Air Force travel card delinquency rates and amounts charged off were substantially lower than non-Air Force DOD components, and delinquencies were about 1 percent higher than non-DOD federal civilian agencies. Cumulative Air Force charge-offs since the inception of the travel card program with Bank of America in November 1998 are approximately $11.6 million, the lowest of the three services. Our analysis of available data showed that the travel cardholder’s rank and pay rate are strong predictors of delinquency problems. We found that the Air Force’s delinquency and charge-off problems are primarily associated with low and mid-level enlisted military employees. As discussed in following sections of this report, improvements in the Air Force’s overall control environment improved Air Force delinquency rates, but DOD’s overall high delinquency and default rates resulted in contentious relations with Bank of America. The bank threatened to end its participation in the program, but eventually agreed to contract modifications that included increased fees. Past delinquencies and charge-offs have cost the Air Force, the federal government, and the taxpayers thousands of dollars in lost rebates, and substantial resources spent pursuing and collecting on past due accounts. We also estimate that contract modifications will cost the Air Force millions of dollars in the future due to higher fees. The Air Force has taken a number of positive actions to address its delinquency and charge-off rates, and data for the first half of fiscal year 2002 show a significant drop in charged-off accounts. For example, this reduction is, in part, attributable to a salary and military retirement offset program—similar to garnishment—which was initiated in November 2001. Other Air Force actions included encouraging the use of the split disbursement payment process, in which the Defense Finance and Accounting Service (DFAS) sends a portion of the traveler’s reimbursement directly to the bank rather than the cardholder, and increased management attention and focus on the delinquency issue. However, except for split disbursements, Air Force actions primarily address the symptoms or back- end result of delinquency and charge-offs after they have already occurred. As noted in the following sections of this report, additional emphasis on front-end management of the travel card program, such as more selective procedures for issuing the cards and overseeing the proper use of the cards, could further improve the Air Force travel card program. As of March 31, 2002, approximately 8,000 Air Force cardholders had over $5 million in delinquent debt. Over the last 2 years, Air Force delinquency rates fluctuated from 5 to 11 percent and on average were about 5 percentage points less than the Army’s and the Navy’s and 1 percentage point higher than non-DOD federal civilian agencies. The Air Force has set a goal of no more than a 4 percent delinquency rate. As discussed later, greater emphasis on commander responsibility and accountability, contributed, at least in part, to lower Air Force delinquency rates. Figure 1 compares delinquency rates among the Air Force, Non-Air Force DOD, and the 23 largest civilian agencies. In addition, as shown in figure 2, Air Force travel card delinquency rates for the eight quarters ending March 31, 2002, were significantly less than Army and Navy travel card delinquency rates. Further analysis revealed that Air Force travel card delinquency rates have decreased from 16.9 percent as of December 31, 1999 to 6.0 percent as of March 31, 2002. Table 1 shows the decrease in Air Force delinquency rates since December 1999, as well as the cyclical nature of Air Force travel card delinquency rates. Since the inception of the travel charge card task order between DOD and Bank of America on November 30, 1998, Bank of America has charged off about 9,000 Air Force travel card accounts with nearly $11.6 million of bad debt. While not an excellent track record, it is lower than the Army’s approximate 23,000 charged-off accounts valued at nearly $34 million and Navy’s approximate 13,800 charged-off accounts valued at nearly $16.6 million. Task order modifications during fiscal year 2001 allowed Bank of America to institute a salary offset provision against DOD military personnel whose travel card accounts were previously charged off or were more than 120 days past due. Table 2 provides a comparison of cumulative charge-offs and delinquencies by military service as of March 31, 2002. Our analysis showed a correlation between certain demographic factors and high delinquency and charge-off rates. Available data showed that the travel cardholder’s rank or grade (and associated pay) is a strong predictor of delinquency problems. As shown in Figure 3, Air Force delinquency and charge-off problems are primarily associated with low- and midlevel enlisted military personnel in grades E-1 (airman) to E-6 (technical sergeant), with relatively low incomes and little experience in handling personal finances. Appendix IV presents information on military and civilian grades and pay rates. Available data indicate that military personnel grades E-1 to E-6 account for about 69 percent of all Air Force military personnel. These enlisted military personnel have basic pay levels ranging from $11,500 to $27,600. These individuals were responsible for 41 percent of the total outstanding Air Force travel card balances as of September 30, 2001. Figure 4 compares the delinquency rates by military grade and civilian personnel to the average Air Force delinquency rate as of September 30, 2001. As shown, the delinquency rates were as high as 15.7 percent for E-1 to E-3 and 9.9 percent for E-4 to E-6, compared to the Air Force overall delinquency rate of 6.2 percent. These rates were markedly higher than the rates for officers, which was 2.4 percent. These rates were also substantially higher than that of Air Force civilians, which at 3.6 percent was 1.4 percentage points lower than the federal civilian agencies rate shown in figure 1. The delinquency rate for military personnel in grades E-4 to E-6 in particular had an important negative impact on the Air Force’s delinquency rate. Specifically, these are senior airmen to technical sergeants in the Air Force. Pay levels for these personnel, excluding supplements such as housing, range from $18,600 to $27,600. As shown by Bank of America data, personnel in grades E-4 to E-6 accounted for 37 percent of the total Air Force outstanding balance. High delinquency rates for the E-1 through E-6 grades combined with their extensive use of the travel card have a significant impact on the Air Force wide delinquency rate. Figure 5 shows Air Force fiscal year 2001 charge-offs. Charge-off amounts of about $2.6 million for military personnel in grades E-1 through E-6 accounted for 79 percent of the $3.3 million in total Air Force charge-offs in fiscal year 2001. An Air Force travel card program official told us that a major factor of the service’s travel card delinquencies relates to first-term enlisted personnel. An Air Force member can normally attain the E-4 grade within 3-1/2 years in his or her first term. According to Air Force data, over half of the personnel in grades E-1 to E-6 are in grades E-4 and below. The official commented that if the members are not committed to an Air Force career and plan to serve only one tour, temptation exists to misuse the card before they separate from the Air Force. In addition, as discussed below, the Air Force did not exempt personnel with poor credit histories from required use of travel cards. Consequently, these low and mid-level enlisted military personnel are often issued travel cards even though they may already be in serious financial trouble and, therefore, may not have been appropriate credit risks. As shown in table 3, five Air Force major commands accounted for about 63 percent of the Air Force travel card delinquencies as of March 31, 2002. Air Force National Guard and Air Force Reserve Command officials attributed their high delinquent balances to the recent activation of guard and reserve forces, the associated increase in travel card use, and inadequate employee training on travel voucher preparation. In addition, the officials explained that National Guard and Reserve forces that report to duty intermittently may not become aware of problems with travel voucher accuracy and late submission of payment vouchers until they report for their next duty assignment—several days to a month after a problem has occurred. Further, the officials told us that many of their members have not been trained on proper travel voucher preparation procedures, and controls over travel card use and payment of travel card bills are weak. One reserve official cited the lack of specific guidance for disciplinary action in DOD’s Financial Management Regulation as a contributing factor. According to Air Force officials, the Air Combat Command, Air Force Materiel Command, and Air Mobility Command have all experienced significant increases in travel and deployments since September 11, 2001. Our audit work showed instances in which extended travel and back-to- back deployments resulted in delays in travel voucher preparation and submission. To reduce delinquencies associated with late payment of travel card bills by deployed units, the Air Force has emphasized the use of the split disbursement payment process and interim travel vouchers. Delinquencies and charge-offs within DOD have resulted in increased costs to the Air Force and the other services. In fiscal year 2001, DOD entered into an agreement with Bank of America to adjust the terms of its travel card contract. DOD agreed to increased fees and a change in rebate calculation. These changes cost the Air Force about $350,000 in lost rebates on individually billed accounts and centrally billed accounts in fiscal year 2001, and could cost an estimated $1.6 million in increased ATM fees annually. Other costs are real but not easily measurable, such as the increased administrative burden to the Air Force to identify and address delinquent accounts. Unexpectedly high defaults by DOD’s travel cardholders resulted in a 5- month legal dispute with Bank of America over the continuation of the travel card contract. In 1998, under the provisions of the General Services Administration’s (GSA) master contract with Bank of America, DOD entered into a tailored task order with Bank of America to provide travel card services for a period of 2 years, ending November 29, 2000. Under the terms of the task order, DOD had three 1-year options to unilaterally renew the contract. On September 29, 2000, prior to the expiration of the initial task order, DOD gave notice to Bank of America that it intended to exercise its option to extend the task order for an additional year. In November 2000, Bank of America contested the provisions of the DOD task order with the GSA contracting officer. Bank of America claimed that the task order was unprofitable due to required “contract and program management policies and procedures” associated with higher-than-anticipated credit losses, including an estimated 43,000 DOD employees had defaulted on more than $59 million in debts. Consequently, in April 2001, the master contract and the related DOD tailored task order for travel card services were renegotiated. Specifically, Bank of America was able to increase its revenue by instituting additional fees, such as higher cash advance and late payment fees; offsetting credit losses against rebates as explained later; facilitating the collection of delinquent and charged off amounts through salary and military retirement pay offset; and encouraging DOD personnel participation in split disbursements, in which the government sends part or all of the travel voucher reimbursements to Bank of America directly. One of the terms of the renegotiated task order was that, effective August 10, 2001, the travel card cash advance fee would be increased from 1.9 percent to 3 percent, with a minimum fee of $2. The Air Force reimburses all cash advance fees related to authorized cash withdrawals. We estimate that this contract modification will result in approximately $1.6 million of increased costs to the Air Force each year. Our estimate was made by applying the new fee structure that went into effect in mid-August 2001 to cash advances made during fiscal year 2001. Other fee increases agreed to in the renegotiation, such as the fee for expedited travel card issuance, will also result in additional cost to the Air Force. The GSA master contract modification also changed the rebate calculation, making it imperative that the Air Force (and the other services) improve their payment rates to receive the full benefits of the program. Under the GSA master contract, credit card companies are required to pay a quarterly rebate, also known as a refund, to agencies and GSA based on the amount charged to both individually billed and centrally billed cards. The rebate to the agency is reduced, or eliminated, if significant numbers of an agency’s individual cardholders do not pay their accounts timely. Specifically, credit losses or balances that reach 180 calendar days past due reduce the rebate amounts. Effective January 2001, the contract modification changed the way that rebates are calculated and how credit losses are handled. If the credit loss of an agency’s individually billed travel card accounts exceeds 30 basis points—or 30 one-hundredths of a percent (.003)—of net sales on the card, the agency is assessed a credit loss fee, or rebate offset, against the rebate associated with both individually billed and centrally billed travel card accounts. This credit loss fee, or rebate offset, which resulted solely from individually billed account losses, significantly affected the amount of rebate the Air Force received as a result of combined individually and centrally billed net sales in fiscal year 2001. In fiscal year 2001, the Air Force collected about $1.4 million of the $1.8 million in rebates that we estimated it would have received, based on fiscal year 2001 dollar volume if the individually billed account payments had been timely. Other costs, such as the administrative burden of monitoring delinquent accounts, are harder to measure, but no less real. For example, employees with delinquent accounts must be identified, counseled and disciplined, and their account activity closely monitored. In addition, employees with financial problems who have access to sensitive data may pose a security risk, as discussed later in this report. In addition to having the lowest net charge-off amount of the three services, $6.9 million, the quarterly dollar amount of Air Force accounts charged off has decreased substantially. As shown in figure 6, at the start of fiscal year 2001, the charged off balance greatly exceeded the recovery amount. Starting in the third quarter of fiscal year 2001, the amount charged off started to decline so that in the first quarter of fiscal year 2002, recoveries, for the first time, exceeded the amounts being charged off. Recoveries also exceeded charge-offs in the second quarter of fiscal year 2002. The institution of the salary and military retirement offset program has contributed to the reduction in Air Force travel card charge-offs, primarily by eliminating the need to charge off past due balances by transferring these balances to the salary off-set program. Starting in fiscal year 2002, DOD began to offset the retirement benefits of military retirees and the salaries of certain civilian and military employees against the delinquent and charged off balances on travel card accounts. The DOD salary offset program implements a provision of the Travel and Transportation Reform Act of 1998 (TTRA) that allows any federal agency, upon written request from the travel card contractor, to collect by deduction from the amount of pay owed to an employee (or military member) any amount of funds the employee or military member owes on his or her travel cards as a result of delinquencies not disputed by the employee. The salary and military retirement offset program was implemented DOD-wide. The offset program came into being as part of the task order modification. Between April and August 2001, DOD and the Bank of America worked together to establish program protocols. Starting in August 2001, the Bank of America sent demand letters to cardholders whose accounts were more than 90 days delinquent. The Defense Finance and Accounting Service processed the initial offsets of delinquent accounts in October 2001 in the various DOD pay systems. The first deductions were made from the November pay period and paid to Bank of America starting December 2001. Figure 6 illustrates the initial impact salary offset had in the first quarter of fiscal year 2002. The Bank of America can also use the offset program to recover amounts that were previously charged off. January 2002 was the first month in which Bank of America requested offsets for such accounts. The effect, shown in figure 6, was recoveries amounting to over three times more than charge-offs for the second quarter of fiscal year 2002. The offset program works as follows. When an account is 90 days delinquent, Bank of America may send a demand letter to the individual cardholder requesting payment in full within 30 days. The demand letter specifies that salary offsets will be initiated if payment is not made in full within 30 days. The cardholder may negotiate an installment agreement or dispute the charges with the bank. The cardholder has a right to review all records such as invoices and to request a hearing if the bank’s disposition of the dispute is not satisfactory. After the 30 days have elapsed, if payment is not made and the cardholder does not dispute the debt, the bank includes the account in the list of accounts that it sends to DFAS requesting offsets. Individuals in the following categories may not be accepted for offset. Civilian employees in bargaining units that have not agreed to the salary- offset program do not qualify for the program. According to a DFAS official, 1,002 of 1,227 DOD bargaining units had agreed to participate in the program as of July 2002. Individuals with debts to the federal government or other garnishments already being offset at 15 percent of disposable pay are considered to be in protected status and are not eligible for the offset program. Individuals who cannot be located in the various payroll and military retirement (active, reserve, retired military, or civilian) systems cannot be accepted for offset. Civilian retirees. The authorizing statutes for both the Civil Service Retirement System and the Federal Employee’s Retirement System in effect at the time of our audit specified that retirement benefits may be offset only to the extent expressly authorized by federal statutes. TTRA, Section 2, provided authority to offset salaries of “employees” of agencies but does not provide such authority for civilian employee retiree annuitants. Once an individual is accepted for offset, the related debt is established in the appropriate pay system and DFAS can deduct up to 15 percent of disposable pay. Disposable pay is defined in GSA’s Federal Travel Regulation as an employee’s compensation remaining after the deduction from an employee’s earnings of any amounts required by law to be withheld (e.g., tax withholdings and garnishments). The amounts collected are paid to the bank on a monthly basis for military personnel and retirees and biweekly for civilian personnel. It takes approximately 2 months from the time an offset is initiated to the first bank payment. According to DFAS, from October 2001 through July 2002, Bank of America referred 53,462 DOD-wide cases with debt of $77.5 million to DOD for offset. DOD accepted and started offset for 74 percent of the cases and 69 percent of the debt amounts referred. The number and debt amount of Air Force-specific cases forwarded by Bank of America were not available. From November 2001 through July 2002, DFAS collected $2.7 million from active and retired Air Force military personnel through the offset program. During the same period, DOD collected $1.6 million from all DOD civilian employees. However, DFAS was unable to provide this amount by military service. We found that Air Force management encouraged a culture that emphasized the importance of integrity and ethical values and was involved in monitoring travel card delinquencies. According to travel card program officials and documentation we obtained, Air Force officials, from the Vice Chief of Staff to wing commanders, have strongly emphasized for the past 2 to 3 years that the travel card program is a “commander’s program” and commanders are responsible for managing their delinquency rates. They explained that officials throughout the Air Force chain of command have monitored travel card delinquency rates and discussed the topic at their respective staff meetings. Documentation we obtained confirmed the use of detailed statistical reports to monitor installation-level delinquencies. Commanding officers are holding unit commanders with excessive delinquency rates accountable to make improvements to reduce delinquencies. Travel card delinquency statistics are discussed at command staff meetings, and unit commanders are held accountable for reducing their delinquencies. The importance of the tone at the top cannot be overstated. Other factors contributing to the reduction in Air Force delinquency rates include the following. Air Force emphasis on financial management training. Each Air Force installation has a Financial Services Office with a trained financial management staff that oversee the travel card program. The Air Force also provides personal financial training to all inductees, which includes developing personal budget plans, balancing checkbooks, preparing tax returns, and financial responsibility. The training also covers disciplinary action and consequences for financial irresponsibility by service members. The Air Force also provides financial counseling and training classes through the Family Services Centers at each base and contracts for professional counselors and trainers. Travel card program audits. The Assistant Secretary of the Air Force (Financial Management and Comptroller) requested Air Force Audit Agency audits of the travel card program, which resulted in recommendations to management and resultant program improvements. According to a DOD Inspector General report, the Air Force Audit Agency issued 27 audit reports on the travel card program from fiscal year 1999 through fiscal year 2001. For example, in April 2001, the Air Force Audit Agency issued an audit report on Travis Air Force Base (AFB), one of the sites we audited. The report identified numerous systemic problems, including inadequate agency program coordinator (APC) oversight due to insufficient training, which resulted in unauthorized transactions not being identified. The Air Force Audit Agency made numerous recommendations for corrective actions, and our audit work showed that Travis AFB had taken actions on many of them. DOD and Air Force initiatives. In March 2000, Air Force travel card delinquency rates were in the double digits—10.2 percent—similar to the Army and Navy delinquency rates. The Air Force initiated a number of actions in the fall of 2000 to reduce its delinquency rate. For example, in December 2000, Air Force headquarters sent an E-mail message to travel card APCs asking them to (1) promote the split disbursement payment process, (2) turn off accounts for infrequent travelers, (3) use Bank of America Electronic Account Government Ledger System (EAGLS) reports to monitor and detect problem accounts, (4) include procedures to deactivate the travel card when a member changes duty location, and (5) correct discrepancies between organizational codes assigned to cardholder accounts and their current assigned units to ensure accurate reporting and effective monitoring of accounts. As an aid in correcting organizational coding, the E-mail included a directory for APCs to use to resolve problems with accounts that were incorrectly assigned to them—referred to as “orphan” accounts—by identifying where those accounts should be properly assigned. Further, in response to June and September 2001 DOD policy memorandums to heads of military departments, the Air Force identified 100,000 travel cards for cancellation due to lack of use. According to an Air Force headquarters official, approximately 90,000 travel cards were cancelled in October 2001. In addition, salary offset procedures were implemented in November 2001, resulting in a significant decrease in charged-off accounts in the first 6 months of fiscal year 2002. Also in November 2001, the Air Force Comptroller issued a letter to all major commands, highlighting the use of the split disbursement payment process and interim vouchers as options for preventing delinquent balances when members are on long-term deployments. According to Bank of America data, the Air Force increased the number of payments remitted to Bank of America via the split disbursement payment process from 20,487 payments, or 17 percent of all payments, totaling $12 million in October 2000, to 54,337 payments, or 39 percent of all payments, totaling $44 million in June 2002. Officials at the sites we audited told us that they emphasized that cardholders use the split disbursement payment process. For example, Hill Air Force Base comptroller personnel told us that they have increased use of the split disbursement payment process from 23 percent during the fourth quarter of fiscal year 2001 to 35 percent during the third quarter of fiscal year 2002. In addition, as of September 17, 2002, Travis AFB implemented a new policy that made the split disbursement process the default, or automatic, payment method for all active duty military employees who use the government travel card with the provision that if an employee chooses not to use the split disbursement payment method, approval from the unit commander or first sergeant is required. While the Air Force has made improvements in its control environment that have resulted in lower delinquency rates than the Army’s and the Navy’s, additional improvements could further reduce Air Force delinquency rates. In addition, similar to our Army and Navy findings, control environment weaknesses contributed to significant potential fraud and abuse of the Air Force travel card. Many of the problem cases that we reviewed were due to ineffective controls over the issuance of travel cards and the transfer or cancellation of accounts when individuals moved to other duty locations, separated, or retired. We also found that improvements are needed in the assignment and training of APCs. The Air Force’s ability to prevent potentially fraudulent and abusive transactions that can eventually lead to additional delinquencies and charge-offs is significantly weakened if individuals with histories of financial irresponsibility are permitted to receive travel cards. Although the DOD policy provides that all DOD personnel are to use the travel card to pay for official business travel, the policy also provides that exemptions may be granted under a number of circumstances, including financial irresponsibility. However, DOD’s policy is not clear as to what level of financial irresponsibility by a travel card applicant would constitute a basis for such an exemption. The Air Force’s practice is to facilitate the issuance of travel cards—with few credit restrictions—to all applicants regardless of whether they have histories of credit problems. We found no evidence that the Air Force exempted any individuals or groups from required acceptance and use of travel cards, even those with histories of severe credit problems. DOD’s Financial Management Regulation provides that credit checks be performed on all travel card applicants, unless an applicant declines the conduct of a credit check. In July 1999, Bank of America began conducting credit checks on DOD travel card applicants and used the resulting information as a basis for determining the type of account— restricted or standard—it would recommend for new DOD travel applicants. DOD policy also permits APCs to raise the credit and ATM limits on restricted cards based on travel requirements. Our analysis of credit application scoring models and credit risk scores used by major credit bureaus confirmed that applicants with low credit scores due to histories of late payments are poor credit risks. Credit bureau officials told us that if their credit rating guidelines for decisions on commercial credit card application approvals were used to make decisions on travel card applicants, a significant number of low- and mid-level enlisted Air Force cardholders would not even qualify for the restricted limit cards. A credit history showing accounts with collection agency action or charge-offs poses an even higher credit risk. Any of these problems can be a reason for denying credit in the private sector. However, in DOD, individuals with no credit history, or little credit history, are generally issued restricted cards with lower credit limits. Credit industry research and the results of our work demonstrate that individuals with previous late payments are much more likely to have payment problems in the future. As discussed in this report, many of the Air Force travel cardholders that we audited who wrote numerous NSF checks, had severe prior financial problems, including accounts charged off, histories of delinquencies and charge-offs relating to other credit cards, and accounts in collection, or numerous bankruptcies. DOD Financial Management Regulation, Volume 9, Chapter 3. The regulation further provides that individuals who do not consent to a credit check may only receive a restricted card. In response to similar findings in our audit of the Army travel card program and an amendment proposed by Senators Byrd and Grassley, the Congress included a provision in the Department of Defense Appropriations Act for fiscal year 2003 requiring the Secretary of Defense to evaluate whether an individual is creditworthy before authorizing the issuance of any government charge card. If effectively implemented, this requirement should improve delinquency rates and reduce potential fraud and abuse. We found numerous examples in which the APCs failed to deactivate or close accounts when cardholders retired, were dismissed, or separated from the service, or the APCs failed to take the proper action to transfer accounts when employees were reassigned to other Air Force locations. The Air Force lacks sufficient guidance and management focus in this area. DOD’s Financial Management Regulation requires APCs to terminate travel cards when cardholders die, retire, or are dismissed or separated from DOD. Bank of America has issued procedural guidance for transferring and terminating cardholder accounts. However, we found instances in which failure to follow these procedures—specifically with respect to travel card transfer and termination—resulted in travel card abuses and charge-offs. The cardholders benefited by using the travel cards to purchase a variety of goods and services for their personal use. Some did not pay their monthly bills, thereby essentially obtaining personal items for no cost. The following examples illustrate the effect of not taking appropriate actions to transfer, deactivate, or close travel card accounts. A Langley AFB APC failed to close an enlisted member’s account after the individual left the service. The member left the service in January 2001, but continued to use his card until March 2001. Because the card was not canceled immediately upon the member’s separation, the account remained open with a $5,000 credit limit allowing the member to charge unauthorized ATM withdrawals and purchases. The member was not disciplined because he had already left the service. The APC stated that she was not aware of the misuse of the travel card until the account was charged off in April 2002 with an unpaid balance of $3,729. At Hill AFB, a senior airman (E-4) transferred to Yokota Air Base, Japan, in July 2001. The APC was unaware that the individual had transferred until his travel card account appeared as delinquent on the Bank of America reports. The APC deactivated the card in September 2001 and made repeated, unsuccessful attempts to contact the individual and the APC at Yokota Air Base. In January 2002, Bank of America placed the account totaling $1,918 in salary offset. Although the individual had continued to appear on Hill AFB delinquency reports, Hill AFB officials could not take any disciplinary action because the individual was no longer assigned to them. The account was eventually transferred from Hill to Yokota Air Base in March 2002. According to EAGLS data, the individual issued two nonsufficient fund (NSF) checks to Bank of America in March and April 2002 in payment of his account. Bank of America closed the account in June 2002. Brooks AFB travel card officials failed to cancel the travel card account when a civilian employee (GS-13) separated from the service in January 2000 and began working for a private contractor. The civilian continued to use his travel card after separation, charging over $17,000 in unauthorized purchases. The charges included approximately $1,000 in cash advances and several charges for an on-line dating service. The cardholder was not disciplined for the abuse because he had separated from the service. Information from EAGLS shows that the account was closed on September 13, 2002, and as of October 25, 2002, the account had an unpaid balance of approximately $1,600, which had not yet been charged off. We found a lack of emphasis on APC training and inadequate monitoring of APC training at two of our three case study locations—Nellis AFB and Travis AFB. As in our Army and Navy travel card audits, we found that Air Force APCs had excessive responsibilities. For example, APC duties were being assigned as collateral duties and certain APCs were responsible for as many as 1,200 accounts. We also found excessive turnover associated with military APCs at Nellis AFB and Travis AFB. GAO’s internal control standards state that management’s commitment to competence and good human capital practices are critical factors in establishing and maintaining a strong internal control environment. Specifically, our standards state that management should identify appropriate knowledge and skills required for various jobs and should provide needed training. The standards also state that establishing appropriate human capital practices, including hiring, training, evaluating, counseling, and disciplining personnel, is another critical control environment factor. The emphasis on APC training varied across the three case study sites. Nellis AFB did not have a control mechanism in place to help ensure that all APCs received appropriate training and Travis AFB did not train APCs in a timely manner. Specifically, Travis AFB APCs told us that they did not receive timely training on how to access and use Bank of America EAGLS data to monitor travel card activity when they were assigned APC duties. However, we determined that Hill AFB had a mechanism in place to monitor APC training, and it provided that training in a timely manner. DOD policy provides that travel card training materials are to be distributed throughout the department and that APCs are to be informed of policy and procedural changes relating to the travel card program. However, neither DOD nor Air Force-wide procedures detail requirements for the extent, timing, and documentation of travel program training for APCs. APCs are not required to receive training on the duties of the position or on how to use available Web-based tools and reports from Bank of America before they assume their APC duties. The lack of emphasis on training could negatively impact APCs’ ability to monitor delinquencies and promptly detect and prevent potentially fraudulent and abusive activities. As in our Army and Navy work, we determined that most Air Force APC duties were usually given to military personnel. As a result, APC positions usually have high turnover rates which, in many cases, have resulted in less effective performance of APC duties, such as monitoring cardholder travel card activity. For example, at Nellis AFB, the average length of assignment for APCs was approximately 12 months, and at Travis AFB assignments for military APCs were generally from 12 to 15 months. In addition, a Pacific Air Force official reported that during a recent 3-month period, one base experienced turnover in 18 of its 30 APC positions. In contrast, at Hill AFB, where most of the APCs were civilians, the average term for civilian APCs was approximately 20 months. Further, we found that Air Force APC duties at the locations we audited were “other duties as assigned.” The primary duties for certain APCs that we interviewed included data systems management and aircraft maintenance. As prescribed by the DOD Financial Management Regulation, APCs “are responsible for the day-to-day operations of the DOD Travel Card Program.” Volume 9, Chapter 3 of the DOD Financial Management Regulation provides that APCs are responsible for a variety of key duties, including establishing and canceling cardholder accounts, tracking cardholder transfers and terminations, monitoring and taking appropriate actions with respect to account delinquencies, interacting with the bank, and fielding questions about the program from both cardholders and supervisors. APCs are also required to notify commanders and supervisors of all travel card misuse so they can take appropriate actions. Several APCs that we interviewed told us they did not receive training on the full range of their APC duties until at least six months after they were assigned APC responsibilities. The APCs also told us they were not trained in using EAGLS until six months or more after they were assigned APC responsibilities. In addition to the part-time nature of APC duties, the number of travel cardholders assigned to APCs can result in excessive span of control, which impacts an APC’s ability to effectively perform monitoring and oversight. If the span of control is excessive, APCs may not be able to provide the necessary oversight to prevent the misuse of the travel cards. Table 4 shows the average span of control and incidences of APCs with a span of control greater than 100 cardholders. As shown in table 4, average APC span of control ratios varied at our case study locations. We also found that a high percentage of APCs had a span of control that exceeded Bank of America guidelines of 100 cardholders per APC. While we did not evaluate the guidance provided by Bank of America, we believe that one APC cannot effectively carry out all necessary management and oversight responsibilities if he or she, even working full- time, has responsibility for hundreds of cardholders. Thousands of Bank of America and DOD employees had access to Bank of America’s travel card transaction data system, known as EAGLS. Computer system access controls are intended to permit authorized users to access the system to perform their assigned duties and preclude unauthorized persons from gaining access to sensitive information. Access to EAGLS is intended to be limited to authorized users to meet their information needs and organizational responsibilities. Authorized EAGLS users include both customers (APCs requiring access to travel data for cardholders under their purview and individual travelers requiring access to their own travel transaction histories) and Bank of America employees who may be granted one of five different levels of access depending on their assigned duties. The highest level of Bank of America employee access to EAGLS is the “super user” level. According to Bank of America security officials, this level of access—which provides users the ability to add, delete, or modify anything in the system, including creating accounts and editing transaction data in the system—should be granted to as few individuals as possible. We found that 1,127 Bank of America employees had some level of access to the EAGLS system, including 285 with super user level access. After we brought this matter to the attention of Bank of America security officials, they reviewed employee access and deactivated access for 655 employees that they determined should not have had any level of access. Further, Bank of America has since initiated periodic reviews to ensure that it maintains appropriate levels of employee access. In addition, DOD employees retained APC access to EAGLS after relinquishing their APC duties or after they may have been transferred or terminated. In a 2000 survey of 4,952 individuals with APC-level access to EAGLS, DOD found that approximately 10 percent could not be located and may have been transferred or terminated or no longer had APC responsibilities. Because of concern that many of these accounts should be deactivated, Bank of America has begun a review to determine if DOD employees with APC-level access no longer have APC responsibilities or have left the service. Of the four key control activities associated with the fiscal year 2001 travel payment process that we tested, we found breakdowns associated with a lack of documentation to support the accuracy of travel reimbursements at all three locations and significant breakdowns in controls at two locations related to requirement for employees to submit vouchers within 5 days of completing travel. On a positive note, we found that travel vouchers were almost always paid within 30 days of submission. As a result, we ruled out late payment of travel vouchers as a contributing factor to travel card delinquencies at the three Air Force locations we audited. Our test results also showed that most travel charges were supported by approved travel orders, indicating minimal personal use—2 percent or less—of the travel card. This is considerably lower than the Army sites we audited, where we estimated that personal charges were as high as 45 percent at one location. It is also significantly lower than the Navy sites we audited, where we estimated that personal charges were as high as 26 percent at one location. However, as discussed later in this report, our overall Air Force data mining found several instances of personal use of the government travel card. Table 5 below shows the results of our statistical sampling tests. Appendix II includes the specific criteria we used to conclude on the effectiveness of these controls. We found a lack of required receipts for hotel and rental car costs in the voucher packages associated with a number of transactions in our sample, indicating that these expenses should not have been reimbursed to the employees. For the three units we audited, Air Force Financial Services Offices were responsible for processing vouchers to ensure that only authorized, properly supported travel charges were reimbursed and that the expenses claimed were accurately calculated. In our samples, we found that most errors were in the following categories. Missing receipts – At all three case study locations, we found the majority of errors related to instances in which voucher packages did not include all required receipts to support claims, based on DOD regulations. For example, a Nellis AFB cardholder was paid for over $700 in lodging costs on a voucher for which required receipts were not attached to the copy of the travel voucher we reviewed. The Nellis AFB Comptroller told us that he believed the receipts were most likely lost between the processing of the voucher at Nellis AFB and the filing of the voucher at the Defense Finance and Accounting Service (DFAS) in Denver. DFAS Denver officials stated that all of the receipts in the voucher package were copied for our review. We were unable to determine whether the missing receipts may have resulted from poor record retention by DFAS Denver or erroneous payments of expenses without required receipts. In either case, the process for obtaining and retaining required receipts was inadequate. Errors in amounts paid – We found instances at all three case study locations in which Financial Services Office personnel used incorrect per diem rates for lodging and meals and incidental expenses to calculate the reimbursement amount, resulting in overpayments to the traveler. Two of the case study sites we audited—Travis AFB and Hill AFB—had ineffective controls for ensuring that vouchers were submitted in a timely manner. DOD policy requires the traveler to submit a travel voucher within 5 days of return from travel. The failure rates we identified involved late submission of vouchers ranging from 8 to 87 days. Late submission of a travel voucher increases the likelihood that travel card bills could become due before the employee receives a reimbursement for travel expenses. Some of the transactions in our statistical sample could not be evaluated for key control attributes due to data management problems, which represent additional control weaknesses. These weaknesses included data entry errors, such as incorrect social security numbers, and organizational coding problems related to “orphan” accounts—accounts that fell into limbo because transferring units did not deactivate travel card accounts when cardholders transferred to new Air Force units and the cardholders did not check in with the gaining unit APCs to ensure that their travel card accounts were coded to their new unit organization codes. When the account of a transferring cardholder falls into this limbo status, the losing unit continues to receive reports on the account status, but has no control over the cardholder, and the gaining unit’s reports contain no information on the cardholder’s account status. Based on our Nellis AFB statistical testing, we estimated that approximately 2 percent of the fiscal year 2001 transactions were affected by data entry problems and another 4 percent were orphan accounts. We estimated that approximately 1 percent of the Hill AFB transactions and 5 percent of the Travis AFB transactions were associated with orphaned accounts. Our testing did not identify any data entry problems at either Hill AFB or Travis AFB. Our limited review of selected travel system controls at the three case study locations found problems in key systems controls, including access controls, segregation of duties, and transaction histories. Travel vouchers that we examined at the three test locations were processed through the Integrated Automated Travel System (IATS), DOD’s primary travel voucher processing system. Air Force Audit Agency’s February 2002 report on IATS controls identified similar problems at 10 other Air Force locations. Because the IATS performs all processing functions from initiating travel account records through disbursing travel pay, it is critical that system controls are in place to protect against fraudulent payments. Access controls for computer systems must be designed to provide protection against unauthorized access to computer resources. One form of access controls is the use of password cracker programs to test the effectiveness of passwords currently in use. These programs were not being used at the three sites, therefore making passwords vulnerable. Another control, required by Air Force Manual 33-223, Identification and Authentication, is that individual passwords are to be revised every 90 days. However, we found that this requirement was not implemented at one of our three case study locations, and supervisors at Nellis AFB did not follow up to determine if password change instructions were followed. We also found a lack of appropriate segregation of duties resulting in access to incompatible duties in IATS at all three of our test locations. Users should have access only to data and system functions required to accomplish their stated responsibilities and they should not have the ability to perform duties incompatible with their assigned responsibilities. We found that IATS users at all three case study locations had conflicting levels of access and, as a result, were able to not only create travel vouchers, but also to update and audit the same records. For example, our review of access privileges at Hill AFB found that assigned privileges for four users afforded them the ability to perform duties such as creating, updating, and auditing travel vouchers. After we called this problem to the attention of the IATS manager, he immediately revised user access levels to ensure that auditors could not also create and update travel voucher information. According to the Air Force Audit Agency report issued in February 2002, this problem is attributable in some measure to an inherent weakness in the software design. Although IATS contains various levels of privileges that can be assigned to individual users, the software design does not effectively limit access to preclude the assignment of incompatible access privileges. In addition, we found that travel voucher data in IATS did not include transaction histories or audit trails. This problem also was identified by the Air Force Audit Agency as a systemic problem. Because IATS software design does not provide the capability to track changes, it is impossible to obtain transaction histories to determine whether changes were made, or who may have made changes, to a particular voucher. This makes the system vulnerable to individuals who could use inappropriate IATS access to create a fictitious travel voucher, process a payment, and subsequently delete the travel record. According to the Air Force Audit Agency report, this problem is being addressed in the design of WINIATS. WINIATS, a Windows-based software application--is targeted to replace IATS in June 2003. Our work identified numerous instances of potentially fraudulent and abusive activity associated with the Air Force’s travel card program during fiscal year 2001 and the first 6 months of fiscal year 2002, similar to the types of cases we found in our Army and Navy work. For purposes of this report, we characterized as potentially fraudulent those cases where cardholders might have committed bank fraud by writing three or more NSF checks or by writing checks on closed accounts to pay their Bank of America bills. We considered abusive travel card activity to include (1) personal use of the cards—any use other than for official government travel—regardless of whether the cardholders paid the bills and (2) cases in which cardholders were reimbursed for official travel and then did not pay Bank of America and thus benefited personally. In addition, some of the travel card activity that we categorized as abusive may be fraudulent if it can be established that the cardholder violated any element of federal or state criminal codes. Failure to implement controls to reasonably prevent such transactions can increase the Air Force’s vulnerability to additional delinquencies and charge-offs. During the 18-month period covering fiscal year 2001 and the first half of fiscal year 2002, over 6,300 individuals wrote nonsufficient fund (NSF) checks, or “bounced checks,” to Bank of America as payment for their travel card bills, including over 400 individuals who wrote three or more NSF checks— potentially fraudulent acts. Potentially fraudulent NSF cases identified in our work include one individual who had charged over $13,000 to the travel card account and wrote seven NSF checks to Bank of America. The Air Force court-martialed the individual and imposed a 90- day confinement. Table 6 includes details on 10 individuals who committed potentially fraudulent acts by writing three or more NSF checks to pay their travel card accounts. Of the ten cardholders included in table 6, six had significant credit problems prior to card issuance, such as charged-off credit card accounts and automobile loans, bankruptcies, and referrals to collection agencies for unpaid bills. The following provides detailed information on some of these cases. Cardholder #1 was a reservist technical sergeant (E-6) who served one weekend each month. Bank of America records showed that the travel card account was opened on December 22, 1999, and that the individual subsequently wrote three NSF checks totaling $3,214 in payment of his travel card bills. In addition, the individual forged a check in the amount of $260. The individual’s account was closed on January 9, 2002, and an unpaid balance of $6,666 was charged off. The individual’s credit report showed that he had credit problems prior to issuance of the government travel card, including repossession of an automobile and a charged-off account. Bank representatives had numerous conversations with the individual about his account. We found that the individual’s travel card account was included on monthly delinquency reports. Bank of America ultimately charged off the travel card account. The individual was discharged from the Air Force under “Other Than Honorable Conditions” for failure to pay his military travel card bills on time and using his travel card for unauthorized purposes. Cardholder #2 was an airman (E-3) at Tinker AFB, Oklahoma. Bank of America records showed that the individual’s account was opened on August 25, 2000, and that the individual subsequently wrote seven NSF checks totaling $23,137 in payment of her travel card bills. The individual submitted NSF checks, which made the account appear to have available credit—a practice known as “boosting”— thus enabling the individual to make cash withdrawals and additional purchases. Bank of America records also showed that bank representatives had numerous conversations with the individual about her travel card debt. The individual’s account was placed in the salary-offset program on March 19, 2001, with monthly payments of $169. The travel card account was closed on July 18, 2002, and an unpaid balance of $13,908 was charged off. The individual’s credit report showed that the individual did not have credit problems prior to the issuance of the travel card. Bank of America notified the squadron about the NSF checks issued in payment of the individual’s travel card account. A subsequent Air Force investigation identified numerous abuses of the travel card, including multiple uses of the card in 1 day for personal ATM withdrawals, and 187 other instances of misuse totaling approximately $13,700, including personal purchases at vendors such as Victoria’s Secret. These findings resulted in the individual being court-martialed, fined $5,000, and initially sentenced to confinement on the base for about 135 days; however, the base commander reduced the sentence to less than 90 days due to the cardholder’s pregnancy. Cardholder #3 was a technical sergeant (E-6) stationed at Wright- Patterson AFB, Ohio, and was the APC for his unit. Bank of America records showed that the individual’s account was opened on October 10, 1998, and that the cardholder subsequently wrote three NSF checks totaling $6,235. The individual’s travel card account was closed on May 3, 2002, and an unpaid balance of $7,679 was charged off. The bank’s customer contact log indicates that bank representatives had numerous conversations with the individual about the delinquent account. The individual’s credit report showed significant credit problems prior to the individual receiving the travel card. Bank of America notified the squadron that the individual had submitted several NSF checks to Bank of America. According to an Air Force official, the problems reported by the bank were especially disturbing because the individual was a trusted combat veteran with many years of service, who also functioned as the squadron’s APC. An Air Force investigation of the individual’s travel card abuses revealed that the individual (1) made approximately $6,000 in personal, nonauthorized charges, (2) submitted a $4,500 NSF check to the bank to boost the amount of available credit on his account to permit additional cash advances, and (3) unrelated to his travel card abuses, the individual also stole checks in the amount of $7,500 from the U.S. mail. The individual was court-martialed for travel card abuse and theft of U.S. mail and sentenced to 1 year in jail, reduced in pay grade to E-1, and discharged from the military for “financial difficulties.” Cardholder #4 was an airman (E-3) reservist assigned to March AFB, California, who was also a full-time DOD employee (GS-9) in a position involving similar work. Our analysis of Bank of America records showed that the individual obtained two travel card accounts during two different periods. The individual issued NSF checks and other checks to Bank of America on closed accounts in payment of both travel card accounts. The first account, which was opened in January 2000, was closed in February 2001 with an unpaid balance of $4,771 that was subsequently charged off. Air Force officials told us that the individual obtained the second account in October 2001 by having a different superior officer, who was unaware of the previous travel card account, sign the application for the new card. The individual fraudulently used a relative’s social security number to apply for the second travel card account. In payment of his second travel card account, the individual wrote seven checks to Bank of America, consisting of four NSF checks totaling $7,131, on an open bank account and three checks totaling $19,225 on a closed bank account. The cardholder used NSF checks to make large payments, which enabled him to boost his available balance and permit cash withdrawals from the account. An Air Force official stated he was unaware of the problem because the NSF checks masked the delinquency problem. The individual’s second travel card account was closed on June 3, 2002, and an unpaid balance of $12,665 was charged off. Bank of America’s customer contact log indicates that its representatives had numerous conversations with the individual about this account. The cardholder resigned his civilian DOD position and was charged with (1) identity theft related to the use of his relative’s social security number, (2) being absent without leave, (3) failure to participate in monthly training, and (4) financial irresponsibility related to personal use of the government card when not on military orders. The individual was in the process of being discharged from his military E-3 reservist position in October 2002. The individual’s credit report showed he had several credit problems, including bankruptcies and a charge-off prior to his receiving a government travel card. Cardholder #5 was a Virginia state employee assigned to the Air National Guard in Richmond, Virginia. Bank of America records showed that the individual’s account was opened on March 18, 1999. The individual wrote four NSF checks totaling $2,818 and stopped payment on two checks totaling $3,230 to Bank of America. The individual’s travel card account was closed on November 26, 2001, and an unpaid balance of $2,127 was charged off. The cardholder paid off the account on June 17, 2002. Bank of America records indicate that bank representatives had numerous conversations with the cardholder about this account. The individual’s credit report did not show any significant credit problems prior to issuance of the card. The current APC, who assumed that role in July 2001, determined the individual was delinquent on his government travel card account when he reviewed Bank of America delinquency reports. The APC referred the matter to the individual’s unit commander who subsequently counseled the individual on “multiple” occasions regarding the card’s use and delinquency. The APC told us that because the individual was a state employee and not a member of the Air National Guard, the individual was not eligible for the Air Force travel card and should not have been granted a card. We also found numerous examples of Air Force personnel misusing and abusing their government travel cards by making transactions that were clearly not for the purpose of government travel, similar to those we reported in our Army and Navy reports. As discussed further in appendix II, we used data mining procedures to identify transactions that we believed to be potentially fraudulent or abusive based upon the nature, amount, merchant, and other identifying characteristics of the transaction. As a result of these procedures, we found instances in which cardholders abused their travel cards by purchasing a wide variety of personal goods or services that were unrelated to official government travel. As shown in table 7, we were able to determine that during an 18-month period, Air Force cardholders charged approximately $31,000 to purchase admission to entertainment events, such as NFL football games and a Janet Jackson concert. We also identified travel card transactions totaling approximately $14,000 for gambling; $31,000 for cruise packages; and $32,000 coded as purchases at gentlemen’s clubs, which provide adult entertainment. The examples shown in table 7 include both instances where the cardholders paid their bills and where they did not. Our investigative work showed that gentlemen’s clubs were sometimes used to convert the travel card to cash by supplying cardholders with actual cash or “club cash” for a 10 percent fee. To illustrate, an Air Force employee that charged $440 to their government travel card at one of these clubs, would receive $400 in cash. Such charges are processed by the establishment’s merchant bank, and authorized by Bank of America, in part because the merchant category code (MCC),which identifies the nature of the transactions and is to be used by Bank of America to block improper purchases, are circumvented when the establishments reported the charges as restaurant, dining, or bar charges. Subsequently, the club would receive payment for a $440 restaurant charge. Examples of Travel Card Abuse We found cases where individuals used their travel cards for both official and personal reasons, but failed to pay their accounts, thereby resulting in accounts that were charged off and/or included in salary offset and fixed payment plans. Table 8 provides examples of those cases. The following examples include details of cases summarized in table 8. Cardholder #1 is a staff sergeant (E-5) in the Idaho Air National Guard who is employed full-time as a juvenile counselor at a county correctional facility. The cardholder told our investigators that from December 22, 2000, to February 19, 2001, his wife used his government travel card without his knowledge or consent. Bank of America records showed that transactions for the above period totaled over $13,000, of which over $10,000 was for on-line gambling charges and another $3,000 was for ATM withdrawals. There were also several credits to the cardholder’s account totaling over $5,000 from his wife’s gambling winnings. The cardholder’s wife admitted to a gambling addiction and to using their personal bank debit card and her husband’s government travel card to fund her addiction. Upon discovering his wife’s abusive use of his government travel card, the cardholder immediately briefed his commanding officer, who informed the APC, and the account was closed. The cardholder also contacted Bank of America to work out a payment plan for the debt but no agreement could be reached. As a result of his inability to pay the debt incurred by his wife, the cardholder filed for Chapter 7 bankruptcy. On September 3, 2001, Bank of America charged off an unpaid balance of $7,258 on the cardholder’s travel card account. To date, no criminal charges have been initiated against the cardholder’s now ex-wife. In researching this case, we noted that although DOD has requested that Bank of America block certain merchant category codes to help prevent improper travel card transactions, such as transactions for on- line gambling at www.PROCCY, merchants are able to circumvent such restrictions by assigning permissible merchant codes to otherwise improper transactions. For example, in this case, to mask gambling activity, the on-line gambling establishments with whom the cardholder’s wife dealt used the merchant category codes for “Miscellaneous and Specialty Retail Stores” and “Professional Services—Not Elsewhere Classified” instead of the merchant category code for “Betting—Including Lottery, Gaming Chips, Track Wagers.” However, these establishments credited the wife’s winnings to the cardholder’s account using the merchant category code for “Betting— Including Lottery, Gaming Chips, Track Wagers.” Active monitoring by the APC of ongoing travel card activity would have helped detect the problem transactions sooner. Cardholder #2 was a highly skilled technical sergeant (E-6) at Travis AFB, California, who held a secret clearance and worked on C-5 aircraft, large cargo aircraft designed for airlifting weapons and supplies. Our discussions with base officials and our review of the cardholder’s personnel file and credit report revealed that the cardholder had several credit card delinquencies prior to issuance of the travel card. In March 1998, prior to being assigned to Travis AFB, the cardholder had received an Article 15 for wrongfully using his American Express government travel card for personal gain and blaming the misuse of the travel card on another family member. In March 2001, when the individual transferred to Travis AFB, his new APC noted that the individual’s travel card account had a past due balance of $2,257. The APC reported this information to the cardholder’s unit commander. At that time, the account was suspended and Bank of America closed and canceled the cardholder’s account a week later. However, Travis AFB officials told us that they asked Bank of America to keep the individual’s travel card account open so that he could travel where necessary to make repairs to downed C-5 aircraft. The officials told us that the cardholder was one of a few experts who could supervise repairs on the C-5 aircraft. According to the officials, when problems arose with the aircraft, repairs had to be made immediately to get the plane back in the air. On April 16, 2001, the unit commander counseled the cardholder and gave him a letter of reprimand for nonpayment of his travel card bill. On June 25, 2001, the cardholder received another Article 15 for failure to pay his “Military Star Account” with the base Army and Air Force Exchange Service (AAFES) store. Both Article 15s and the letter of reprimand contained statements indicating that this behavior would not be tolerated. It is apparent that this statement on the documents did not deter the individual from being delinquent, nor did the officials abide by these statements. During the fall of 2001, Air Force investigators were notified that personal protective gear, including body armor and biochemical and biological protective masks, was missing from C-5s arriving in Afghanistan. The cardholder came under suspicion as one of a few individuals with access to C-5 aircraft. During the ensuing investigation involving the individual, his security badge was revoked and he had to be escorted to and from his worksite. Shortly thereafter, Air Force investigators videotaped the individual selling military protective gear in a town near the base, and the individual was arrested and charged with theft and sale of government property. Investigators determined that the individual was addicted to gambling and had used his government travel card reimbursements and the proceeds from the sale of stolen government property to finance his gambling habit. In January 2002, the individual was court-martialed, and in March 2002, he was convicted of theft and sale of $50,000 in government property and was dishonorably discharged. He was sentenced to a 5-year jail term. Air Force investigative and legal officials told us that the individual’s failure to pay his travel card debt was considered in the sentencing decision. If Travis AFB officials had acted sooner to cancel the technical sergeant’s travel card account, revoke his security clearance, and discharge him from the service, they may have prevented the theft of critical protective gear needed by troops deployed in Afghanistan. Further, we found examples where individuals used their government travel cards for personal use on purchases of items, such as computers, entertainment, college tuition, and jewelry, but kept their accounts current by paying their travel card bills in a timely manner. We considered these purchases to be abusive travel card activity because the travel card may only be used for official government travel expenses. Personal use of the travel card may increase the risk of charge-offs, which are costly to the government and the taxpayer. In addition, instances of personal use are indicative of internal control breakdowns, such as the failure of the APCs to monitor travel card activities. Table 9 provides details on 10 cases where the cardholders made personal purchases but paid their accounts. The instances illustrated in this report clearly represent abusive use of the government travel card. Air Force personnel are informed that these types of transactions are not permitted. All Air Force cardholders are required to sign a statement of understanding that the card is to be used only for authorized official government travel expenses. Air Force policy provides commanders with a wide variety of disciplinary options for addressing misconduct by service members. The means of discipline include counseling, oral and written reprimands, creating an unfavorable information file, issuing Article 15s, and court-martial. The policy leaves the means of discipline and the actual punishment to the discretion of the individual commander based upon the facts of each case. However, for the cases involving 58 cardholders whose accounts involved NSF checks, charge-offs, or salary offsets, we found documented evidence of disciplinary actions in only 19 cases. Our analysis of cases where travel card accounts had been charged off, were in salary offset, or involved NSF checks showed that when the Air Force took disciplinary actions, those actions ranged from counseling to court-martial and discharge from the service. In certain cases where documentation of disciplinary actions was not available, Air Force officials told us that verbal counseling had been provided, but was not documented. In other cases where documentation was not available, Air Force officials claimed that disciplinary actions had been taken, but records had not been retained because the individuals had transferred or left the service. At Hill AFB, most of the cases we reviewed involved civilians. Air Force Instruction 36-704, Discipline and Adverse Actions, provides guidance on disciplinary action for civilians who fail to honor valid debts or legal obligations. However, the guidelines limit disciplinary action to reprimands, even after the third offense. In addition, we found that 32 of the 58 most severe abusers of the travel card still had secret or top secret clearances in August 2002. According to Air Force Instruction 31-501, Personnel Security Program Management, military units are responsible for maintaining unfavorable information files on individuals, and are supposed to notify the central security facility of instances of financial irresponsibility or other behavioral problems that may affect an individual’s security clearance. However, we determined that the Air Force does not have consistent procedures in place to link travel card account delinquencies or charge-off status to an individual’s security clearance. Some of the Air Force personnel holding security clearances who have had difficulty paying their travel card bills may present security risks to the Air Force. We have referred the names of these individuals to the Air Force Central Adjudication Facility for appropriate evaluation. Linking disciplinary actions and security clearances to misuse of travel cards was recently addressed by the fiscal year 2003 Defense Appropriations Act. In addition to requiring the Secretary of Defense to establish guidance and procedures for disciplinary actions, section 8149(c) of the act states that such actions may include (1) review of the security clearance of the cardholders in cases of misuse of the government travel card, and (2) modification or revocation of the security clearance in light of such review. Since March 2002, DOD and the Air Force have taken additional actions to reduce delinquencies in the travel card program. For example, the DOD Comptroller established a Charge Card Task Force to address management issues related to DOD’s purchase and travel card programs. The task force issued its final report on June 27, 2002, which called for additional actions to improve the controls over the travel card program. However, to date, many of the actions that DOD has taken primarily address the symptoms rather than the underlying causes of the problems with the program. Specifically, actions to date have focused on dealing with accounts that are seriously delinquent, which are “back end” or detective controls rather than preventive controls. On September 27, 2002, the Air Force Assistant Secretary for Financial Management (Comptroller) issued a memorandum emphasizing travel card management tools and policy updates to assist local commanders in the detection of travel card misuse. Specifically, the memorandum (1) directed that travel cards that have had no activity within the last 12 months be canceled, (2) emphasized that program coordinators should use new EAGLS exception reports to help identify suspicious card activity that may indicate abuse or potential delinquency problems before they appear on delinquency reports, and (3) noted that the Air Force is conducting a thorough review of MCCs to ensure that cards cannot be used at establishments that are not travel related. In addition, Air Force officials told us they also are considering contracting for data mining services to support their oversight of the travel card program. The Congress has recently addressed several of the key issues we identified in our Army and Navy work. Section 8149(b) of the Department of Defense Appropriations Act, 2003, requires creditworthiness evaluations of all potential cardholders and guidelines and procedures for disciplining individuals for fraudulent and abusive use of government travel cards. Further, section 1008(a) and (b) of the Bob Stump National Defense Authorization Act for Fiscal Year 2003 provides authority for the Secretary of Defense to require (1) use of the split disbursement process, where any part of a DOD employee’s or service member’s travel reimbursement is paid directly to the travel card-issuing bank, and (2) deductions of prescribed amounts from salary and retirement pay of DOD employees or service members who have delinquent travel card balances and payment of those amounts to the travel card-issuing bank. The intent of the travel card program was to improve convenience for the traveler and to reduce the government’s costs of administering travel. Since implementation of the travel card as part of its travel program, the Air Force changed its management strategies to oversee the use of government travel cards. What once was a weak internal control environment in the travel program has been strengthened, resulting in a decrease in delinquency rates and charge-offs of bad debts. Despite these efforts, the Air Force continues to experience potentially fraudulent and abusive travel card activity. Air Force and DOD actions addressed many areas in the program needing improvements. However, DOD and the Air Force will need to implement further improvements to more effectively prevent potentially fraudulent and abusive activity and further reduce severe credit problems associated with the travel card. A focus on additional “front-end” or preventive controls will be paramount. In this regard, section 8149(c) of the fiscal year 2003 DOD Appropriations Act requires creditworthiness evaluations of all potential cardholders and guidelines and procedures for disciplining individuals for fraudulent and abusive use of government charge cards. To strengthen the overall control environment and improve internal control for the Air Force’s travel card program, we recommend that the Secretary of the Air Force take the following actions. We also recommend that the Under Secretary of Defense (Comptroller) assess the following recommendations and, where applicable, incorporate them into or supplement the DOD Charge Card Task Force recommendations to improve travel card policies and procedures throughout DOD. We recommend that the Secretary of the Air Force establish specific policies and procedures governing the issuance of individual travel cards to military and civilian employees, including the following. In accordance with recently enacted legislation, provide individuals who have no prior credit histories “restricted” travel cards with low credit and ATM limits. Develop procedures to periodically evaluate the frequency of cardholders’ travel card use and close accounts of infrequent travelers in order to minimize exposure to fraud and abuse. In conjunction with the periodic reviews, cancel accounts for current infrequent travelers as noted in the Charge Card Task Force report. Evaluate the feasibility of activating and deactivating travel cards, regardless of whether they are standard or restricted cards, so that they are available for use only during the period authorized by the cardholders’ travel orders. At a minimum, this policy should focus on controlling travel card use by “high-risk” enlisted military personnel in the E-1 to E-6 grades. Develop comprehensive, consistent Air Force-wide initial training and periodic refresher training for travel cardholders that focuses on the purpose of the program and appropriate uses of the card. The training should emphasize the prohibitions on personal use of the card, including gambling, personal travel, and adult entertainment. Such training should also address the policies and procedures of the travel order, voucher, and payment processes. For entry-level personnel, the training should also include information on basic personal financial management techniques to help avoid financial problems that could affect an individual’s ability to pay his or her travel card bill. We recommend that the Secretary of the Air Force establish the following specific policies and procedures to strengthen controls to address improper use of the travel card. Establish guidance regarding the knowledge, skills, and abilities required to carry out APC responsibilities effectively. Establish guidance on APC span of control responsibilities so that such responsibilities are properly aligned with time available to ensure effective performance. Determine whether certain APC positions should be staffed on a full-time basis rather than as collateral duties. Establish Air Force-wide procedures to provide assurance that APCs receive training on their APC responsibilities, including requirements for monitoring cardholders’ travel card use. The training should include how to use EAGLS transaction reports and other available data to monitor cardholder use of the travel card—for example, reviewing account transactional histories to ascertain whether transactions are incurred during periods of authorized travel and appear to be appropriate travel expenses and are from approved MCCs. Require agency program coordinators to review EAGLS reports to identify cardholders who have written NSF checks for payment on their account balances and refer this data to the employee’s immediate supervisor. Review, in conjunction with Bank of America, APC-level access to EAGLS to limit such access to only those individuals with current APC duties. Establish Air Force procedures detailing how APCs should carry out their responsibility to monitor travel card use for all cardholders assigned to them. Include in the procedures the development of a data mining program that would enable APCs to easily identify potentially inappropriate transactions for further review. Enforce controls for canceling accounts after employees transfer to other units to avoid “orphan” accounts that are not subject to effective management oversight. Require cognizant APCs to retain records documenting any cardholder’s fraudulent or abusive use of the travel card and require that this information be provided to the gaining APC when the cardholder is transferred. Review records of individuals whose accounts had been charged off or placed in salary offset to determine whether they have been referred to Air Force Central Adjudication Facility for a security review. Strengthen procedures regarding employees leaving the service to assure that all travel card accounts are deactivated or closed and that repayment of any outstanding debts is arranged. Perform a review to determine that these procedures are implemented effectively and that accounts of departed cardholders are deactivated or closed in a timely manner. Develop procedures to identify active cards of departed cardholders, including comparing cardholder and payroll data. In oral comments on a draft of this report, DOD and the Air Force concurred on all 16 of our recommendations and stated that it had taken actions or had actions underway to address many of them. For example, with respect to actions completed, DOD stated that the Air Force recently implemented procedures to (1) evaluate the frequency of cardholder travel card use and close travel card accounts that were not used in the past year and (2) work with Bank of America to perform semi-annual reviews of travel card use. With respect to actions underway, (1) the Air Force has started a project to evaluate the feasibility of deactivating travel cards so that they are available for use only during periods of authorized travel and (2) DOD is evaluating travel card training and developing revised policy requirements for APC span of control and travel card management responsibilities. As agreed with your offices, unless you announce the contents of this report earlier, we will not distribute this report until 30 days from its date. At that time, we will send copies to interested congressional committees; the Secretary of Defense; the Under Secretary of Defense (Comptroller); the Secretary of the Air Force; the Assistant Secretary of the Air Force for Financial Management (Comptroller); the Director of the Defense Finance and Accounting Service; and the Director of the Office of Management and Budget. We will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Please contact Gregory D. Kutz at (202) 512-9505 or kutzg@gao.gov, John J. Ryan at (202) 512-9587 or ryanj@gao.gov, or Gayle L. Fischer at (202) 512- 9577 or fischerg@gao.gov, if you or your staffs have any questions concerning this report. Major contributors to this report are acknowledged in appendix V. In 1983, the General Services Administration (GSA) awarded a governmentwide master contract with a private company to provide government-sponsored, contractor-issued travel cards to federal employees to be used to pay for costs incurred on official business travel. The intent of the travel card program was to provide increased convenience to the traveler and lower the government’s cost of travel by reducing the need for cash advances to the traveler and the administrative workload associated with processing and reconciling travel advances. The travel card program includes both individually billed accounts—accounts held and paid by individual cardholders—and centrally billed accounts that are used to purchase transportation or are used for the travel expenses of a unit and are paid directly by the government. As of the end of fiscal year 2001, over 2.1 million individually billed travel cards were issued to federal government travelers. These travel cardholders charged $3.6 billion during the same fiscal year. Under the current GSA master contract, the Department of Defense entered into a tailored task order with Bank of America to provide travel card services to DOD and the military services, including the Air Force. Table 10 provides the number of individually billed travel cards outstanding and related dollar amount of travel card charges by DOD and its components in relation to the total federal government. As shown in table 10, DOD accounts for about 1.4 million, or 66 percent, of the total number of the individually billed travel cards issued by the entire federal government, and DOD’s cardholders charged about $2.1 billion, or about 59 percent of the federal government’s travel card charges during fiscal year 2001. Table 10 also shows that the Air Force provided 501,306 individually billed cards to its civilian and military employees as of September 2001. These cardholders charged an estimated $831 million to their travel cards during fiscal year 2001. The Travel and Transportation Reform Act of 1998 (Public Law 105-264) expanded the use of government travel cards by mandating the use of the cards for all official travel unless specifically exempted. The act is intended to reduce the overall cost of travel to the federal government through reduced administrative costs and by taking advantage of rebates from the travel card contractor. The act requires that agencies reimburse cardholders for proper travel claims within 30 days of submission of approved travel vouchers by the cardholders. Further, the act allows, but does not require, agencies to offset a cardholder’s pay for amounts the cardholder owes to the travel card contractor as a result of travel card delinquencies not disputed by the cardholder. The act calls for GSA to issue regulations incorporating the requirements of the act. GSA incorporated the act’s requirements into the Federal Travel Regulation. The Federal Travel Regulation governs travel and transportation and relocation allowances for all federal government employees, including overall policies and procedures governing the use of government travel cards. Agencies are required to follow the requirements of GSA’s Federal Travel Regulation, but can augment these regulations with their own implementing regulations. DOD issued its Financial Management Regulation (FMR), Volume 9, Chapter 3, “Travel Policies and Procedures,” to supplement GSA’s travel regulations. DOD’s Joint Travel Regulations, Volume 1, “Uniformed Service Members,” and Volume 2, “Civilian Personnel,” refer to the FMR as the controlling regulation for DOD’s travel cards. As shown in figure 7, the Air Force’s travel card management program for individually billed travel card accounts encompasses card issuance, travel authorization, cardholders charging goods and services on their travel cards, travel voucher processing and payment, and managing travel card usage and delinquencies. When an Air Force civilian or military employee or the employee’s supervisor determines that he or she will need a travel card, the employee contacts the unit’s travel card agency program coordinator (APC) to complete an individually billed card account application form. As shown in figure 8, the application requires the applicant to provide pertinent information, including full name and social security number, and indicate whether he or she is an active, reserve, or a civilian employee of the Air Force. The applicant is also required to initial a statement on the application acknowledging that he or she has read and understands the terms of the travel card agreement and agrees to be bound by these terms, including a provision acknowledging that the card will be used only for official travel. The APC is required to complete the portion of the member’s application concerning who will be responsible for managing the use and delinquencies related to the card. Bank of America is required to issue a travel card to all applicants for whom it receives completed applications signed by the applicants, the applicants’ supervisors, and the APCs. Bank of America issues travel cards with either a standard or restricted credit limit. If an employee has little or no credit history or poor credit based on a credit check performed by Bank of America, Bank of America may suggest to the service that the applicant receive a restricted credit limit of $2,000 instead of the standard credit limit of $5,000. However, as shown in figure 8, the application allows the employee to withhold permission for Bank of America to obtain credit reports. If this option is selected, Bank of America automatically issues a restricted credit limit card to the applicant. Before cardholders leave the Air Force, they are required to contact their APCs and notify them of their planned departure. Based on this notification from the cardholders, the APCs are to deactivate or terminate the cardholders’ accounts. When a cardholder is required to travel for official government purposes, he or she is issued a travel order authorizing travel. The travel order is required to specify the timing and purpose of the travel authorized. For example, the travel order is to authorize the mode of transportation, the duration and points of the travel, and the amounts of per diem and any cash advances. Further, the Air Force can limit the amount of authorized reimbursement to military members based on the availability of lodging and dining facilities at military installations. For authorized travel, travelers must use their cards to pay for allowable expenses such as hotels, rental cars, and airfare. The travel card can also be used for meals and incidental expenses or cash can be obtained from an automatic teller machine. When the travel card is submitted to a merchant, the merchant will process the charge through its banking institution, which in turn charges Bank of America. At the end of each banking cycle (once each month), Bank of America prepares a billing statement that is mailed to the cardholder for the amounts charged to the card. The statement also reflects all payments and credits made to the cardholder’s account. Bank of America requires that the cardholder make payment on the account in full within 30 days of the statement closing date. If the cardholder does not pay his or her monthly billing statement in full, and does not dispute the charges within 60 days of the statement closing date, the account is considered delinquent. Within 5 duty days of return from travel, the cardholder is required to submit a travel voucher claiming legitimate and allowable expenses incurred while on travel. Further, the standard is for the cardholder to submit an interim voucher every 30 days for extended travel of more than 45 days. The amount that cardholders are reimbursed for their meals and incidental expenses and hotels is limited by geographical rates established by GSA. Upon submission of a proper voucher by the cardholder, DOD has 30 days in which to make reimbursement without incurring late payment fees. Cardholders are required to submit their travel vouchers to their supervisors or other designated approving officials who must review the vouchers and approve them for payment. If the review finds an omission or error in a voucher or its required supporting documentation, the approving official must inform the traveler of the error or omission. After the supervisor approves a cardholder’s travel voucher package for payment, the voucher-processing unit at the location to which the cardholder is assigned processes it. The voucher-processing unit enters travel information from the approved voucher into DOD’s Integrated Automated Travel System (IATS). IATS calculates the amount of per diem authorized in the travel order and voucher and the amount of mileage, if any, claimed by the cardholder. In addition, any other expenses claimed and approved are entered into IATS. If problems with the voucher are found during the initial entry of the information into IATS or during audits after the initial entry, the voucher can be rejected and returned to the cardholder for correction. Once the vouchers are processed and possibly audited, they are sent to DFAS for payment to the cardholder or to Bank of America and the cardholder, if the cardholder elected to use the split disbursement payment process whereby part of the reimbursement is sent directly to Bank of America. If the payment of the approved proper voucher takes longer than 30 days, DOD is required to pay the cardholder a late payment fee plus an amount equal to the amount Bank of America would have been entitled to charge the cardholder had the cardholder not paid the bill by the due date. In addition to controlling the issuance and credit limits related to the travel card, APCs are also responsible for monitoring the use of and delinquencies related to travel card accounts for which they have been assigned management responsibility. Bank of America’s Web-based Electronic Account Government Ledger System (EAGLS) provides on-line tools that are intended to assist APCs in monitoring travel card activity and related delinquencies. Specifically, APCs can access EAGLS to monitor and extract reports on their cardholders’ travel card transaction activity and related payment histories. Both the Air Force and Bank of America have a role in managing travel card delinquencies under GSA’s master contract. While APCs are responsible for monitoring cardholders’ accounts and for working with cardholders’ supervisors to address any travel card payment delinquencies, Bank of America is required to use EAGLS to notify the designated APCs if any of their cardholders’ accounts are in danger of suspension or cancellation. When Bank of America has not received a required payment on any travel cardholder’s account within 60 days of the billing statement closing date, it is considered delinquent. As summarized in figure 9, there are specific actions required by both the Air Force and Bank of America based on the number of days a cardholder’s account is past due. The following is a more detailed explanation of the required actions by the Air Force and/or Bank of America with respect to delinquent travel card accounts. 45 days past due—Bank of America is to send a letter to the cardholder requesting payment. Bank of America has the option to call the cardholder with a reminder that payment is past due and to advise the cardholder that the account will be suspended if it becomes 60 days past due. 55 days past due—Bank of America is to send the cardholder a presuspension letter warning that Bank of America will suspend the account if it is not paid. If Bank of America suspends a travel card account, the card cannot be used until the account is paid. 60 days past due—The APC is to issue a 60-day delinquency notification memorandum to the cardholder and to the cardholder’s immediate supervisor, informing them that the cardholder’s account has been suspended due to nonpayment. The next day, a suspension letter is to be sent by Bank of America to the cardholder providing notice that the card has been suspended until payment is received. 75 days past due—Bank of America is to assess the account a late fee. The late fee charged by Bank of America was $20 through August 9, 2001. Effective August 10, 2001, Bank of America increased the late fee to $29 under the terms of the contract modification between Bank of America and DOD. Bank of America is allowed to assess an additional late fee every 30 days until the account is made current or charged off. 90 days past due—The APC is to issue a 90-day delinquency notification memorandum to the cardholder, the cardholder’s immediate supervisor, and the company commander (or unit director). The company commander is to initiate an investigation into the delinquency and take appropriate action, at the company commander’s discretion. At the same time, Bank of America is to send a “due process letter” to the cardholder providing notice that the account will be canceled if payment is not received within 30 days unless he or she enters into a payment plan, disputes charge(s) in question, or declares bankruptcy. 120 days past due—The APC is to issue a 120-day delinquency notification memorandum to the cardholder’s commanding officer. At 126 days past due, the account is to be canceled by Bank of America. Beginning in October 2001, once accounts were 120 days past due, Bank of America began sending files to DFAS listing these accounts for salary offset. 150 days past due—The point at which DFAS generally initiates action for salary offset. 180 days past due—Bank of America is to send a “precharge-off” or last call letter to the cardholder informing him or her that Bank of America will charge-off the account and report the cardholder to a credit bureau if payment is not received. A credit bureau is a service that reports the credit history of an individual. Banks and other businesses assess the credit-worthiness of an individual using credit bureau reports. 210 days past due—Bank of America is to charge off the delinquent account and, if the balance is $50 or greater, report it to a credit bureau. Some accounts are pursued for collection by Bank of America’s recovery department; others are sent to attorneys or collection agencies for recovery. The delinquency management process can be suspended when a cardholder’s APC informs Bank of America that the cardholder is on official travel and is unable to submit vouchers and pay his or her account in a timely manner, through no fault of his or her own. Under such circumstances, the APC is to notify the Bank of America that the cardholder is in “mission-critical” status. By activating this status, the Bank of America is precluded from identifying the cardholder’s account as delinquent until 45 days after such time as the APC determines the cardholder is to be removed from mission-critical status. According to Bank of America, approximately 800 to 1,000 cardholders throughout DOD were in this status at any given time throughout fiscal year 2001. Pursuant to a joint request by the Chairman and Ranking Minority Member of the Subcommittee on Government Efficiency, Financial Management and Intergovernmental Relations, House Committee on Government Reform, and the Ranking Minority Member of the Senate Committee on Finance, we audited the controls over the issuance, use, and monitoring of individually billed travel card accounts and associated travel processing and management for the Department of the Air Force. Our assessment covered the reported magnitude and impact of delinquent and charged off Air Force travel card accounts for fiscal year 2001 and the first 6 months of fiscal year 2002, along with an analysis of causes and related corrective actions; an analysis of the universe of Air Force travel card transactions during fiscal year 2001 and the first 6 months of fiscal year 2002 to identify potentially fraudulent and abusive activity related to the travel card; the Air Force overall management control environment and the design of selected Air Force travel program management controls, including controls over (1) travel card issuance, (2) agency program coordinators (APC) capacity to carry out assigned duties, (3) limiting card activation to meet travel needs, (4) transferred and “orphan” accounts, (5) procedures for terminating accounts when cardholders leave military service, and (6) access to Bank of America’s travel card database; and tests of statistical samples of transactions to assess the implementation of key management controls and processes for three Air Force units’ travel card activity including (1) travel order approval, (2) accuracy of travel voucher payments, (3) the timely submission of travel vouchers by travelers to the approving officials, and (4) the timely processing and reimbursement of travel vouchers by the Air Force and DOD. We used as our primary criteria applicable laws and regulations, including the Travel and Transportation Reform Act of 1998 (Public Law 105-264), the General Services Administration’s (GSA) Federal Travel Regulation, and the Department of Defense (DOD) Financial Management Regulation, Volume 9, “Travel Policies and Procedures.” We also used as criteria our Standards for Internal Control in Federal Government and our Guide to Evaluating and Testing Controls Over Sensitive Payments. To assess the management control environment, we applied the fundamental concepts and standards in our internal control standards to the practices followed by management in the six areas reviewed. To assess the magnitude and impact of delinquent and charged-off accounts, we compared the Air Force’s delinquency and charge-off rates to those of other DOD services and federal civilian agencies. We also analyzed the trends in the delinquency and charge-off data from the third quarter of fiscal year 2000 through the first half of fiscal year 2002. In addition, we used data mining to select Air Force units for audit and identify individually billed travel card transactions for further analysis. Our data mining procedures covered the universe of individually billed Air Force travel card activity during fiscal year 2001 and the first six months of fiscal year 2002 and identified transactions that we believed were potentially fraudulent or abusive. However, our work was not designed to identify, and we did not determine, the extent of any potentially fraudulent or abusive activity related to the travel card. In performing our data mining, we obtained and analyzed information on travel card account status and credit history, security clearance, and disciplinary action. To assess the overall control environment for the travel card program at the Department of the Air Force, we obtained an understanding of the travel process, including travel card management and oversight, by interviewing officials from the Office of the Undersecretary of Defense, Comptroller; Department of the Air Force; Defense Finance and Accounting Service (DFAS); Bank of America; and GSA. We reviewed applicable policies, procedures, and program guidance they provided. We visited three Air Force units to “walk through” the travel process, including the management of travel card use and delinquency. Further, we contacted one of the three largest U.S. credit bureaus to obtain credit history data and information on how credit-scoring models are developed and used by the credit industry for credit reporting. At each of the Air Force locations we audited we also used our review of policies and procedures and the results of our “walk-throughs” of travel processes and other observations to assess the effectiveness of controls over segregation of duties among persons responsible for issuing travel orders, preparing travel vouchers, processing and approving travel vouchers, and certifying travel voucher payments. We performed a limited review of access controls for travel voucher processing at our three case study locations. We did not assess electronic signature controls over the electronic data processing of Air Force travel card transactions. We also reviewed computer system access controls for the Electronic Account Government Ledger System (EAGLS)—the system used by Bank of America to maintain DOD travel card data. To determine whether access controls for EAGLS were effective, we interviewed Bank of America officials and observed EAGLS functions and capabilities. To test the implementation of key controls over individually billed Air Force travel card transactions processed through the travel system— including the travel order, travel voucher, and payment processes—we obtained and used the Bank of America database of fiscal year 2001 Air Force travel card transactions to review random samples of transactions at three Air Force locations. Because our objective was to test controls over travel card expenses, we excluded credits and miscellaneous debits (such as fees) from the population of transactions used to select random samples of travel card transactions to review at each of three Air Force units we audited. Each sampled transaction was subsequently weighted in the analysis to account statistically for all charged transactions at each of the three units, including those that were not selected. We did not verify the accuracy of the data in the Air Force travel card database. We selected three Air Force case study locations for testing controls over travel card activity by first selecting three large commands based on the number of travel card accounts, outstanding balances, and delinquencies. The three commands we selected accounted for about 38 percent of the total number of Air Force travel card accounts, 41 percent of the outstanding balance of travel card charges, and about 33 percent of the travel card delinquencies. We selected one installation from each of these commands for detailed testing based on the volume of travel card activity and delinquencies. Table 11 presents the sites selected and the number of fiscal year 2001 transactions at each location. We performed tests on statistical samples of travel card transactions at each of the three case study sites to assess whether the system of internal controls over the transactions was effective, as well as to provide an estimate of the percentage of transactions by unit that were not for official government travel. For each transaction in our statistical sample, we assessed whether (1) there was an approved travel order prior to the trip, (2) the travel voucher payment was accurate, (3) the travel voucher was submitted within 5 days of the completion of travel, and (4) the travel voucher was paid within 30 days of submission of an approved travel voucher. We considered transactions not related to authorized travel to be abuse and incurred for personal purposes. Although we projected the results of our samples of these control attributes, as well as the estimate for personal use—or abuse—related to travel card activity to the population of transactions at the respective case study locations, the results cannot be projected to the population of Air Force transactions or the installations as a whole. Tables 12 through 15 show (1) the results of our tests of key control attributes, (2) the point estimates of the failure rates for the attributes, (3) the two-sided 95 percent confidence intervals for the failure rates for each attribute, (4) our assessments of the effectiveness of the controls, and (5) the relevant lower and upper bounds of a one-sided confidence interval for the failure rate. All percentages in these tables are rounded to the nearest percentage point. We use one-sided confidence bounds to classify the effectiveness of a control activity. If the 1-sided lower bound does not exceed 5 percent, then the control activity is effective. If the 1-sided lower bound exceeds 10 percent, then the control is ineffective. Otherwise, we say that the control is partially effective. Partially effective controls may include those for which there is not enough evidence to assert either effectiveness or ineffectiveness. For example, if we were 95 percent confident that the 1-sided lower bound of a failure rate for a particular control is 3 percent, we would categorize that control activity as “effective” because 3 percent is less than the 5 percent standard. Similarly, if we were 95 percent confident that the 1-sided upper bound of a failure rate for a particular control is 72 percent, we would categorize that control as “ineffective” because 72 percent is greater than the 10 percent standard. Table 12 shows the results of our test of the key control related to the authorization of travel—approved travel orders were prepared prior to dates of travel. Table 13 shows the results of our test for effectiveness of controls in place over the accuracy of travel voucher payments. Our test work included determining whether (1) the travel voucher information was consistent with dates and locations of travel authorized on the related travel order, (2) per diem was paid in the proper amount, and (3) transactions for lodging, air fare, and other expenses over $75 were supported by required receipts. Table 14 shows the results of our tests of key controls related to timely processing of claims for reimbursement of expenses related to government travel—timely submission of the travel voucher by the employee. Table 15 shows the results of our tests of key controls related to timely processing of claims for reimbursement of expenses related to government travel—timely travel voucher approval and payment processing. To determine if cardholders were reimbursed within 30 days, we used the DFAS payment dates. We did not independently validate the accuracy of these reported payment dates. We briefed DOD managers, including DFAS officials in DOD’s Office of the Under Secretary of Defense (Comptroller) and Air Force officials in the office of the Assistant Secretary of the Air Force (Financial Management and Comptroller); and unit commanders; comptrollers; and installation agency program coordinators on the details of our audit, including our findings and their implications. On November 26, 2002, we requested comments on a draft of this report. We received oral comments on December 17, 2002, and have summarized those comments in the “Agency Comments and Our Evaluation” section of this report. We conducted our audit work from January 2002 through mid-November 2002 in accordance with U.S. generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. Table 16 shows the travel card delinquency rates for Air Force’s major commands (and other Air Force organizational units at a comparable level) that had outstanding balances over $1 million during the 2-year period ending March 31, 2002. Commands with a March 31, 2002, balance outstanding under $1 million have been combined into “all other commands.” The Air Force’s commands and other units are listed in descending order based on their respective delinquency rates as of March 31, 2002. Table 17 shows outstanding balances and delinquency rates by major command listed in descending order of outstanding balances as of March 31, 2002. Tables 18 and 19 show the grade, rank (where relevant), and the associated basic pay rates for 2001 for Air Force’s military and civilian personnel. The basic 2001 pay rates shown exclude other considerations such as locality pay and any allowances for housing or cost of living. Staff making key contributions to this report include: Mario L. Artesiano, Paul S. Begnaud, Bertram J. Berlin, Fannie M. Bivins, Francine M. DelVecchio, Donald H. Fulwider, C. Robin Hodge, Woodward H. Hunt, Jeffrey A. Jacobson, Jr., Jonathan T. Meyer, Sue Piyapongroj, John R. Ryan, Sidney H. Schwartz, Robert A. Sharpe, Bennet E. Severson, and Lisa M. Warde. The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO Mailing Lists” under “Order GAO Products” heading.

Summary: Poor oversight and management of the Department of Defense (DOD) travel card program has led to high delinquency rates costing DOD millions in lost rebates and increased ATM fees. As a result, Congress asked GAO to report on (1) the magnitude, impact, and cause of delinquencies, (2) the types of fraudulent and abusive uses of travel cards, and (3) the effectiveness of internal controls over DOD's travel card program. GAO previously reported on travel card management at the Air Force. Air Force management has reduced travel card delinquencies through greater command attention and the use of travel card audits to identify problems and needed corrective actions. As of March 2002, the Air Force delinquency rate on average was about 5 percentage points lower than the rest of DOD and 1 percentage point higher than the federal civilian agencies. The Air Force's overall delinquency and charge-off problems were primarily associated with lower paid, low- to midlevel enlisted military personnel. Despite these improvements, a weak control environment contributed to significant abuse and potential fraud. For example, many of the problem cases identified were due to ineffective controls over the issuance and cancellation of travel cards and weaknesses in the assignment and training of agency program coordinators. During the period of our review, over 400 Air Force cardholders committed potential bank fraud by writing three or more nonsufficient fund (NSF) checks to Bank of America. Also, many cardholders used their cards for inappropriate purchases, such as cruises and event tickets. A significant relationship also existed between potential travel card fraud, abuse, and delinquencies and individuals with substantial credit history problems. Some cardholders had personal accounts placed in collection while others had filed bankruptcies prior to receiving government travel cards. Also, the issuance of the travel cards to virtually everyone who applied for them compounded these problems. GAO found documented evidence of disciplinary actions in less than half of the cases reviewed where cardholders wrote NSF checks, or their accounts were charged off or placed in salary offset. GAO also found that over half of the cases reviewed involved individuals who still had secret or top-secret security clearances. Other control weaknesses related to the Air Force's failure to provide the necessary agency program coordinator training, and infrequent or nonexistent monitoring of travel card activities. The recently enacted fiscal year 2003 Defense appropriations and authorization acts require the Secretary of Defense to establish guidelines and procedures for disciplinary actions and to deny issuance of travel cards to individuals who are not creditworthy.