were not able to take a statistical sample of these transactions, we were not able to project inventory failure rates for accountable and pilferable property. Similarly, because the scope of our work was restricted to purchase card acquisitions, we did not audit agencies’ controls over accountable property acquired using other procurement methods. However, the extent of the missing property we are reporting on may not be restricted to items acquired with the government purchase cards, but may reflect control weaknesses in agencies’ management of accountable property governmentwide. The lost or stolen items included computer servers, laptop computers, iPods, and digital cameras. Our prior reports have shown that weak controls over accountable property purchased with government purchase cards increases the risk that items will not be reported and accounted for in property management systems. We acknowledge agency officials’ position that the purchase card program was designed to facilitate acquisition of goods and services, including property, and not specifically to maintain accountability over property. However, the sheer number of accountable property purchases made “over the counter” or directly from a vendor increases the risk that the accountable or pilferable property would not be reported to property managers for inclusion in the property tracking system. Unrecorded assets decrease the likelihood of detecting lost or stolen government property. In addition, if these items were used to store sensitive data, this information could be lost, stolen, or both without the knowledge of the government. Failure to properly account for pilferable and accountable property also increases the risk that agencies will purchase property they already own but cannot locate—further wasting tax dollars. Although each agency establishes its own threshold for recording and tracking accountable property, additional scrutiny is necessary for sensitive items (such as computers and related equipment) and items that are easily pilfered (such as cameras, iPods, and personal digital assistants (PDA)). Consequently, for this audit, we selected $350 as the threshold for our accountable property test. Standards for Internal Control in the Federal Government provides that an agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for, and limited access to, assets such as cash, securities, inventories, and equipment, which might be vulnerable to risk of loss or unauthorized use. Failure to maintain accountability over property, including highly pilferable items, increases the risk of unauthorized use and lost and stolen property. Our accountable asset work consisted of identifying accountable and pilferable properties associated with transactions from both the statistical sample and data-mining transactions, requesting serial numbers from the agency and vendors, and obtaining evidence—such as a photograph provided by the agency—that the property was recorded, could be located, or both. In some instances, we obtained the photographs ourselves. We then evaluated each photograph to determine whether the photograph represented the accountable or pilferable item we selected for testing. Property items failed our physical property inventory tests for various reasons, including the following: the agency could not locate the item upon request and reported the item as missing, the agency failed to provide photographs, or the agency provided photographs of items where the serial numbers did not match the items purchased. In many instances, we found that agencies failed to provide evidence that the property was independently received or entered into the agency property book. Weak controls over accountable and pilferable property increase the risk that property will be lost or stolen and also increase the chance that the agency will purchase more of the same item because it is not aware that the item has already been purchased. The following descriptions further illustrate transactions that failed our property tests: The Army could not properly account for 16 server configurations containing 256 items that it purchased for over $1.5 million dollars. Despite multiple inquiries, the Army provided photographs of only 1 configuration out of 16, but did not provide serial numbers for that configuration to show that the photograph represented the items acquired as part of the transaction we selected for testing. Further, when we asked for inventory records as an acceptable alternative, the Army could not provide us evidence showing that it had possession of the 16 server configurations. A Navy cardholder purchased general office supplies totaling over $900. As part of this purchase, the cardholder bought a Sony digital camera costing $400 and an iPod for $200. In supporting documentation provided, the Navy stated that the cardholder, approving official, and requester had no recollection of requesting or receiving the iPods. To find out whether these pilferable items could have been converted for personal use and effectively stolen, we asked the Navy to provide a photograph of the camera and iPod, including the serial number. However, the Navy informed us that the items were not reported on a property tracking system and therefore could not be located. We found numerous instances of fraud, waste, and abuse related to the purchase card program at dozens of agencies across the government. Internal control weaknesses in agency purchase card programs directly increase the risk of fraudulent, improper, and abusive transactions. For instance, the lack of controls over proper authorization increases an agency’s risk that cardholders will improperly use the purchase card. As discussed in appendix II, our work was not designed to identify all instances of fraudulent, improper, and abusive government purchase card activity or estimate their full extent. Therefore, we did not determine and make no representations regarding the overall extent of fraudulent, improper, and abusive transactions governmentwide. The case studies identified in the tables that follow represent some of the examples that we found during our audit and investigation of the governmentwide purchase card program. We found numerous examples of fraudulent and potentially fraudulent purchase card activities. For the purpose of this report, we define fraudulent transactions as those where a fraud case had been adjudicated or was undisputed or a purchase card account had been compromised. Potentially fraudulent transactions are those transactions where there is a high probability of fraud, but where sufficient evidence did not exist for us to determine that fraud had indeed occurred. As shown in table 4, these transactions included (1) acquisitions by cardholders that were unauthorized and intended for personal use and (2) purchases appropriately charged to the purchase card but involving potentially fraudulent activity that went undetected because of the lack of integration among the processes related to the purchase, such as travel claims or missing property. In a few instances, agencies have taken actions on the fraudulent and potentially fraudulent transactions we identified. For example, some agency officials properly followed policies and procedures and filed disputes with the bank against fraudulent purchases that appeared on the card, and subsequently obtained refunds. However, in the most egregious circumstances, such as repeated fraudulent activities by the cardholders, sometimes over several years, the agencies did not take actions until months after the fraudulent activity occurred, or after we selected the transactions and requested documentation from the agencies for the suspicious transactions. Table 4 illustrates instances where we found fraud, or indications of fraud, from our data mining and investigative work. The following text further describes three of the fraudulent cases from table 4: Case 1 involves a cardholder who embezzled over $642,000 from the Forest Service’s national fire suppression budget from October 10, 2000, through September 28, 2006. This cardholder, a purchasing agent and agency purchase card program coordinator, wrote approximately 180 checks to a live-in boyfriend with whom the cardholder shared a bank account. Proceeds from the checks were used for personal expenditures, such as gambling, car and mortgage payments, dinners, and retail purchases. Although the activities occurred repeatedly over a 6-year period, the embezzled funds were undetected by the agency until USDA’s Office of Inspector General received a tip from a whistleblower in 2006. In June 2007, the cardholder pled guilty to one count of embezzlement and one count of tax fraud. As part of the plea agreement, the cardholder agreed to pay restitution of $642,000. Further, in November 2007, the cardholder was sentenced to 21 months imprisonment followed by 36 months supervised release. Case 2 involves a potential theft of government property. A Navy cardholder purchased 19 pilferable items totaling $2,200 from CompUSA without proper authorization or subsequent review of the purchase transaction. After extensive searches, the Navy provided evidence that only 1 of the 19 items listed on the invoice—an HP LaserJet printer purchased for $150—was found. Other items that were lost or stolen included five iPods; a PDA; iPod travel chargers, adapters, flash drives, leather accessories, and two 17-inch LCD monitors—all highly pilferable property that can be easily diverted for personal use. According to officials from the Navy, at the time of the purchase, the command did not have a requirement for tracking highly pilferable items. Additionally, all members involved in the transaction had since transferred and the agency did not have the capability to track where the items might have gone. Navy officials also informed us that the command issued a new policy requiring that pilferable items be tracked. Case 4 involves a USPS postmaster who fraudulently used the government purchase card for personal gain. Specifically, from April 2004, through October 2006, the cardholder made more than 15 unauthorized charges from various online dating services totaling more than $1,100. These were the only purchases made by this cardholder during our audit period, yet the cardholder’s approving official did not detect any of the fraudulent credit card activity. According to USPS officials, this person was also under an internal administrative investigation for viewing pornography on a government computer. Based on the administrative review, the cardholder was removed from his position in November 2006 after working out an agreement with USPS in which he was authorized to remain on sick leave until his retirement date in May 2007. In April the USPS Office of Inspector General issued a demand letter and recovered the fraudulent Internet dating service charges. Our data mining identified numerous examples of improper and abusive transactions. Improper transactions are those purchases that although intended for government use, are not permitted by law, regulation, or government/agency policy. Examples we found included (1) purchases that were prohibited or otherwise not authorized by federal law, regulation, or government/agency policy and (2) split purchases made to circumvent the cardholder single-purchase limit or to avoid the need to obtain competition on purchases over the $2,500 micropurchase threshold. Abusive purchases are those where the conduct of a government organization, program, activity, or function fell short of societal expectations of prudent behavior. We found examples of abusive purchases where the cardholder (1) purchased goods or services at an excessive cost (e.g., gold plated) or (2) purchased an item for which government need was questionable. Table 5 identifies examples of improper and abusive purchases. The following text further describes four of the cases in table 5: Case 2 relates to a cardholder who is a 20-year veteran at FAS, a unit within USDA. At the end of fiscal year 2006, the cardholder purchased two vehicles—a Toyota Land Cruiser and Toyota Sienna—on two separate days for two separate USDA offices overseas. Although the vehicles appeared to have been shipped overseas for a legitimate government need, our investigative work found that these purchases were made in violation of USDA purchase card policies and with the implicit agreement by FAS policyholders as follows: According to written communications at FAS, the requester for one of the cars had a “large chunk of money that needed to be used before the end of the fiscal year (2006).” The requester requested that the vehicle be purchased in the United States, and then shipped overseas because it was not possible to finalize the purchase during fiscal year 2006 if the agency was to purchase the vehicle in the country where the office was located. The cardholder stated that he wrote three checks (two at $25,000 each and a third at $7,811) to purchase the Land Cruiser because the checks have a $25,000 limit printed on them. The convenience check fee on the three checks was over $1,000. Pursuant to our investigation, the cardholder informed his supervisor that he intentionally violated agency policy, which requires that vehicles be acquired through the GSA unless a waiver is obtained. The cardholder stated that he disagreed with USDA policy requiring GSA involvement in car acquisition because it was too cumbersome and that USDA needed to issue new policies. We reviewed supporting documentation showing that the vehicles were shipped overseas to the units that purchased them, but we did not perform work to determine whether the year-end purchase was necessary. Agency management did not take action when they were made aware of the cardholder’s significant violation of agency policy. In case 3, four DOD cardholders purchased over $77,000 in clothing and accessories at high-end clothing and other sporting goods stores, including over $45,000 at high-end retailers such as Brooks Brothers. The Brooks Brothers invoices showed that the cardholders paid about $2,300 per person for a number of servicemembers for tailor-made suits and accessories—$7,000 of which were purchased a week before Christmas. According to the purchase card holder, DOD purchased these items to provide servicemembers working at American embassies with civilian attire. While the Department of Defense Financial Management Regulation authorizes a “civilian clothing allowance” when servicemembers are directed to dress in civilian clothing when performing official duty, the purchase card transactions made by these individuals are far greater than the maximum allowable initial civilian clothing allowance of $860 per person. Case 7 relates to the $13,500 that USPS spent on food at the National Postal Forum in Orlando, Florida, in 2006. For this occasion, USPS paid for 81 dinners averaging over $160 per person for customers of the Postal Customer Council at an upscale steak restaurant. Further, USPS paid for over 200 appetizers and over $3,000 of alcohol, including more than 40 bottles of wine costing more than $50 each and brand- name liquor such as Courvoisier, Belvedere, and Johnny Walker Gold. In case 9, a NASA cardholder purchased two 60GB iPods for official data storage. During the course of our audit, we found that the iPods were used for personal use, such as to store personal photos, songs, and video clips. Further, we question the federal government’s need to purchase iPods for data storage when other data storage devices without audio and video capabilities were available at lower cost. The purchase card continues to be an effective tool that helps agencies reduce transaction costs for small purchases and provides flexibility in making acquisitions. While the overall failure rates associated with governmentwide purchase card transactions have improved in comparison to previous failure rates at specific agencies, breakdowns in internal controls over the use of purchase cards leave the government highly vulnerable to fraud, waste, and abuse. Problems continue to exist in the area of authorization of transactions, receipt and acceptance, and accountability of property bought with purchase cards. This audit demonstrates that continued vigilance over purchase card use is necessary if agencies are to realize the full potential of the benefits provided by purchase cards. We are making the following 13 recommendations to improve internal control over the government purchase card program and to strengthen monitoring and oversight of purchase cards as part of an overall effort to reduce instances of fraudulent, improper, and abusive purchase card activity. We recommend that the Director of OMB: Issue a memorandum reminding agencies that internal controls over purchase card activities, as detailed in Appendix B of OMB Circular No. A-123, extend to the use of convenience checks. Issue a memorandum to agency heads requesting the following: Cardholders, approving officials, or both reimburse the government for any unauthorized or erroneous purchase card transactions that were not disputed. When an official directs a cardholder to purchase a personal item for that official, and management later determines that the purchase was improper, the official who requested the item should reimburse the government for the cost of the improper item. Consistent with the goals of the purchase card program, to streamline the acquisition process, we recommend that the Administrator of GSA, in consultation with the Department of the Treasury’s Financial Management Service: Provide agencies guidance on how cardholders can document independent receipt and acceptance of items obtained with a purchase card. The guidelines should encourage agencies to identify a de minimis amount, types of purchases that do not require documenting independent receipt and acceptance, or both and indicate that the approving official or supervisor took the necessary steps to ensure that items purchased were actually received. Provide agencies guidance regarding what should be considered sensitive and pilferable property. Because purchase cards are frequently used to obtain sensitive and pilferable property, remind agencies that computers, palm pilots, digital cameras, fax machines, printers and copiers, iPods, and so forth are sensitive and pilferable property that can easily be converted to personal use. Instruct agencies to remind government travelers that when they receive government-paid-for meals at conferences or other events, they must reduce the per diem claimed on their travel vouchers by the specified amount that GSA allocates for the provided meal. Provide written guidance or reminders to agencies: That cardholders need to obtain prior approval or subsequent review of purchase activity for purchase transactions that are under the micropurchase threshold. That property accountability controls need to be maintained for pilferable property, including those items obtained with a purchase card. That cardholders need to timely notify the property accountability officer of pilferable property obtained with the purchase card. That property accountability officers need to promptly record, in agency property systems, sensitive and pilferable property that is obtained with a purchase card. That, consistent with the guidance on third-party drafts in the Department of the Treasury’s Treasury Financial Manual, volume 5, chapter 4-3000, convenience checks issued on the purchase card accounts should be minimized, and that convenience checks are only to be used when (1) a vendor does not accept the purchase cards, (2) no other vendor that can provide the goods or services can reasonably be located, and (3) it is not practical to pay for the item using the traditional procurement method. That convenience check privileges of cardholders who improperly use convenience checks be canceled. We received written comments on a draft of this report from the Acting Controller of OMB (see app. III) and the Administrator of GSA (see app. IV). In response to a draft of our report, OMB agreed with all three recommendations. OMB agreed that the efficiencies of the purchase card program are not fully realized unless federal agencies implement strong and effective controls to prevent purchase card waste, fraud, and abuse. To that end, OMB noted that it had proactively designated government charge card management as a major focus area under Appendix B of Circular No. A-123, Improving the Management of Government Charge Card Programs. With respect to the recommendations contained in this report, OMB is proposing to issue further guidance reminding agencies that Appendix B extends to convenience checks as well as government charge cards, and that agency personnel have financial responsibility with regard to unauthorized and erroneous purchase card transactions. While GSA wholly or partially concurred with four recommendations, GSA generally disagreed with the majority of our recommendations. Specifically, GSA stated that it was not within the scope of its authority to issue guidance to agencies with respect to asset accountability and receipt and acceptance of items purchased with government purchase cards, as these are not strictly purchase card issues. Further, GSA stated that there are more effective ways to deal with purchase card misuse or abuse than issuing “redundant” policy reminders or guidance. It also took exception to our testing methodology. We agree with GSA that the problems we identified with property accountability and receipt and acceptance go beyond the bounds of strictly purchase card issues. However, our work over the last several years has consistently shown substantial problems with property accountability and independent receipt and acceptance of goods and services, problems that arose because of the flexibility provided by the purchase card program. We do not believe that our recommendations related to policy guidance and reminders to strengthen internal controls are redundant—our previous recommendations in this area had been targeted at specific agencies we audited. With respect to governmentwide purchase card issues, GSA’s role as the purchase card program manager puts it in a unique position to identify challenges to agency internal control systems and assist agencies with improving their internal controls governmentwide. We are encouraged by OMB’s support for aggressive and effective controls over purchase cards, and believe that GSA can seek OMB support to overcome the perceived lack of authority. We believe that GSA has a number of tools already at its disposal, such as online training and annual conferences, where GSA could easily remind cardholders and approving officials to pay particular attention to governmentwide issues, including asset accountability and independent receipt and acceptance of goods and services identified in this report. We also reiterate support for our testing methodology, which included systematic testing of key internal controls through statistical sampling. The following contains more detailed information on GSA’s comments, along with our response. GSA concurred with 3 of 10 recommendations. Specifically, GSA concurred with 2 recommendations to improve controls over convenience checks and 1 recommendation related to approval of purchases below the micropurchase threshold. Specifically, GSA agreed to provide written guidance to agencies that convenience check use should be minimized, and that improper use of convenience checks would result in cancellation of convenience check privileges. As part of its concurrence, GSA provided that it is not practical to strictly prohibit the use of convenience checks given the unique nature of some suppliers or services acquired by agencies and vendor refusal to accept purchase cards. It was not our intent to completely eliminate the use of convenience checks. As such, we clarified our recommendation to require only that the cardholder make a “reasonable”—not absolute—effort to locate other vendors that can provide the same goods and services and that accept the purchase card prior to using convenience check. The requested revision is consistent with our intent and therefore we have made the necessary change to our recommendations. With respect to the third recommendation related to approval of micropurchases, GSA agreed that cardholders need to obtain prior approval or subsequent review of purchase card activity for purchase transactions that are under the micropurchase threshold. However, GSA believed that OMB needed to take the lead and incorporate this change in its Circular No. A-123. GSA offered to help OMB revise Circular No. A-123 in this regard. GSA stated that it partially concurred with our recommendation to remind travelers to reduce the per diem claims on their travel vouchers when meals are provided by the government. However, based on its response, it appears that GSA substantially agrees with our recommendation, and that the GSA Office of Governmentwide Policy will issue this guidance. In actuality, GSA concurred with our recommendation but disagreed that this was a purchase card issue. Further, GSA took exception as to whether the requirement to deduct per diem applies to continental breakfasts, stating that continental breakfasts did not constitute “full breakfasts.” Thus, GSA stated that it needs to convene stakeholders in the GSA travel policy community to consider whether the requirement for deducting per diem should be applied to continental breakfasts. We disagree with this assessment. If the costs of the continental breakfasts were in fact not significant, we would not have reported on this finding; however, the basis of our recommendation rests primarily on the fact that GSA itself paid for continental breakfasts costing $23 per person, which was greater than the portion of government per diem established by GSA for breakfast in any city in the United States. GSA then proceeded to reimburse the same employees the breakfast portion of per diem—in effect paying twice for breakfasts. We disagree with GSA that this is an appropriate treatment of continental breakfast, as it implies that it is appropriate for taxpayers to pay twice for a government traveler’s meal. Consequently, we reiterate the need for GSA to promote prudent management of taxpayer’s money, and our support for requiring travelers to reduce their per diem if they took advantage of the continental breakfasts provided. GSA disagreed with all of our recommendations related to receipt and acceptance and controls over accountable and pilferable property. GSA stated that these issues were not within the purview of the GSA SmartPay® program or the scope of GSA SmartPay® contracts. Further, GSA stated that other approaches would be more effective at addressing purchase card abuse and misuse than issuing “redundant” policy guidance and reminders. With respect to receipt and acceptance, GSA stated that it did not have the authority to encourage agencies to identify a de minimis amount, types of items that do not require receipt and acceptance, or both, or to determine how approving officials should document receipt and acceptance. With respect to accountable property, GSA did not believe that it should provide reminders to agencies that computers and similar items are sensitive and pilferable property that can easily be converted to personal use. GSA argued that what constitutes sensitive and pilferable property is defined by agencies and is not within its purview. GSA also believes that it does not have authority to remind cardholders to maintain accountability of, and notify property managers when, pilferable property is acquired with purchase cards. Finally, GSA does not believe that it can issue reminders to property managers to record, in a timely manner, pilferable property acquired with purchase cards in their property management systems. GSA suggested we modify these recommendations accordingly. With respect to receipt and acceptance, we agree that GSA alone should not issue guidance concerning agencies’ internal controls over purchase cards and related payment process. We reiterate that we did not ask GSA to take actions in isolation—instead, we recommended that GSA work with the Department of the Treasury’s Financial Management Service to provide guidance on improving internal controls while at the same time streamlining the acquisition process. After all, streamlining the acquisition process is a key objective of the purchase card program. We believe this could be achieved, in part, by requiring independent receipt and acceptance only for items above a de minimis amount. Further, governmentwide guidance in this area would not be redundant—the fact that no current guidance exists demonstrates the need for consistent policy governmentwide that all agencies can follow. Consistent guidance is crucial to engendering taxpayers’ confidence in the purchase card program—as we stated above, our previous audits and our current work showed that ineffective receipt and acceptance of goods and services acquired with the purchase card is a widespread, governmentwide problem. Furthermore, OMB indicated that it was extremely concerned about purchase card abuse and supported our recommendations designed to improve internal controls over the program. We believe that GSA can adopt a proactive approach and coordinate with OMB to obtain its support to overcome the perceived obstacles. In our opinion, the purchase card program will continue to expose the federal government—and the taxpayers—to fraud, waste, and abuse, unless GSA helps facilitate a governmentwide solution. Similarly, GSA argued that it did not have the authority to take the recommended actions with respect to property accountability. As with independent receipt and acceptance, our work continues to demonstrate that accountability for property acquired with purchase cards is ineffective across many agencies. For example, the purchase card program provides cardholders the ability to acquire sensitive and pilferable items directly from vendors. This process results in cardholders bypassing the normal property receipt and acceptance procedures, which increases the risk that the item will not be recorded in an agency’s list of accountable property. GSA needs to recognize this risk (and other inherent risks) created by purchase card use and proactively work with agencies to improve the accountability of property acquired with government purchase cards. We also believe that our recommendations fully take into account the extent of GSA’s authority—to that end, our recommendation called for GSA to provide agencies guidance and reminders to improve internal controls over asset accountability. Even though GSA already issued guidance related to the proper use of the purchase card program through online training, refresher courses, and annual conferences, GSA should go a step further and address control weaknesses related to property accountability and receipt and acceptance. GSA’s position contrasted sharply with OMB, which, in its comments on our report, expressed support for aggressive and effective controls over purchase cards. We believe that GSA can take advantage of the diverse tools already at its disposal, such as online training and annual conferences, with which GSA could easily remind cardholders and approving officials to pay particular attention to governmentwide issues, including asset accountability and independent receipt and acceptance of goods and services identified in this report. Overall, our recommendations are focused on GSA taking a proactive approach to improve the success of the purchase card program. Last year, the federal government spent nearly $18 billion using purchase cards. While the purchase card program has achieved significant savings, a program of this magnitude needs to focus on both preventive and detective controls to prevent fraud, waste, and abuse. In its response, GSA also pointed out that the new SmartPay® 2 contract should provide better management tools to agencies. However, the changes GSA identified in SmartPay® 2 were mostly related to data mining for fraud, waste, and abuse after a potentially fraudulent or improper transaction had taken place, but did not address the issues we raised in this report. As our previous work indicated, while detection can help reduce fraud, waste, and abuse, preventive controls are a more effective and less costly means to minimize fraud, waste, and abuse. The recommendations we made, to which GSA took exception, were meant to improve these up-front controls. GSA also took exception to our methodology, arguing that we improperly failed items as part of our control testing. GSA argued that some unauthorized purchases were still appropriate purchases. We believe that this argument is flawed. Standards for Internal Control in the Federal Government states that transactions should be authorized and executed only by persons acting within the scope of their authority. In other words, authorization is the principal means of assuring that only valid transactions are initiated or entered into and, consequently, without authorization, adequate assurance does not exist that the items purchased were for authorized purposes only. Our statistical sampling was designed to test authorization control, and the results we reported reflected items that did not pass this attribute. Such attribute testing is a widely accepted and statistically valid methodology for internal control evaluations. GSA also stated that our report did not adequately address the areas of personal responsibility and managerial oversight. We disagree. We recommended that OMB require agencies to hold cardholders financially responsible for improper and wasteful purchases, and OMB agreed to implement our recommendations; we believe that this would contribute to holding cardholders accountable to management for their actions. Further, our past reports on purchase card management have always focused on managerial oversight. However, it is not feasible within the scope of a governmentwide audit to test managerial oversight at every government agency. Consequently, we focused on providing GSA, the manager of the governmentwide purchase card program, with recommendations that could contribute to improving management oversight at the agencies. Finally, GSA disagreed with our characterization that travelers who did not reduce the per diem claimed on their travel voucher when dinners were provided may be engaging in potentially fraudulent activities. Because we are unable to establish that these travelers acted with the requisite knowledge and willfulness necessary to establish either a false statement under 18 U.S.C. §1001 or a false claim, we have characterized such activities as potentially fraudulent. GSA’s and OMB’s comments are reprinted in appendixes III and IV. As agreed with your offices, unless you announce the contents of this report earlier, we will not distribute it until 30 days from its date. At that time, we will send copies of this report to the Director of OMB and the Administrator of GSA. We will make copies available to others upon request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix V. Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to Fraudulent, Improper, and Abusive Activity. GAO-06-1117. Washington, D.C.: September 28, 2006. Purchase Cards: Control Weaknesses Leave DHS Highly Vulnerable to Fraudulent, Improper, and Abusive Activity. GAO-06-957T. Washington, D.C.: July 19, 2006. Lawrence Berkeley National Laboratory: Further Improvements Needed to Strengthen Controls Over the Purchase Card Program. GAO-04-987R. Washington, D.C.: August 6, 2004. Lawrence Livermore National Laboratory: Further Improvements Needed to Strengthen Controls Over the Purchase Card Program. GAO-04-986R. Washington, D.C.: August 6, 2004. Pacific Northwest National Laboratory: Enhancements Needed to Strengthen Controls Over the Purchase Card Program. GAO-04-988R. Washington, D.C.: August 6, 2004. Sandia National Laboratories: Further Improvements Needed to Strengthen Controls Over the Purchase Card Program. GAO-04-989R. Washington, D.C.: August 6, 2004. VHA Purchase Cards: Internal Controls Over the Purchase Card Program Need Improvement. GAO-04-737. Washington, D.C.: June 7, 2004. Purchase Cards: Increased Management Oversight and Control Could Save Hundreds of Millions of Dollars. GAO-04-717T. Washington, D.C.: April 28, 2004. Purchase Cards: Steps Taken to Improve DOD Program Management, but Actions Needed to Address Misuse. GAO-04-156. Washington, D.C.: December 2, 2003. Forest Service Purchase Cards: Internal Control Weaknesses Resulted in Instances of Improper, Wasteful, and Questionable Purchases. GAO-03-786. Washington, D.C.: August 11, 2003. HUD Purchase Cards: Poor Internal Controls Resulted in Improper and Questionable Purchases. GAO-03-489. Washington, D.C.: April 11, 2003. FAA Purchase Cards: Weak Controls Resulted in Instances of Improper and Wasteful Purchases and Missing Assets. GAO-03-405. Washington, D.C.: March 21, 2003. Purchase Cards: Control Weaknesses Leave the Air Force Vulnerable to Fraud, Waste, and Abuse. GAO-03-292. Washington, D.C.: December 20, 2002. Purchase Cards: Navy is Vulnerable to Fraud and Abuse but Is Taking Action to Resolve Control Weaknesses. GAO-02-1041. Washington, D.C.: September 27, 2002. Purchase Cards: Control Weaknesses Leave Army Vulnerable to Fraud, Waste, and Abuse. GAO-02-732. Washington, D.C.: June 27, 2002. Government Purchase Cards: Control Weaknesses Expose Agencies to Fraud and Abuse. GAO-02-676T. Washington, D.C.: May 1, 2002. Purchase Cards: Control Weaknesses Leave Two Navy Units Vulnerable to Fraud and Abuse. GAO-02-32. Washington, D.C.: November 30, 2001. We performed a forensic audit of executive agencies’ purchase card activity for the 15 months ending September 30, 2006. Specifically, we (1) determined the effectiveness of internal controls intended to minimize fraudulent, improper, and abusive transactions by testing two internal control attributes related to transactions taken from two statistical samples and (2) identified specific examples of potentially fraudulent, improper, and abusive transactions through data mining and investigations. We obtained the databases containing agency purchase and other government charge card transactions for the 12-month period ending June 30, 2006, from Bank of America, Citibank, JP Morgan Chase, Mellon Bank, and U.S. Bank. The databases contained purchase, travel, and fleet card transactions. Using information provided by the banks, we queried the databases to identify transactions specifically related to purchase cards. We performed other procedures—including reconciliation to purchase card data that the General Services Administration (GSA) published—to confirm that the data were sufficiently reliable for the purposes of our report. Our statistical sampling work covered purchase card activity at executive agencies. We define executive agencies as federal agencies that are required to follow the Federal Acquisition Regulation (FAR), including executive departments, independent establishments, and wholly owned federal government corporations as defined by the United States Code. We excluded transactions from the legislative and judicial branches, entities under treaty with the United States, and federal agencies with specific authority over their own purchase card programs. To assess compliance with key internal controls, we extracted and tested two statistical (probability) samples of 96 transactions each. The first sample consisted of transactions exceeding $50 taken from a population of over 16 million purchase card transactions totaling almost $14 billion. We also selected a second sample from the population of over 600,000 transactions totaling nearly $6 billion that exceeded the $2,500 micropurchase threshold. We selected this second sample because of additional acquisition requirements associated with purchases over the micropurchase threshold, and the high dollar amount associated with these transactions. Specifically, while only 3 percent of governmentwide purchase card transactions from July 1, 2005, through June 30, 2006, were over the micropurchase threshold, they accounted for 44 percent of the total dollars spent during that period. With our probability sample, each transaction in the population had a nonzero probability of being included, and that probability could be computed for any transaction. Each sample element was subsequently weighted in the analysis to account statistically for all the transactions in the population, including those that were not selected. Because we followed a probability procedure based on random selection, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent interval (e.g., plus or minus 10 percentage points). This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. As a result, we are 95 percent confident that each of the confidence intervals in this report will include the true values in the study population. All percentage estimates from the samples of executive agency purchase card activity have sampling errors (confidence interval widths) of plus or minus 10 percentage points or less. Our audit of key internal controls focused on whether agencies provided adequate documentation to substantiate that (1) purchase card transactions were properly authorized and (2) goods and services acquired with purchase cards were independently received and accepted. As part of our tests of internal controls, we reviewed applicable federal laws and regulations related to the FAR and purchase card uses. We also identified and applied the internal control principles contained in Standards for Internal Control in the Federal Government, Audit Guide: Auditing and Investigating the Internal Control of Government Purchase Card Programs, and agencies’ purchase card policies and procedures. Furthermore, for purchases exceeding the micropurchase threshold of $2,500, we tested FAR requirements that the cardholder use required vendors and promote competition by soliciting bids—or justify the departure from this requirement in writing. To determine whether a transaction was properly authorized, we reviewed documentation to ascertain if an individual other than the cardholder was involved in the approval of the purchase. To determine that proper authorization existed, we used reasonable evidence for authorization of micropurchases from $50 to $2,500, such as purchase requests from responsible officials, requisitions, e-mails, and other documents that identify an official government need, including blanket authorizations for routine purchases with subsequent approval. For purchase card transactions exceeding the micropurchase threshold of $2,500, we required prior purchase authorization, such as a contract, a requisition, or other approval document. Additionally, we looked for evidence that the cardholder used required vendors (as required by the Javits-Wagner-O’Day Act (JWOD)) and solicited quotes to promote competition (or provided evidence justifying departure from this requirement, such as an annotation justifying the use of a sole source). To determine whether goods or services were independently received and accepted, we reviewed supporting documentation provided by the agency. For each transaction, we compared the quantity, price, and item descriptions on the vendor invoice and shipping receipt to the purchase requisition to verify that the items received and paid for were actually the items ordered. We also determined whether evidence existed that a person other than the cardholder was involved in the receipt of the goods or services purchased. We concluded that independent receipt and acceptance existed if the vendor invoice, shipping documents, and receipt materially matched the transaction data, and if the signature or initial of someone other than the cardholder was on the sales invoice, packing slip, bill of lading, or any other shipping or receiving document indicating receipt. For statistical sample and data-mining transactions containing accountable or highly pilferable property, we performed an inventory to determine whether executive agencies maintained accountability over the physical property items obtained with government purchase cards. Because each agency had its own threshold for accountable property, we were not able to test accountable property against each agency’s threshold for this governmentwide audit. Consequently, we defined accountable property as any property item exceeding a $350 threshold and containing a serial number. We defined highly pilferable items as items that can be easily converted to personal use, such as cameras, laptops, cell phones, and iPods. We selected highly pilferable property at any price if it was easily converted to personal use. The purchase card data provided by the banks did not always contain adequate details to enable us to isolate property transactions for statistical testing. Because we were not able to take a statistical sample of these transactions, we were not able to project failure rates for accountable and pilferable property. Consequently, our tests of property accountability were performed on a nonrepresentative selection of property that we identified when a transaction selected for statistical sampling or data mining contained accountable and pilferable property. For these property items, we identified serial numbers from supporting documentation provided by the agency and, in some cases, by contacting the vendors themselves. To minimize travel costs associated with conducting a physical inventory governmentwide, we requested that each agency provide photographs of the property items, which we compared against the serial numbers originally provided. When we were unable to obtain serial numbers from supporting documentation or from the vendors, we gave the agency the benefit of the doubt and accepted the serial numbers shown in agency-provided photographs as long as the product(s) and quantity matched. In some isolated instances, we performed the physical inventory ourselves. To identify examples of fraudulent, improper, and abusive purchase card activity, we data mined purchase card transactions from July 1, 2005, through September 30, 2006. This period contained an additional 3 months of data subsequent to the period included in our statistical samples. For data-mining purposes, we also included transactions from federal agencies that had been granted specific authority over their own purchase card programs, such as the U.S. Postal Service. In general, we analyzed purchase card data for merchant category codes and vendor names that were more likely to offer goods, services, or both that are on executive agencies’ restricted/prohibited lists, personal in nature, or of questionable government need. We identified split purchases by extracting multiple purchase transactions made by the same cardholder at the same vendor on the same day. For year-end purchases, we identified transactions from purchase card accounts where year-end activity is high compared to the rest of the year. With respect to convenience checks, we used various criteria, including identifying instances where convenience checks were written to cash or payees not normally associated with procurement needs and where a large number of convenience checks were written to a single payee, among others. We analyzed the banks’ databases for detailed transaction data, whenever available, for accountable property and highly pilferable items. We then requested and reviewed supporting documentation for over 550 transactions among the thousands we identified. We conducted investigative work, which included additional inquiries and data analysis, when applicable. While we identified fraudulent, improper, and abusive transactions, our work was not designed to identify and we cannot determine the extent of fraudulent, improper, or abusive transactions occurring in the population of governmentwide purchase card transactions. We assessed the reliability of the data provided by (1) performing various testing of required data elements, (2) reviewing financial statements of the five banks for information about the data and systems that produced them, and (3) interviewing bank officials knowledgeable about the data. In addition, we verified that totals from the databases agreed with the total purchase card activity provided by GSA and published on its Web site, in totality and for selected agencies. We determined that the data were sufficiently reliable for the purposes of our report. We conducted this performance audit from September 2006 through February 2008, in accordance with U.S. generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. Gregory D. Kutz, (202) 512-6722 or kutzg@gao.gov. In addition to the contact above, Tuyet-Quan Thai, Assistant Director; James Ashley; Beverly Burke; Bruce Causseaux; Sunny Chang; Dennis Fauber; Danielle Free; Jessica Gray; Ryan Guthrie; Ken Hill; Ryan Holden; Aaron Holling; John Kelly; Delores Lee; Barbara Lewis; Andrew McIntosh; Richard McLean; Aaron Piazza; John Ryan; Barry Shillito; Chevalier Strong; Scott Wrightson; Tina Wu; and Michael Zola made key contributions to this report.

Summary: Over the past several years, GAO has issued numerous reports and testimonies on internal control breakdowns in certain individual agencies' purchase card programs. In light of these findings, GAO was asked to analyze purchase card transactions governmentwide to (1) determine whether internal control weaknesses existed in the government purchase card program and (2) if so, identify examples of fraudulent, improper, and abusive activity. GAO used statistical sampling to systematically test internal controls and data mining procedures to identify fraudulent, improper, and abusive activity. GAO's work was not designed to determine the overall extent of fraudulent, improper, or abusive transactions. Internal control weaknesses in agency purchase card programs exposed the federal government to fraud, waste, abuse, and loss of assets. When testing internal controls, GAO asked agencies to provide documentation on selected transactions to prove that the purchase of goods or services had been properly authorized and that when the good or service was delivered, an individual other than the cardholder received and signed for it. Using a statistical sample of purchase card transactions from July 1, 2005, through June 30, 2006, GAO estimated that nearly 41 percent of the transactions failed to meet either of these basic internal control standards. Using a second sample of transactions over $2,500, GAO found a similar failure rate--agencies could not demonstrate that 48 percent of these large purchases met the standard of proper authorization, independent receipt and acceptance, or both. Breakdowns in internal controls, including authorization and independent receipt and acceptance, resulted in numerous examples of fraudulent, improper, and abusive purchase card use. These examples included instances where cardholders used purchase cards to subscribe to Internet dating services, buy video iPods for personal use, and pay for lavish dinners that included top-shelf liquor. GAO identified some of the case studies, including one case where a cardholder used the purchase card program to embezzle over $642,000 over a period of 6 years from the Department of Agriculture's Forest Service firefighting fund. This cardholder was sentenced to 21 months in prison and ordered to pay full restitution. In addition, agencies were unable to locate 458 items of 1,058 total accountable and pilferable items totaling over $2.7 million that GAO selected for testing. These missing items, which GAO considered to be lost or stolen, totaled over $1.8 million and included computer servers, laptop computers, iPods, and digital cameras. For example, the Department of the Army could not adequately account for 256 items making up 16 server configurations, each of which cost nearly $100,000.