We conducted our audit work from August 2000 through June 2001 in accordance with generally accepted U.S. government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. We briefed DOD managers, including officials in DOD’s Purchase Card Program Management Office and the Defense Finance and Accounting Service (DFAS), and Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego officials on the details of our review, including our objectives, scope, and methodology and our findings and conclusions. We referred instances of potentially fraudulent transactions that we identified during our work to our Office of Special Investigations for further investigation. Our work was not designed to identify, and therefore we did not determine, the extent of fraudulent, illegal, or abusive transactions. Our control tests were based on stratified random probability samples of 135 SPAWAR San Diego purchase card transactions and 121 Navy Public Works Center San Diego transactions. Further details on our objectives, scope, and methodology are included in appendix III. Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. A positive control environment is the foundation for all other standards. It provides discipline and structure as well as the climate which influences the quality of internal control. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) A weak internal control environment at SPAWAR San Diego and the Navy Public Works Center San Diego contributed to internal control weaknesses, fraud, and abuse. The importance of the “tone at the top” or the role of management in establishing a positive internal control environment cannot be overstated. GAO’s internal control standards go on to state that, “management plays a key role in demonstrating and maintaining an organization’s integrity and ethical values, especially in setting and maintaining the organization’s ethical tone, providing guidance for proper behavior, removing temptations for unethical behavior, and providing discipline when appropriate.” The specific factors that contributed to the lack of a positive control environment at these two units included a proliferation of purchase cardholders, ineffective training of cardholders and certifying officers, ineffective rebate management, and a lack of monitoring and oversight. SPAWAR San Diego and the Navy Public Works Center San Diego did not have specific policies governing the number of cards issued or establishing criteria for identifying employees eligible for the privilege of cardholder status. At both units, cards were given out on the basis of a request from an individual employee’s supervisor. The request was then forwarded to the unit’s purchase card agency program coordinator, who approved the request and began the process for obtaining a new card from Citibank. According to SPAWAR and Navy Public Works Center officials, specific criteria did not exist for either the supervisors or the program coordinators to use in requesting and approving purchase cards for employees. This flawed policy has resulted in a proliferation of purchase cards at the two units. For example, as of September 30, 2000, about one in three, or 36 percent of SPAWAR San Diego employees and about one in six, or 16 percent, of Navy Public Works Center San Diego employees were cardholders. As a result, at the end of fiscal year 2000, about 1,526 SPAWAR San Diego employees and 254 Navy Public Works Center San Diego employees were authorized to procure goods and services. Within this weak control environment, these two Navy units had given purchase cards to over 1,700 employees, most of whom had credit limits of $20,000 or more and the authority to make their own purchase decisions. Table 1 shows the proliferation of cardholders and the percentage of employees at SPAWAR and the Navy Public Works Center in San Diego that were cardholders as of September 30, 2000. Most of SPAWAR’s 1,526 cardholders had a $25,000 credit limit and most of the Navy Public Works Center’s 254 cardholders had a $20,000 credit limit. Information we obtained from six large defense contractors on their purchase card programs showed that the percent of the contractors’ employees that were cardholders ranged from about 2 percent to nearly 4 percent—significantly less than at SPAWAR and the Navy Public Works Center in San Diego. The proliferation of cardholders, particularly at SPAWAR San Diego, created a situation where it was virtually impossible to maintain a positive control environment. For example, at SPAWAR, a significant span of control issue existed, with one approving official responsible for certifying monthly summary billing statements covering an average of over 700 monthly purchase card statements relating to 1,526 purchase cardholders. At the Navy Public Works Center San Diego, the span of control problem was not as serious, with six approving officials responsible for certifying monthly summary statements covering an average of 55 monthly statements for 254 cardholders. The span of control issue is particularly important for purchase cards because supervisors and, in some cases, cardholders themselves, are responsible for authorizing purchases, rather than an independent contracting officer as is the case under the standard procurement process. Thus, the approving official serves as a key control in certifying cardholder purchases. The lack of documented evidence of purchase card training also contributed to a weak internal control environment at SPAWAR and the Navy Public Works Center in San Diego. GAO’s internal control standards emphasize that effective management of an organization’s workforce—its human capital—is essential to achieving results and is an important part of internal control. Training is key to ensuring that the workforce has the skills necessary to achieve organizational goals. In accordance with Navy Supply Command (NAVSUP) Instruction 4200.94, all cardholders and approving officials must receive purchase card training. Specifically, NAVSUP Instruction 4200.94 requires that prior to the issuance of a purchase card, all prospective cardholders and approving officials must receive training regarding both Navy policies and procedures as well as local internal operating procedures. Once initial training is received, the Instruction requires all cardholders to receive refresher training every 2 years. Although we found the training policies and procedures to be generally adequate, we determined that SPAWAR and the Navy Public Works Center lacked documentation to demonstrate that all cardholders and approving officials had received the required training. Based on our tests of fiscal year 2000 purchase card transactions, we estimate that about 40 percent of the SPAWAR transactions, totaling at least $6.8 million, and 56 percent of the Navy Public Works Center transactions, totaling at least $10.9 million, were made by cardholders for whom there was no documented evidence that they had received either the required initial training or refresher training on purchase card policies and procedures. SPAWAR San Diego management contended that we should accept training provided under the Navy’s previous purchase card program as meeting the training requirements under the new program. Although we determined that the policies and procedures related to cardholder responsibilities were essentially the same under the previous Navy purchase card program, we found that several cardholders had received the prior training as many as 2 years to 6 years before the current program began. Therefore, these cardholders had not received the required biennial refresher training. The Navy Public Works Center San Diego had no documented evidence that its cardholders had received any purchase card training prior to March 2000. We also found no documented evidence that two of six Navy Public Works Center approving officials had received training on purchase card policies and procedures prior to assuming certifying officer responsibilities. SPAWAR’s one approving official had received all required training. We found ineffective management of purchase card rebates by the Navy, SPAWAR San Diego, and the Navy Public Works Center San Diego. The Navy requested that Citibank defer payment of all of the purchase card rebates it earned since the current purchase card program began in November 1998 because, according to DOD and Navy officials, it had not yet determined how to record and allocate the rebates to Navy programs. According to Citibank officials, Citibank plans to pay cumulative purchase card rebates and accrued interest to the Navy on July 31, 2001, the payment date required in the Navy’s latest purchase card contract task order modification. Citibank estimates that the total payment will be about $8.8 million, including an estimated $8.3 million in cumulative rebates and an estimated $530,000 in accrued interest on these rebates. In addition, the Navy had not established policies and procedures for managing rebates and had not monitored its rebate earnings. As a result, the Navy, SPAWAR San Diego, and the Navy Public Works Center San Diego were not aware that Citibank had miscalculated the rebates that SPAWAR and the Navy Public Works Center should have earned during fiscal year 2000 by about $150,000. Specifically, the rebates due SPAWAR were understated by $136,760, while the Navy Public Works Center’s rebates were overstated by $12,039. Further, SPAWAR and Navy Public Works Center managers were not effectively managing purchase card payments to maximize the amount of rebates earned. We determined that delays in the receipt of monthly purchase card statements had precluded the opportunity for these two units to earn another $242,000 in fiscal year 2000 rebates. We do not know the extent to which these factors have adversely impacted the Navy’s total fiscal year 2000 purchase card rebates. SPAWAR and the Navy Public Works Center in San Diego had not established an effective monitoring and internal audit function for the purchase card program. Further, the Navy’s purchase card policies and procedures did not require that the results of internal reviews be documented or that corrective actions be monitored to help ensure that they are effectively implemented. NAVSUP Instruction 4200.94 calls for agency program coordinators to perform semiannual reviews of their units’ purchase card program, including adherence to internal operating procedures, applicable training requirements, micro-purchase procedures, receipt and acceptance procedures, and statement certification and prompt payment procedures. Further, these reviews are to serve as a basis for agency program coordinators to initiate appropriate action to improve the local program or correct problem areas. However, the Instruction does not require written reports on the results of internal reviews to be submitted to either local management or a central Navy office for monitoring and oversight. As a result, the Navy did not have a consistent process for documenting the results of purchase card reviews, identifying systemic problems, and monitoring corrective actions to help ensure that they are effectively implemented. This weakness also impaired the Navy’s ability to assess purchase card controls for possible inclusion in its Annual Statements of Assurance pursuant to 31 U.S.C. 3512(d) (commonly referred to as the Federal Managers’ Financial Integrity Act of 1982), which requires agency heads to make annual disclosures regarding the adequacy of their internal controls. The Secretary of the Navy’s fiscal year 2000 Annual Statement of Assurance did not disclose any control weaknesses related to the purchase card program. Our analysis of SPAWAR San Diego Agency Program Coordinator fiscal year 2000 reviews showed that these reviews identified problems with about 42 percent of the monthly cardholder statements that were reviewed. The problems identified were consistent with the control weaknesses discussed later in this testimony, including lack of independent documentation that the Navy received items ordered by purchase card, accountable items that were not recorded in the property records, inadequate documentation for transactions, split purchases, and transactions that did not appear to be related to government business purposes. During our review, we saw correspondence and other documentation showing that SPAWAR San Diego management had considered the findings identified in its agency program coordinator evaluations, but directed that corrective actions should not be implemented due to complaints from cardholders and their supervisors regarding the administrative burden associated with procedural changes that would be needed to address the review findings. As a result, the agency program coordinator had not used these reviews to make systematic improvements in the program. Rather, these reviews generally resulted in the reviewer counseling the cardholders or, in some instances, recommending that cardholders attend purchase card training. During fiscal year 2000, the SPAWAR San Diego Office of Command Evaluation internal review group had not conducted any reviews or audits of the purchase card program. Further, although the SPAWAR San Diego Command Inspector General reviewed the SPAWAR purchase card program during fiscal year 2000 and prepared a draft report summarizing the results of this review, the final report has not yet been issued. Our review of the draft report determined that the Command IG identified a number of internal control problems that are consistent with our findings, including issues related to receipt and acceptance, training, and split purchases. The Navy Public Works Center San Diego purchase card agency program coordinator did not perform any systematic reviews of the program during fiscal year 2000. He told us that his monitoring efforts consisted of scanning some monthly invoices for duplicate payments, split purchases, and other suspicious payments. However, he did not document these actions. Further, the Public Works Center internal review group in the Office of Command Evaluation did not perform any reviews during fiscal year 2000. However, Navy Public Works Center managers told us that they asked the Naval Audit Service to review the Center’s purchase card program during fiscal year 2000 because of concerns about the growth of the program, the adequacy of internal controls, and recent instances of fraud. Although the Naval Audit Service completed its fieldwork in November 2000 and briefed Navy Public Works Center San Diego management on its findings, the results of that effort have yet to be externally reported. According to the Navy’s Deputy Assistant Auditor General, the Naval Audit Service plans to finalize its work and issue a report in the fall of 2001. Basic internal controls over the purchase card program were ineffective at the two units we reviewed. Based on our tests of statistical samples of purchase card transactions, we determined that the three transaction-level controls that we tested were ineffective, rendering SPAWAR San Diego and Navy Public Works Center San Diego purchase card transactions vulnerable to fraudulent and abusive purchases and theft and misuse of government property. As shown in table 2, the specific controls that we tested were (1) independent, documented receipt and acceptance of goods and services, (2) independent, documented certification of monthly purchase card statements, and (3) proper accounting for purchase card transactions. In addition, we tested whether the accountable items—easily pilferable or sensitive items— included in some of the transactions in our samples were recorded in the units’ property records to help prevent theft, loss, and misuse of government assets. Our tests of SPAWAR and Navy Public Works Center fiscal year 2000 purchase card transactions that included accountable property items, showed that the two units failed to record one or more accountable items in their property records for nearly all of these transactions. Further, when we analyzed the property items included in our sampled transactions, we found that SPAWAR and the Navy Public Works Center did not record 46 of the 65 accountable items included in our sampled transactions in their property records. Moreover, when we asked to inspect these items, the two units could not provide conclusive evidence that 31 of them, including laptop computers, Palm Pilots, and digital cameras, were in the possession of the government. Key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. This should include separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling any related assets. Simply put, no one individual should control all the key aspects of a transaction or event. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) SPAWAR San Diego and the Navy Public Works Center San Diego generally did not have independent, documented evidence that they received items ordered by purchase card. That is, they generally did not have a receipt for the acquired goods and services that was signed by someone other than the cardholder. As a result, there is no documented evidence that the government received the items purchased or that those items were not lost, stolen, or misused. NAVSUP Instruction 4200.94 generally requires segregation of duties between the individual making the purchase and the individual responsible for documenting receipt and acceptance of goods and services acquired by purchase card. However, employees at the two units were not following these procedures. In some instances employees were following an alternative procedure permitted by the NAVSUP Instruction whereby independent authorization of a purchase order can be substituted for independent confirmation of receipt of the items purchased. However, the alternative procedure does not provide any assurance that the items ordered and paid for were received. Based on our test work, we estimate that SPAWAR San Diego did not have independent, documented evidence to confirm the receipt and acceptance of goods and services acquired with the purchase card for about 65 percent of its fiscal year 2000 transactions totaling at least $10.1 million. For the Navy Public Works Center San Diego, we estimated that 47 percent of its fiscal year 2000 purchase card transactions totaling at least $6.6 million did not include independent, documented receipt of goods and services. The types of items in our sampled transactions that lacked independent evidence of receipt and acceptance included computers, monitors, and compact disk writers that were purchased at stores such as Byte and Floppy Computer, Dell Computer, and CompUSA. Further, during fiscal year 2000, SPAWAR and the Navy Public Works Center in San Diego made over 2,000 transactions totaling over $468,000 for items from The Home Depot, Best Buy, Circuit City, and Wal-Mart. Our review of the five purchase card fraud cases related to Navy activities based in San Diego, discussed in appendix II, showed that fraudulent purchases had been made to acquire items for personal use from these same stores. Because the Navy purchases items for valid, government purposes from stores that are widely used by consumers to acquire items for personal use, verification of receipt of goods and services by an individual other than the cardholder is necessary to reduce the risk of fraudulent transactions. Transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) We assessed a 100-percent failure rate at both units for this critical control. NAVSUP Instruction 4200.94 and, to a greater extent, a policy memorandum issued by the Navy Comptroller’s office on June 3, 1999, do not provide adequate internal controls and are inconsistent with the responsibilities of certifying officers reflected in statutes and DOD’s fiscal policy guidance. Approving officials at the two units told us that they were not following the existing procedures due to time constraints and the Navy Comptroller’s policy memorandum. Under 31 U.S.C. 3325 and DOD’s Financial Management Regulation, disbursements are required to be made on the basis of a voucher certified by an authorized agency official. The certifying official is responsible for ensuring (1) the adequacy of supporting documentation, (2) the accuracy of payment calculations, and (3) the legality of the proposed payment under the appropriation or fund charged. Proper certification of bills for payment is a preventive control that requires and provides the incentive for certifying officers to maintain proper controls over public funds. It also helps detect fraud and improper payments, including invalid (unsupported or prohibited) transactions, split purchases, and duplicate payments. Further, section 933 of the National Defense Authorization Act for Fiscal Year 2000 requires the Secretary of Defense to prescribe regulations that ensure, among other things, that each purchase cardholder and approving official is responsible for reconciling charges on a billing statement with receipts and other supporting documentation. According to NAVSUP Instruction 4200.94, upon receipt of the individual cardholder statement, the cardholder has 5 days to reconcile the transactions appearing on the statement by verifying their accuracy to the supporting documents and notify the approving official in writing of any discrepancies in the statement or sign and forward it to the approving official. The approving official is responsible for ensuring that all purchases made by the cardholders within his or her cognizance were appropriate and that the charges are accurate. However, the Instruction further states that within 5 days of receipt of the cardholders’ statements, the approving official must review and certify the monthly summary statement for payment, whether or not the cardholder has reviewed the statement and notified the official of any discrepancies or agreement with the statement. That is, the approving official is to presume that all transactions on the monthly statements are proper unless notified in writing by the purchase cardholder. Under this process, the certifying officer relies upon the silence of a cardholder who may have failed to timely forward corrections or exceptions to the account statement or, even worse, may not have even reviewed the statement. A certifying officer in these circumstances is not taking steps to assure that a payment is proper and an agency therefore cannot rely on the certification for assurance that a payment is for the proper amount and a legal purpose. This NAVSUP policy is inconsistent with the purpose of certifying vouchers prior to payment, which is to maintain proper control over public funds and assure that payments are made for proper amounts and purposes. Certifying officers are responsible for the correctness of facts and computations in the voucher, and the legality of the proposed payment under the appropriation involved. A certifying officer is liable for losses resulting from improper certifications, but may be relieved from liability if the certification was based upon official records and the officer did not know, and could not have reasonably discovered, the correct information. While certifying officials may rely on systems, controls, and personnel that process transactions rather than personally reviewing the supporting documentation, they must show that their reliance was reasonable. Regardless of what system is used, there is no authority to make known improper payments. At SPAWAR and the Navy Public Works Center, the certifying officers relied on a process without assurances that even a minimal review of the facts and computations underlying the proposed payment or the legality of such payment was carried out before certification was made. Thus, the certifying officers may not be able to demonstrate that their reliance on such a system is reasonable. In addition to the problems with NAVSUP Instruction 4200.94, the Navy Comptroller’s June 3, 1999, policy memorandum further weakens the certification process. The policy memorandum does not explicitly state that the cardholder must review the statement of account and notify the approving official of any improper or incorrect items within 5 days of receipt. Nonetheless, the approving official must certify the invoices based on the presumption that all cardholder accounts are proper unless notified in writing within 5 days of receipt of the invoice. Navy officials told us that it is assumed that cardholders would review the statements and notify the approving officials of any problems. While the cardholder’s review is not explicitly required, the memorandum states that the change in policy “will ensure that the cardholder will inform the AO in a prompt manner of any duplicate payments or fraudulent or improper charges to his account.” Again, by requiring certification within 5 days, whether or not a cardholder has reviewed a statement, the June 3, 1999, policy memorandum requires a certifying officer to rely upon a process that does not require review of a proposed payment or otherwise assure that a payment is properly payable before certification occurs. All seven approving officials at the two activities (one at SPAWAR and six at the Navy Public Works Center) told us that they never reviewed the cardholders’ supporting documentation before signing and submitting purchase card statements for payment. Accordingly, we assessed the failure rate for this control as 100 percent for both SPAWAR San Diego and the Navy Public Works Center San Diego. Approving officials explained that they certify purchase card statements for payment without reviewing cardholders’ supporting documentation because (1) they do not have time to review the documentation and (2) the Navy Comptroller’s June 3, 1999, guidance relieves them of this responsibility. With regard to the first issue, both activities are faced with a significant span of control issue that makes the overall purchase card environment difficult, if not impossible, to control. With an average of over 700 monthly cardholder statements at SPAWAR San Diego and only one approving official—who is also the Agency Program Coordinator—proper certification of monthly summary statements within 5 days of receipt is not physically possible. Thus, the SPAWAR San Diego approving official told us that the certification process is largely a “rubber stamp” with no real verification of the underlying cardholder support for the monthly summary statements. The environment is somewhat more manageable at the Navy Public Works Center San Diego, with six approving officials charged with certifying summary statements that cover an average of 55 cardholder statements each month. However, Public Works Center approving officials also told us that they did not review all cardholder supporting documentation before certifying purchase card statements for payment. As a result, these two Navy units paid their monthly purchase card bills without knowing whether the charges were valid. As discussed later in this statement, this has contributed to payments being made for unauthorized and improper transactions. With regard to the second issue, the June 3, 1999, policy memorandum appears to improperly assign certifying officer accountability to cardholders. The policy memorandum stated that because it is not possible for the approving official to personally review and verify individual cardholder transactions and statements of account, the approving official is to certify the purchase card statements for payment based on the presumption that all cardholder accounts are proper unless the approving official has been notified to the contrary by the cardholder. The memorandum goes on to say that, “his new policy recognizes that the ultimate responsibility for purchases being proper is with the cardholder.” However, under 31 U.S.C. 3528 and DOD’s Financial Management Regulation, certifying officers are liable for an illegal, improper, or incorrect payment as a result of an inaccurate or misleading certification. An agency may not shift certifying officer liability to other employees. The policy memorandum is also inconsistent with GAO’s internal control standard for ensuring that only valid transactions are entered into. According to DOD and Navy officials, this policy memorandum has created confusion about whether the cardholder or the approving official is responsible for proper certification of purchase card statements for payment. Transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and making decisions. This applies to the entire process or life cycle of a transaction or event from the initiation and authorization through its final classification in summary records. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) The two units we reviewed did not have controls in place to ensure that purchase card transactions were recorded to customer accounts in a timely manner and that local accounting records reflected the proper classification of expense. The timely and accurate recording of purchase card transactions is important to ensure the reliability of data and information used in day-to-day management and decision-making, particularly for working capital fund activities such as SPAWAR and the Navy Public Works Center. We have previously reported that DOD has long-standing problems accumulating and reporting the full costs associated with its working capital fund operations. The two units did not always record purchase card costs to customer accounts within required time frames. Consistent with GAO’s internal control standards and Statement of Federal Financial Accounting Standards (SFFAS), No. 4, “Managerial Cost Accounting Standards,” SPAWAR San Diego and Navy Public Works Center San Diego operating procedures require timely recording of purchase card costs to projects that received the goods and services acquired by purchase card. This is an important control because as working capital fund operations, SPAWAR and the Navy Public Works Center are to provide their customers with information on the full cost of goods and services provided—either through billing or other information. Further, working capital fund activities are to operate on a break-even basis over time—that is, not make a profit or incur a loss. Accurate and timely recording of customer transactions are key to ensuring that these working capital fund objectives are met. However, based on our tests of fiscal year 2000 purchase card transactions, we estimate that 83 percent of the SPAWAR transactions totaling at least $15.3 million and an estimated 35 percent of the Navy Public Works transactions totaling at least $5 million had not been recorded to customer or overhead accounts within 5 days of receipt of the purchase card statements. As time passes, the likelihood that documentation will be available to properly record transactions decreases. For example, because SPAWAR did not have the documentation to support timely and accurate recording of purchase card transactions, it wrote off as a loss $657,642 in fiscal year 2000 transactions that could not be identified to a specific job order. Further, according to the SPAWAR Accounting Officer, as of the end of fiscal year 2000, SPAWAR had a backlog of about $5.6 million in purchase card transactions that had not been recorded to customer accounts or its own overhead account. As a result of unrecorded transactions, year-end data on actual overhead costs used to estimate future overhead rates for billing purposes were unreliable. Navy Public Works Center San Diego officials were unable to provide reliable information on the amount of unrecorded purchase card transactions at the end of fiscal year 2000 because systems weaknesses rendered their fiscal year-end data incomplete and unreliable. In addition to problems with timely and accurate recording of transactions to customer accounts, SPAWAR San Diego and the Navy Public Works Center San Diego did not properly classify purchase card transactions in their detail accounting records to show the nature and type of expenditures made using purchase cards. Office of Management and Budget (OMB) Circular A-11, Preparation and Submission of Budget Estimates, requires federal agencies to report obligations and expenditures by object class, such as salaries, benefits, travel, supplies, services, and equipment, to indicate the nature of the expenditures of federal funds. Object classification data are reported by appropriation in the President’s Annual Budget Submissions to the Congress. OMB prepares summary reports of object class data to support budget projections and other analyses. Accurate object classification data are critical to the reliability of information reported in the President’s budget submission and budget projections and other analyses that are based on these data. In addition, because the Congress has asked for and is using object class information for its oversight activities, it is important that these data be properly recorded. We previously reported that inaccurate reporting by object class hampers congressional oversight. DOD Purchase Card Program Office guidance requires payments of monthly purchase card statements to be recorded as summary records in the Navy’s accounting systems and has directed that these summary records be recorded to the object class for supplies and materials, regardless of the nature of the expenses incurred. After purchase card statements have been paid, SPAWAR San Diego and the Navy Public Works Center San Diego are to record the individual transactions included in the summary payment record in their local accounting records. However, we determined that SPAWAR did not classify summary records related to payment of monthly purchase card statements to any expense category in the Navy’s accounting system and recorded all of the purchase card transactions in our sample to object class 25, as services, in its local accounting records. Consistent with DOD Purchase Card Joint Program Management Office guidance, the Navy Public Works Center San Diego recorded both the summary records related to payment of monthly purchase card statements and the detailed transactions to object class 26, as supplies and materials, in its local accounting system. Because SPAWAR San Diego and the Navy Public Works Center San Diego did not ensure that their detail transaction records reflected the proper classification of expense, 100 percent of the SPAWAR and Navy Public Works Center transactions in our samples were recorded to the wrong object class. For example, although the majority of the SPAWAR purchase card transactions in our sample—76 transactions totaling over $73,000— were for equipment purchases, none of these transactions were properly classified and recorded. Further, SPAWAR did not maintain sufficient documentation to determine the correct object class for 15 of the transactions in our sample totaling about $12,000. In addition, although the Navy Public Works Center recorded all of the purchase card transactions in our sample as supplies and materials, many of these transactions should have been recorded as contractual services or equipment. Also, the Navy Public Works Center did not maintain sufficient documentation to determine the proper object class for nine of the transactions in our sample totaling about $6,000. An agency must establish physical control to secure and safeguard vulnerable assets. Examples include security for and limited access to assets such as cash, securities, inventories, and equipment which might be vulnerable to risk of loss or unauthorized use. Such assets should be periodically counted and compared to control records. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) Most of the accountable items—easily pilferable or sensitive items—in our samples were not recorded in property records. Recording these items in the property records is an important step to ensure accountability and financial control over these assets and, along with periodic inventory, to prevent theft or improper use of government property. Consistent with GAO’s internal control standards, DOD’s Property, Plant, and Equipment Accountability Directive and Manual, which was issued in draft for implementation on January 19, 2000, and the Appropriation, Cost and Property Accounting procedures (referred to as the NAVSOP 1000-3M) issued by DFAS Cleveland, require accountable property to be recorded in property records as it is acquired. Accountable property includes easily pilferable or sensitive items, such as computers and related equipment, cameras, cell phones, and power tools. The NAVSOP property procedures require such property to be recorded in property records along with a description of the item, property identification number, model and serial number, manufacturer, acquisition cost, and the location or custodian of the property. Based on our tests of fiscal year 2000 purchase card transactions that included accountable property items, we estimate that SPAWAR did not record all accountable items in its property records for about 84 percent of its purchase card transactions, covering at least $5.4 million in accountable property. Based on our tests of Navy Public Works Center fiscal year 2000 purchase card transactions that included accountable property items we estimate that the Center did not record all accountable items in its property records for about 95 percent of its purchase card transactions, covering at least $317,000 in accountable property. Our analysis of the individual property items included in our sampled SPAWAR and Navy Public Works Center fiscal year 2000 purchase card transactions showed that the two units did not record a total of 46 of the 65 accountable items that were included in our sampled transactions in their property records, including 36 SPAWAR items and 10 Public Works Center items. SPAWAR officials told us that they were not aware of the requirement to record items such as computer monitors, cameras, and palm pilots in the property records. Moreover, when we asked to inspect these items, the two units could not provide conclusive evidence that 31 of them were in the possession of the government, including 19 SPAWAR items and 12 Public Works Center items. The unverified accountable items included laptop computers, Palm Pilots, and digital cameras. Of the 31 items that could not be verified, 5 items had been transferred to other locations throughout the world and SPAWAR and the Public Works Center officials were unable to conclusively demonstrate their existence and location, serial numbers for 4 items did not match those on the purchase documentation, 3 items were declared to be lost or stolen by employees who had custody of these items, and the existence of the remaining 19 items could not be verified because a serial number was not included in the purchase documentation or a receipt for the item including a serial number could not be located. The three items that were declared lost or stolen included two Palm Pilots that could not be located—one at SPAWAR San Diego and the other at the Navy Public Works Center San Diego—and a video conferencing camera that was reported stolen from a Public Works Center employee’s car. SPAWAR and Navy Public Works Center officials directed the employees to prepare lost property reports on the two Palm Pilots. Subsequently, in early June 2001, Navy Public Works Center officials advised us that their lost Palm Pilot had been located and showed us what they believed was the item in question. However, because the serial number had been rubbed off, we could not confirm that it was the accountable item acquired by purchase card. In late June 2001, SPAWAR officials advised us that their lost Palm Pilot had been located. Because we had already completed our review of SPAWAR property controls, we did not attempt to view and confirm the existence of this Palm Pilot. The third item was a video conferencing camera that was reported stolen on January 27, 2001, by a Navy Public Works Center San Diego employee. According to the employee, the video camera was stolen from his car along with a laptop computer that also belonged to the government. The employee submitted a claim to his insurance company, and the claim was paid on February 27, 2001. Although the stolen items cost about $3,876, the employee’s insurance policy limited payment of claims for business property to $2,500. However, about two months later, in May 2001, our investigators determined that the insurance check in the amount of $2,500 was deposited in the employee’s personal bank account instead of being endorsed to the government. The employee admitted to our investigators that he had been reimbursed for the stolen items from his insurance company. On May 3, 2001, the employee issued a check to the government in the amount of $2,500. Navy Public Works Center officials told us that they are considering assessing the employee for the remaining loss of $1,376 and taking possible disciplinary action for the failure to reimburse the government for the equipment loss in a timely manner. We identified several cases of potentially fraudulent, improper, and abusive transactions at both SPAWAR San Diego and the Navy Public Works Center San Diego. Given the breakdown of controls described in this testimony, the two units would have difficulty detecting and preventing these three types of transactions. We considered potentially fraudulent purchases to be those which were unauthorized and intended for personal use. Some of these instances may involve the use of compromised accounts, in which an account number was stolen and used to make fraudulent purchases. Other cases involve the cardholder making unauthorized purchases for personal use. The transactions we determined to be improper are those purchases intended for government use, but are not for a purpose that is permitted by law or regulation. We also identified as improper a number of purchases made on the same day from the same vendor, which appeared to circumvent cardholder single transaction limits. Federal Acquisition Regulation and NAVSUP Instruction 4200.94 guidelines prohibit splitting purchase card transactions into more than one segment to avoid the requirement to obtain competitive bids on purchases over the $2,500 micro- purchase threshold or to circumvent higher single transaction limits for payments on deliverables under requirements contracts. We defined abusive transactions as those that were authorized, but the items purchased were at an excessive cost or for a questionable government need, or both. In these instances, it appears that cardholders were permitted to purchase items for which there was not a reasonable, documented justification. As discussed in our Objectives, Scope, and Methodology, our work was not designed to identify, and we cannot determine, the extent of fraudulent, improper, or abusive transactions. Although both SPAWAR and the Navy Public Works Center had policies and procedures that were designed to prevent fraudulent purchases, our tests showed that the controls were not implemented as intended. For example, as discussed previously, controls for independent verification of receipt and acceptance and proper certification of monthly statements prior to payment were ineffective. Fraudulent activities must then be detected after the fact during supervisor or internal reviews and disputed charge procedures must be initiated to obtain a credit from Citibank. Table 3 shows examples of potentially fraudulent transactions that we identified from the universe of fiscal year 2000 purchases by SPAWAR San Diego and Navy Public Works Center San Diego cardholders. Navy Public Works Center San Diego officials told us that they were aware of the potentially fraudulent transactions that we identified. The officials told us that the apparently fraudulent Public Works Center transactions were all made using a limited number of cardholder accounts and that they had referred these transactions to the Naval Criminal Investigative Service. SPAWAR officials also told us that they were aware of their potentially fraudulent transactions. Both Public Works Center and SPAWAR officials said that they had submitted disputed charged forms to Citibank and had received credits for these transactions. However, given the extensive breakdowns in purchase card controls that we identified, SPAWAR and the Navy Public Works Center have no assurance that all fraudulent charges were detected. Our Office of Special Investigations is conducting a further investigation of the potentially fraudulent purchases we identified. We identified several SPAWAR San Diego transactions that involved the improper use of federal funds. For example, one case involved flowers costing $97 purchased for Secretary’s Day. We also identified several transactions for food for employee-related activities, including food costing $75 for an office outing. The Federal Acquisition Regulation, 48 C.F.R. 13.301(a), provides that the Governmentwide Commercial Purchase Card “may be used only for purchases that are otherwise authorized by law or regulations.” Therefore, a procurement using the purchase card is lawful only if it would be lawful using conventional procurement methods. Pursuant to 31 U.S.C. 1301(a), “ppropriations shall only be applied to the objects for which the appropriations were made . . . .” In the absence of specific statutory authority, appropriated funds may only be used to purchase items for official purposes, and may not be used to acquire items for the personal benefit of a government employee. For example, without statutory authority, appropriated funds may not be used to furnish meals or refreshments to employees within their normal duty stations. Free food and other refreshments normally cannot be justified as a necessary expense of an agency’s appropriation because these items are considered personal expenses that federal employees should pay for from their own salaries. Likewise, appropriated funds may not be used to purchase gifts for employees or others unless an agency can demonstrate that the items further the purposes for which the appropriation was enacted. The purchase of the flowers and food were both personal rather than official in nature and, therefore, may not be paid for with appropriated funds. Another transaction involved the purchase of a file cabinet from Macy’s at a cost of $1,462. Purchases of file cabinets are subject to rules prescribed in Title 41 of the Code of Federal Regulations, Subtitle C, “Federal Property Management Regulations System,” which cover specific procedures that must be followed to limit the purchases of new filing cabinets, including disposing of all records that have been authorized for disposition in accordance with authorized disposal schedules and transferring inactive records not needed for daily business to approved agency records centers. After taking appropriate steps to maximize the use of existing filing cabinets, if the agency determines that additional filing cabinets are required, the FAR requires the agency to submit a requisition to the General Service Administration (GSA). We found no documented evidence that the required procedures were followed. Further, we found no documented justification for purchasing the file cabinet from Macy’s instead of through GSA, as required. We also identified a number of potentially abusive transactions. These were purchases of items supposedly for official use but without any documented agency determination that these items were necessary for government business rather than merely to satisfy the personal preference of individual employees. When a contracting official—in this case, a purchase cardholder—purchases an item based on his or her own preferences (or the desires of another agency official or employee) without a management decision that the item is necessary, he or she is abusing the procurement process. Some of these items fall into categories described in GAO’s Guide for Evaluating and Testing Controls Over Sensitive Payments (GAO/AFMD-8.1.2, May 1993). The guide states that “Abuse is distinct from illegal acts (noncompliance). When abuse occurs, no law or regulation is violated. Rather, abuse occurs when the conduct of a government organization, program, activity, or function falls short of societal expectations of prudent behavior.” Our review of the transactions in our samples as well as our analytical review of the universe of SPAWAR and Navy Public Works Center fiscal year 2000 transactions identified a number of purchases that appear to be abusive, as shown in table 4. For example, SPAWAR San Diego cardholders purchased 9 flat-panel computer monitors at a total cost of $13,192. The cost of each monitor ranged from $800 to $2,500. In contrast, the current GSA schedule cost of a standard 17-inch computer monitor is about $300. We were unable to find any pre-purchase agency determination that the nature of the work performed by SPAWAR officials or employees was such that standard monitors would not satisfy their needs. SPAWAR’s commanding officer later told us that flat-panel monitors save space and energy and are easier on the eyes. However, his opinion did not constitute an official agency determination that these monitors were needed. It appears more likely that cardholders purchased these more costly monitors to satisfy the personal preferences of individual SPAWAR officials or employees. Our sample transactions also included four SPAWAR purchases of PDAs for a total cost of $1,150. We performed a similar review of the Navy Public Work Center’s fiscal year 2000 transactions and generally did not identify the same types of potentially abusive transactions. We did, however, identify nine PDA purchases for a total cost $3,642. Again, we were unable to find any pre- purchase agency determination that these officials or employees needed PDAs to perform their work. Therefore, it again appears likely that the PDAs were acquired to satisfy the personal preferences of the individuals for whom they were purchased. Our analysis of the universe of fiscal year 2000 Navy purchase card payments made by DFAS San Diego identified nearly $100 million in purchases made on the same day from the same vendor, which appeared to circumvent cardholder single transaction limits—including about $2.5 million in potential SPAWAR split purchases and nearly $4.7 million in potential Navy Public Works Center split purchases. The Federal Acquisition Regulation and Navy purchase card policies and procedures prohibit splitting a transaction into more than one segment to avoid the requirement to obtain competitive bids for purchases over the $2,500 micro-purchase threshold or to avoid other established credit limits. DOD and Navy purchase card policies and procedures prohibit such actions as improper use of the purchase card. Once items exceed the $2,500 micro-purchase threshold, they are to be purchased in accordance with simplified acquisition procedures, which are more stringent than those for micro-purchases. Our analysis of the universe of fiscal year 2000 SPAWAR San Diego and Navy Public Works Center San Diego transactions identified a number of potential split purchases. To determine whether these were, in fact, split purchases, we obtained and analyzed the supporting documentation for 20 purchases each at SPAWAR and the Navy Public Works Center. We found that in many instances, cardholders made multiple purchases from the same vendor within a few minutes or a few hours for items such as computers, computer-related equipment, and software, that involved the same, or sequential or nearly sequential purchase order and vendor invoice numbers. Based on our analyses, we concluded that 18 of the 20 SPAWAR purchases and 14 of the 20 Navy Public Works Center purchases that we examined were split into two or more transactions to avoid micro-purchase thresholds. Tables 5 and 6 provide examples of cardholder purchases that we believe represent split purchases intended to circumvent the $2,500 micro-purchase limit or cardholder transaction limits. In addition to the items in table 6, we identified three Navy Public Works Center purchases totaling $147,000 that were made to the same vendor on the same day by a cardholder with a $100,000 transaction limit. The Navy Public Works Center did not have receipts to document the items acquired. When we brought the control failures and other issues we identified to the attention of the Executive Officer at the Navy Public Works Center San Diego, he demonstrated a proactive position to identifying and correcting the weaknesses. According to the Executive Officer, because of concerns about recent instances of purchase card fraud, the Navy Public Works Center requested a Naval Audit Service review of purchase card activity and undertook a number of corrective actions as a result of auditor findings. For example, in February 2000, the Navy Public Works Center San Diego started to reduce the number of purchase cardholders, which totaled 359 at that time, to about 250, and in September 2000, the Public Works Center revised its purchase card policies and procedures to comply with NAVSUP Instruction 4200.94. In addition, due to the time required for review and proper certification of purchase card statements before payment, the Executive Officer told us that he would consider further reducing the number of cardholders to help ensure adequate review of documentation prior to certifying statements for payment. During fiscal year 2001, according to a SPAWAR acquisition official, SPAWAR reduced the number of its cardholders from over 1,500 to 1,070; however, it continued to have only one approving official who was responsible for certifying monthly summary purchase card statements, and the average number of individual monthly purchase card statements remained about the same. In addition, the SPAWAR San Diego Commanding Officer told us that SPAWAR planned to implement an Enterprise Resources Planning (ERP) system. The ERP system is expected to help improve overall controls for the purchase card program, including a central electronic file of imaged documents supporting purchase card transactions and an audit trail of actions by individuals executing various purchase card processing functions. A SPAWAR official advised us that SPAWAR implemented its ERP system in mid-July 2001. However, unless substantial improvements are made in the overall control environment and employees actually follow purchase card policies and procedures, the ERP system will simply automate the same weaknesses as the current manual process. The serious breakdown in internal controls at SPAWAR San Diego and Navy Public Works San Diego are the result of a weak overall internal control environment, flawed or nonexistent policies and procedures, and employees that do not adhere to valid policies. The proliferation of cardholders at these two activities resulted in over 1,700 cardholders with essentially the authority to make their own purchase decisions in an environment that lacked basic controls over receipt of government property, certification of monthly statements, and accountability over sensitive property items. Our work found that these weak internal controls resulted in lost, stolen, missing, or misused government property, potentially abusive use of purchase cards, and payment of unauthorized and potentially fraudulent charges. The combination of these factors also contributed to the five known fraud cases and leaves the government highly vulnerable to significant additional fraud, waste, and abuse from the purchase card program at these two Navy units. Following this testimony, we plan to issue a report that will include recommendations to DOD and the Navy for improving internal controls over purchase card activity. Mr. Chairman, Members of the Subcommittee, and Senator Grassley, this concludes my prepared statement. I would be pleased to respond to any questions that you may have. For future contacts regarding this testimony, please contact Gregory D. Kutz at (202) 512-9095. Individuals making key contributions to this testimony included Wendy Ahmed, Christie Arends, Bertram Berlin, Sharon Byrd, Francine DelVecchio, Stephen Donahue, Michael Chambless, Douglas Ferry, Gayle Fischer, Kenneth Hill, Wilfred Holloway, Jeffrey Jacobson, John Kelly, Richard Larsen, John Ryan, and Sidney Schwartz. The Navy’s purchase card program is part of the Governmentwide Commercial Purchase Card Program, which was established to streamline federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. DOD reported that it used purchase cards for 95 percent of its eligible transactions—more than 10 million transactions, valued at $5.5 billion—in fiscal year 2000. The Navy’s reported purchase card activity represented nearly one third of the reported DOD total during fiscal year 2000—2.7 million transactions, valued at $1.7 billion. According to unaudited DOD data, SPAWAR and Navy Public Works Center San Diego-based activities accounted for $68 million (about 15 percent) of the $451 million in fiscal year 2000 Navy purchase card payments processed by DFAS San Diego. Although SPAWAR San Diego and the Navy Public Works Center San Diego are both working capital fund activities, their missions are very different. SPAWAR San Diego is a highly technical systems operation staffed by scientists and engineers who provide research, technology, and engineering support to other Navy programs worldwide. The Navy Public Works Center San Diego provides maintenance, construction, and operations support to other Navy programs in the San Diego area. Under the Federal Acquisition Streamlining Act of 1994, the Defense Federal Acquisition Regulation Supplement guidelines, eligible purchases include (1) micro-purchases (transactions up to $2,500 for which competitive bids are not needed); (2) purchases for training services up to $25,000; and (3) payment of items costing over $2,500 that are on the General Services Administration’s (GSA) pre-approved schedule, including items on requirements contracts. The streamlined acquisition threshold for such contract payments is $100,000. Accordingly, cardholders may have single transaction purchase limits of $2,500 or $25,000, and a few cardholders may have transaction limits of up to $100,000 or more. Under the GSA blanket contract, the Navy has contracted with Citibank for its purchase card services, while the Army and the Air Force have contracted with U.S. Bank. The Federal Acquisition Regulation, Part13, “Simplified Acquisition Procedures,” establishes criteria for using purchase cards to place orders and make payments. U.S. Treasury regulations issued pursuant to provisions of law in 31 U.S.C. 3321, 3322, 3325, 3327, and 3335, govern purchase card payment certification, processing, and disbursement. DOD’s Purchase Card Joint Program Management Office, which is in the office of the Assistant Secretary of the Army for Acquisition, Logistics, and Technology, has established departmentwide policies and procedures governing the use of purchase cards. The Under Secretary of Defense (Comptroller) has established related financial management policies and procedures in various sections of DOD’s Financial Management Regulation. The Navy Supply Systems Command is responsible for the overall management of the Navy’s purchase card program, and has published the Navy Supply Command (NAVSUP) Instruction 4200.94, Department of the Navy Policies and Procedures for Implementing the Governmentwide Purchase Card Program. Under the NAVSUP Instruction, each Navy Command’s head contracting officer authorizes purchase card program coordinators in local Navy units to obtain purchase cards and establish credit limits. The program coordinators are responsible for administering the purchase card program within their designated span of control and serve as the communication link between Navy units and the purchase card issuing bank. When a supervisor requests that a staff member receive a purchase card, the agency program coordinator is to first provide training on purchase card policies and procedures and then establish a credit limit and issue a purchase card to the staff member. The Navy had a total of about 1,700 purchase card program coordinators during fiscal year 2000, including one program coordinator at SPAWAR San Diego and one at the Navy Public Works Center San Diego. Purchase cardholders are delegated contracting officer ordering responsibilities, but they do not negotiate or manage contracts. SPAWAR San Diego and Navy Public Works Center San Diego cardholders use purchase cards to order goods and services for their units as well as their customers. Cardholders may pick up items ordered directly from the vendor or request that items be shipped directly to end users (requestors). Upon receipt of items acquired by purchase cards, cardholders are to record the transaction in their purchase log and obtain independent confirmation from the end user, their supervisor, or another individual that the items have been received and accepted by the government. They are also to notify the property book officer of accountable items received so that these items can be recorded in the accountable property records. The purchase card payment process begins with receipt of the monthly purchase card billing statements. Section 933 of the National Defense Authorization Act for Fiscal Year 2000, Public Law 106-65, requires DOD to issue regulations that ensure that purchase card holders and each official with authority to authorize expenditures charged to the purchase card reconcile charges with receipts and other supporting documentation. NAVSUP Instruction 4200.94 states that upon receipt of the individual cardholder statement, the cardholder has 5 days to reconcile the transactions appearing on the statement by verifying their accuracy to the transactions appearing on the statement and notify the approving official in writing of any discrepancies in the statement. In addition, under the NAVSUP Instruction, the approving official is responsible for (1) ensuring that all purchases made by the cardholders within his or her cognizance are appropriate and that the charges are accurate and (2) the timely certification of the monthly summary statement for payment by DFAS. The Instruction further states that within 5 days of receipt, the approving official must review and certify for payment the monthly billing statement, which is a summary invoice of all transactions of the cardholders under the approving official’s purview. The approving official is to presume that all transactions on the monthly statements are proper unless notified in writing by the purchase cardholder. However, the presumption does not relieve the approving official from reviewing for blatant improper purchase card transactions and taking the appropriate action prior to certifying the invoice for payment. In addition, the approving official is to forward disputed charge forms to the unit’s comptroller’s office for submission to Citibank for credit. Under the Navy’s contract, Citibank allows the Navy up to 60 days after the statement date to dispute invalid transactions and request a credit. Upon receipt of the certified monthly purchase card summary statement, a DFAS vendor payment clerk is to (1) review the statement and supporting documents to confirm that the prompt payment certification form has been properly completed and (2) subject it to automated and manual validations. The purpose of the automated validation is to confirm that a SPAWAR or a Navy Public Works Center obligation for a purchase card invoice has been recorded in their respective cost accounting systems in an amount sufficient to cover the payment. Quality control clerks manually verify that purchase card statement and payment data were correctly entered in the Navy’s vendor payment (disbursing) system—STARS 1-Pay. Once the payment has passed these validation tests, the quality control supervisor authorizes the statement for payment. The DFAS vendor payment system then batches all of the certified purchase card payments for that day, generates a tape for payment by electronic funds transfer to the purchase card bank, and sends the file to the accounting station for recording the payment as a summary record in the Navy’s accounting system. Figure 1 illustrates the current purchase card payment process used by SPAWAR and the Naval Public Works Center in San Diego. The Navy earns purchase card rebate revenue from Citibank of up to 0.8 percent based on sales volume (purchases) and payment timeliness. According to the DOD Deputy Director of DOD’s Purchase Card Joint Program Management Office, rebate revenue is generally to be recorded to the purchase card statements and used to offset monthly charges. Pursuant to Senator Grassley’s request, we identified five fraud cases related to Navy programs based in the San Diego, California, area and investigated by the Naval Criminal Investigative Service (NCIS). All of these cases can be linked to the types of internal control weaknesses discussed in this testimony. Of these five cases, two involved Navy Public Works Center San Diego employees and one involved 2,600 compromised purchase card accounts, including 22 currently active SPAWAR San Diego accounts. One of the remaining cases, which has been concluded, was related to a fraud that occurred at the Navy’s Millington (Tennessee) Flying Club—an activity of the Navy Morale, Welfare, and Recreation entity, which is based in San Diego. The other case involved a military officer and other service members who were assigned to the Marine Corps Station in Miramar, near San Diego. The first San Diego-related purchase card fraud case is an example of the lack of segregation of duties. This case involved the cardholder at the Navy’s Millington (Tennessee) Flying Club, an entity of the U.S. Navy’s Morale, Welfare, and Recreation activity, which is based in San Diego, California. The cardholder, who was having financial problems, was hired by her stepfather, who was the club’s treasurer. The stepfather delegated nearly all purchase card duties to the cardholder, as well as the authority for writing checks to pay the Flying Club’s monthly purchase card statements. The cardholder made over $17,000 in fraudulent transactions to acquire personal items from Wal-Mart, The Home Depot, shoe stores, pet stores, boutiques, an eye care center, and restaurants over an 8-month period from December 1998 through July 1999. The fraud was identified when the club’s checking account was overdrawn due to excessively high purchase card payments and a bank official contacted the president of the Flying Club. The cardholder pleaded guilty and was sentenced to 15 months in jail and assessed about $28,486 in restitution due to purchase card fraud and bounced checks. The defendant commented that illegal use of the card was “too easy” and that she was the sole authorizer of the card purchases. The second case involved a military officer and other service members who were assigned to the Marine Corps Station in Miramar, near San Diego, California. This alleged fraud occurred through collusion, and internal controls will not prevent collusion. However, adequate monitoring of purchase card transactions along with enforcing controls such as documentation of independent confirmation of receipt and acceptance and recording accountable items in property records would have made detection easier. In this instance, the military officer allegedly conspired with cardholders under his supervision to make nearly $400,000 in fraudulent purchases from five companies—two that he owned, one owned by his sister, and the other two owned by friends or acquaintances. They charged thousands of dollars for items such as DVD players, Palm Pilots, and desktop and laptop computers. The officer also allegedly made cash payments to employees to keep silent about the fraud and provided auditors with falsified purchase authorizations and invoices to cover the fraud. The fraud occurred from June 1999 through September 2000. The total amount of the alleged fraud is unknown. The alleged fraud was identified based on a tip from a service member. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution and four other active service members are under investigation. The third case involved a Navy Public Works Center San Diego maintenance/construction supervisor who allegedly made at least $52,000 in fraudulent transactions to a suspect contractor on work orders for which the work was not performed by that contractor. Adequate monitoring of purchase card transactions along with enforcing controls such as independent, documented receipt and acceptance and recording accountable items in property books would have made detection easier. Navy investigators believe that the employee also may have used his government purchase card to make unauthorized purchases for personal use, including jewelry, an air conditioner, and other personal items from The Home Depot from April 1997 through October 1998. The total amount of this alleged purchase card fraud is unknown. The alleged fraud was identified when the employee’s supervisor reviewed Navy Public Works Center work orders and noticed that four work orders totaling approximately $7,000 were completed by the employee and paid for with the suspect’s government purchase card. Further inquiry by the supervisor revealed that Navy Public Works Center employees, not the contractor, had completed the work. NCIS investigators and Naval Audit Service auditors identified approximately $52,000 in purchase card transactions made by the employee to a suspect contractor for work that was performed by either the Public Works Center or other legitimate contractors. The employee has resigned and an investigation by the Federal Bureau of Investigation and NCIS is ongoing. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution. The fourth case involved a Navy Public Works Center San Diego purchasing agent that allegedly made at least $12,000 in fraudulent purchases and planned to submit approximately $103,000 in fraudulent disputed charge forms, including payments for hotels, airline tickets, computers, phone cards, and personal items from The Home Depot. The alleged fraud occurred from April 1997 through July 1999. As with the other cases, adequate monitoring of purchase card transactions along with enforcing controls such as independent, documented receipt and acceptance and recording accountable items in property books would have made detection easier. The alleged fraud was identified during an investigation of a possible bribery/kickback scheme. The employee has resigned and an NCIS investigation is ongoing. The U.S. Attorney’s Office in San Diego has accepted the case for prosecution. The fifth Navy purchase card fraud case is ongoing and involves the compromise of up to 2,600 purchase card accounts assigned to Navy activities in the San Diego area. Investigators were only able to obtain a partial list consisting of 681 compromised accounts so the exact number is not known. At least 45 of the compromised accounts were for SPAWAR San Diego and one of the compromised accounts was for the Navy Public Works Center in San Diego. Of these 46 compromised accounts, 22 SPAWAR San Diego accounts were still active in May 2001. None of the active accounts on the partial listing found by investigators were for the Navy Public Works Center San Diego. Although the account numbers showed up on a computer printer in a community college library in San Diego in September 1999, the Navy has not canceled all of the compromised accounts. Instead, according to NCIS and Navy Supply Command officials, the Navy is canceling the compromised accounts as fraudulent transactions are identified. Naval Supply Systems Command, SPAWAR San Diego, and Navy Public Works Center San Diego officials told us that they were aware of this incident but did not have a listing of the account numbers affected. As a result, the Navy did not take any measures to flag the compromised accounts and implement special monitoring procedures to detect any potential fraudulent use of these accounts. According to Navy investigators, as of January 2001, at least 30 of the compromised account numbers had been used by 27 alleged suspects to make more than $27,000 in fraudulent transactions for pizza, jewelry, phone calls, tires, and flowers. As of May 21, 2001, 22 of the compromised SPAWAR accounts were still active. Our review of the monthly credit limits associated with the 22 compromised accounts showed that SPAWAR continued to have an aggregate monthly financial exposure of $900,000 associated with these accounts nearly 2 years after the compromised list was discovered in a San Diego community college library in September 1999. Further, with the lack of controls over receipt of goods and certification of purchase card statements that we identified at the two activities we reviewed, it is impossible for the Navy to identify fraudulent purchases as they occur or to determine the extent of the fraudulent use of the compromised accounts. As a result, when fraudulent use of one of the comprised accounts was identified, the Navy could not determine if the incident was due to cardholder fraud or use of the compromised account by an outside party. A joint task force in San Diego, comprised of NCIS, the U.S. Secret Service, local police, and the U.S. Attorney’s Office, investigated this fraud. The task force investigators recently traced the list of compromised accounts to a vendor used by the Navy, which acknowledged that the list came from its database. The vendor identified two former employees as possible suspects. Pursuant to Senator Grassley’s request, we obtained and reviewed information on five fraud cases related to Navy purchase card programs in the San Diego, California, area and to review purchase card controls and accounting for two Navy units based in San Diego—the Space and Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public Works Center. Our assessment of SPAWAR San Diego and the Navy Public Works Center San Diego purchase card controls covered the overall management control environment, including (1) span of control issues related to the number of cardholders, (2) training for cardholders and accountable officers, (3) management of rebates, and (4) monitoring and audit of purchase card activity; tests of statistical samples of key controls over purchase card transactions, including (1) documentation of independent confirmation that items ordered by purchase card were received, (2) proper certification of purchase card statements for payment, and (3) proper accounting for purchase card transactions; substantive tests of accountable items in our sample transactions to verify whether they were recorded in property records and whether they could be found; and analysis of the universe of transactions to identify (1) any potentially improper, fraudulent, and abusive transactions and (2) purchases that were split into one or more transactions to avoid micro-purchase thresholds or other credit limits. We used as our primary criteria applicable laws and regulations; our Standards for Internal Control in the Federal Government; and our Guide for Evaluating and Testing Controls Over Sensitive Payments. To assess the management control environment, we applied the fundamental concepts and standards in the GAO internal control standards to the practices followed by management in the four areas reviewed. To test controls, we selected stratified random probability samples of 135 SPAWAR San Diego purchase card transactions from a population of 47,035 transactions totaling $38,357,656, and 121 Navy Public Works Center San Diego transactions from a population of 53,026 transactions totaling $29,824,160 that were recorded by the Navy during fiscal year 2000. We stratified the samples into two groups—transactions from computer vendors and other vendors. With this statistically valid probability sample, each transaction in the population had a nonzero probability of being included, and that probability could be computed for any transaction. Each sample element was subsequently weighted in the analysis to account statistically for all the transactions in the population, including those that were not selected. Table 7 presents our test results on three key transaction-level controls and shows the confidence intervals for the estimates for the universes of fiscal year 2000 purchase card transactions made by SPAWAR and the Navy Public Works Center in San Diego. Our analytical reviews covered the universe of fiscal year 2000 purchase card transactions for the two units’ San Diego-based activities covered about 47,000 transactions totaling about $38 million at SPAWAR San Diego and about 53,000 transactions totaling about $30 million at the Navy Public Works Center San Diego. For these reviews, we did not look for all potential abuses of purchase cards. For example, because a large number of store receipts (such as those from The Home Depot) were missing, we were unable to determine whether certain purchases were made for personal use. In addition, we did not physically examine purchases made to determine whether goods and services were received and used for government purposes. While we identified some improper and potentially fraudulent and abusive transactions, our work was not designed to identify, and we cannot determine, the extent of fraudulent, improper, or abusive transactions. We briefed DOD managers, including officials in DOD’s Purchase Card Joint Program Management Office and the Defense Finance and Accounting Service, and Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego officials on the details of our review, including our objectives, scope, and methodology and our findings and conclusions. We conducted our audit work from August 2000 through June 2001 in accordance with generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. Following this testimony, we plan to issue a report, which will include recommendations to DOD and the Navy for improving internal controls over purchase card activity. Web site: http://www.gao.gov/fraudnet/fraudnet.htm e-mail: fraudnet@gao.gov 1-800-424-5454 (automated answering system)

Summary: This testimony discusses internal controls weaknesses that left two Navy units in San Diego, California, vulnerable to purchase card fraud and abuse. GAO found a proliferation of purchase cards at the two units in San Diego--the Space and Naval Warfare Systems Command and the Navy Public Works. In the end, more than 1,700 cardholders essentially had the authority to make their own purchase decisions. A serious breakdown in internal controls over the receipt of government property and the certification of monthly statements, coupled with flawed or nonexistent policies and procedures and the failure of Navy employees to adhere to valid policies and procedures, led to (1) the loss, theft, and misuse of government property; (2) the potential abuse of purchase cards; and (3) payments of potentially fraudulent charges. Five fraud cases have already been identified, and the government remains extremely vulnerable to fraud, waste, and abuse arising from the purchase card program at the two Navy units. This testimony summarized the November report, GAO-02-32 .