The military services and DOD have long procured and operated multiple types of telecommunication services to meet their individual mission needs. DOD guidance defines telecommunications as circuits or equipment used to transmit or receive information via voice, data, video, integrated telecommunication transmission, wire, or radio. Telecommunication equipment and services collectively include such items as telephones, switching systems and circuit termination equipment. Overall, telecommunications can be thought of broadly in two categories— base and long-haul telecommunications. Also, DOD has been using and paying for some special category types of services—cell phones and calling cards—that can usually be used to access either the base or long-haul infrastructure or both. DOD defines base telecommunications as facilities, equipment, and services used to support the distribution, transmission, or reception of information via voice, data, video, integrated telecommunications, wire, or radio within the confines of an area, such as an installation. This may include local interconnecting lines to the first commercial central office providing service to the local community and to other DOD component facilities in the local area. Calls originating and ending within the local calling area are considered local service calls and activities pay a flat monthly fee for such service. The fee that is paid to vendors is based upon the number of circuits billed and not the number of calls made. DISA does not have direct responsibility for acquiring and managing base telecommunication equipment and services, although it does have some oversight responsibilities. Long-haul telecommunications are the facilities, equipment, and services (in addition to those described for base telecommunications) that are used for the transmission or receipt of information that crosses the boundary of a facility’s local calling community. DOD service components are required to contract for their long-haul services through DITCO, DISA’s contracting organization. DITCO charges the components the actual costs for the services it provides them, plus a surcharge (which is currently 2 percent) to cover DITCO’s cost of administering the program. Cell phones allow DOD personnel, including Navy personnel, to make official calls when other alternatives are unavailable or are uneconomical. They can be used to access a local as well as a long-distance network, but it is generally more economical to use other service for local service, when possible. Navy activities generally either contract directly for cellular phone service or procure the phones under an already established GSA negotiated contract. Vendors normally offer various service plan packages to their customers with a range of rates, depending on the types of service and options provided. Items that can cause rates to vary are geographical location, the user’s calling area, and the number of telephones requested. Cellular phones differ from conventional telephone systems in the way charges for calls accrue. For cellular phones, activities are usually charged a fixed fee for a specific plan package, which includes a limited number of available minutes. After using all of the available minutes in a month, activities then pay a per-minute charge for any excess minutes, not included in the contracted amount. When callers exceed the number of minutes allowed in the plan package, they generally pay a very high premium per minute for the minutes in excess of the plan. Generally, charges for cellular phone services include (1) charges for airtime for all completed outgoing and incoming calls and (2) charges (known as roaming charges) for calls made when the caller is outside his or her home service area. In addition, cellular phones may incur long-distance charges for calls made where the number called is outside the local area in which the caller is physically located or if this service is not included in the service contract. Calling cards are used to access telecommunication services at a location where DOD-owned services are unavailable or where it is desired that the calls be charged to an account other than the one from which the calls are being made. Navy calling cards are issued to individual Navy employees for their official use in conducting government business. The card provides the user with access to the Federal Telecommunications System (FTS) and offers a variety of available services. Navy activities generally procure the calling cards through DITCO in bulk and they are stored by the activities until issued. DITCO obtains the calling cards through a prenegotiated GSA contract. The cards incur no charges until issued and activated. The Navy activities are responsible for issuing the cards to individuals and the individuals activate the cards. Once issued, the activities are responsible for reviewing and certifying the calling card charges, just as they are for all other types of telecommunication service charges. DOD and its components have long acquired telecommunication systems to meet their individual mission needs, resulting in a fragmented and redundant telecommunication environment. To eliminate costly duplication and improve the effectiveness and efficiency of its communication services, in 1991 DOD began to plan and implement the Defense Information Systems Network (DISN) as the common-user, long­ haul telecommunication network for all DOD components. Under the DISN program, DOD’s service components and Defense agencies are still responsible for acquiring local base telecommunication services for their local bases and installations; however, DISA is to be the sole provider of long-haul telecommunication services for all DOD components. To improve the interoperability of DOD’s long-haul telecommunication networks and service as well as to reduce costs, the Assistant Secretary of Defense for Command, Control, Communications, and Intelligence (ASD/C3I)established policies and procedures that (1) directed DOD components to develop comprehensive inventories of their own long-haul telecommunication networks and directed DISA to develop a Defense-wide inventory of long-haul networks; (2) directed DISA to report annually on telecommunication services, acquisitions, trends, and associated costs; (3) mandated components to use common-user networks such as DISN or FTS 2000 for long-haul communications; (4) directed DISA to establish a waiver process to let components procure independent networks when their telecommunication needs could not be met by common-user networks; and (5) directed DOD components to periodically review and revalidate their long-haul telecommunication requirements. In a previous review of the DISN program,and during our work on this audit, we found that DOD had not effectively implemented any of these directives. In response, DOD agreed to address our concerns and to implement these policies and procedures. However, as discussed in this report, the Navy has not yet established an accurate and complete telecommunication inventory or created a database of information on acquisition, trends, and associated costs, which are necessary to plan for future growth and cost effectively purchase new telecommunication equipment and services. The Navy did not know exactly how much it was spending on telecommunication services nor did it know much about its telecommunication service vendors. The Navy’s lack of detailed cost data prevented us from analyzing its telecommunication expenditures on an aggregate level. For this reason, we were unable to comprehensively sample and test the adequacy of the Navy’s controls or perform effective data mining of its telecommunication expenditures. More importantly, this lack of adequate information also prevented the Navy from obtaining the knowledge needed to take steps to leverage its buying power, even though it is a large customer for telecommunication services. Moreover, obtaining knowledge of current requirements and usage, as well as developing forecasts of users’ future telecommunication needs, would assist Navy acquisition planning to ensure those future needs can be met in a more cost-effective manner. Our past work has identified specific practices that can be employed by DOD agencies to manage services acquisitions—including telecommunication services—from a more strategic perspective, thereby enabling DOD organizations to leverage buying power and achieve significant savings.These include establishing a central agent or manager for acquiring services, gaining visibility over spending, and revising business processes to enable the organization to leverage its buying power. Our past work showed that leading organizations that applied a strategic approach to their purchases of services found it necessary to develop new “spend analysis” information systems that could provide them with reliable data in a timely fashion. Spend analysis is a tool that answers basic questions about how much is being spent for what goods and services and helps to identify both buyers and suppliers, as well as opportunities to leverage buying, save money, and improve performance. Having the type of information discussed above would enable the Navy to perform spend analysis on the purchase and use of its telecommunication assets, which would provide the Navy with a complete picture of what is being spent on telecommunications—the cornerstone to identifying what can be done to improve the purchasing process and to leverage the Navy’s buying power. The task of gaining accurate visibility over spending will be difficult for the Navy given the lack of information systems available to provide spending data and the magnitude, breadth, and complexity of spending involved with multiple types and sources of telecommunication services. However, leading companies we studied that developed formal, centralized spend analysis programs found that they could overcome similar difficulties of piecing together incomplete and inaccurate data from various information systems through the use of key processes involving automating, extracting, supplementing, organizing, and analyzing data.Currently, the Navy lacks the needed information to perform effective cost/spend analysis. Recognizing that the best practices experiences of leading companies could help improve the cost effectiveness of DOD’s acquisition of services, Congress includedprovisions in the National Defense Authorization Act for Fiscal Year 2002that require, among other things, that DOD establish an automated system to collect and analyze data to support management decisions in contracting for services. The provisions were intended to put DOD in a position to gain visibility over services contract spending and more effectively leverage its buying power, thus (1) improving the performance of its service contractors, (2) organizing its supplier base, and (3) achieving significant savings and ensuring that its dollars are used more effectively. Although DOD is in the early stages of responding to these legislative requirements, DOD has a departmentwide spend analysis pilot underway and has called on agencies to embrace a strategic approach for acquiring services.Based on our assessment of the Navy’s payment and expenditure reporting systems, the Navy’s current process for acquiring telecommunication services is not strategic and its ability to use spend analysis to support a strategic approach is hampered by the lack of centrally available and detailed telecommunications expenditure data. Because the Navy does not budget or account for telecommunication requirements separately from other nontelecommunication requirements, the Navy’s automated systems are not designed to track the cost associated with purchasing telecommunication services in total or by network or by type of service provided. Consequently, the Navy is unable to perform the kind of meaningful spend analysis envisioned by the act. The Navy has yet to take steps to perform the kind of meaningful spend analysis employed by leading companies to better manage its purchasing of telecommunication services. Much earlier, in 1991, DOD directed DISA to establish a central inventory of all long-haul telecommunication equipment and services and directed the heads of DOD components to establish and maintain an inventory of all base telecommunication equipment and services. However, we found in several instances that DISA’s long-haul database was incomplete and contained numerous errors and that the Navy had yet to establish a base communications database as directed. Specifically, we found that (1) the DISA database did not track long-haul equipment and services that were purchased outside of DISA channels, (2) networks and services were still reflected in the DISA database long after they had been discontinued, and (3) point of contact or ownership information often had not been updated in years. In addition, some of the Navy locations we audited did not maintain an accurate inventory of the number of calling cards and cell phones currently in use or maintain adequate records of to whom the cards and phones were issued. As discussed later, our case-study work at four Navy locations demonstrated that this lack of reliable inventory data combined with other breakdowns in basic controls creates a fertile environment for fraud, waste, and abuse. Although DOD established a policy in 1991 requiring that DOD components biennially review and revalidate their local and long-distance telecommunication requirements, none of the four Navy locations we visited or DITCO Scott had established effective review and revalidation programs to ensure that they were not paying for capacity or services they no longer needed or they were not paying too much for the needed services used. In addition, the Navy did not have policies to ensure the cost-effective purchase and use of cell phone services. Consequently, we found that the four Navy sites we audited had established their own policies for the procurement and management of cellular services and equipment. These policies varied greatly, due to the differences in size, capability, and requirements of the cellular program at each site, which resulted in some of these sites paying more for these equipment and services than was necessary. Further, although DOD financial management regulations require proper receipt and acceptance of goods and services and the reconciliation of bills prior to payment, we found that the Navy activities we visited were improperly approving payments for telecommunication services without appropriate review. Failure to properly reconcile the bills has allowed payment to be made for inappropriate and irregular local and long-distance charges and has allowed the activities to improperly make overpayments and duplicate payment to telecommunication vendors. Finally, we found that the Navy does not have policies addressing the administration and management of calling cards. This has resulted in either inconsistent policies or a total lack of policies from one command to the next. Because of this lack of control, we identified several instances where the Navy had paid bills for calling card services that appeared to us to be potentially fraudulent or abusive, a situation that will likely be repeated unless changes are made. The review and revalidation process is important because it enables an activity to determine, based on empirical data, whether it is meeting its local and long-distance telecommunication needs in the most cost-effective means possible. According to DOD instructionsthis involves (1) assessing telecommunication traffic or usage to determine whether telecommunication services are still needed, (2) conducting market surveys to determine if current telecommunication contracts provide the most cost-effective solution for satisfying usage requirements, and (3) updating the appropriate inventory database to indicate that the requirement for the local and long-distance lines has been revalidated. It is particularly important that Navy personnel routinely review and revalidate their needs for the local and long-distance services they currently have and are paying for, and that they promptly cancel any unnecessary lines to avoid paying monthly usage fees for unneeded services. Activities are assessed fees for a line based either on the usage, a flat rate regardless of usage, or a combination of both. Therefore, if lines are not promptly canceled and if they have a monthly charge, the Navy will continue to receive and pay for these services indefinitely until they are canceled. None of the Navy sites we visited or DITCO Scott had effectively implemented existing policies to perform all three of the review and revalidation procedures mentioned earlier. At NAVSEA Crane, officials had recently assessed their telecommunication traffic to determine whether the services for which they were currently contracted were still needed. However, they had not conducted a market survey and, therefore, had no assurance that they were meeting their telecommunication needs in the most economical way possible. Two other sites, NAVAIR Patuxent and SPAWAR Charleston, had assessed their telecommunication traffic and performed a market survey but had failed to update the database to reflect that they had taken the required actions. As mentioned previously, these failures undermine DISA’s ability to monitor and effectively manage the DISN program and to maintain the quality of the database. For example, according to DISA’s long-haul database, as of February 17, 2004, approximately 3,100 of the Navy’s 26,000 long-haul lines had either not been revalidated in over 2 years or had not been properly updated. Some of these records indicated that the lines had been past due for revalidation for decades—in one case since March 1969. According to agency officials, as a result of our review, both NAVAIR Patuxent and SPAWAR Charleston have implemented corrective actions to ensure that the appropriate inventory database is updated whenever they revalidate their local and long-distance lines. As shown in table 1, at two of the four sites, we identified 37 long-distance lines that had not been reviewed and revalidated in over 2 years. When we asked the appropriate Navy personnel to review these 37 long-distance lines to determine if they were still needed, they found that 8 of the 37 lines for which they had been paying a total monthly usage fee of $4,969 were no longer needed. We relied on the accuracy of their responses and did not perform an independent review to determine their validity. Subsequent to our inquiry, Navy officials told us that the 8 lines shown in table 1 have now been disconnected. For these 8 lines, they were unable to quantify the total unnecessary cost that had been incurred to operate them because they were unable to determine exactly how long the lines had been operating without a valid need. To further demonstrate the risk of not promptly reviewing and revalidating existing lines, DITCO Scott officials were able to tell us that 4 of their 18 past-due lines for revalidation should have been discontinued in fiscal year 2000 or 2001. Instead, they continued to incur and pay monthly charges of $917 for 3 of these lines for about 3 years—incurring about $36,000 in unnecessary charges—until we raised the issue in fiscal year 2003 and the lines were discontinued. For the fourth line, DITCO was unable to quantify the cost for unnecessary usage. Similarly, two of the four Navy sites we audited had not reviewed or revalidated their base communication networks as required; however, the immediate financial impact of not doing so is not as evident. Base telecommunication networks are the equipment or services used to support the transmission of data within the confines of an installation. According to a Navy official, because a unit is not charged specifically for individual base communication lines, there are no unit cost savings associated with the deletion of a few unused individual lines. However, over time, the number of unused lines may become significant enough to warrant resizing a unit’s base communication network. For this reason, it is important that the Navy also implement an effective review and revalidation program for its base as well as its long-distance telecommunications. When we asked Navy officials at the two sites why they were not routinely reviewing and revalidating their telecommunication needs, we found that they were not aware of the requirement or did not see it as a top priority. The remaining two locations, NAVSEA Crane and NAVAIR Patuxent, had reviewed and revalidated their base communication network as required. The Navy’s use of cell phones has increased dramatically in recent years, allowing Navy personnel to make official calls when other alternatives are unavailable or uneconomical. In 1997, on the basis of a recommendation of the Naval Audit Service, NCTC, in conjunction with the Chief of Navy Operations, agreed to develop and issue specific guidelines and procedures relating to acquisition, accountability, and use of cellular phones. However, at the time we did our work for this assignment, neither DOD nor the Navy had taken the required actions to establish comprehensive policies or guidance governing the purchase and use of cell phone services, including guidance on (1) using prenegotiated or centrally negotiated rates or (2) requiring periodic assessment of cell phone usage to determine if plan packages provide the most cost-effective means to satisfy its usage requirements. Consequently, three of the four sites we audited were either paying retail prices for their cell phones when lower prenegotiated rates were available or were paying too much for cell phone services because they were not monitoring the use and thus had no basis for aligning the contracts with expected use. In the absence of DOD- and Navy-wide policies and procedures for the purchase of cell phones, individual Navy units have had to develop their own approaches for the procurement and management of cellular services and equipment. While three of the four sites we visited made a concerted effort to either (1) purchase cell phones at the GSA-negotiated rate— currently 12 percent discount off retail—or (2) establish their own negotiated contract with local cellular service providers, the remaining location, NAVSEA Crane, did neither. Instead, at NAVSEA Crane, individuals responsible for the procurement as well as cell phone users themselves bought their cell phones directly from retail sources using their purchase cards. As a result, NAVSEA Crane in some instances was paying a higher rate for cell phones—12 percent higher—than that established by GSA and in some cases paying taxes that should not be paid by government entities. In contrast, CINCLANFLT Norfolk negotiated a contract with one vendor using a shared minute plan, which allows multiple individuals to be on the same plan using an allocated number of minutes. The advantage of this plan is that if one individual goes over his or her allocated number of minutes and another individual uses fewer than his or her allotted number of minutes, charges for additional usage are not incurred. As a result of this plan, excess minutes were eliminated and CINCLANFLT Norfolk’s monthly access charges were reduced from $45.65 to $33.19. To take it one step further, the NAVAIR Command was able to achieve a large saving for all seven of its subcommands because it leveraged its buying power as a command to negotiate a better deal with a single service provider. Under this contract, NAVAIR Patuxent, a participating subcommand, received a 23 percent discount off retail—almost twice the amount of the GSA­ negotiated discount rate—and free standard cell phones. NAVAIR Command was able to negotiate such a favorable contract because it had the information it needed on its cell phone users, allowing it to negotiate with different local vendors and select the vendor with the best rate. This information included such factors as the number of cell phone users, the total number of plan minutes used, and the amount spent annually for cell phone equipment and services. As a result of the negotiated contract, NAVAIR Patuxent estimated that it saved approximately $110,000 in fiscal year 2003 and projects that it will save over $200,000 in fiscal year 2004 for its cell phone services and equipment requirements. The differences in the three procurement methods illustrated show that even on a small level, information consolidation and centralization is the foundation for implementing cost-effective methods for procuring cell phones and related services. Realizing this, NAVSEA Crane is currently developing a centralized procurement contract with a local vendor. In addition, three of the four Navy locations we audited paid too much for cell phone services because they were not monitoring individual plan usage. As shown in table 2, we identified selected cases at three of the four sites we audited where cell phone users were either (1) consistently exceeding their monthly allotment of minutes, thus incurring excessive charges for extra minutes (overutilization); or (2) consistently using only a small portion of their allotted minutes, thus incurring high charges per minute actually used because they contracted for substantially more minutes than needed (underutilization). At the fourth location, as previously mentioned, CINCLANFLT Norfolk negotiated a contract with one vendor using the shared minute plan, which allows multiple individuals to be on the same plan using an allocated amount of minutes—eliminating their charges for over- and underutilization of cellular plans. Overutilization of cellular plans can result in considerable additional costs to the government. We found that management personnel at these sites were not routinely comparing cell phone plans and usage to identify possible savings. For example, we found at one unit listed in table 2 that for some cellular plans, excess minute charges ranged from 20 to 35 cents per minute. This is more than twice the cost of the plans’ allowable per minute charges, which ranged from 7 to 15 cents per minute. For the 15 overutilized plans, these two sites incurred over $34,000 in excess minute charges in fiscal year 2002. Officials at NAVAIR Patuxent, concerned over our finding regarding the overutilization of cellular plans at their site, implemented a quarterly review process where they monitor cell phone usage with respect to allotted minutes and modify individual cell phone plans to achieve maximum cost effectiveness. According to these officials, for the first quarter of fiscal year 2004, NAVAIR Patuxent saw a reduction of 39 percent in its excess minute costs. Similarly, SPAWAR Charleston is in the process of negotiating a contract with a vendor for shared pool minutes to reduce its excess minute costs. While the monetary impact of underutilizing cell phone minutes is not as significant as consistently exceeding plan minutes, at one site in particular—NAVSEA Crane—using data-mining techniques on vendor invoices, we found instances where cell phone users were paying $95 per month for service plans in which they were using less than an average of 2 percent of their allotted monthly minutes for fiscal year 2002. As shown in table 3, the average cost per minute on these underutilized cell phone plans was extremely high. When we saw similar issues at SPAWAR Charleston, officials reviewed the usage requirements for 71 of their 1,900 cell phone users and determined that these users had either significant over- or underutilization. They further determined that they could save over $59,000 annually on these 71 plans alone if they changed the individual users to plans that more accurately matched their actual usage. According to these officials, they intended to review the remaining plans to achieve additional savings. None of the four sites we audited had consistently implemented procedures that complied with DOD policies regarding reconciliation of telecommunication invoices. DOD regulations require that payments on invoices be supported by documentation that reflects the receipt of services and goods and that those goods and services conform to the contractual requirements. These documents must be reconciled prior to payment unless special circumstances warrant otherwise. For telecommunication, this reconciliation process involves reviewing telecommunication invoices and reconciling invoice charges with an accurate inventory of telecommunication lines, circuits, networks, and services currently in operation and verifying that the billing rates used to calculate the charges are valid. However, we found that two of the Navy sites we audited had few or no controls in place, while the other two sites were not consistently implementing their established controls to review vendor invoices prior to certification of payment. Consequently, approving officials at these sites failed to detect inappropriate and irregular telecommunication charges, which allowed overpayments and duplicate payments to be made to vendors. Two of the four sites we audited had few or no controls in place to review and reconcile vendor invoices prior to certification of payment. At NAVSEA Crane, we reviewed the payment information for fiscal year 2002 and the first 6 months of fiscal year 2003 and found that officials reviewed the total amount billed per invoice and did not review specific charges to determine whether the charges were valid. Consequently, NAVSEA Crane paid almost $1,700 in vendor-assessed late fees. According to agency officials, only DFAS can approve late fees for past due Navy payments, and therefore NAVSEA Crane failed to ensure that any review of late fees was completed prior to payment. The other site, CINCLANFLT Norfolk, which procured its local and long-distance services via NCTAMS, had its invoices certified for payment by NCTAMS for more than 1 year without proper review. This occurred because CINCLANFLT Norfolk had not received billing information from NCTAMS that would allow it to review and reconcile its detailed charges with the services currently in operation. According to NCTAMS officials, billing information, such as service charges and long-distance call details, is e-mailed to the respective units’ contact point using the same e-mail address used by the vendor. However, NCTAMS officials did not confirm that the units were receiving the billing information or if the e-mail address was correct. Instead, these officials stated that they assumed the billing information was correct unless they were contacted by the activity within 15 days. However, relying on negative assurance prevents these sites from properly reviewing and reconciling invoices in accordance with DOD policies. For example, at NCTAMS, we found 52 long-distance calls on a July 2003 invoice that were 24 hours or over in length. These calls included 4-day, 10-day, and 12-day phone calls, which all originated from different phone numbers at different times. The length of these calls alone should have prompted further investigation but, because the invoice was never properly reviewed, the billing errors went unnoticed until we called the issue to the attention of NCTAMS officials. As shown in table 4, we further investigated 10 of the 52 calls to determine what caused the apparent billing errors. In 7 of the 10 cases, NCTAMS officials who approved the invoices could neither provide us with an explanation for the length of the calls nor could they provide us with valid points of contact for the activities responsible for the calls. The other two sites, SPAWAR Charleston and NAVAIR Patuxent, had procedures in place to review and reconcile telecommunication invoices prior to payment, but these procedures were not consistently implemented. As a result, we found these reviewing officials had not detected irregular charges, which resulted in overpayments and duplicate payments being made to vendors. For example, at SPAWAR Charleston, officials paid $5,600 over a 5-month period for services that had been discontinued. Further, we found that both SPAWAR Charleston and NAVAIR Patuxent had made duplicate payments on invoices because they did not follow the procedures in place to pay only the current charges on an invoice. Instead, on two occasions, these units paid the total balance due. As a result, officials at both of these two sites paid a total of $17,855 (SPAWAR, Charleston-­ $17,382 and NAVAIR Patuxent--$473) in duplicate payments for prior months’ charges, which had been previously paid. If SPAWAR Charleston and NAVAIR Patuxent had consistently followed their procedures for reviewing and reconciling telecommunication invoices, the overpayments would not have occurred. These examples illustrate the types of potential billing errors that telecommunication managers should be able to avoid with more detailed reviews of invoices. According to some Navy officials, reviewing and reconciling detailed telecommunication charges each month is time­ consuming and impractical given the number of telecommunication local and long-distance transactions occurring monthly. In addition, they stated that the rate structures used to calculate the invoice charges were often so complex that they were unable to determine how the final charges were calculated or whether they were, in fact, correct. As part of their long-haul service contract provided through DISA, DOD components may also order and receive long-distance calling card services. Long-distance calling card charges are then billed, along with other long­ haul services, on the components’ monthly invoices. According to an MCI official, each calling card with its respective PIN should be issued to and used only by one individual in order to assist in monitoring calling card usage. Additionally, calling cards should be tracked to determine who is accountable for each card’s usage, and invoices should be reviewed to detect and prevent unauthorized calling card use. However, some of the Navy sites we audited were unaware they owned calling cards. Furthermore, neither DOD nor the Navy had specific policies addressing the administration and management of calling cards. This lack of policies, combined with the ineffective controls over payments to telecommunication vendors, discussed previously, creates a fertile environment for fraud, waste, and abuse. To identify possible calling card misuse, we analyzed 3 months of the Navy’s calling card activity and used data-mining techniques to select seven calling card accounts from seven Navy activities that had either overlapping calls (two or more calls occurring at the same time with different originating numbers) or calls originating from different geographic locations at approximately the same time—using the same calling card number. Such cases would indicate calling cards that were being shared and/or compromised. As shown in table 5, five of the seven cards had been compromised. When we contacted the Navy officials and account owners responsible for managing and reviewing telecommunication invoices, we found that for four of the five calling cards shown in table 5, they were unaware that their unit owned or used calling cards. Further, according to these officials, they had not receive detailed information on calling card charges from either the vendor or from NACTAMS and therefore did not know that they were paying for these charges. Consequently, these officials could not determine if the calling cards had been compromised because they did not know who had possession of the cards and many did not have documentation supporting the use of these cards for the time period in question. Also, NCTSSD and MCB Camp Pendleton were unaware that in July 2003 the vendor’s fraud detection unit had suspended the calling cards we reviewed. As a result of our review, NCTAMS Norfolk, NCTSSD, and MCB Camp Pendleton identified and cancelled a total of 52 calling cards, including the 3 we selected, which they were unaware that they owned. However, neither MCI nor DISA was able to tell us how many dollars of charges had been made on these 52 calling cards since the cards had been activated. The remaining two units either canceled their card due to an MCI fraud alert as mentioned above or an internal investigation. Although the account owners for the two remaining calling card accounts we audited were aware that their unit owned and used calling cards, they did not have policies restricting the sharing of the cards. In many cases, card users within the same units shared the same calling cards and PIN. For example, at NAVAIR Patuxent, officials told us that they believed the selected card’s transactions were due to shared use and as a result of our review have changed their local calling card policies to prevent the sharing of calling cards in the future and to hold individuals accountable if unauthorized usage is found. At BCO Philadelphia, agency officials told us that the cards were shared because the unit’s cell phones were down. However, after the cell phones were reactivated, the sharing of calling cards was discontinued. As a result of the sharing of calling cards, officials at both of these locations could not subsequently determine whether these two calling cards were used for legitimate business reasons and whether all the charges were accurate. Further, because these cards were shared and thus the numbers compromised, these officials could not identify the responsible party for the questionable calls. Overall, these seven units lacked effective management oversight and adequate internal controls, which left them vulnerable to potential fraudulent and abusive calling card transactions. For example, an official at the USS Mitscher said that he routinely provided the same card number and PIN to several of his officers, as needed, but he did not know how many officers he had given the numbers to or how many currently had possession of the numbers. For this one card alone, between April and June of 2003, the Navy paid over $17,000 in long-distance charges. However, because no one was monitoring the activity on this card regularly, the unit was unaware of the excessive charges. Instead, it was not until the vendor’s fraud unit raised questions about more than $11,000 in charges during the first 6 days of July 2003 that the card was suspended. As shown in figure 1, on July 6, 2003, the card had 189 calls that originated from 12 different cities in five different states and Canada to 12 different countries for a total of over $5,000. In this 24-hour period, the card incurred over 55 hours of calling card charges. The lack of management oversight and accountability combined with inadequate internal controls over payments to telecommunication vendors has created an environment that is vulnerable to fraud, waste, and abuse. Until the Navy enforces existing policies related to maintaining accurate inventory data and designs automated systems capable of tracking cost data, the Navy has no assurance that telecommunication goods and services are purchased in the most cost-effective way possible. Further, the failure of the units we audited to follow existing policies related to reviewing and revalidating telecommunication requirements and performing adequate receipt and acceptance procedures puts these units at risk of making payments for erroneous or improper telecommunication charges. Finally, although we performed audit work only at selected units, the Navy’s lack of comprehensive policies and guidance governing the purchase, issuance, and use of cell phone and calling card services increases the likelihood that the problems we identified at these units may exist elsewhere within the Navy. To improve the Navy’s management oversight of its telecommunication program, we recommend that the Secretary of the Navy take eight corrective actions and the CNO take three corrective actions. We recommend that the Secretary of the Navy direct the CNO to ensure that existing policies are enforced. Specifically, the CNO should ensure that the Navy: develops and maintains a comprehensive inventory of the Navy’s base telecommunication equipment and services; supports DISA efforts to track acquisitions of telecommunication services throughout DOD, actual costs of those services, and trends in usage (that is, the volume and types of traffic that networks carry). We further recommend that the Secretary of the Navy direct the CNO to establish comprehensive policies and guidance governing the purchase and use of: cell phone services, which should include (1) the use of prenegotiated or centrally negotiated rates and (2) periodic assessment of cell phone usage to determine if plan packages provide the most cost-effective means to satisfy the Navy’s usage requirements; and calling card services, which should include policies about accountability, the proper review of invoices, and the prohibition of sharing of calling cards. To strengthen the Navy’s ability to acquire telecommunication services effectively and efficiently, we recommend that the Secretary of the Navy direct the CNO to develop, in coordination with the Navy commands, a strategic management framework for improving the acquisition of telecommunication services. This framework should include provisions for inventorying current and potential users of telecommunication services to determine existing and future requirements; identifying and exploiting opportunities to consolidate requirements among Navy commands; and adopting, when appropriate, commonly used commercial practices, such as conducting spend analyses and competing and negotiating pricing discounts based on overall Navy volume, to strengthen the Navy’s bargaining position in acquiring telecommunication services. To ensure the successful implementation of this strategic management framework and to better leverage Navy buying power, we recommend that the Secretary of the Navy direct the CNO to strengthen analysis of telecommunication service requirements, spending, and the capabilities of telecommunication service providers by enhancing core internal technical expertise and information systems. At the selected units that we audited, we recommend that the CNO direct the commanders to provide assurance that existing policies are enforced and fully evaluate the internal controls over the review and revalidation of telecommunication requirements, reconciliation of telecommunication invoices with a current inventory of telecommunication equipment and services, and distribution and use of calling cards and cancellation of cards that are not properly controlled. DOD provided written comments on a draft of this report, which are reprinted in appendix II. DOD concurred with 9 of our 11 recommendations and partially concurred with the remaining 2 recommendations. These latter recommendations were that the Navy (1) support DISA efforts to track acquisitions of telecommunication services, the actual cost of those services, and trends in usage of telecommunication services throughout DOD; and (2) strengthen the analysis of telecommunication services requirements, spending, and the capabilities of telecommunication service providers by enhancing core internal technical expertise and information systems. Although the Navy said it plans to take actions on these 2 recommendations, it was unclear whether these planned actions will satisfy our recommendations. The department also provided technical comments, which we have incorporated in the report as appropriate. Concerning Navy support of DISA efforts to track acquisition of telecommunication services throughout DOD, the actual costs of those services, and trends in usage, DOD responded that the Secretary of the Navy will direct cognizant senior Department of the Navy officials to support DISA tracking efforts to the maximum extent practicable. Such measures are an important aspect of the management of telecommunication programs and appear to be responsive to our recommendation. However, since we are uncertain of the meaning of “maximum extent practicable”, we cannot evaluate the extent to which DOD plans to implement this recommendation. We continue to strongly encourage the Navy to track all acquisitions of telecommunication equipment and services in order to enable it, in conjunction with DISA, to successfully develop an enterprisewide governance process for telecommunication, meet DOD expectations for major management reform, and obtain the maximum savings in its procurement services. Regarding the Navy enhancing core internal technical expertise and information systems, DOD stated that requirements would be analyzed and considered as part of DOD’s efforts to develop a management framework for improving the efficiency of the Navy’s acquisition and use of telecommunication services. Although it appears the DOD’s response may address the intent of this recommendation, the extent of its efforts is unclear. We continue to believe that the Navy could benefit from a strengthened analysis of its telecommunication service requirements, spending, and the capabilities of its service providers, which could be aided by enhancing its core technical expertise and information systems. As agreed with your office, unless you announce the contents of this report earlier, we will not distribute it until 30 days from its issuance date. At that time, we will send copies of this report to other interested congressional committees, the Secretary of the Navy, the Chief of Naval Operations, and the Assistant Secretary for Financial Management (Comptroller) for the Navy. Copies will be made available to others upon request. Please contact me at (202) 512-9505 or kutzg@gao.gov if you or your staffs have any questions about this report. Other GAO contacts and key contributors to this report are listed in appendix III. We reviewed selected aspects of DOD’s and the Navy’s management of their telecommunication programs. We modified the scope of our work, in process, because in some cases the information needed to perform comprehensive analyses was lacking and in other cases the data were so fragmented that they could not be analyzed in the aggregate. Thus, in many cases, we had to rely on case studies and nonrepresentative selections of transactions to illustrate the internal control problems we identified. This assignment originated because of congressional concerns that DOD’s vendor pay process, which accounted for approximately $112 billion in fiscal year 2003, might suffer from many of the same types of pervasive problems that we uncovered during our previous work on DOD’s purchase card program. Specifically, we were asked to evaluate the effectiveness of DOD’s management oversight and controls of payments to its vendors. Initially, we intended to assess DOD’s oversight and controls over vendor purchases and payments for telecommunication goods and services— including local and long-distance services, calling cards, and cellular phone services. However, because it was not feasible to provide a comprehensive assessment of the adequacy of all 17 of DOD’s vendor payment systems or the multitude of varying controls and processes over the telecommunication purchases and processes that we encountered, we subsequently focused our effort primarily on the Navy. Then, because the Navy was unable to provide us with a complete population of telecommunication expenditures from which to perform statistical sampling and testing of transactions, we used a case-study approach to assess the adequacy of management oversight and internal controls. This lack of information with which to do statistical sampling and testing applied at all levels, including the unit level. Even at the case study locations selected, we were unable to perform statistical testing because the local databases were often incomplete, or they had insufficient, inconsistent, or inaccurate data. Because of this, we evaluated the design of controls in place and relied on nonrepresentative selections to evaluate the effectiveness of the case study locations’ internal controls of their telecommunication programs. Consequently, we were unable to gauge the extent of the problem from a DOD, Navy, or even unit perspective. Our objectives were to determine (1) whether the Navy has the basic cost and inventory information needed to oversee and manage its purchases from telecommunication vendors and (2) whether selected Navy sites have adequate controls to provide reasonable assurance that telecommunication goods and services are purchased cost effectively and payments are made only for valid telecommunication charges. We reviewed current DOD and Navy guidance contained in applicable regulations, directives, instructions, or other guidance concerning the procurement, management, and use of common-user networks. We also reviewed our own prior reports as well as prior DOD Inspector General and other DOD military audit services’ reports. We met and had numerous discussions with officials from DISA— DOD’s major telecommunication manager—and at DITCO Scott, the primary contracting organization in DISA. To determine whether the Navy’s controls of expenditures are adequate to provide reasonable assurance that telecommunication goods and services are purchased cost effectively and that payments are made only for valid transactions, we audited the effectiveness of the Navy’s internal controls over its fiscal year 2002 telecommunication transactions at selected sites. Because the Navy lacked a consolidated source for telecommunication data, we were unable to obtain complete and accurate information for telecommunication disbursements Navy-wide. Instead, we identified the approximate amount spent by the Navy on telecommunications for fiscal year 2002 by manually identifying known telecommunication vendors and matching this list against the information contained in the Standard Accounting and Reporting System (STARS), the Financial Accounting Budget System (FABS), and the purchase card accounting database. Using these three databases, we were able to determine that the Navy paid at least $271 million to telecommunication vendors in 2002. Because the STARS database contained the highest dollar amount of telecommunication payments, we summarized the STARS payments by the Authorized Accounting Activity (AAA) code to identify the organizations having responsibility for providing the funding for the payments. However, these accounting organizations were not necessarily the users of the goods and services for which they made payments. Using the information developed from this methodology, we identified the four major commands having the largest telecommunication payments in 2002. They were the Space and Naval Warfare Systems Command (SPAWAR), the Naval Network and Space Operations Command (NNSOC),the Naval Air Systems Command (NAVAIR), and the Naval Sea Systems Command (NAVSEA). We then selected one activity (or subactivity, if necessary) within each command at which to do further detailed work. Using our methodology, the four major commands selected accounted for about $114 million of the Navy’s total $271 million in telecommunication payments, or 42 percent of fiscal year 2002 Navy telecommunication payments. (These amounts may include tactical and nontactical telecommunication.) The four activities selected accounted for $63 million of the $114 million (55 percent) of the total for the four commands. At the four navy activities, we used a case study approach. At the sites, we obtained and reviewed information from directives, policies, and procedures governing their telecommunication programs. We evaluated the documentation provided and had numerous meetings and follow-up discussions with personnel responsible for various aspects of the telecommunication programs at the sites we visited as well as at remote locations, if applicable. To assess the overall control environment governing telecommunications to determine if it provides reasonable assurance that telecommunication goods and services are purchased and paid for cost effectively, the primary criteria we used were applicable laws and regulations; our Standards for Internal Control in Federal Government (GAO/AIMD-00-21.3.1, November 1999); and our Internal Control Standards: Internal Control Management and Evaluation Tool (GAO-01-1008G, August 2001). To assess the management control environment, we evaluated DOD and Navy management practices using the fundamental concepts and standards contained in GAO’s Internal Control Standards. To test the implementation of key control activities during fiscal year 2002 at the four installations we audited, we performed the following detailed testing. Base Communications—At each site visited, we obtained a database or list of base (local service) circuits. For each base circuit, we requested information such as the installation date, the validation date, the service end date, and the discontinue date (if applicable), the physical location of the circuit (building), the responsible point of contact and organization, the vendor, and billing information for fiscal year 2002 and the first 6 months of fiscal year 2003. From each local database, we selected nonrepresentative selections of base circuits to test for compliance with DOD, Navy, and local policies. For each selected transaction, we compared the total number of circuits and total disbursements for selected months in order to perform a reconciliation of the invoice totals. For months in which the totals did not agree, we analyzed detailed information in the reconciliation and invoices to test for (1) inaccuracy of data, (2) payment for items not currently owned or being used, (3) differences in invoice amounts versus reconciliation and database amounts, and (4) payments for excess lines. We also analyzed invoices after circuits had been discontinued to determine whether the vendor was still charging for disconnected circuits, and we analyzed selected invoices to determine if the vendor had assessed late fees and whether those late fees had been certified for payment by the selected case study sites. Long-Haul Communications—Using the DISA database, we obtained a list of circuits with past due validation dates as of July 9, 2003, for the activities and major commands. We compared the long-haul inventory information in DISA’s database to the installation’s long-haul inventory information in order to determine (1) if long-haul circuits were being reviewed and revalidated every 2 years, as required by regulation; (2) the accuracy of DITCO’s long-haul inventory information; and (3) whether the installations had procured long-haul services or equipment without going through DITCO. We spoke with numerous agency officials on site and in follow-up discussions in order to try to resolve any discrepancies. Cell Phones—Further, at three of the four case study sites, we determined if cell phones were monitored to detect significant over- or underuse of plan minutes and for compliance with DOD, Navy, and local policies. To determine if cell phones were being monitored for over- or underuse of plan minutes, we first obtained a list of cell phone users. Next, we obtained detailed monthly billing for each user selected for fiscal year 2002 and May 2003 and through data mining compared the monthly minutes used to cell plan minutes to identify if the cellular plan was being under- or over utilized. To test for compliance, we selected a nonrepresentative selection of cell phone transactions (request for service, authorization, receipt and acceptance, and payment) and compared the transactions against DOD, Navy, and local policies. Calling Cards—We analyzed the DISA/DITCO Columbus calling card transactional database, which contained DOD’s calling card transactions from April through June 2003. However, due to the scope of our audit, we focused our review only on the Navy’s calling card transactions. Through data mining, we identified Navy calling card numbers that (1) had overlapping calls or calls from different geographical areas within an hour. From this population, we selected seven calling card accounts and spoke with officials from the following seven activities and the telecommunication vendor, MCI, to determine why there were overlapping calls or calls placed from different geographical areas. The seven activities were (1) NCTAMS Norfolk, (2) Base Communications Office (BCO) Philadelphia, (3) Naval Computer and Telecommunication Station San Diego (NCTSSD), (4) Marine Corps Base (MCB) Camp Pendleton, (5) USS Mitscher, (6) Naval Air Lakehurst, and (7) NAWCAD Patuxent. At these locations, we spoke with Navy officials and their telecommunications vendor, MCI, to determine why there were overlapping calls or calls placed from different geographical areas at almost the same time. We requested comments on a draft of this report from the Secretary of the Navy or his designee. DOD provided written comments, which are presented and evaluated in the “Agency Comments and Our Evaluation” section and are reprinted in appendix II. We conducted our work from May 2003 through February 2004 in accordance with generally accepted government auditing standards. In addition to those named above, Art Brouk, Michael Chambless, Francine DelVecchio, Johnny Clark, Carmen Harris, John Ledford, and John Ryan made key contributions to this report. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full­ text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: Problems with management oversight and control of DOD's purchase card program led to concerns that similar issues exist for DOD's vendor payments. As a result, this report focuses on the Navy's telecommunication program and whether (1) the Navy has the basic cost and inventory information needed to oversee and manage these purchases and (2) selected Navy sites have adequate control to provide reasonable assurance that goods and services are purchased cost effectively and payments are made only for valid charges. The Navy did not know how much it spent on telecommunications and did not have detailed cost and inventory data needed to evaluate spending patterns and to leverage its buying power. Obtaining knowledge of current requirements and usage, as well as developing forecasts of future telecommunication needs, would assist Navy's acquisition planning to ensure future needs were met in a more cost-effective manner. At the four case study sites we audited, management oversight of telecommunication purchases did not provide reasonable assurance that requirements were met in the most cost-effective manner. For local and long-distance services, these sites did not follow policies to biennially review and revalidate these requirements. As a result, they paid for services no longer required. Also, the Navy lacks policies to provide assurance that cell phone requirements are met in the most cost-effective manner. Cell phone usage at three sites was not monitored to determine whether plan minutes met users' needs. Consequently, these sites overpaid for cell phone services. Also, none of the sites had adequate controls over review of invoices to provide assurance of payments for only valid charges. These sites failed to detect erroneous charges and potentially improper use of these services. In addition, the Navy lacks specific policies and processes addressing the administration and management of calling cards. Consequently, some sites did not know they owned and were being billed for calling cards. Other sites allowed calling cards to be shared and were unable to determine the legitimacy of the calls, and thus paid for potentially fraudulent or abusive long-distance charges. On one card alone, in a 3-month period, the Navy paid over $17,000. However, because no one was regularly monitoring the activity on this card, the unit was unaware of potentially fraudulent charges. Not until the vendor's fraud unit raised questions about more than $11,000 in charges incurred during the first 6 days of July 2003 was the card suspended.