The serious breakdown in internal controls at the SPAWAR Systems Center San Diego and the Navy Public Works Center San Diego are the result of a weak overall internal control environment, flawed or nonexistent policies and procedures, and employees that do not adhere to valid policies. We found significant problems with every aspect of purchase card management that we reviewed at SPAWAR and the Navy Public Works Center. To fix these problems, SPAWAR and Navy Public Works Center management will need to demonstrate leadership in this area and establish accountability, proper incentives, and consequences for their employees in order to ensure acceptable behavior. The following are our recommendations to address the key findings related to the weak management control environment discussed in our testimony. Proliferation of Cardholders We recommend that the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego work with the Naval Supply Systems Command and DOD’s Purchase Card Joint Program Management Office to do the following. Establish specific policies and strategies governing the number of purchase cards to be issued with a focus on minimizing the number of cardholders. Develop criteria for identifying employees eligible for the privilege of cardholder status. As part of the effort to develop these criteria, assess the feasibility and cost-benefit of performing credit checks on employees prior to assigning them cardholder responsibilities to ensure that employees authorized to use government purchase cards have demonstrated credit worthiness and financial integrity. Develop policies and strategies on credit limits provided to cardholders with a focus on minimizing specific cardholder spending authority and minimizing the federal government’s financial exposure. We recommend that the Commander of the Naval Supply Systems Command confirm that required training has been completed and documented, and incorporate into purchase card training programs any relevant changes in policies and procedures made as a result of the recommendations in this report. We recommend that the Commander of the Naval Supply Systems Command work with the Navy Comptroller and the Defense Finance and Accounting Service to investigate ways to maximize potential rebates, such as (1) working with Citibank to facilitate timely receipt of monthly purchase card statements and (2) reducing the time associated with mailing and receipt of hard copy billing statements, establish effective policies and procedures for routinely calculating and verifying Citibank rebates, and develop guidance for routine distribution of rebate earnings to Navy units and activities. We recommend that the Commander of the Naval Supply Systems Command establish in NAVASUP Instruction 4200.94, further guidelines for an effective internal review program, such as having reviewers analyze monthly summary statements to identify (1) potentially fraudulent, improper, and abusive purchases and (2) any patterns of improper cardholder transactions, such as purchases of food or other prohibited items, revise NAVSUP Instruction 4200.94 to require that (1) written reports on the results of internal reviews along with any recommendations for corrective actions be prepared and submitted to local management and cognizant commands and (2) commands identify and report systemic weaknesses and corrective action plans to the Naval Supply Systems Command for monitoring and oversight, require purchase card Agency Program Coordinators to report in writing to the unit commander and the Commander of Naval Supply Systems Command any internal control weakness identified during the semiannual program reviews, and disclose systemic purchase card control weaknesses along with corrective action plans in the Secretary of the Navy’s Annual Statement of Assurance prepared under 31 U.S.C. 3512(d) (commonly referred to as the Federal Managers’ Financial Integrity Act of 1982). The following are our recommendations to address breakdowns in key controls over the purchase card program at the SPAWAR Systems Center San Diego and the Navy Public Works Center San Diego. the Commander of the Naval Supply Systems Command revise NAVSUP Instruction 4200.94 to eliminate ambiguous language suggesting that advance independent authorization of a purchase can be substituted for independent confirmation that goods and services ordered and paid for with a purchase card have been received and accepted by the government, and the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego implement procedures to require and document independent confirmation of receipt of goods and services acquired with a purchase card. To provide assurance that certifications of monthly purchase card statements for payment reflect certifying officer responsibilities in 31 U.S.C. 3325, 3528, and the approving official’s informed judgment that purchases are proper, we recommend that the Commander of the Naval Supply Systems Command revise NAVSUP Instruction 4200.94 to require that (1) cardholders notify approving officials prior to payment that purchase card statements have been reconciled to supporting documentation, (2) approving officials certify monthly statements only after reviewing them for potentially fraudulent, improper, and abusive transactions, and (3) approving officials verify, on a sample basis, supporting documentation for various cardholders’ transactions prior to certifying monthly statements for payment, and the Navy Comptroller withdraw the June 3, 1999, policy memorandum or revise the policy guidance to be consistent with the preceding recommendation for revising payment certification guidance in NAVSUP Instruction 4200.94. the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego monitor and confirm that purchase card transactions are recorded to projects that benefited from the goods and services or to relevant overhead accounts in a timely manner, in accordance with internal control standards and federal accounting standards, the Commander of the Naval Supply Systems Command revise NAVSUP Instruction 4200.94 to require that purchase card expenses be properly classified in the Navy’s detail accounting records, and the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego verify that their detail purchase card transaction records reflect the proper object classification of expense. We recommend that the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego require and verify that accountable property obtained using a purchase card is promptly recorded in property records as it is acquired, in accordance with DOD and Navy policies and procedures. The following are our recommendations to identify and address potentially fraudulent, abusive and improper purchase card transactions prior to payment. We recommend that the Commander of the Naval Supply Systems Command do the following. Act immediately to cancel all known active compromised purchase card accounts. Determine whether purchases of excessive cost, questionable government need, or both, such as items for personal use, including personal digital assistants (such as Palm Pilots), and flat screen computer monitors, that were identified by GAO are proper government purchases. If not, the Commander should prohibit their purchase. Establish written policies and criteria requiring documented justifications and procurement management approval for types of items that can be acquired with a government purchase card. Examine purchase card acquisition guidance to determine whether the purchase card is the right vehicle for acquiring certain goods and services, such as vehicle and equipment maintenance, installation of upgraded computer software, and other recurring or installationwide services, or whether these items should be subject to negotiated contracts. Work with the Under Secretary for Acquisition, Technology, and Logistics and DOD’s Purchase Card Joint Program Office to determine whether the purchase card should be used to acquire computers and other equipment or property items individually that could be more economically and efficiently procured through bulk purchases. Revise NAVSUP Instruction 4200.94 to make the Instruction consistent with the Federal Acquisition Regulation, 48 C.F.R. 13.301(a), which states that the “card may be used only for purchases that are otherwise authorized by law or regulation.” The clarifying guidance should specifically state that in the absence of specific statutory authority, purchases of items for the personal benefit of government employees, such as flowers or food, are not permitted and are therefore improper transactions. We recommend that the Commanding Officer of the SPAWAR Systems Center San Diego and the Commanding Officer of the Navy Public Works Center San Diego prohibit splitting purchases into multiple transactions as required by the Federal Acquisition Regulation and emphasize this prohibition in purchase card training provided to cardholders and approving officials, and require approving officials to monitor monthly purchase card statements and identify and report to them regarding any split purchases and the names of cardholders who made the transactions. To help ensure that cardholders adhere to applicable purchase card laws, regulations, internal control and accounting standards, and policies and procedures, we recommend that the Commander of the Naval Supply Systems Command revise NAVSUP Instruction 4300.94 to include specific consequences for noncompliance with these guidelines and enforce the guidelines. In commenting on a draft of this report, DOD stated that it was in overall agreement with 19 of our 29 recommendations. DOD did not concur with three recommendations, and it partially concurred with seven other recommendations. In addition, DOD indicated that the SPAWAR Systems Center San Diego and the Navy Public Works Center San Diego have initiated or completed corrective actions on certain of our recommendations. We plan to assess the adequacy and effectiveness of the corrective actions during the next few months and advise you of the results of our assessment. The DOD comment letter is reprinted in appendix II. The recommendations that DOD disagreed with related to four major issues addressed in our work—(1) the need for specific policies and strategies on minimizing the number of cardholders, (2) the need for Navy- wide criteria on the types of items that can be acquired using a government purchase card, (3) whether their purchases of food and flowers are proper, and (4) the need for Navy guidelines setting forth specific consequences for noncompliance with applicable purchase card laws, regulations, internal controls and accounting standards, and policies and procedures. DOD stated that the Navy executes the department’s purchase card program in a decentralized manner consistent with DOD policy. We are concerned that the lack of adequate Navy-wide guidance and the delegation of policy-making responsibility to local commands without Navy Department oversight will continue to result in a weak management control environment and the types of problem transactions identified in this report. We plan to examine this issue as part of our ongoing, broader review of the Navy's purchase card program. DOD stated that it believed that the intent of our recommendation to establish specific policies and strategies governing the number of credit cards to be issued was to encourage a manageable span of control between billing officials and cardholders. DOD maintained that in accordance with DOD policy, the Navy's decentralized execution of the purchase card program allows individual commands to issue purchase cards to employees as mission requirements warrant. DOD noted that the Naval Supply Systems Command’s recently released policy implementing DOD “Span of Control Goals” will result in approving officials being responsible for review and payment certification of a reasonable number of cardholder statements. DOD's "Span of Control Goals" states that as a general rule, billing officials should have no more than five to seven cardholders assigned to them for oversight. We agree with DOD that our recommendation is intended, in part, to ensure a manageable span of control between approving, or billing, officials and cardholders. At SPAWAR, we found only one approving official responsible for reviewing and certifying payment of 1,526 cardholders' monthly purchase card statements, creating a substantial span of control issue. Providing several hundred approving officials to create a reasonable span of control over SPAWAR's 1,526 cardholders would not be a practical or economical course of action for SPAWAR. We found no valid justification for 1,526, 36 percent, of SPAWAR's employees to have purchase cards. Further, the intent of our recommendation is broader than the span of control issue. We are also concerned about the financial exposure associated with the excessive number of cardholders. As stated in our testimony, the two Navy units had given purchase cards to over 1,700 employees, most of whom had credit limits of $20,000 or more and the authority to make their own purchase decisions. For example, most of SPAWAR's 1,526 cardholders had a $25,000 credit limit and most of the Navy Public Works Center's 254 cardholders had a $20,000 credit limit. The proliferation of cardholders, particularly at SPAWAR San Diego, significantly increased the government's financial exposure and created a situation where it was virtually impossible to maintain a positive control environment. To reduce the financial exposure associated with the large number of cardholders, we continue to recommend that the two Navy commands establish specific policies and strategies governing the number of purchase cards to be issued with a focus on minimizing the number of cardholders. In addition, the Naval Supply Systems Command guidance implementing the Department's "Span of Control Goals" merely restates DOD’s guideline that approving officials should have no more than five to seven cardholders under their purview—it does not provide specific guidance for reducing the number of cardholders. DOD also stated that the criteria for employees being issued purchase cards should be a function of mission requirements and the level of trust between the cardholder and supervisor. Further, DOD stated that the Navy believes the supervisor's judgment is sufficient as to the trustworthiness of the employee to obligate on the part of the government. We continue to believe that DOD should assess the feasibility and cost benefit of performing credit checks on employees prior to issuing a purchase card. Individuals who have a history of personal credit problems are more likely to improperly use their government purchase cards if their access to personal credit has been limited. In fact, our review of the Navy purchase card fraud cases discussed in our testimony shows this to be true for at least one of the cases. Further, as discussed in our testimony, we identified several cases of potentially fraudulent, improper, and abusive transactions at both the SPAWAR Systems Center San Diego and the Navy Public Works Center San Diego that had been certified as proper for payment. We are continuing to investigate several of these cases as part of our follow-up work and plan to assess the correlation between fraudulent, abusive, and improper use of the government purchase card and cardholders who have personal credit problems. DOD stated that it is the responsibility of the local Navy commands to establish written policies and procedures and ensure that purchases are made for official use, meet mission requirements, and are made at a fair and reasonable price. DOD also stated that due to differing and unique mission requirements throughout the Navy, it is difficult to develop a general listing of what items can be purchased with or without special justification. For example, DOD stated that ticket purchases to Disneyland may be an appropriate purchase not requiring special justification within a “Non-Appropriated Funded activity,” but may require such documentation for an “Appropriated Funded activity.” We continue to believe there is a need for Navy-wide guidance in the form of written policies and criteria requiring documented justifications and procurement management approval for types of items can be acquired with a government purchase card. For example, we found some instances where employees were buying flat panel monitors costing from $800 to $2,500 each while others were buying traditional monitors costing about $300 each. In addition, at SPAWAR, we found that employees made abusive purchases of high-cost personal items, including two designer brief cases costing about $400 each and several designer palm pilot cases costing about $100 each. In these instances, the decision of what to buy and the quality of the items purchased often appeared to be a matter of cardholder preference. Further, the fact that such purchases were not questioned supports our recommendation that specific written guidelines be established for purchases of these types of items. DOD’s example of the purchase of tickets for Disneyland is another example of the type of purchase card use that should be specifically addressed in the NAVSUP Instruction 4200.94 to avoid misuse of the card and abusive purchases. Establishing criteria for determining the propriety of purchases of high- cost items and prohibiting the purchase of personal preference items, such as designer brief cases and designer palm pilot cases, would help prevent abusive purchases in the future and avoid unnecessary federal expenditures. DOD stated that the present language in the policy section of NAVSUP Instruction 4200.94 provides clear guidance on the propriety of buying food and flowers using the purchase card. We disagree. The policy section of NAVSUP Instruction 4200.94 merely states that the “purchase card shall only be used for authorized U.S. Government purchases.” We found numerous potentially fraudulent, improper, and abusive purchases that had been approved by supervisors as authorized government purchases. The Federal Acquisition Regulation (FAR), 48 C.F.R. 13.301(a), states that the Governmentwide Commercial Purchase Card "may be used only for purchases that are otherwise authorized by law or regulations." Therefore, a procurement using the purchase card is lawful only if it would be lawful using conventional procurement methods. Further, the Treasury Financial Manual (TFM) requires agencies to establish guidance on approved uses of the government purchase card and limitations on types of transactions permitted. The NAVSUP Instruction 4200.94 policy statement does not address these specific purchase card requirements of the FAR or the TFM. As stated in our testimony, without statutory authority, appropriated funds may not be used to furnish meals or refreshments to employees within their normal duty stations. Free food and other refreshments normally cannot be justified as a necessary expense of an agency's appropriation because these items are considered personal expenses that federal employees should pay for from their own salaries. Likewise, appropriated funds may not be used to purchase gifts for employees or others unless an agency can demonstrate that the items further the purposes for which the appropriation was enacted. The purchase of the flowers and food were both personal rather than official in nature and, therefore, may not be paid for with appropriated funds. Given the problems we found, clarifyng the current guidance on the propriety of purchasing food, flowers, and similar personal items could help reduce improper purchase card use for these items. DOD stated that the present language in the NAVSUP Instruction 4200.94 policy section clearly identifies the consequences for fraud, abuse, and misuse of the purchase card. We disagree. The policy section of the NAVSUP Instruction only states that deliberate misuse of the purchase card may be prosecuted as fraud. It does not identify any specific consequences for failure to follow control requirements, such as the failure to (1) obtain independent documentation of receipt and acceptance of goods and services, (2) notify property book officers of accountable items acquired with a purchase card, (3) properly certify purchase card statements for payment, and (4) comply with prohibitions on certain purchases and split transactions. Our work identified pervasive failures to follow established controls in these and other areas. To ensure that the Navy's purchase card controls are effective, it is critical that the Navy enforce those controls by establishing specific disciplinary consequences—such as removal of cardholder status, reprimands, suspension from employment for several days, and firing—for those employees who fail to follow established controls even if their action does not amount to fraud against the United States. Unless cardholders and approving officials are held accountable for following key internal controls, the Navy is likely to continue to experience the types of fraudulent, abusive, and improper transactions identified in our work. As agreed with your offices, unless you announce the contents of this report earlier, we will not distribute this report until 30 days from its date. At that time, we will send copies of this report to the Secretary of Defense, the Under Secretary of Defense (Acquisition, Technology, and Logistics), the Director of the Department’s Purchase Card Joint Program Management Office, the Under Secretary of Defense (Comptroller), the Secretary of the Navy, the Navy Comptroller, the Commander of the Naval Supply Systems Command, the Commander of the Space and Naval Warfare Systems Command, the Commanding Officer of the Space and Naval Warfare Systems Command’s Systems Center in San Diego, the Commander of the Navy Public Works Center, the Commanding Officer of the Navy Public Works Center in San Diego, and the Director of the Defense Finance and Accounting Service. We are also sending copies to the Chairman of the Senate Committee on Finance; the Chairman and Ranking Minority Member of the Senate Committee on Governmental Affairs; the Chairman and Ranking Minority Member of the House Committee on Government Reform; the Ranking Minority Member of the Subcommittee on Government Efficiency, Financial Management, and Intergovernmental Relations, House Committee on Government Reform; other interested congressional committees; and the Director of the Office of Management and Budget. Copies will be made available to others upon request. Please contact Gregory D. Kutz at (202) 512-9095 or kutzg@gao.gov, Robert H. Hast at (202) 512-7455 or hastr@gao.gov, or Gayle Fischer, Assistant Director at (202) 512-9577 or fischerg@gao.gov, if you or your staff have any questions concerning this report. Major contributors to this work are acknowledged in appendix III. Mr. Chairman, Members of the Subcommittee, and Senator Grassley: Thank you for the opportunity to discuss Department of Defense (DOD) internal controls and accounting practices for purchase card transactions and payments. DOD reported that it used purchase cards—MasterCard or VISA cards issued to its civilian and military personnel—for more than 10 million transactions valued at $5.5 billion in fiscal year 2000. DOD has increased the use of purchase cards with the intention of eliminating the bureaucracy and paperwork long associated with making small purchases and intends to expand the use of purchase cards over the next several years. Given the rapid growth of purchase card use at DOD, ensuring that key controls are in place over the program is critical to protecting the government from fraud, waste, and abuse. We began looking into this issue at the request of Senator Grassley, who was concerned about internal control weaknesses that may have contributed to reports of purchase card fraud related to Navy programs based in San Diego, California. As a result, we agreed to obtain and review DOD fraud case information related to Navy purchase card programs in the San Diego area and to review purchase card controls and accounting for two Navy units based in San Diego—the Space and Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public Works Center. Further background information on the Navy purchase card program is included in appendix I. Today, I will discuss the results of our review of Navy purchase card controls, including (1) the purchase card control environment at the two Navy units’ San Diego activities and overall management issues that affect the Navy-wide purchase card program, (2) the results of our test work on statistical samples of purchase card transactions at the two Navy units, which identified control weaknesses in four critical areas, and (3) potentially fraudulent, improper, and abusive transactions made by the two Navy units. Some of these transactions are similar to those involved in five specific fraud cases related to Navy programs based in San Diego that had been identified at the time of our work. Information on the five fraud cases is presented in appendix II. The Navy’s purchase card program is part of the Governmentwide Commercial Purchase Card Program, which was established to streamline federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. DOD reported that it used purchase cards for 95 percent of its eligible transactions—more than 10 million transactions, valued at $5.5 billion—in fiscal year 2000. The Navy’s reported purchase card activity represented nearly one third of the reported DOD total during fiscal year 2000—2.7 million transactions, valued at $1.7 billion. According to unaudited DOD data, SPAWAR and Navy Public Works Center San Diego-based activities accounted for $68 million (about 15 percent) of the $451 million in fiscal year 2000 Navy purchase card payments processed by DFAS San Diego. Although SPAWAR San Diego and the Navy Public Works Center San Diego are both working capital fund activities, their missions are very different. SPAWAR San Diego is a highly technical systems operation staffed by scientists and engineers who provide research, technology, and engineering support to other Navy programs worldwide. The Navy Public Works Center San Diego provides maintenance, construction, and operations support to other Navy programs in the San Diego area. Under the Federal Acquisition Streamlining Act of 1994, the Defense Federal Acquisition Regulation Supplement guidelines, eligible purchases include (1) micro-purchases (transactions up to $2,500 for which competitive bids are not needed); (2) purchases for training services up to $25,000; and (3) payment of items costing over $2,500 that are on the General Services Administration’s (GSA) pre-approved schedule, including items on requirements contracts. The streamlined acquisition threshold for such contract payments is $100,000. Accordingly, cardholders may have single transaction purchase limits of $2,500 or $25,000, and a few cardholders may have transaction limits of up to $100,000 or more. Under the GSA blanket contract, the Navy has contracted with Citibank for its purchase card services, while the Army and the Air Force have contracted with U.S. Bank. the Assistant Secretary of the Army for Acquisition, Logistics, and Technology, has established departmentwide policies and procedures governing the use of purchase cards. The Under Secretary of Defense (Comptroller) has established related financial management policies and procedures in various sections of DOD’s Financial Management Regulation. The Navy Supply Systems Command is responsible for the overall management of the Navy’s purchase card program, and has published the Navy Supply Command (NAVSUP) Instruction 4200.94, Department of the Navy Policies and Procedures for Implementing the Governmentwide Purchase Card Program. Under the NAVSUP Instruction, each Navy Command’s head contracting officer authorizes purchase card program coordinators in local Navy units to obtain purchase cards and establish credit limits. The program coordinators are responsible for administering the purchase card program within their designated span of control and serve as the communication link between Navy units and the purchase card issuing bank. When a supervisor requests that a staff member receive a purchase card, the agency program coordinator is to first provide training on purchase card policies and procedures and then establish a credit limit and issue a purchase card to the staff member. The Navy had a total of about 1,700 purchase card program coordinators during fiscal year 2000, including one program coordinator at SPAWAR San Diego and one at the Navy Public Works Center San Diego. Purchase cardholders are delegated contracting officer ordering responsibilities, but they do not negotiate or manage contracts. SPAWAR San Diego and Navy Public Works Center San Diego cardholders use purchase cards to order goods and services for their units as well as their customers. Cardholders may pick up items ordered directly from the vendor or request that items be shipped directly to end users (requestors). Upon receipt of items acquired by purchase cards, cardholders are to record the transaction in their purchase log and obtain independent confirmation from the end user, their supervisor, or another individual that the items have been received and accepted by the government. They are also to notify the property book officer of accountable items received so that these items can be recorded in the accountable property records. The purchase card payment process begins with receipt of the monthly purchase card billing statements. Section 933 of the National Defense Authorization Act for Fiscal Year 2000, Public Law 106-65, requires DOD to issue regulations that ensure that purchase card holders and each official with authority to authorize expenditures charged to the purchase card reconcile charges with receipts and other supporting documentation. NAVSUP Instruction 4200.94 states that upon receipt of the individual cardholder statement, the cardholder has 5 days to reconcile the transactions appearing on the statement by verifying their accuracy to the transactions appearing on the statement and notify the approving official in writing of any discrepancies in the statement. In addition, under the NAVSUP Instruction, the approving official is responsible for (1) ensuring that all purchases made by the cardholders within his or her cognizance are appropriate and that the charges are accurate and (2) the timely certification of the monthly summary statement for payment by DFAS. The Instruction further states that within 5 days of receipt, the approving official must review and certify for payment the monthly billing statement, which is a summary invoice of all transactions of the cardholders under the approving official’s purview. The approving official is to presume that all transactions on the monthly statements are proper unless notified in writing by the purchase cardholder. However, the presumption does not relieve the approving official from reviewing for blatant improper purchase card transactions and taking the appropriate action prior to certifying the invoice for payment. In addition, the approving official is to forward disputed charge forms to the unit’s comptroller’s office for submission to Citibank for credit. Under the Navy’s contract, Citibank allows the Navy up to 60 days after the statement date to dispute invalid transactions and request a credit. generates a tape for payment by electronic funds transfer to the purchase card bank, and sends the file to the accounting station for recording the payment as a summary record in the Navy’s accounting system. Figure 1 illustrates the current purchase card payment process used by SPAWAR and the Naval Public Works Center in San Diego. The Navy earns purchase card rebate revenue from Citibank of up to 0.8 percent based on sales volume (purchases) and payment timeliness. According to the DOD Deputy Director of DOD’s Purchase Card Joint Program Management Office, rebate revenue is generally to be recorded to the purchase card statements and used to offset monthly charges. Pursuant to Senator Grassley’s request, we identified five fraud cases related to Navy programs based in the San Diego, California, area and investigated by the Naval Criminal Investigative Service (NCIS). All of these cases can be linked to the types of internal control weaknesses discussed in this testimony. Of these five cases, two involved Navy Public Works Center San Diego employees and one involved 2,600 compromised purchase card accounts, including 22 currently active SPAWAR San Diego accounts. One of the remaining cases, which has been concluded, was related to a fraud that occurred at the Navy’s Millington (Tennessee) Flying Club—an activity of the Navy Morale, Welfare, and Recreation entity, which is based in San Diego. The other case involved a military officer and other service members who were assigned to the Marine Corps Station in Miramar, near San Diego. The first San Diego-related purchase card fraud case is an example of the lack of segregation of duties. This case involved the cardholder at the Navy’s Millington (Tennessee) Flying Club, an entity of the U.S. Navy’s Morale, Welfare, and Recreation activity, which is based in San Diego, California. The cardholder, who was having financial problems, was hired by her stepfather, who was the club’s treasurer. The stepfather delegated nearly all purchase card duties to the cardholder, as well as the authority for writing checks to pay the Flying Club’s monthly purchase card statements. The cardholder made over $17,000 in fraudulent transactions to acquire personal items from Wal-Mart, The Home Depot, shoe stores, pet stores, boutiques, an eye care center, and restaurants over an 8-month period from December 1998 through July 1999. The fraud was identified when the club’s checking account was overdrawn due to excessively high purchase card payments and a bank official contacted the president of the Flying Club. The cardholder pleaded guilty and was sentenced to 15 months in jail and assessed about $28,486 in restitution due to purchase card fraud and bounced checks. The defendant commented that illegal use of the card was “too easy” and that she was the sole authorizer of the card purchases. documentation of independent confirmation of receipt and acceptance and recording accountable items in property records would have made detection easier. In this instance, the military officer allegedly conspired with cardholders under his supervision to make nearly $400,000 in fraudulent purchases from five companies—two that he owned, one owned by his sister, and the other two owned by friends or acquaintances. They charged thousands of dollars for items such as DVD players, Palm Pilots, and desktop and laptop computers. The officer also allegedly made cash payments to employees to keep silent about the fraud and provided auditors with falsified purchase authorizations and invoices to cover the fraud. The fraud occurred from June 1999 through September 2000. The total amount of the alleged fraud is unknown. The alleged fraud was identified based on a tip from a service member. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution and four other active service members are under investigation. The third case involved a Navy Public Works Center San Diego maintenance/construction supervisor who allegedly made at least $52,000 in fraudulent transactions to a suspect contractor on work orders for which the work was not performed by that contractor. Adequate monitoring of purchase card transactions along with enforcing controls such as independent, documented receipt and acceptance and recording accountable items in property books would have made detection easier. Navy investigators believe that the employee also may have used his government purchase card to make unauthorized purchases for personal use, including jewelry, an air conditioner, and other personal items from The Home Depot from April 1997 through October 1998. The total amount of this alleged purchase card fraud is unknown. The alleged fraud was identified when the employee’s supervisor reviewed Navy Public Works Center work orders and noticed that four work orders totaling approximately $7,000 were completed by the employee and paid for with the suspect’s government purchase card. Further inquiry by the supervisor revealed that Navy Public Works Center employees, not the contractor, had completed the work. NCIS investigators and Naval Audit Service auditors identified approximately $52,000 in purchase card transactions made by the employee to a suspect contractor for work that was performed by either the Public Works Center or other legitimate contractors. The employee has resigned and an investigation by the Federal Bureau of Investigation and NCIS is ongoing. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution. The fourth case involved a Navy Public Works Center San Diego purchasing agent that allegedly made at least $12,000 in fraudulent purchases and planned to submit approximately $103,000 in fraudulent disputed charge forms, including payments for hotels, airline tickets, computers, phone cards, and personal items from The Home Depot. The alleged fraud occurred from April 1997 through July 1999. As with the other cases, adequate monitoring of purchase card transactions along with enforcing controls such as independent, documented receipt and acceptance and recording accountable items in property books would have made detection easier. The alleged fraud was identified during an investigation of a possible bribery/kickback scheme. The employee has resigned and an NCIS investigation is ongoing. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution. The fifth Navy purchase card fraud case is ongoing and involves the compromise of up to 2,600 purchase card accounts assigned to Navy activities in the San Diego area. Investigators were only able to obtain a partial list consisting of 681 compromised accounts so the exact number is not known. At least 45 of the compromised accounts were for SPAWAR San Diego and one of the compromised accounts was for the Navy Public Works Center in San Diego. Of these 46 compromised accounts, 22 SPAWAR San Diego accounts were still active in May 2001. None of the active accounts on the partial listing found by investigators were for the Navy Public Works Center San Diego. Although the account numbers showed up on a computer printer in a community college library in San Diego in September 1999, the Navy has not canceled all of the compromised accounts. Instead, according to NCIS and Navy Supply Command officials, the Navy is canceling the compromised accounts as fraudulent transactions are identified. Naval Supply Systems Command, SPAWAR San Diego, and Navy Public Works Center San Diego officials told us that they were aware of this incident but did not have a listing of the account numbers affected. As a result, the Navy did not take any measures to flag the compromised accounts and implement special monitoring procedures to detect any potential fraudulent use of these accounts. associated with the 22 compromised accounts showed that SPAWAR continued to have an aggregate monthly financial exposure of $900,000 associated with these accounts nearly 2 years after the compromised list was discovered in a San Diego community college library in September 1999. Further, with the lack of controls over receipt of goods and certification of purchase card statements that we identified at the two activities we reviewed, it is impossible for the Navy to identify fraudulent purchases as they occur or to determine the extent of the fraudulent use of the compromised accounts. As a result, when fraudulent use of one of the comprised accounts was identified, the Navy could not determine if the incident was due to cardholder fraud or use of the compromised account by an outside party. A joint task force in San Diego, comprised of NCIS, the U.S. Secret Service, local police, and the U.S. Attorney’s Office, investigated this fraud. The task force investigators recently traced the list of compromised accounts to a vendor used by the Navy, which acknowledged that the list came from its database. The vendor identified two former employees as possible suspects. Pursuant to Senator Grassley’s request, we obtained and reviewed information on five fraud cases related to Navy purchase card programs in the San Diego, California, area and to review purchase card controls and accounting for two Navy units based in San Diego—the Space and Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public Works Center. Our assessment of SPAWAR San Diego and the Navy Public Works Center San Diego purchase card controls covered the overall management control environment, including (1) span of control issues related to the number of cardholders, (2) training for cardholders and accountable officers, (3) management of rebates, and (4) monitoring and audit of purchase card activity; tests of statistical samples of key controls over purchase card transactions, including (1) documentation of independent confirmation that items ordered by purchase card were received, (2) proper certification of purchase card statements for payment, and (3) proper accounting for purchase card transactions; substantive tests of accountable items in our sample transactions to verify whether they were recorded in property records and whether they could be found; and analysis of the universe of transactions to identify (1) any potentially improper, fraudulent, and abusive transactions and (2) purchases that were split into one or more transactions to avoid micro-purchase thresholds or other credit limits. concepts and standards in the GAO internal control standards to the practices followed by management in the four areas reviewed. To test controls, we selected stratified random probability samples of 135 SPAWAR San Diego purchase card transactions from a population of 47,035 transactions totaling $38,357,656, and 121 Navy Public Works Center San Diego transactions from a population of 53,026 transactions totaling $29,824,160 that were recorded by the Navy during fiscal year 2000. We stratified the samples into two groups—transactions from computer vendors and other vendors. With this statistically valid probability sample, each transaction in the population had a nonzero probability of being included, and that probability could be computed for any transaction. Each sample element was subsequently weighted in the analysis to account statistically for all the transactions in the population, including those that were not selected. Table 7 presents our test results on three key transaction-level controls and shows the confidence intervals for the estimates for the universes of fiscal year 2000 purchase card transactions made by SPAWAR and the Navy Public Works Center in San Diego. Projection (millions) Projection (millions) Projection (millions) 65% (+/- 10%) $14.5 (+/- $4.4) 83% (74-90%) $20.4 (+/- $5.1) 47% (+/- 12%) $12.9 (+/- $6.3) 35% (+/- 11.4%) $11.2 (+/- $ 6.2) The projections represent point estimates for the population based on our sampling tests at a 95- percent confidence level. All seven approving officials with certifying officer responsibilities told us that they did not review support for transactions before certifying purchase card statements for payment. of store receipts (such as those from The Home Depot) were missing, we were unable to determine whether certain purchases were made for personal use. In addition, we did not physically examine purchases made to determine whether goods and services were received and used for government purposes. While we identified some improper and potentially fraudulent and abusive transactions, our work was not designed to identify, and we cannot determine, the extent of fraudulent, improper, or abusive transactions. We briefed DOD managers, including officials in DOD’s Purchase Card Joint Program Management Office and the Defense Finance and Accounting Service, and Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego officials on the details of our review, including our objectives, scope, and methodology and our findings and conclusions. We conducted our audit work from August 2000 through June 2001 in accordance with generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. Following this testimony, we plan to issue a report, which will include recommendations to DOD and the Navy for improving internal controls over purchase card activity. (918994) The following are GAO’s comments on the DOD letter dated October 3, 2001. Comment 1. See the "Agency Comments and Our Evaluation" section of this report. Comment 2. We are concerned that DOD’s support of the current process whereby Agency Program Coordinators report the results of their purchase card internal reviews to their unit’s contracting activity or their local commanding officer will not ensure that the results of purchase card internal reviews are fully communicated to central Navy management to support oversight and corrective actions on systemic control weaknesses. During our review, we found documented evidence that SPAWAR management ignored written reports on results of Agency Program Coordinator internal reviews, which identified problems that are consistent with the control weaknesses discussed in our testimony and summarized in this report. For example, SPAWAR Agency Program Coordinator reviews identified the lack of independent documentation that the Navy had received items ordered by purchase card, accountable items that were not recorded in the property records, inadequate documentation for transactions, split purchases, and transactions that did not appear to be related to government business purposes. SPAWAR San Diego management ignored the internal review results, primarily due to complaints from cardholders and their supervisors regarding the administrative burden associated with procedural changes that would be needed to address the review findings. Further, although the Naval Audit Service reviewed Navy Public Works Center San Diego purchase card activity and the SPAWAR San Diego Command Inspector General reviewed SPAWAR Systems Center San Diego purchase card activities, reports were not issued on the results of either of these reviews. Therefore, we continue to recommend that Agency Program Coordinators report any internal control weaknesses identified during semiannual reviews to the Commander of the Naval Supply Systems Command in addition to their unit commanders. Comment 3. While DOD stated that using a single object class for all micro- purchases streamlines the accounting process and reduces the numbers of problem disbursements resulting from manual keystrokes when entering such data, this practice results in unreliable expense data. As we stated in our testimony, aggregating all micro-purchases under one object class does not show the nature and type of expenditures made using purchase cards. Because SPAWAR San Diego and the Navy Public Works Center San Diego did not ensure that their detail transaction records reflected the proper classification of expense, 100 percent of the SPAWAR and Navy Public Works Center transactions in our samples were recorded to the wrong object class. For example, although the majority of the SPAWAR purchase card transactions in our sample—76 transactions totaling over $73,000— were for equipment purchases, none of these transactions were properly classified and recorded. Further, SPAWAR did not maintain sufficient documentation to determine the correct object class for 15 of the transactions in our sample totaling $12,000. Office of Management and Budget (OMB) Circular A-11, Preparation and Submission of Budget Estimates, requires federal agencies to report obligations and expenditures by object class, such as salaries, benefits, travel, supplies, services, and equipment, to indicate the nature of expenditures of federal funds. Accurate object classification data are critical to the reliability of information reported in the President's budget submission and budget projections and other analyses that are based on these data. In addition, because the Congress has asked for and is using object class information for its oversight activities, it is important that these data be properly recorded. Therefore, we continue to recommend that detail purchase card transaction records reflect the proper object classification of expense. Further, an appropriate procedure for summarizing detail purchase card transactions would be to record a separate summary record for each classification of expense--such as services, supplies, and equipment. Comment 4. The steps outlined in DOD's response do not ensure that cardholders will obtain reasonable prices or the best value. For example, we found numerous examples of individual purchases of computers and property items, and purchases of services, such as the installation of upgraded computer software, that were not made as part of a negotiated contract or a bulk purchase. Because these purchases did not appear to be cost-effective, we continue to recommend that the Navy determine whether the purchase card is (1) the right vehicle for acquiring certain items and services and (2) if items, such as computers, should be procured individually or through bulk purchases. The intent of our recommendation is that these determinations would result in Navy-wide policy guidance on the cost-effective use of purchase cards. Staff making key contributions to this report were Bertram Berlin, Francine DelVecchio, Steve Donahue, Douglas Ferry, Kenneth Hill, Jeffrey Jacobson, John Kelly, and John Ryan. The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO E-mail this list to you every afternoon, go to our home page and complete the easy-to-use electronic order form found under “To Order GAO Products.” Web site: www.gao.gov/fraudnet/fraudnet.htm, E-mail: fraudnet@gao.gov, or 1-800-424-5454 (automated answering system).

Summary: GAO reviewed purchase card activity at the Space and Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public Works Center in San Diego and found significant breakdowns in internal controls over purchase card transactions, including fraudulent, improper, and abusive purchases and theft and misuse of government property. Neither SPAWAR nor the Navy Public Works Center had effective policies for issuing purchase cards, establishing credit limits, and minimizing the federal government's financial exposure. Any employee having supervisory approval could get a card. GAO found that the units did not do credit checks on prospective cardholders. GAO also found that nearly half of SPAWAR's fiscal year 2000 purchase card transactions and more than half of the Navy Public Works Center's transactions were made by employees who did not have documented evidence of timely training. Policies for rebate management were deficient, including a lack of procedures to maximize rebates and ensure that bank calculations of rebates were correct. Management was not effectively using internal reviews and audits to determine whether purchase card internal controls were effectively implemented. These internal control weaknesses allowed purchases that were potentially fraudulent, improper, or abusive. GAO summarized this report in testimony before Congress ( GAO-01-995T , July 2001).