GSA manages the federal government’s purchase card program, which has existed since the late 1980s. The Federal Acquisition Streamlining Act of 1994 first defined a micropurchase threshold, and permitted certain agency employees to make purchases under this amount without competitive quotations if the employee considered the price to be reasonable. On the day of the act’s enactment, an Executive Order was issued that directed agencies to expand the use of purchase cards and take maximum advantage of the micropurchase authority provided in the act. As a result, purchase card use broadened, improving the ability of agencies to quickly and easily acquire items needed to support daily operations and reducing the administrative costs associated with such small purchases. The Federal Acquisition Regulation (FAR) designated the purchase card as the preferred method of making micropurchases, the threshold for which was set at $3,000 for the period of our review (fiscal year 2014) and was raised to its current level, $3,500, for most purchases, on October 1, 2015. Government purchase card spending grew rapidly from the late 1990s into the early 2000s. During the 10-year period from fiscal year 1999 through 2008, annual purchase card spending increased by nearly 60 percent—from about $14 billion in fiscal year 1999 to a peak of over $22 billion in fiscal year 2008, in 2015 dollars. Between 2008 and 2013, spending declined slightly, followed by a slight uptick in purchase card spending from 2014 to 2015, as illustrated in figure 1 below. In fiscal year 2014, federal agencies made over 19.5 million purchase card transactions for supplies and services, spending over $17 billion. Of these transactions, over 18.5 million (95 percent) were for micropurchases, which accounted for about half of the total spending using purchase cards ($8.7 billion). DOD and VA together accounted for over three-fourths of all purchase card spending and about two-thirds of all micropurchase spending in fiscal year 2014, as shown in table 1. DOD micropurchase spending covered a wide range of items to support its civilian and military operations, such as housing-repair services on a military base. According to VA officials, the majority of VA’s micropurchase spending was through the Veterans Health Administration for medical supplies for veterans. GSA’s Center for Charge Card Management administers the SmartPay charge card program, which includes purchase cards (for supplies and services), travel cards (for airline, hotel, and related travel expenses), fleet cards (for fuel and supplies for government vehicles), and integrated cards (a combination of purchase, travel or fleet cards). GSA currently maintains purchase card contracts—as part of the SmartPay program— with three commercial banks. These three contracts are collectively referred to as the GSA SmartPay2 Master Contract. The current master contract base year began in November 2008. With all option years included, it is set to expire in November 2018. According to GSA’s SmartPay website, the replacement of paper-driven acquisition processes of the past with the use of purchase cards saves the government about $1.7 billion annually in administrative costs. Further, when selecting which bank to use for its purchase card program, an agency can negotiate with its bank the terms for purchase card refunds under the purchase card program’s contract. These refunds are based on speed of payment and volume of transactions and may also result in a cost savings for agencies. GSA’s SmartPay website indicates that the government has received approximately $3 billion in refunds from purchase card spending since the SmartPay program’s inception in 1998. Along with deciding which bank to use to support its purchase card requirements, individual agencies are responsible for monitoring the actions of their cardholders as well as issuing agency-specific policies and procedures on the appropriate use of purchase cards. Individual cardholders have primary responsibility for the proper use of purchase cards, including following agency policies and other acquisition laws and regulations. Cardholders must also reconcile the transactions that appear on their monthly statements with receipts and other supporting documentation, and ensure records are maintained in accordance with agency policies. Cardholders are assigned to an Approving Official (AO), who is often the cardholder’s supervisor. AOs make sure that purchases are necessary for accomplishing the mission of the agency and must provide final approval of purchase card transactions after they are reconciled by the cardholder. OMB is responsible for prescribing policies and procedures to agencies regarding how to maintain internal controls in government charge card programs. Specifically, OMB has established minimum requirements and suggested best practices for government charge card programs in Appendix B of Circular No. A-123, Improving the Management of Government Charge Card Programs. OMB most recently revised Appendix B in January 2009 in response to recommendations in our 2008 report. According to officials, OMB is currently in the process of revising Appendix B as part of a larger effort to update Circular A-123; the revised Appendix B is scheduled to be released in 2017. GSA and OMB have taken a number of actions since 2008 to enhance program controls over micropurchases made using purchase cards. GSA created new purchase card training and certification programs, implemented new monitoring and management tools, and provided agencies with updates to guidance through its website, while OMB revised its guidance to executive agencies and facilitated new reporting requirements in response to the Charge Card Act, as shown in figure 2. In February 2011, GSA expanded its SmartPay website to include online training modules for cardholders and agency program managers, and later developed additional training opportunities for agency program managers. GSA’s online training modules enable agencies to meet training requirements established by OMB and are available to all agencies via GSA’s SmartPay website. Each training module provides information on the respective roles and responsibilities of cardholders, approving officials, and agency program managers. Training modules also provide information on the rules and best practices for the use of the purchase card, including requirements pertaining to vendor selection, record maintenance, and prohibited items, among other areas. GSA reports that, between 2011 and 2015, cardholders completed the purchase card cardholder training module over 174,000 times, while agency program managers completed their training module over 20,300 times. As an additional management tool, GSA’s training portal allows agency program managers to generate reports that enable them to access and manage their cardholders’ training information, which can make it easier to ensure cardholders are meeting their training requirements. In June 2014, GSA also instituted optional training leading to a new Charge Card Manager Certification. Agency program managers can earn the certification by completing required coursework offered by GSA and the card-issuing banks and by possessing hands-on experience managing a card program and working with cardholders and managers. The certification requires the completion of 12 courses and documentation of a minimum of 6 months of continuous, hands-on experience managing agency cardholders and accounts. According to GSA, the certification is intended to help agencies ensure that their card- management personnel have the fundamental training and experience needed to manage a card program. GSA and the purchase card–issuing banks made new monitoring and management tools available to agencies in the current SmartPay2 master contract that went into effect in November 2008. In particular, SmartPay2 offered agency program managers additional reporting and account- management capabilities in the bank electronic access systems. These new features included enabling agency program managers to generate ad hoc reports; dispute transactions; activate, deactivate, and renew cards; and block card usage from specific categories of merchants. In addition, the electronic access systems allow approving officials to electronically review transaction details and certify invoices and statements. In addition to providing increased reporting and account-management tools, GSA developed a data-analytic system, called the SmartPay Data Warehouse, which is designed to assist agencies with monitoring and analyzing their purchase card spending. According to GSA, the Data Warehouse, which reached initial operating capability in early 2015, receives a daily feed of transactional data from the banks for two dozen agencies (covering over 90 percent of purchase and travel card spending) dating back to 2011. According to GSA officials, the Data Warehouse can be used to compile aggregate data from banks for each participating agency and for the government as a whole. The data can be sorted by various fields, such as vendor, agency, and transaction date. The Data Warehouse provides data-visualization tools through an online dashboard that allows agencies to monitor related trends in their use of purchase cards. Users can access the dashboard through a web-based portal, as shown in figure 3. As of September 2016, GSA reported that 19 agencies have access to the Data Warehouse. According to GSA officials, the performance metrics analyzed include the number of cardholder accounts with disputed charges, the number of accounts that have at least 10 transactions and 80 percent or greater of spending at one merchant, the number of confirmed violations involving misuse of a purchase card, the number of transactions and spending amount with merchants that are listed under merchant category codes that are highly monitored for government spending, and the types of data-analytics tool or method used by agencies. GSA has provided agencies with purchase card management guidance through a variety of means. For instance, GSA issues periodic information and guidance on charge card program-management matters through publications known as Smart Bulletins. According to GSA, Smart Bulletins are intended to keep agencies and stakeholders informed of new or updated policies, regulations, statutes related to government charge cards, program-management practices, and other related matters. Since 2008, GSA has released over 20 Smart Bulletins on a variety of issues related to purchase card management, such as record-retention requirements, best practices for using third-party payment processors, new training opportunities, and other policy changes. After the passage of the Charge Card Act in 2012, GSA also developed a template, known as the Compliance Summary Matrix, to help agencies ensure that all of the safeguards and internal controls required by the act are in place. The compliance summary matrix details the internal-control requirements under the Charge Card Act and can be used to document the operating effectiveness of existing internal controls, as well as to document areas of noncompliance and plans to mitigate and correct those areas. As discussed below, agencies are required by OMB to use this template when preparing their annual internal-control assessment and certification. As stated previously, OMB issued a revision to Appendix B of Circular A-123 in January 2009 in response to recommendations that we made in our 2008 report. This revision included a number of changes, such as expanded descriptions of erroneous and improper purchases along with practices for minimizing such purchases; guidance on disciplinary actions for fraud and abuse of charge cards, including purchase cards; additional internal controls for managing property obtained using purchase cards; and additional internal controls for purchases made using convenience checks. While these 2009 revisions enhanced controls on agencies’ purchase card program, OMB officials stated that OMB does not opine on a particular approach for agencies to design and implement these controls, which OMB views as a more appropriate role for the agencies’ Offices of Inspector General (OIG) and GAO. In the fall of 2016, OMB was in the process of revising Appendix B as part of a larger effort to revise Circular A-123. OMB officials told us they plan on issuing the revised Appendix B in 2017. In addition to making revisions to Appendix B, OMB also started collecting information from executive agencies and agency OIGs in response to the Charge Card Act. In September 2013, OMB issued a memorandum that directed executive agencies and OIGs to submit the information required by the Charge Card Act to OMB, and provided guidance and clarification on the requisite information and submission deadlines for different reports. For example, OMB directed executive agencies to submit annual assessments and certifications that agencies have the appropriate policies and controls in place to mitigate the risk of fraud, waste, and abuse in the purchase card program. OMB further directed agencies to complete these assessments using the compliance template developed by GSA. In addition, OMB clarified that agency OIGs should conduct the periodic risk assessments of agency charge card programs (including purchase cards) required by the Charge Card Act on at least an annual basis. In the September 2013 memorandum, OMB also directed agency OIGs to submit annual reports to OMB on their respective agency’s progress on implementing audit recommendations related to purchase card and travel card programs. OMB uses these OIG reports to provide Congress and GAO with a summary of the type and nature of all outstanding OIG recommendations related to purchase and travel card programs across the government. OMB produced its first government-wide summary in October 2014. In its next summary—in October 2015—OMB determined that, in 2 years of reporting, OIGs across the government have identified 70 recommendations pertaining to agency purchase card programs that remain open. In the September 2013 memorandum, OMB also required that agencies with at least $10 million in annual purchase card spending during the prior fiscal year (beginning with fiscal year 2013) submit semiannual reports on employee purchase card violations to OMB. These reports—which are prepared jointly by the agency heads and OIGs—provide a summary of the number of purchase card violations by category (abuse; fraud; other loss, waste, or misuse) and the types of actions taken in response (e.g., demotion, reprimand, suspension), as well as the number of any pending violations. Our government-wide review found that agencies have not consistently maintained required documentation of the approval process, which can increase the risk of purchase card misuse. However, we found little evidence of improper or potentially fraudulent purchases. On the basis of our statistical testing of the approval process for purchase card transactions, we estimated that 22 percent of transactions government- wide, 23 percent of DOD transactions, and 13 percent of VA transactions had incomplete documentation. The Department of the Interior (DOI) was not included in our government-wide analysis because the agency did not require one transaction review requirement in our test of the approval process, which may increase the risk that fraudulent, improper, and other abusive activity could occur without detection. In addition, our review of agency property-management policies found that most agencies in our sample had policies that at least partially addressed OMB guidance developed in response to recommendations in our 2008 report for property acquired with the purchase card, such as requirements for independent receipt and acceptance. However, we found transactions in our sample that were not properly documented as received by an independent party (independent receipt and acceptance) based on each agency’s policy. For all but two transactions in our sample, the agencies provided us with full or partial documentation, which we reviewed and determined that the transactions were not potentially fraudulent. In addition, we conducted targeted data mining in selected categories and reviewed documentation of potentially improper purchases, but we found little evidence of improper or potentially fraudulent purchases. On the basis of our sample, we estimated that 22 percent of transactions government-wide in fiscal year 2014 had incomplete documentation associated with the approval process for purchase card transactions. Incomplete documentation can limit the ability of the agency and GAO to provide effective oversight of the purchase card program and increases the risk that fraud, charge card misuse, and other abusive activity could occur without detection. GAO has previously found that requiring documentation of transactions is a preventive control, which is a key element of strategically managing fraud risks. Preventive activities generally offer the most cost-efficient use of resources, since they enable managers to avoid a costly and inefficient “pay-and-chase” model. We did not include DOI in the government-wide results because of a difference in the agency’s purchase card policies, as discussed below. Additionally, we estimated that 23 percent of DOD transactions and 13 percent of VA transactions had incomplete documentation, as shown in table 2. To ensure the government ultimately only pays for valid charges, the Charge Card Act requires that purchase cardholders and their AOs verify the accuracy of charges that appear on monthly statements using receipts and other supporting documentation and resolve any discrepancies. To that end, we tested three transaction review elements of the approval process: 1. Presence of a purchase receipt that contained the date of purchase, a description of the goods or services received, the price, and the quantity. 2. Presence of other supporting documentation that, according to OMB guidance, includes documentation of the purchase request or preapproval for self-generated purchases. We also accepted preauthorization for purchases of certain items as reasonable evidence of preapproval. For example, one agency provided a purchase cardholder with an annual preauthorization for a range of purchases as follows: engineering supplies, road crew supplies, and simple services. 3. Presence of approval by the AO after the transaction posted to the bank. We estimated that government-wide transactions had incomplete documentation rates of 6 percent for purchase receipt, 12 percent for other supporting documentation, and 11 percent for AO approval, as shown in figure 4. These estimates have a margin of error of +/-5 percentage points or less at the 95 percent confidence level. DOD has levels of incomplete documentation similar to that of the government-wide rate, while VA had fewer instances of transactions with incomplete documentation compared to the aggregate of the agencies in rest of our sample. Transactions with incomplete documentation included those where 1. the agency was missing documentation and therefore unable to provide at least one piece of documentation; or 2. the agency provided documentation that was insufficient, inaccurate, or not completed in an appropriate time frame. According to agency officials, missing documentation generally occurred because the cardholder or AO failed to maintain sufficient documentation, the cardholder or AO no longer worked for the agency, or the cardholder failed to document requests in writing. One example of insufficient or inaccurate documentation that we encountered was when agency officials provided an e-mail purchase request and approval for one transaction that did not match the final transaction. The billing amount and the items in the request were inaccurate for the sample transaction. Examples of documentation that was not completed in an appropriate time frame included several transactions that were approved by the AO after we had submitted our request for documentation of AO approval. Of the 60 transactions with incomplete documentation in our sample, 11 were transactions with GO!cards, which are purchase cards used to distribute transit benefits and include additional control functions to ensure cardholders only make transit-related purchases. The Department of Health and Human Services (HHS) Program Support Center (PSC) manages the GO!card program and offers the service to HHS and other federal agencies for a fee. According to HHS officials, the GO!card is designed so that it can only be used to purchase transit fare media through transit providers identified in a limited list of merchant category codes approved by HHS. Additionally, transit beneficiaries are provided a GO!card with a monthly credit limit equal to the cardholder’s approved transit benefit so that the cardholder is unable to charge more than the monthly benefit. In a previous report, we concluded that a similar transit benefit program administered by the Department of Transportation contained appropriate control functions to provide reasonable assurance that non-transit-related purchases can be identified and denied. While the GO!card has additional controls and does not function as a traditional purchase card, we included the transactions in our sample because they were subject to OMB Circular A-123, Appendix B, in fiscal year 2014, according to GSA officials, and therefore in the scope of our review. According to HHS officials, PSC program administrators reviewed the monthly statements for anomalies and occurrences of potentially fraudulent purchases, but at the time of our review the agency did not have a formal process of AO approval after the transaction posted to the bank. Therefore, the transactions we identified had incomplete documentation due to missing documentation of AO approval. As of October 2016, HHS had produced a draft policy for the GO!card program that included AO approval of the monthly bank statements and that the agency estimated would be finalized in May 2017. Officials from two agencies in our sample initially were unable to provide documentation of final AO approval made through one of the three SmartPay banks because the agencies relied on the bank to maintain the records for 3 years. While the bank’s online purchase card management system enabled AOs to electronically approve transactions, the bank’s system did not retain transaction approval history information, including final approval by the AO, beyond 2 years of the transaction. According to the GSA SmartPay2 master contract and the FAR, in fiscal year 2014 contractors were required to maintain electronic records for a minimum of 3 years after payment. However, according to a bank official, the bank did not consider the transaction approval process part of the transaction but rather information appended through the online system. Under the SmartPay2 master contract, the bank was only required to allow access to that online system for 18 months. Failure to retain records for 3 years after final payment limits the ability of the agency, GAO, and other oversight groups to provide oversight of the program as part of an overall effort to reduce instances of fraudulent, improper, and abusive purchase card activity. As a result of our current review, GSA worked with the bank used by these two agencies to develop short- and long-term solutions for the retention of AO approval records. In the short term, the bank developed a transaction-specific manual process to locate and produce AO approval records for transactions that had aged out of the online system. The bank also agreed to provide this manual service on a case-by-case basis for audits and investigations for the duration of the SmartPay2 master contract. In the longer term, GSA will pursue a contract modification in the SmartPay2 master contract in fiscal year 2017 to further clarify review and approval record-retention requirements, according to a GSA official. In the SmartPay3 master contract, according to a GSA official, the agency will require a 6-year retention period for this information to conform with updated FAR requirements, which reflect the revised National Archives and Records Administration General Records Schedule. DOI was not included in our government-wide analysis of the approval process because the agency did not require the second transaction review requirement, which was other supporting documentation. By policy, DOI granted blanket purchase authority for cardholders to use the purchase card for most transactions within the micropurchase limit in fiscal year 2014. DOI updated its purchase card policy in August 2015 but did not change its policies regarding other supporting documentation. According to officials from DOI’s Office of Acquisition and Property Management, the agency does not require cardholders to obtain preapproval or otherwise document a micropurchase request before making the purchase, in order to minimize delays in obtaining needed supplies in fieldwork environments and to save administrative costs in offices, which they stated is the intent of the integrated card. However, not requiring cardholders to obtain appropriate authorization and lack of management oversight may increase the risk that fraudulent, improper, and other abusive activity could occur without detection. DOI was the one agency out of 16 in our sample that did not require other supporting documentation. DOI also spent about $395 million on micropurchase transactions, using purchase cards, in fiscal year 2014. As part of the approval process for purchase card transactions, the Charge Card Act requires that heads of agencies establish controls to ensure that purchase cardholders and their AOs verify the accuracy of charges that appear on monthly statements using receipts and other supporting documentation, although the exact type of this additional documentation is not specified. According to OMB guidance, documentation that a purchase cardholder should maintain to minimize erroneous and improper purchases includes documentation of the purchase request and preapproval for self-generated purchases. DOI officials noted that the OMB guidance specifies that such documentation should be maintained “to the maximum extent possible” and that the nature of DOI’s mission makes it impractical to require these actions agency-wide. According to OMB officials, OMB does not prescribe a particular approach for agencies to design and implement internal controls based on its policy. Because DOI policy does not require supporting documentation on the purchase request or preapproval for a self-generated purchase, DOI did not provide this documentation for 17 of 21 transactions included in our random sample. Additionally, 2 of 21 transactions from DOI had incomplete documentation due to a missing receipt. On the basis of our samples, we estimated that 23 percent of DOD transactions and 13 percent of VA transactions had incomplete documentation associated with the approval process for purchase card transactions. Together, DOD and VA accounted for over three-fourths of all purchase card spending and about two-thirds of all micropurchase spending in fiscal year 2014. Therefore, we designed our stratified sample to include 100 transactions from DOD and 100 transactions from VA, which allowed us to provide estimates specific to each agency for fiscal year 2014. DOD accounted for about 29 percent of all purchase card spending and about 35 percent of all micropurchase spending in fiscal year 2014. As shown in figure 5, DOD had incomplete documentation rates of an estimated 6 percent for purchase receipt, 16 percent for other supporting documentation, and 11 percent for AO approval, which are commensurate with the government-wide rates. These estimates have a margin of error of +/-8 percentage points or less at the 95 percent confidence level. VA accounted for about 49 percent of all purchase card spending and about 32 percent of all micropurchase spending in fiscal year 2014. Of the 100 VA transactions in our sample, 99 were within the Veterans Health Administration. VA transactions in our sample included purchases such as eyeglasses for a veteran and bandages for use at a Veterans Affairs Medical Center. As shown in figure 6, VA had incomplete documentation rates of an estimated 7 percent for purchase receipt and 6 percent for AO approval. VA provided complete and accurate other supporting documentation for all of the transactions in our sample. These estimates have a margin of error of +/-7 percentage points at the 95 percent confidence level. In addition, according to the transactions in our sample, we project that VA had fewer instances of transactions with incomplete documentation compared to the aggregate of the agencies in the rest of our sample. VA uses an online system that tracks the purchase throughout the life cycle of the transaction, which may account for its lower number of transactions with incomplete documentation. This transaction information, including the purchase order number and AO approval, can be produced in a summary report. Most of the agencies in our sample had policies that at least partially covered OMB’s guidelines specific to property acquired with a purchase card, such as the documentation of independent receipt and acceptance, when appropriate, and the determination of items to be classified as sensitive or accountable property. OMB added these guidelines as part of its revision to Appendix B in response to recommendations in our 2008 report. OMB detailed five areas that agency policy must address to ensure effective property management: (1) definition of “sensitive” and “accountable” property; (2) a process for notifying the property- management activity of property receipt; (3) the process for recording and tracking such property; (4) the documentation of independent receipt and acceptance, when appropriate; and (5) procedures for addressing missing, stolen, or damaged property. We reviewed the fiscal year 2014 policy documents of the agencies included in our random sample to assess their compliance with these guidelines. The Department of Justice was the one agency in our sample unable to provide policies that addressed, even partially, two of the areas specified by OMB. For a summary of our analysis of agency policy on property acquired with a purchase card, see table 3. For details, see appendix II. To assess agency program controls related to property management, we also requested additional documentation from agencies when the sample items included purchases of accountable or sensitive property or required independent receipt and acceptance, according to agency policy documents. Sensitive or accountable property. While OMB guidance directs each agency to develop its own definitions of “sensitive” and “accountable” property, OMB provides guidance to agencies on how to define this property. According to OMB guidance, sensitive property includes items, regardless of cost, that have an unusual rate of loss, theft, or misuse, or require additional controls due to national security. OMB guidance defines accountable property as items with an acquisition value defined by each agency that have a useful life of 2 years or longer. Using each agency’s definition for accountable or sensitive property, we identified 4 transactions in our sample of 300 that contained sensitive or accountable property. This number of transactions is too small to make conclusions on government handling of accountable or sensitive property. Independent receipt and acceptance. On the basis of our sample, we estimated that 28 percent of transactions government-wide failed independent receipt and acceptance, that is, goods or services ordered and charged to a government purchase card account were either received by the cardholder or are missing documentation of receipt by a third party. In our random sample of 300 transactions, we identified 184 transactions that required independent receipt and acceptance, according to agency policy requirements. Agency policies differed on when the documentation of independent receipt and acceptance was required. Several agencies did not require someone other than the cardholder to receive micropurchases made with the government purchase card, regardless of the item purchased. Other agencies required independent receipt and acceptance for all purchase card transactions, while others detailed specific restrictions based on, for example, purchase price or type of purchase. Almost all of the DOD transactions in our sample required independent receipt and acceptance; DOD transactions accounted for 97 of the 184 transactions we reviewed. Of these 97, DOD provided evidence of independent receipt and acceptance for 59 transactions and did not provide documentation of independent receipt and acceptance for 38 transactions. Of those 38 transactions 23 transactions were missing documentation, 8 transactions had insufficient documentation, and 7 transactions were received by the cardholder. Our review found little evidence of improper or potentially fraudulent purchases. While 22 percent of transactions government-wide had incomplete documentation, we estimated that only 2 percent of transactions in fiscal year 2014 were improper purchases, which according to OMB guidance include those that should not have been made or that were made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements, as well as fraudulent purchases. While fraudulent purchases are considered improper purchases, we found little evidence of potentially fraudulent purchases, such as those for personal use. We obtained at least some documentation from agencies for all but 2 transactions. We reviewed this documentation and determined that the transactions were not potentially fraudulent. For example, one transaction missing a receipt was for a $3.55 shipping purchase. The agency was able to provide the preapproval for the monthly shipping charges and a list of monthly charges that included this transaction, but the receipt for the specific transaction was lost during an office move, according to an agency official. We found 5 improper purchases in our sample that included 1 transaction for $2.00 that was approved in error; 1 split purchase, which we defined as purchases made from the same vendor that appeared to circumvent single-purchase limits; 1 transaction for uniform items made by the requestor instead of the 2 transactions for which agency officials were unable to provide any documentation. We considered the 2 transactions in our sample that were missing all three pieces of documentation to be improper purchases because without any documentation we were unable to verify that the transactions were authorized and correct. Without any documentation, we were unable to make a determination of potential fraud for these 2 transactions. While the $2.00 transaction approved in error, the split purchase, and the purchase made by the requestor were improper, we determined that they were not potentially fraudulent because they were not for personal use. Additionally, our targeted data mining of selected categories for potentially improper purchases found little evidence of improper purchases, including potentially fraudulent purchases, among micropurchase transactions made using government purchase cards. Our prior work identified numerous instances of fraud, waste, and abuse related to the purchase card program at dozens of agencies across the government. We reviewed fiscal year 2014 purchases in several of the same categories identified in our 2008 report, but we did not identify any improper purchases. However, as discussed in appendix I, our targeted data mining was not designed to identify all instances of improper government purchase card activity or estimate their full extent government-wide. Rather, we focused our data mining on selected categories that we identified as potentially high risk for improper purchases to illustrate the potential for improper purchases in the population of transactions, develop a better understanding of the types of purchase card transactions within each category, and determine whether purchases that initially appeared to be problematic were improper. We used targeted data mining to identify 20 potentially improper purchases for further review in four selected categories: (1) high-risk merchants, (2) wireless services, (3) convenience checks, and (4) split purchases. While overall we identified 20 purchases, three of the wireless purchases and the two convenience checks purchases were also possible split purchases. Therefore, the sum of the purchases we reviewed by category is 25. Figure 7 further describes these categories and shows the number of purchases per category we reviewed. We requested and analyzed source documentation for the 20 potentially improper purchases within these categories against OMB’s definition of an improper purchase and determined that none of the 20 purchases reviewed were “improper.” It is difficult to determine whether a transaction is improper without examining the source documentation, and in some instances talking to agency officials or the cardholder. For example, as discussed in table 4, we discovered that many of the transactions within the Department of Housing and Urban Development’s (HUD) Real Estate Assessment Center (REAC) office were transactions where the cardholder name closely matched the merchant name. While these transactions appeared suspicious, we were unable to determine the nature of these transactions without further evidence. Thus we requested source documentation for a transaction and additional documentation on the REAC program, and interviewed HUD officials. HUD officials explained that this method of using purchase card accounts to pay inspectors was established in 2005 so that the inspectors, who are often part of a small business, are paid quickly and directly. The contracted inspectors do not possess physical purchase cards—which are maintained by the REAC office—and are unable to initiate a payment for more than the approved amount. Table 4 summarizes the types of purchases we reviewed, why we reviewed the purchase, and the results of our assessment. We also used targeted data mining to examine purchases related to child care, online dating, alcohol, and, in addition to those assessed above, other merchants providing goods or services at high-risk of being used for personal benefit. However, we did not find indicators of improper or potentially fraudulent purchases within these categories and did not request supplemental documentation from the agencies. For example, in our 2008 report, we identified an example where a cardholder used a government purchase card to fraudulently subscribe to two Internet dating services. We conducted targeted data mining for purchases from potential Internet dating services to determine whether these types of purchases were still occurring. However, our searches of the fiscal year 2014 data revealed only a few purchases from providers of Internet dating services and these charges had been refunded to the agency. Given that the federal government spent nearly $8.7 billion in micropurchases in fiscal year 2014 using purchase cards, it is critical to monitor program activity closely. Since 2008, GSA, OMB, and federal agency purchase card managers have taken many steps to enhance their oversight capabilities. New training and tools from GSA, and ongoing guidance from GSA and OMB, provide agency purchase card managers the opportunity to enhance their oversight of purchase card activity within their agencies. While we found little evidence of potentially fraudulent purchases in our current review—which is an improvement from the past—documentation issues exist. We estimated that agencies had incomplete documentation of the transaction approval process for 22 percent of fiscal year 2014 micropurchases. Maintaining sufficient documentation as required by the Charge Card Act is an important element of effective oversight of the purchase card program. The key elements in managing the approval process of purchase card activity are written documentation of the purchase request, including preapproval for self-generated purchases; maintaining a receipt of the purchase; and reconciling/approving the charge on the monthly bank statement. Absent continued vigilance to ensure that data for all three elements are consistently collected and maintained, agencies will not be able to confirm the integrity of their purchase card programs. While federal government purchases are vast and varied, of the agencies we reviewed only DOI granted blanket purchase authority for cardholders for most transactions under the micropurchase limit in fiscal year 2014. This blanket authority increases the risk that fraudulent, improper, and other abusive activity could occur for DOI’s micropurchase spending, which was about $395 million in fiscal year 2014. To help strengthen the documentation of the purchase card transaction approval process, which can help to prevent improper and fraudulent micropurchases, we recommend that 1. the Administrator of GSA direct the head of the Center for Charge Card Management to provide guidance to agency purchase card managers reemphasizing the need to obtain and retain complete documentation in support of purchase card transactions, per OMB specifications and 2. the Secretary of the Interior direct the head of Office of Acquisition and Property Management to reexamine the agency’s Integrated Card Program policy to require that cardholders maintain documentation of purchase requests and preapproval for self-generated purchases for purchase card transactions. We provided a draft of our report to the Administrator of GSA and the Secretaries of the Interior, Defense, and Veterans Affairs, as well as the Director of OMB. GSA and DOI both provided comments. DOD and VA stated by e-mail that they had no comments on the draft of our report, and OMB did not respond to our request for comments. In written comments (reproduced in app. III), GSA agreed with our findings and concurred with our recommendation to provide guidance reemphasizing complete documentation for purchase card transactions. GSA noted that it is developing a comprehensive plan to address this recommendation. In an e-mail from the DOI liaison for GAO and Office of Inspector General audits, DOI commented that it partially concurs with our recommendation to direct the head of the Office of Acquisition and Property Management to reexamine DOI’s Integrated Card Program policy to require that cardholders maintain documentation of purchase requests and preapproval for self-generated purchases. Specifically, DOI noted that it understands that risk assessment and mitigation is an ongoing process. DOI said the department will continue evaluating its charge card policies and procedures and update them as appropriate to maintain effective controls that reduce the risk of fraud, waste, and misuse. However, in its comments, DOI indicated that its current policy includes sufficient requirements for supporting documentation and transaction monitoring. DOI noted that, as a field-based agency, its mission is carried out in many remote locations outside of the traditional office environment (e.g., wildland fire fighting, law enforcement, and emergency response). As such, according to DOI, it is not always possible or practical for employees to obtain preapproval to make micropurchases. As discussed in the report, we recognize that challenges may arise with obtaining preapproval under some circumstances in the field. However, rather than forgoing the preapproval process by granting blanket purchase authority, we believe agencies can balance flexibility and management oversight in the Integrated Card Program by defining broad, but not unlimited, preauthorizations. For example, one agency in our review provided a purchase cardholder with an annual preauthorization for a range of purchases including engineering supplies, road crew supplies, and simple services. After reexamining its policy, DOI could, for example, also potentially exclude emergency situations from the preapproval requirement. Doing so could help mitigate the risk that fraudulent, improper, and other abusive activity could occur without detection. If you or your staff have any questions about this report, please contact me at (202) 512-5045 or LarinK@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. This report examines (1) what actions the General Services Administration (GSA) and the Office of Management and Budget (OMB) have taken since 2008 to enhance program controls over micropurchases made using government purchase cards, and (2) whether weaknesses exist in the approval process for micropurchase transactions and, if so, whether there are indicators of improper or potentially fraudulent purchases. To determine what actions GSA and OMB may have taken to enhance program controls over micropurchases in the federal purchase card program, we reviewed purchase card policies and guidance issued by OMB and GSA since 2008. We also reviewed GSA’s SmartPay2 master contract to identify additional monitoring and management tools made available to agencies and examined GSA’s SmartPay Data Warehouse. In addition, we obtained and analyzed purchase card training data from 2011 to 2015 from GSA, which were the most recently available data at the time of our review. We determined that the training data were sufficiently reliable for the purpose of reporting on the total number of completed trainings per year. We also reviewed agency documentation submitted to OMB, including purchase card violation reports for 2014, the most recently available at the time of our review, and summaries of outstanding Office of Inspector General recommendations related to purchase card programs. We also interviewed GSA and OMB officials and requested documents and reports these agencies produced to implement and comply with program requirements. To determine the extent to which weaknesses exist in the approval process for micropurchase transactions and whether there are indicators of improper or potentially fraudulent purchases, we (1) conducted statistical testing of transaction review elements within the approval process, (2) assessed various agency property-management policies against OMB guidance and reviewed transactions with an independent receipt and acceptance requirement or that contained sensitive or accountable property according to agency policy, and (3) conducted targeted data mining. Additionally, we reviewed applicable federal statutes and regulations related to the purchase cards, including the Government Charge Card Abuse Prevention Act of 2012 (Charge Card Act) and the Federal Acquisition Regulation (FAR). We also identified and applied the internal-control activities contained in Standards for Internal Control in the Federal Government and agencies’ purchase card policies and procedures. We obtained purchase card transaction data for all transactions posted during fiscal year 2014 from the three purchase card–issuing banks. This was the most recently available and complete fiscal year of data at the time of our review. During the time frame of our audit, the micropurchase threshold for most purchases was $3,000, with exceptions for some construction, service, or other specific types of contracts. We assessed the reliability of the data by: (1) performing electronic testing of key data elements, including checks for missing, out-of-range, or logically inaccurate data; (2) reviewing documents for information about the data and the banks’ systems; and (3) interviewing bank officials knowledgeable about the data to discuss any limitations. We also compared the bank transaction data to source documentation from agencies. We determined that the data were sufficiently reliable for the purposes of our report. From these data, we extracted and tested a random, stratified statistical sample of 300 transactions from a population of over 17 million micropurchases that were posted during fiscal year 2014. We interviewed agency officials to discuss specific sample transactions. The random, stratified sample consisted of 100 transactions each from the Department of Defense (DOD), Department of Veterans Affairs (VA), and all other executive agencies within our scope. Our sample examined DOD and the VA separately because, together, both agencies accounted for over three-fourths of all purchase card spending and about two-thirds of all micropurchase spending in fiscal year 2014. Agencies present in our random sample were the Department of Agriculture, Department of Commerce, Department of Defense, Department of Health and Human Services, Department of Homeland Security, Department of Housing and Urban Development, Department of Justice, Department of State, Department of the Interior, Department of Veterans Affairs, Environmental Protection Agency, National Aeronautics and Space Administration, National Archives and Records Administration, National Science Foundation, Smithsonian Institution, and Social Security Administration. The statistical sample allowed us to provide estimates for fiscal year 2014 for the entire population of government agencies in our sample frame (i.e., government-wide), as well as separate estimates specific to DOD and VA. With our statistical sample, each transaction in the population had a nonzero probability of being included, and that probability could be computed for any transaction. Each sample element was subsequently weighted in the analysis to account statistically for all the transactions in the population, including those that were not selected. Because we followed a probability procedure based on random selection, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent interval (e.g., +/-5 percentage points). Percentage estimates for the government-wide, VA, and DOD results have sampling errors (confidence interval widths) of +/-5, 7, and 8 percentage points or less, respectively. To test the approval process, we obtained source documentation from agencies for each sample item and evaluated it against the requirements of the Charge Card Act and OMB guidance to determine whether review elements of the transaction approval process were effective. We also evaluated the source documentation for each sample item against OMB guidance to determine whether there were any indicators of improper or potentially fraudulent purchases. We asked agencies to provide us the following source documentation for each sample item: 1. A receipt for the transaction. The receipt should include the date of purchase, a description of the good/service received, the price, and the quantity. 2. All other supporting documentation for the transaction, including a written request for the item/service; or documentation by the cardholder of a nonwritten request that includes the requester’s name, item description, quantity, estimated cost, and date of request; or, documentation of prior approval in the event that a purchase/need was self-generated by the cardholder, which may include preauthorization for certain purchases. 3. A record that the transaction was approved by the approving official. If the transaction was unauthorized, incomplete, damaged, or returned; or if the transaction was reversed in part or in whole, supporting documentation should be provided. When determining whether a transaction passed our test for Approving Official (AO) approval, we also included cardholder reconciliation of the transaction, within the scope of our test. Additionally, if we determined that a cardholder or other agency official took actions on a sample item in response to our review—such as approving a transaction after our request for documentation of AO approval—then we failed the sample item on that particular test. We also reviewed transactions for which agencies provided full or partial documentation to determine whether the transactions were potentially fraudulent. Additionally, we determined that if a transaction was missing documentation for all three elements of the approval process, we would classify the transaction as improper. We reviewed the fiscal year 2014 policy documents of the agencies included in our random sample to assess their compliance with OMB’s guidance on ensuring effective agency asset management. OMB’s guidance detailed five areas that agency policy must address: (1) definition of “sensitive” and “accountable” property; (2) a process for notifying the property-management activity of property receipt; (3) the process for recording and tracking such property; (4) the documentation of independent receipt and acceptance, when appropriate; and (5) procedures for addressing missing, stolen, or damaged property. For each of these requirements, we determined whether agency policy “passed,” “partially passed,” or “failed.” When necessary, we interviewed agency officials to discuss specific purchase card policies. To test agency program controls related to asset management, we reviewed agency policies and assessed each transaction in the sample to determine whether there was an independent receipt and acceptance requirement according to agency policy. Of the 300 transactions in our sample, we identified a generalizable selection of 184 transactions where agency policy required independent receipt and acceptance. We reviewed agency policy on what actions and documentation were required to meet independent receipt and acceptance requirements. We assessed the source documentation provided by the agency to determine whether the transaction met the agency’s requirements for independent receipt and acceptance. The percentage estimates for the government- wide independent receipt and acceptance results have a sampling error of +/-7 percentage points or less at the 95 percent confidence interval. Purchase card data provided by the banks did not always contain adequate details on the items purchased to enable us to identify transactions with likely sensitive or accountable property. Because we were not able to draw a statistical sample of these transactions, we were not able to project failure rates for accountable or sensitive property. Consequently, our tests on accountable property were performed on a nonrepresentative population of transactions that we identified when agency documentation showed that a transaction selected in our random sample contained accountable or sensitive items. When we found that a sample item was “sensitive” or “accountable” property according to the agency’s policies, we requested evidence that the property was currently in the agency’ s possession and being tracked in the agency’s property - tracking system. Because we identified only four transactions from our sample and data mining with accountable or sensitive items, we were unable to make any conclusions on government handling of sensitive or accountable property. To identify indicators of improper or potentially fraudulent purchases, we performed targeted data mining of micropurchase transactions that posted in fiscal year 2014. We identified categories that were potentially high risk for improper purchases by reviewing prior GAO reports on purchase cards, reports on agency purchase card programs from their inspectors general, and congressional testimony. Additionally, we identified categories of transactions for which we wished to develop a better understanding of the nature of such transactions. For example, we wished to better understand transactions made using third-party payment systems such as PayPal that we categorized as part of a high-risk merchant category. We queried the data to identify potentially improper purchases and requested source documentation from agencies for 20 of these purchases within the following categories: (1) high-risk merchants, (2) wireless transactions, (3) convenience checks, and (4) split purchases. We reviewed the source documentation for these 20 potentially improper purchases to determine whether they were improper purchases according to OMB guidance. When necessary, we interviewed agency officials to discuss these transactions and requested additional documentation. We also performed data mining for potentially improper purchases in a broad range of categories such as (1) alcohol, wine, and beer purchases, (2) adult entertainment, (3) online dating, (4) child care, and (5) spa, hair, and makeup. We did not request source documentation for transactions within these categories, as we did not find indicators of improper of potentially fraudulent purchases. Our data-mining work was not designed to identify and we cannot determine the extent of improper or fraudulent purchases occurring in the population of government-wide purchase card transactions. We conducted this performance audit from January 2015 to February 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Included in this appendix are details of our assessment of the extent to which the 16 agencies that we reviewed had policies and procedures in effect for fiscal year 2014 that complied with the Office of Management and Budget’s (OMB) guidance on property acquired with a purchase card. OMB detailed five areas that agency policy must address in its Appendix B of Circular A-123, Improving the Management of Government Charge Card Programs: 1. “The determination of items to be classified as ‘sensitive,’ and the establishment of dollar value thresholds for accountable property, taking into account the risk of loss of data or sensitive information on electronic items. 2. “A process of notifying the agency property management activity of property receipt, including situations where property is delivered at locations other than a central receiving facility. 3. “The process for the agency to record property in the agency property tracking system and financial systems, including the designation of property as sensitive or accountable, when applicable. 4. “The documentation of independent receipt and acceptance, when appropriate, to ensure that items purchased were actually received, including procedures addressing remote locations and emergency/urgent purchases where independent acceptance may be difficult or impossible. 5. “Procedures for cardholders and/or custodians of the property to follow when property is determined to be missing, stolen, or damaged.” Table 5 includes assessments of the five areas for each agency that was included in our 300-transaction random sample. Following the table are summaries of our analysis on the areas where the agency’s policies and procedures did not address all aspects of the guidance. The Department of Agriculture policy set the dollar-value threshold for accountable property at $5,000 and delegated responsibility for defining a list of sensitive items to its components. Our random sample included transactions from four components that we then reviewed. The Farm Service Agency, the Agricultural Research Service, and the Forest Service provided a list of sensitive items. The other component we reviewed, the Food Safety and Inspection Service, reported that it does not have a list of sensitive items and does not classify items as sensitive. For the first part of fiscal year 2014, the agency’s policy required independent receipt and acceptance for purchases above $300; however, the policy did not specify procedures for items received in remote locations or during emergency or urgent conditions. The agency revised its purchase card policy in April 2014, including a change to the independent receipt and acceptance requirement, among other changes. The new policy did not require independent receipt and acceptance for purchases, but encouraged the separation of duties. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of Commerce policy did not have an agency-wide requirement of independent receipt and acceptance for transactions, though it encouraged the separation of duties. The agency policy delegated responsibility for establishing independent receipt and acceptance or subsequent review of purchases to its components. Our random sample included transactions from two components that we then reviewed—the Office of the Secretary and the National Oceanic and Atmospheric Administration. These components did not have separate policies and followed the agency-wide policy. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of Defense policies and procedures addressed all aspects of the OMB guidance. The Department of Health and Human Services policies and procedures addressed all aspects of the OMB guidance. The Department of Homeland Security policy required independent third- party receipt for purchases, except for shipping, subscriptions, training, or similar purchases; however, it did not specify procedures for items received in remote locations or during emergency or urgent conditions. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of Housing and Urban Development policy instructed the cardholder to provide clear and precise shipping instructions and to retain proof of receipt documentation, but did not specifically mention independent receipt and acceptance. An agency official confirmed that the Department of Housing and Urban Development policy did not require independent receipt and acceptance for purchases in fiscal year 2014. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of Justice was unable to provide policies and procedures in effect for fiscal year 2014 that addressed two of the five areas: (1) the process of notifying the agency property-management activity of property receipt and (2) the process for recording and tracking such property. Additionally, the agency’s policies addressed only some aspects of two other areas: (1) the documentation of independent receipt and acceptance, when appropriate, and (2) procedures for addressing missing, stolen, or damaged property. The agency’s policies noted that the purchase must be received in “accordance with the Government’s requirements,” but did not provide additional details on independent receipt and acceptance, including procedures for items received in remote locations or during emergency or urgent conditions. According to agency officials, independent receipt and acceptance was required for most of the Department of Justice transactions in our random sample. Further, the Department of Justice policies noted that during annual and biennial physical inventories of agency property every effort must be made to locate missing property. However, the policy did not address the procedures for addressing property once it had been determined to be missing, stolen, or damaged. The Department of State policy required cardholders to complete a receiving report for accountable or sensitive property and affix a bar- coded property sticker to the item, but did not further detail the process for recording the property in the property tracking and financial systems. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of the Interior policy did not specifically mention independent receipt and acceptance. The agency’s policy documents provided instructions when someone other than the cardholder received the purchase, implying that independent receipt and acceptance was not required for purchases. Agency officials confirmed that the agency policy did not require independent receipt and acceptance for purchases in fiscal year 2014. The agency’s policy does require that an authorized recipient sign a property receipt for accountable or sensitive property after the cardholder initially receives the purchase. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Department of Veterans Affairs required independent receipt and acceptance for certain types of purchases. For the first part of fiscal year 2014, the agency’s policy assigned cardholders as authorized signers for purchases so that the cardholder’s electronic signature in the computerized accountability system served as documentation of receipt. In May 2014, the agency clarified that all self-generated transactions made with a purchase card required independent verification of receipt. However, the Department of Veterans Affairs policy did not address independent receipt procedures for items received in remote locations or during emergency or urgent conditions. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The Environmental Protection Agency policy required third-party verification of delivery for all purchase card transactions; however, it did not specify procedures for items received in remote locations or during emergency or urgent conditions. The agency’s policies and procedures addressed all other aspects of the OMB guidance. National Aeronautics and Space Administration policy required independent receipt and acceptance for purchases above $500; however, it did not specify procedures for items received in remote locations or during emergency or urgent conditions. The agency’s policies and procedures addressed all other aspects of the OMB guidance. National Archives and Records Administration policy did not specifically mention independent receipt and acceptance, though the policy encouraged the separation of duties. An agency official confirmed that the agency’s policy did not require independent receipt and acceptance for purchases in fiscal year 2014. The agency’s policies and procedures addressed all other aspects of the OMB guidance. The National Science Foundation’s policies and procedures addressed all aspects of the OMB guidance. The Smithsonian Institution’s policies and procedures addressed all aspects of the OMB guidance. The Social Security Administration policy required independent receipt and acceptance for purchases where the cardholder and requestor were the same; however, it did not specify procedures for items received in remote locations or during emergency or urgent conditions. The agency’s policies and procedures addressed all other aspects of the OMB guidance. In addition to the contact name above, individuals making contributions to this report include Philip Reiff (Assistant Director), Katherine Carter, Charles Culverwell, Carrie Davidson, Colin Fallon, Justin Fisher, Amber D. Gray, Samuel Harris, Robert Heilman, Olivia Lopez, Daniel McKenna, Maria McMullen, Madeline Messick, Kevin Metcalfe, James Murphy, Anna Maria Ortiz, Daniel Purdy, Michael Rebman, Thomas Twambly, Ariel Vega, and Nick Weeks.

Summary: For fiscal year 2014, the most recently available data at the time of GAO's review, the federal government spent $8.7 billion in micropurchases using purchase cards. In its last government-wide review of the program in 2008, GAO found that internal control weaknesses in agency purchase card programs left the government vulnerable to fraud, waste, and abuse. GAO was asked to review purchase card micropurchases to determine whether weaknesses still exist. GAO examined (1) what actions GSA and OMB have taken since 2008 to enhance program controls over micropurchases and (2) whether weaknesses exist in the approval process for them and, if so, whether there are indicators of improper or potentially fraudulent purchases. GAO analyzed purchase card policies and guidance issued by OMB and GSA; obtained purchase card data on fiscal year 2014 transactions; tested three elements of the approval process through a generalizable random, stratified sample of 300 transactions from a population of over 17 million across the government; and conducted targeted data mining for improper or potentially fraudulent purchases. Since 2008, the General Services Administration (GSA) and the Office of Management and Budget (OMB) have taken several steps, in part to address prior GAO recommendations, to enhance purchase card program controls over micropurchases, which are currently capped at $3,500 for most purchases. These steps include developing training, monitoring tools, and guidance. For example, according to OMB guidance, a cardholder should maintain documentation to minimize risk of erroneous and improper purchases, including documentation of the purchase request and preapproval for self-generated purchases. GAO's government-wide review found some weaknesses in the approval process for micropurchases due to inadequate documentation. Specifically, in its sample, GAO found that 22 percent of transactions government-wide did not have complete documentation to substantiate the transactions' approval process. Additionally, GAO estimated that 23 percent of Department of Defense (DOD) transactions and 13 percent of Department of Veterans Affairs (VA) transactions had incomplete documentation. Together, DOD and VA accounted for about two-thirds of all micropurchase spending in fiscal year 2014. GAO's government-wide review and targeted data mining of selected categories for potentially improper purchases found little evidence of improper or potentially fraudulent purchases among micropurchase transactions. However, incomplete documentation increases the risk that fraud, charge card misuse, and other abusive activity could occur without detection. One agency, the Department of the Interior (DOI), granted blanket purchase authority for cardholders for most transactions under the micropurchase limit, and therefore did not require any documentation of the purchase request or preapproval. This blanket authority may increase the risk that fraudulent, improper, and other abusive activity could occur. Following OMB guidance for documentation can help reduce such risks. GAO recommends that GSA reemphasize OMB guidance to obtain and retain complete documentation of micropurchases, and that DOI require cardholders to document purchase request and preapproval for self-generated purchases. GSA concurred with GAO's recommendation. DOI partially agreed, noting potential challenges with requiring preapproval. GAO still believes this recommendation is valid.