The General Services Administration (GSA) administers the federal government’s contracts in support of agencies’ purchase card programs. GSA contracts with commercial banks to issue purchase cards to federal employees to make official government purchases. Citibank issues purchase cards to VA operating administrations, including VHA. Use of the purchase card is intended to streamline federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. VA’s purchase card program, including VHA, also includes the use of convenience checks to pay vendors that do not accept purchase cards as payment. VA is subject to the Federal Acquisition Regulation (FAR), which governs the acquisition of goods and services by all executive agencies. To implement and supplement these regulations, VA issues the Department of Veterans Affairs Acquisition Regulations (VAAR), which prescribes VA procurement policies and procedures. To implement and supplement the VAAR, VA issues directives that set forth policy, and handbooks, that prescribe procedures for implementing the applicable policy. For the purchase card program, VA issued departmentwide guidance, VA Directive 4080, Government Purchase Card Policy, and VA Handbook 4080, Government Purchase Card Procedures, both dated April 4, 2003. VA has separate policies and procedures for the use of convenience checks related to the purchase card program: VA Directive 4010, Agent Cashier Policy, and VA Handbook 4010, Agent Cashier Procedures, both dated October 17, 1994; and VA Directive 4070, Cash Management, and VA Handbook 4070.2, Disbursement Mechanisms, both dated April 21, 1997. VHA Directive 1730.1 Use of the Government Purchase Card in VHA, (May 19, 2003) and VHA Handbook 1730.1, Use and Management of the Government Purchase Card Program (June 14, 2000) provide policies and procedures that VHA facilities and program offices must follow when using the government purchase card. VHA uses this guidance, in conjunction with VA’s departmentwide guidance, to operate its VHA purchase card program. VA and VHA mandate the use of the purchase card for all micro- purchases – acquisitions of supplies and services generally at or below $2,500 and provides that the purchase card must be used to the maximum extent practical for all purchases up to the simplified acquisition threshold, currently $100,000. In fiscal year 2002, VHA used purchase cards and convenience checks to make 2.8 million purchases totaling $1.4 billion. During this time frame, about 14,000 of the approximately 188,000 VHA employees, or 7 percent of the VHA workforce, had purchase cards or convenience check accounts. For the purchase cards, a majority of the cardholders had single purchase limits between $2,500 and $25,000. For the convenience checks, the single purchase limits were either set at $2,500 or $10,000. The VHA Chief Financial Officer (CFO) has overall responsibility for the implementation and oversight of the purchase card program within VHA. A facility director and/or regional office director at each of VHA’s 21 Veterans Integrated Service Network (VISN) is responsible for implementing the purchase card program at the local level. These officials are also responsible for designating an agency or organization program coordinator (A/OPC) to oversee the purchase card program at each facility within the director’s geographic area. There are approximately 162 VHA medical centers and about 148 local A/OPCs responsible for the primary management of the purchase card activity at their facilities. Generally, at each facility, personnel in three positions – A/OPC, cardholder, and approving official – are collectively responsible for providing reasonable assurance that purchase card transactions are appropriate and meet a valid government need. The A/OPC is responsible for the day-to-day management, administration, and oversight of the program such as ensuring appropriate training has been provided, setting up cardholder and approving official accounts, retrieving and canceling all unneeded cards, and performing reviews of purchase card activity to ensure compliance with applicable laws, regulations, policies and procedures. VHA’s purchase card guidance states that the A/OPC cannot be a cardholder or an approving official. The cardholders are responsible for making purchases, inputting purchase information in the local purchasing system, maintaining supporting documentation, and electronically reconciling their purchases by matching the payment charges from the purchase card program contractor to the local purchasing system. The approving officials, who typically are responsible for more than one cardholder, are charged with monitoring purchase card usage to ensure compliance with applicable laws and regulations and VA/VHA policies and procedures, are to ensure applicable documentation is maintained, and according to VHA guidance, certify, through an electronic signature, that all procurements are legal and proper and that the items have been received. VA’s guidance also provides that in most cases, the approving official should not be a cardholder. However, where staffing levels necessitate, the approving official may be a cardholder, but cannot approve his or her own transactions. VHA’s purchase card program also allows the use of convenience checks to pay vendors that do not accept credit cards. VA’s disbursement mechanism policy provides that convenience checks be used in lieu of cash but only when the government purchase card cannot be used. Agent cashiers are responsible for making payments to the payee upon receiving authorization and supporting purchase documentation from the office requesting payment, reconciling the check payments as they clear VA’s purchase card account, and maintaining a copy or carbon copy of the check for a period of one year. On February 12, 1999, the OIG issued a report of VA’s purchase card program. The OIG reported that management controls were not effectively implemented to ensure the integrity of the purchase card program and that maximum benefits were not being realized. Among other things, the OIG found weaknesses related to account reconciliation and certification, documentation, split purchases, and safeguarding of purchase cards. The OIG made several recommendations for corrective action. During the period March 1999 through September 2003, the OIG issued an additional 83 reports that continued to identify internal control weaknesses in the VA’s purchase card program. A summarization of these results, was reported in the OIG’s April 26, 2004 report on its evaluation of VA’s purchase card program. Specifically, during this time frame, the OIG reported 5 fraud cases totaling $435,900. The fraud cases involved former and current employees and in one instance, a non-VA employee. Items purchased included computers, televisions, stereos, DVD and CD players, a diamond ring, and other merchandise. The OIG reported that generally, cardholders were able to commit purchase card fraud because approving officials did not ensure that purchases were legal and proper and that items had been received and were for official government use. In addition, the OIG reported it had identified 457 improper or questionable purchases totaling $1.1 million that did not comply with the FAR, VA policy, or were not adequately supported by documentation. The improper and questionable purchases included (1) procurements over the $2,500 micro- purchase threshold without the use of competition, (2) purchases split into two or more transactions to circumvent the micro-purchase limit, (3) use of the purchase card by someone other than the cardholder, and (4) recurring purchases from the same vendor where the cardholders did not maintain vendor documentation to support the purchases. The OIG made two new recommendations in its 2004 report that (1) direct VA facility managers to conduct quarterly audits, (2) provide for the development and implementation of procedures and checklists for approving officials to use in monitoring cardholder activity, (3) update VA’s purchase card policy to include span of control criteria for approving officials, and (4) expand internal audit procedures to include identifying questionable purchases through data mining. The OIG reported that the Under Secretary for Health, the Under Secretary for Benefits, and the Assistant Secretary for Management agreed with the findings and recommendations and provided acceptable improvement plans. To determine whether existing controls at VHA were designed to provide reasonable assurance that improper purchases would be prevented or detected in a normal course of business, we obtained an understanding of VA/VHA’s purchase card and convenience check policies and procedures, and the related internal controls. We then assessed the adequacy of those controls using various GAO prescribed guidance and by performing detailed tests of transactions. Specifically, we reviewed applicable laws and regulations, VA and VHA directives and handbooks, and previous reports issued by VA’s OIG, conducted walkthroughs and telephone interviews with VHA personnel to identify key purchase card and convenience check policies and procedures, assessed the adequacy of internal controls, using our Audit Guide: Auditing and Investigating the Internal Control of Government Purchase Card Programs, Standards for Internal Control in the Federal Government, Internal Control Management and Evaluation Tool, Guide for Evaluating and Testing Controls Over Sensitive Payments, and Executive Guide: Strategies to Manage Improper Payments, and performed tests of those control activities that we considered to be key in creating a system to provide reasonable assurance that transactions are correct and proper throughout the purchase card procurement process and convenience check payment process. The key internal control activities we tested included the following. Segregation of duties – (1) independent receiving and acceptance of goods and services by someone other than the cardholder, and (2) dividing key duties and responsibilities among different people to reduce the risk of error or fraud, Adequate supporting documentation – (1) cardholders and agent cashiers obtaining and maintaining invoices or other documentation that support their purchases and provide a basis for reconciling purchases, (2) agent cashiers obtaining written authorization to disburse funds for payment, and (3) agent cashiers maintaining copies of checks issued, and Timely recording of transactions and events – prompt recording, reconciliation, and review of transactions in VHA’s electronic purchase card order system. In addition, although not a primary focus of the internal control testing, we reviewed purchase card and convenience check supporting documentation to determine whether any vendor-offered discounts were taken for purchased goods. We also inquired of and reviewed VHA’s monitoring procedures over the purchase card program to determine if ongoing monitoring occurred in the normal course of operations. To determine whether purchase card and convenience check expenditures were made in compliance with applicable laws and regulations, we reviewed the Federal Acquisition Regulation, VA’s acquisition regulation, and VA/VHA policies and procedures, and performed tests of federal and agency acquisition requirements related to the purchase card procurement process and convenience check payment process. To perform tests of internal controls and applicable laws and regulations, we selected purchase card and convenience check transactions using two different methods. For each method of selection, we provided VHA with the transactions selected and obtained and reviewed related supporting documentation. The two methods are as follows. Data Mining. We performed data mining on VA’s Financial Service Center (FSC) database of fiscal year 2002 purchase card and convenience check transactions for indicators of potential noncompliance with established policies and procedures. Specifically, we looked for purchases that were split into two or more transactions to circumvent single purchase limits, convenience check purchases that exceeded established limits, purchases made against designated blocked merchant category codes (MCCs), A/OPCs with card accounts, cardholders who were payees on convenience checks, ratio of cardholders assigned to approving officials, comparison of single and monthly credit limits to actual purchase card activity, former employees who had active purchase card accounts after their separation dates, and purchases from vendors on the Department of Health and Human Services Office of Inspector General (DHHS OIG) Exclusion List. We forwarded the results of the transactions that met the specific criteria to the VHA Central Office in Washington, D.C. to obtain responses and related documentation, which we used to assess whether in fact these were violations of applicable laws and regulations or policy. We also asked Citibank, VHA’s purchase card program contractor, to extract from its database of VHA cardholders, all inactive VHA purchase card accounts. We analyzed this data and forwarded our results to the VHA Central Office for further review and assessment of cardholders’ ongoing need for the card. Statistical Sampling. We selected five stratified random statistical samples of purchase card and convenience check transactions from five populations of purchase card and convenience check transactions paid from October 1, 2001 through September 30, 2002. See table 1 below for a description of each sample and their related populations which were aggregated from a database of all purchase card and convenience check transactions for fiscal year 2002 to test specific control activities and compliance with applicable laws and regulations, and policies. We stratified transactions in each sample on the basis of the total dollar values for each population. Sample units in each sample were subsequently weighted in the analysis to account statistically for all the transactions in the population, including those that were not selected. Results from these statistical samples were projected to their respective populations of purchase card and convenience check transactions for fiscal year 2002. To determine whether purchases were made for a reasonable cost and a valid government need, we selected transactions on a nonstatistical basis to allow us to identify transactions that appeared to have a higher risk of fraud, waste, or abuse, although the results cannot be projected to the overall population of purchases. To select these transactions, we first performed data mining on fiscal year 2002 transactions to identify purchases from certain vendors that would more likely be selling unauthorized or personal use items; purchases made on the weekends, during holidays, or at fiscal year-end; purchases from travel-related vendors; and purchases of sensitive assets. This resulted in tens of thousands of transactions identified, from which we then selected 982 transactions totaling $1.2 million to test whether these purchases were made at excessive cost and/or for questionable government need, and whether they complied with select purchasing regulations, policies, and procedures. While we identified some improper purchases, our work was not designed to identify all fraudulent or otherwise improper purchases made by VA. We conducted our review from April 2003 through April 2004 in accordance with generally accepted government auditing standards. VHA’s internal controls were not designed to provide reasonable assurance that improper purchase card and convenience check purchases would not occur or would be detected in the normal course of business. We found that VHA lacked adequate segregation of duties between purchasing and receiving goods; that purchase card and convenience check transactions often did not have key supporting documents; that timeliness standards for recording, reconciling, and reviewing transactions were not met; and that cardholders did not consistently take advantage of vendor-offered purchase discounts. Generally, we found that internal controls were not operating as intended because cardholders and approving officials were not following VA/VHA operating guidance governing the program, and in the case of documentation and vendor-offered discounts, lacked guidance. We also noted instances where monitoring activities could be strengthened through prescribed operating procedures to decrease the risk of improper purchases. Effective internal controls are the first line of defense in safeguarding assets and in preventing and detecting fraud. In addition, they help to ensure that actions are taken to address risks, and are an integral part of an entity’s accountability for the stewardship of government resources. Our Standards for Internal Control in the Federal Government requires that (1) key duties and responsibilities be divided or segregated among different people to reduce the risk of error or fraud, (2) all transactions and other significant events be clearly documented and readily available for examination, and other significant events be authorized and executed only by persons acting within the scope of their authority, (3) transactions should be promptly recorded to maintain their relevance and value to management in controlling operations and decisions, and (4) internal control monitoring be performed to assess the quality of performance over time and ensure that audit findings are promptly resolved. Similarly, internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives. Control activities occur at all levels and functions of the entity. They include a wide range of diverse activities such as approvals, authorizations, verifications, reconciliations, performance reviews, and the production of records and documentation. VHA lacked adequate segregation of duties regarding independent receiving of goods and separation of responsibilities within the purchasing process. Independent receiving–receiving of goods and services by someone other than the cardholder– provides additional assurance that purchased items are not acquired for personal use and that the purchased items come into the possession of the government. Such separation of responsibilities within the purchasing process reduces the risk of error or fraud. From our purchase card internal control testing, we estimate that $75 million in transactions did not have evidence that independent receiving of goods had occurred. In addition, our data mining of the purchase card and convenience check activity identified 15 A/OPCs who were also cardholders that collectively made 9,411 purchases totaling $5.5 million during fiscal year 2002. Because A/OPCs are responsible for monitoring cardholders’ and approving officials’ activities for indications of fraud, waste, and abuse, these A/OPCs were essentially monitoring their own activities. VA’s and VHA’s purchase card guidance varied regarding segregation of duties within the purchasing process. VHA’s guidance does not require independent receiving by someone other than the cardholder; however, it does state that cardholders are responsible for ensuring that goods and services ordered are received. In addition, VA’s current guidance, dated April 4, 2003, makes no mention of the receiving function regarding cardholder purchases. The guidance only requires a clear separation of duties for authorizing transactions, making purchases, and recording transactions. Although there is no written agency-wide requirement for independent receiving, agency officials informed us that the purchase card order system includes an option that allows for independent receiving when a cardholder creates a detailed purchase card order in the system. Specifically, the cardholder can select an option that requires independent receiving of goods at the applicable VHA facility warehouse. Once goods are physically received and notated to that effect via an electronic signature in the purchase card order system, the cardholder can print the receiving report and maintain it in his or her files. Although this option is available, we found that cardholders did not consistently select the detailed process option when creating a purchase card order in the system. One of the factors contributing to this inconsistency is the ambiguity of the criteria that VA has instituted for determining when the detailed process option should be selected for creating a purchase card order. According to the purchase card order system’s user guide, the cardholder should use the detailed process option to keep track of specific items in the inventory system. However, this user guide does not identify the types of procured goods that should be inventoried, tracked, and accounted for by this system. To test the independent receiving function, we requested certain system data print screens for each transaction included in the purchase card internal control sample to determine whether the cardholder had created a detailed purchase card order that would allow for independent receiving. From the documentation provided, we determined that 142 of the 283 sample transactions were detailed purchase card orders and thus, had characteristics of independent receiving. Of the 142, we found 16 transactions totaling $70,475 where cardholders did not provide evidence that independent receiving had occurred. Based on the results of our review, we estimate that $75 million of the total sampled population of purchase card transactions lacked evidence of independent receiving. We believe documented independent receiving is a basic internal control activity that provides additional assurance to the government that purchased items come into the possession of the government. Another weakness we identified regarding segregation of duties included A/OPCs who are also cardholders. VHA’s purchase card guidance explicitly prohibits A/OPCs from being cardholders. When A/OPCs perform in this dual capacity, they are essentially monitoring their own activities. During our data mining of the purchase card and convenience check activity, we identified 15 of 180 A/OPCs who were also cardholders and had collectively made 9,411 purchases totaling $5.5 million during fiscal year 2002. When we inquired about the dual responsibilities, we were told that certain VHA facilities cannot adequately segregate purchasing duties because of the small number of employees located at those sites and that management is aware of the dual responsibilities. Although this segregation of duties issue was prevalent during fiscal year 2002, our period of review, it has been largely rectified, since all but one A/OPC account had been closed as of the end of fieldwork. Regarding the open account, the national program coordinator provided us a copy of a memorandum, dated December 1, 1997, from the Chief of Acquisition and Material Management to the director of that facility requesting approval to keep the A/OPC as a cardholder because the office has no other staff to perform these cardholder responsibilities. In the memorandum, the Chief also stated that the office has a “double check audit” in place to ensure there are no problems with any of the A/OPC’s purchases. We found instances where purchase card and convenience check transactions lacked key supporting documentation such as internal written authorization for convenience check disbursements and vendor invoices that independently support the description and quantity of what was purchased and the price paid. We also found that VHA’s purchase card guidance does not address the types of documentation that cardholders should maintain to support purchases made. The guidance only addresses documentation requirements in its audit guide, which is an appendix to the purchase card guidance that provides instructions to internal reviewers when performing their monitoring functions. Furthermore, we noted that VA’s operating guidance for convenience checks has no requirement that vendor documentation be provided before checks are issued. The guidance only provides that sufficient documentation, such as a VA-created purchase order, must be evident before checks are issued. The invoice is a key document in purchase card internal control activities. Without an invoice, independent evidence of the description and quantity of what was purchased and the price charged is not available. In addition, the invoice is the basic document that should be forwarded to the approving official or supervisor so that he or she can perform an adequate review of the cardholder’s purchases. In testing for evidence of an invoice, we accepted either a copy of the invoice, sales receipt, packing slip, in cases where the item description could be directly traced to the cardholder’s detailed purchase card order, and the purchase card order amount agreed to the charged amount, or other store receipt. Of the 283 purchase card sample transactions, 74 transactions totaling $2.1 million lacked an invoice, credit card slip, or other adequate vendor documentation to support the purchase. Based on these results, we estimate that $312.8 million of the fiscal year 2002 purchase card transactions lacked key supporting documentation. For the convenience check sample, we found 35 of 255 transactions totaling $43,669 lacked the same key documentation. Based on these results, we estimate that $3.8 million of the fiscal year 2002 convenience check transactions lacked key supporting documentation. We also noted missing documentation in the other three statistical samples (purchases over $2,500, purchase card split purchases, and convenience checks exceeding established limits) and one nonstatistical sample. For the three statistical samples, in instances where VHA did not provide documentation to us to perform our test work, we reported these purchases as exceptions for each attribute tested. Based on our audit work, we estimate that $45.9 million of the fiscal year 2002 purchase card and convenience check transactions had missing documentation. For the nonstatistical sample, we reported all transactions with key missing documentation as questionable transactions, as discussed later in this report. In some instances, cardholders or others told us that the invoice or other file documentation had been lost, sent to storage, destroyed after a year, or not retained when the cardholder retired or separated from VA. However, there were instances for which no explanation was provided as to why cardholders could not submit supporting documentation as of the end of our fieldwork. Without such documentation, we could not verify what was purchased, whether it was for a legitimate government purpose, or complied with acquisition requirements. A valid invoice to show what was purchased and the price paid is a basic document for the transactions, and a missing invoice could be an indicator of potential fraud. Without an invoice, two key internal control activities– independent receiving and approving official review–become ineffective. Independent receiving cannot confirm that the purchased items were received and the approving official cannot review a cardholder’s reconciled purchase with the supporting invoice. A near zero failure rate is a reasonable goal considering that invoices are easily obtained or replaced when inadvertently lost. VA’s operating guidance over convenience checks does not provide detailed procedures regarding appropriate written documentation or authorization that is required to be forwarded to the authorizing employee (agent cashier) prior to the disbursement of funds to a third party. VA’s operating guidance only provides that the required documentation be the same as that for paying with cash such as a purchase order. The guidance makes no mention of independent vendor documentation and that this type of documentation be required prior to issuing checks to vendors. In addition, VA’s guidance requires that the agent cashiers issuing convenience checks retain copies of issued convenience checks for only one year. This documentation requirement is inconsistent with the Federal Acquisition Regulation and VHA’s Records, Control Schedule 10-1, dated February 14, 2002, which requires that such records be retained for 6 years and 3 months after final payment for procurements exceeding the simplified acquisition threshold and for 3 years after final payment for procurements below the simplified acquisition threshold. In testing for evidence of written authorization, we accepted either a copy of a purchase order, standard forms VA uses for certain types of expenditures such as salary and travel, or signed internal memorandums. Of the 255 convenience check transactions, 17 transactions totaling $8,890 lacked written authorization needed to issue the convenience check. Based on these results, we estimate that $1.7 million of the fiscal year 2002 convenience check transactions lacked written authorization. In addition, we noted that 19 of the 255 convenience check transactions lacked a copy of the check or carbon copy. Based on these results, we estimate that $2.3 million of the fiscal year 2002 convenience check transactions lacked this supporting documentation. Although VA only requires copies of convenience checks to be retained for one-year, retaining the copies and the supporting documentation for the longer retention period mandated by the FAR and incorporated in VHA’s Records, Control Schedule 10-1, would facilitate subsequent internal and external reviews in assessing whether or not transaction activity was proper and in compliance with acquisition policies and procedures. As part of the purchase card process, VHA has established several timeliness standards that cardholders and approving officials must meet to ensure prompt recording, reconciliation, and review of purchases. Specifically, within 1 workday of making a purchase, cardholders are required to input or record the purchase information in VA’s purchase card order system. Within 10 calendar days of electronically receiving the transaction charge information from Citibank, the cardholder must reconcile 75 percent of these Citibank charges to the purchase information in the system. Within 17 calendar days, 95 percent of the Citibank charges must be reconciled. As evidence of reconciliation, the purchase card order system assigns the date the cardholder reconciled the purchase in the system. For testing the timeliness of cardholder reconciliations, we used the 17 calendar day criteria. In addition, VHA requires that within 14 calendar days of electronically receiving the cardholder’s reconciled purchases, that the approving official, through an electronic signature, certify in the purchase card order system that all procurements are legal, proper, and have been received. Table 2 summarizes the statistical results of VHA’s timeliness standards that cardholders and approving officials must meet to ensure prompt recording, reconciliation, and review of purchases. Our work shows that the internal controls were not operating as intended to ensure prompt recording of transactions and events. The following examples illustrate the extent of untimely recording, reconciliation, and review of the purchase card transactions. Untimely recording. A cardholder made a purchase on July 9, 2002 for $994, but did not input information into the VA’s purchase card order system until August 29, 2002 or 51 days later. According to VHA policy, the cardholder was required to input information about this purchase within one workday of making a purchase. The purpose of this timeliness standard is to ensure that VHA has proper control over the obligation and expenditure of its resources. By allowing this timeliness standard to be circumvented, VHA has less control over its financial resources. Untimely reconciliation. A cardholder made a purchase of $100 on August 24, 2002. Citibank electronically sent charge information to VHA for this purchase on October 8, 2002. According to the VHA policy, the cardholder should have reconciled this charge within 17 days, or by October 25, 2002, of receiving the Citibank charge information to meet the 95 percent reconciliation timeliness standard. However, the cardholder did not reconcile this charge until September 8, 2003, or 335 days later after receiving the Citibank charge information. The purpose of cardholder reconciliation is to detect invalid transactions, including billing errors and unauthorized purchases. If cardholders do not promptly reconcile their purchase card charges, the risk increases that fraudulent, improper, and wasteful purchase card expenditures could occur and go undetected. Also, during our review of cardholder reconciliations, we found 17 instances of cardholders who had electronically notated that the reconciliation had been completed, but the invoice amount and the charged amount did not agree and there was no documentation to explain the difference. VHA’s purchase card guidance requires that cardholders match Citibank payment charges to VA’s purchase card order system within VHA’s prescribed tolerance level, currently $100 or 10 percent, whichever is less. However, VHA’s guidance only requires that cardholders provide a written explanation when differences, at the prescribed tolerance level, occur between the vendor invoice amount and Citibank payment charged amount. Cardholders are not required to document any differences below the prescribed tolerance level. We believe cardholder reconciliation is a key control activity for detecting invalid transactions, including billings and unauthorized purchases. Documenting any difference between the invoice amount and payment charged amount provides additional assurances that transactions are properly reconciled and charged amounts are correct. We brought this issue to the attention of several VHA officials. VHA officials agreed that cardholders should explain any difference in the purchase card order system and said they would proceed to have VHA’s purchase card guidance revised to clarify this cardholder responsibility. Approving Official Review. A cardholder reconciled his purchase card transaction totaling $3,149 on December 21, 2002. According to the VHA policy, the approving official should review the reconciled purchase and certify within 14 calendar days that the purchase was legal, proper, and has been received. We noted that for this transaction, there was no evidence that the approving official reviewed this cardholder’s reconciliation until August 6, 2003 or 227 days later from the receipt of cardholder reconciliation. The purpose of an independent approving official review of reconciled cardholder purchase card transactions is to ensure that key responsibilities in the purchase card program are segregated and that no one individual has control over all aspects of a purchase card transaction. If approving officials do not promptly review cardholder purchase card transactions, VHA has no assurance that purchase card activity did not involve fraudulent, improper, or wasteful transactions. It is critical that cardholders and approving officials promptly record, reconcile, and review purchase card transactions so that erroneous charges can be quickly disputed with the vendor and any fraudulent, improper, or wasteful purchases can be quickly detected and acted upon. From our detailed tests of transactions, we found instances where cardholders did not consistently take advantage of vendor-offered purchase discounts. Specifically, we identified 69 invoices containing vendor-offered discounts totaling $15,785 that were available to the cardholder, but not taken at the time of purchase or subsequently credited for the discount amount, as evident by the amount charged to the cardholders’ account. When purchases are made, vendors may offer purchase discounts if buyers make early payments of their invoices. Typically, the vendor specifies a period of time during which the discount is offered, but expects the full invoice amount for payments made after that period. When cardholders use the purchase card, payment to vendors, via Citibank, generally occurs at the time of purchase. In turn, Citibank bills VA for the purchases through a daily electronic file. VA makes daily payments to Citibank to pay charges made from the previous day. Therefore, it is critical that cardholders inquire of any vendor-offered discounts at the time of purchase and make efforts to obtain a credit upon receipt and review of the invoice. Our detailed testing indicated that VHA did not always take advantage of vendor-offered discounts and that VHA lacked purchase card guidance to ensure cardholders inquired of or reviewed vendor payment terms to determine whether discounts were being offered for the applicable goods and services rendered. For example, one vendor offered VHA a discount of 2.9 percent, or $896, for an invoice amount of $30,888, if paid within 15 days. Citibank, on behalf of VA, made payment to the vendor within the 15-day timeframe, yet the vendor charged the cardholder’s account for the full invoice amount. We found no evidence that the cardholder attempted to obtain a credit for the available discount offered. In another example, we found that a cardholder had taken advantage of the vendor-offered discount. The vendor offered VHA a discount of 3 percent, or $180, for an invoice amount of $6,000, if paid within 30 days. We noted that the vendor charged the cardholder’s account for the discount amount of $5,820. A factor that may contribute to cardholder inconsistencies for taking advantage of vendor discounts is the lack of established policies and procedures that address this issue. Specifically, we found that VHA’s purchase card guidance did not include established procedures to ensure cardholders take advantage of available vendor discounts prior to making payments, or require that approving officials identify instances when cardholders did not take advantage of vendor discounts in order to determine the frequency of these occurrences. Without such guidance, VHA will not be able to determine the extent of this type of occurrence and actual dollars lost to the government. Our review found that VHA’s monitoring requirements lacked procedures to ensure that cardholder accounts were cancelled promptly when an employee left service and that cardholder credit limits were based on actual spending patterns. In addition, we found that VHA management has not provided sufficient human capital resources at the A/OPC level, to enable adequate monitoring of the purchase card program. Our Standards of Internal Control state that internal control monitoring assess the quality of performance over time and that ongoing monitoring should occur in the course of normal operations. It includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. VHA’s purchase card guidance includes prescribed monitoring procedures over its purchase card program to help ensure purchases are legal and proper. For example, the purchase card guidance requires that on a monthly basis, the Head of the Contracting Activity office at each VHA facility, the A/OPC and billing officer, perform joint reviews to include various aspects of the purchase process, such as proper accounting of purchases; proper oversight to ensure purchases were for a legitimate government need; and timely recording, reconciliation, and review of purchases. Although VHA’s guidance requires these reviews, we found no monitoring procedures to identify active accounts of cardholders who had separated from VA nor provisions for ongoing assessment of cardholders’ credit limits. We also noted insufficient human capital resources at the A/OPC level, for executing the prescribed monitoring activities over its purchase card program. Prompt cancellation of departing cardholder accounts. We identified 18 instances of purchase card accounts that remained active after the cardholder separated from VA and all related outstanding purchase orders had been reconciled. Specifically, we found that the cancellation of these accounts varied from the date that the last purchase had been reconciled, ranging from 1 day to 339 days. Of the 18 purchase card accounts that remained active after the cardholder had left VA, we determined that 14 accounts remained active 6 or more days after the cardholders’ outstanding purchase orders had been reconciled, which we deemed too long. For example, one cardholder separated from VA on April 3, 2002 with 5 outstanding purchase card orders that were made against the cardholder’s account prior to separation. The last purchase transaction was reconciled on May 21, 2002, but the account was not canceled until April 25, 2003, or 339 days after reconciliation. According to VHA’s purchase card guidance, departed cardholders are responsible for turning in their purchase card to the A/OPC in accordance with facility procedures, and providing the approving official with records of outstanding orders and unreconciled charges prior to leaving service. The approving official is responsible for ensuring a designated alternate approving official takes appropriate action necessary to complete the pending orders of departed cardholders and notifies the A/OPC when the last purchase has been reconciled so that the card account will be canceled promptly. However, VHA has no specific procedures for determining the time period for prompt cancellation of card accounts once all outstanding orders have been reconciled. As a result, for analysis purposes, we determined that untimely cancellation of cardholder accounts occurred when accounts were not canceled within 5 days of the reconciliation date for the last purchase charged against that account, as shown in table 3 below. In addition to the above analysis, we also identified 3 card accounts from two VHA facilities where the applicable A/OPC did not provide us the necessary documentation as of the end of our audit fieldwork to determine the time period when the departed cardholders’ accounts had been canceled once the transactions against their accounts had been reconciled. Therefore, we were unable to determine if these departed cardholder accounts had been promptly canceled once all outstanding purchase orders had been reconciled. Requiring monitoring procedures to identify active accounts of departed cardholders and ensure prompt closure once outstanding purchase orders have been reconciled would assist in reducing the risk of fraud, waste, and abuse that could occur when accounts remain open beyond the necessary time frame. Reasonableness of cardholder credit limits. Our analysis of purchases VHA cardholders made in fiscal year 2002 showed that, on average per month, cardholders cumulatively purchased $112 million of goods and services, but they had credit limits of $1.2 billion or 11 times their actual spending. The difference between the cumulative credit limits of $1.2 billion and actual spending of $112 million per month on average represents a monthly financial exposure of $1.1 billion to VHA. For example, we identified 5 cardholders with monthly credit limits of about $10 million each, yet each cardholder’s average purchases for one month only totaled $111,310. According to VHA’s purchase card guidance, the approving official, in conjunction with the A/OPC, billing officer, and head of contracting activity, recommends cardholder single purchase and monthly credit limits. However, we found no guidance on what factors to consider when recommending the dollar amounts to be assigned to each cardholder, such as existing and continuing needs of program operations and cardholders. Further, we found no monitoring procedures that require the A/OPC or approving official to determine, on an ongoing basis, whether or not cardholder limits should be changed based on existing and expected future use. Although 29 of the 111 A/OPCs who responded to a GAO data collection instrument question regarding monitoring cardholder’s single and monthly credit limits, reported that such monitoring occurs and that cardholders’ limits were increased or decreased to reflect actual spending patterns, we found no consistent application VHA-wide. A determination of cardholders’ spending limits requires an objective effort by operational supervisors and management, with assistance from purchase card program management, to evaluate the existing and continuing needs of operations and cardholders. Periodic monitoring and analysis of cardholders’ actual monthly and average charges, in conjunction with existing credit limits would aid VHA management in making reasonable determinations of cardholder spending limits. Without adequate monitoring, the financial exposure in VHA’s purchase card program can become excessive when its management does not exercise judgment in determining single purchase and monthly credit limits. Limiting credit available to cardholders is a key factor in managing the VHA purchase card program, minimizing the government’s financial exposure, and enhancing operational efficiency. Inadequate human capital resources. VHA has not provided sufficient human capital resources to enable monitoring of the purchase card program. One key position for monitoring purchases and overseeing the program is the A/OPC. While the A/OPC position is a specifically designated responsibility, we found in many instances that the A/OPC also functioned in another capacity and/or performed other assigned duties such as a systems analyst, budget analyst, and contract specialist. Of the 90 A/OPCs that responded to a GAO data collection instrument question regarding other duties assigned, including a percentage breakdown of time spent on the various duties,55 A/OPCs, or 61 percent, reported that they spend 50 percent or less of their time performing A/OPC duties. The bar graph below provides further information on the allocation of resources directed at monitoring the VHA purchase card programs at the local level. The bar graph above depicts the percentage of time that A/OPCs reported they spend to carry out their duties related to the purchase card program. Of the 90 A/OPCs who provided a percentage breakdown of performing their assigned duties, we found that 31 A/OPCs spend up to 25 percent of their time performing A/OPC assigned tasks, 24 A/OPCs spend between 26 and 50 percent, 11 A/OPCs spend between 51 and 75 percent, and the remaining 24 A/OPCs spend between 76 and 100 percent. For example, at the extreme low end of the scale, one A/OPC responded that he was also the budget analyst and that he spends 100 percent of his time on budget analyst duties, leaving no time for A/OPC duties on an ongoing basis. In another example, an A/OPC responded that she was also the director of the finance center and that she spends 99.5 percent of her time on these director duties, leaving less than 15 minutes per 40-hour week for A/OPC duties on an ongoing basis. Given that VHA makes millions of purchase card and convenience check transactions annually, which in fiscal year 2002, exceeded $1.4 billion, it is essential that VHA management devote adequate attention to monitoring its purchase card program to ensure that it is properly managed to reduce the risk of fraud, waste, and abuse. Although VHA has prescribed some monitoring procedures to ensure purchases are made in compliance with laws, regulations, policies, and procedures, these procedures do not adequately address other aspects of the program as described previously, that, if not frequently monitored, could increase the program’s risk of fraud, waste, and abuse. In addition, these types of monitoring activities become more critical when existing internal controls are not operating as intended and result in improper, wasteful, and questionable purchases as we identify in the remainder of this report. The lack of adequate internal controls resulted in numerous purchases made in violation of either applicable laws and regulations or VA/VHA purchase card policies that we classified as improper purchases. Improper purchases we found due to violations of applicable laws and regulations included (1) purchases of items for personal use, such as food for internal meetings and clothing, (2) purchases made from an improper source, (3) purchases split into two or more transactions to circumvent single purchase limits, (4) purchases, over the $2,500 micro-purchase threshold that exceeded the cardholders’ delegated purchasing authority, and (5) no evidence of competition for purchases exceeding the $2,500 micro- purchase threshold. Improper purchases we found due to violations of VA/VHA policy included (1) obtaining conference rooms and other items without following applicable procurement procedures, (2) convenience check payments that exceeded established limits, and (3) using convenience checks to pay purchases even though the vendor accepted the government purchase card. While the total amount of improper purchases we identified is relatively small compared to the over $1.4 billion in annual purchase card and convenience check transactions, it demonstrates vulnerabilities from weak controls that could easily be exploited to a greater extent. The just-cited violations are discussed in more detail here. Purchases of items for personal use. From the nonstatistical sample, we identified 17 purchases totaling $14,054 for clothing, food, and other items in which cardholders purchased goods that were for personal use. Items that are classified as personal expenses may not be purchased with appropriated funds without specific statutory authority. The Federal Acquisition Regulation emphasizes that the governmentwide commercial purchase card may be used only for purchases that are otherwise authorized by law or regulation. We identified 6 purchases of clothing totaling $2,377 that were for personal use and not authorized by law. One transaction was a purchase of 4 winter jackets totaling $286 for warehouse employees exposed to inclement weather. Absent specific statutory authority, cold weather clothing is an employee’s personal responsibility for which appropriated funds are not available. In another example, we found a purchase of 18 pairs of Wrangler and Levi’s jeans totaling $405 that VHA indicated were to be used as “employee uniforms” for the engineering office. Under 5 U.S.C. § 5901, appropriated funds are available to furnish employees with either uniforms or a uniform allowance. Because the statute does not define “uniform,” the Comptroller General has relied on the common meaning of the term “uniform” in determining what wearing apparel may be purchased with appropriated funds. Merriam-Webster’s Tenth Collegiate Dictionary (2001) defines a “uniform” as “dress of a distinctive design or fashion worn by members of a particular group and serving as a means of identification” and broadly regarded as “distinctive or characteristic clothing.” Jeans would not qualify as a uniform under that definition as jeans are common everyday attire and would not distinguish or set a group apart. We also found 11 transactions that included purchases of food totaling $11,677 that were for personal use and not authorized by law. We identified 5 transactions that included the purchase of food for government meetings totaling $3,142 and 6 transactions where a significant portion of the purchases were for food related to refreshments or meals for training sessions or conferences in the medical center’s immediate geographic area totaling $11,309. For example, one transaction totaling $575 included lunch and beverages purchased from the Pacific Athletic Club in the amount of $277 in addition to a room rental fee. According to documentation provided, this purchase was for seven VA employees to discuss the Compensated Work Therapy program. In another example, breakfast and lunch meals totaling $2,430 were purchased during a weeklong training conference for new supervisors at a local inn. All attendees were on staff at the nearby medical facility and the documentation provided indicates that networking was scheduled to take place during breakfast and lunch. This and other purchases of refreshments identified during our testing were improper to the extent that employees were not in a travel status or the agency did not justify providing meals to employees. Improper Source. We identified 8 purchases totaling $7,510 in the non- statistical sample that were subject to procurement from a mandatory source of supply but were obtained from other sources. Various federal laws and regulations such as the Javits-Wagner-O’Day Act (JWOD) require government cardholders to acquire certain products from designated sources. The JWOD program is a mandatory source of supply for all federal entities. It generates job and training for Americans who are blind or have severe disabilities by requiring that federal agencies purchase supplies and services furnished by nonprofit agencies, such as the National Industries for the Blind and the National Institute for the Severely Handicapped. Most JWOD program supplies are small value items such as office supplies, cleaning products, or medical/surgical supplies that nearly always fall into the micro-purchase category. Based on our nonstatistical testing, we noted that cardholders did not consistently purchase items from JWOD when they should have. For example, a cardholder purchased planner starter kits and refills for employees totaling $1,591 from Franklin Covey, a high-end office supply store. These items provide essentially the same features as the JWOD items, and would have cost $1,126, or $465 less, if they had been procured through JWOD or a JWOD supplier. During our data mining, we noted that VHA made 652 purchases totaling $76,350 from Franklin Covey during 2002. While we did not review all of these individual purchases, based on our detailed testing of similar transactions, it is likely that many of them should have been procured from a mandatory source at a much lower cost. Split purchases. Using data mining techniques, we identified card purchases that appeared to have been split into two or more transactions by cardholders to circumvent their single purchase limit. We requested documentation for a statistically determined sample of 280 potential split transactions totaling $4 million. Of these 280 transactions, we determined that 49 transactions were actual splits. Based on these results, we estimate that $17.1 million of the total fiscal year 2002 purchase card transactions were split transactions. For example, a cardholder with a single purchase limit of $2,500 purchased accommodations at 110 hotel rooms totaling $4,950. When performing follow-up, the cardholder stated that VA provides lodging accommodations for veterans receiving medical services such as radiation therapy, chemotherapy, and day surgery who live at least 150 miles from the medical facility. The cardholder created two separate purchase orders and had the vendor create two separate charges, one for $2,500 and the other for $2,450, so that the purchase could be made. On the documentation provided, the cardholder stated the “purchase was split per the direction of the previous purchase card program administrator.” The cardholder also stated that currently, her purchase card at that facility is no longer used to pay hotel lodging for veterans. Hotel payments are now disbursed electronically via VA’s Financial Service Center. The purpose of the single purchase limit is to require that purchases above established limits be subject to additional controls to ensure that they are properly reviewed and approved before the agency obligates funds. By allowing these limits to be circumvented, VA had less control over the obligation and expenditure of its resources. Noncompliance with simplified acquisition procedures. The Federal Acquisition Regulation provides that the purchase card may be used by contracting officers or individuals who have been delegated micro- purchase authority in accordance with agency procedures. Purchases above the micro-purchase threshold using the purchase card are permissible only by warranted contracting officers who must promote competition to the maximum extent practicable when making such purchases. Contracting officers must consider solicitation of quotations from at least three sources, and they must minimally document the use of competition or provide a written justification for the use of other than competitive procedures. When cardholders circumvent these laws and regulations, VHA has no assurance that purchases comply with certain simplified acquisition procedures and that cardholders are making contractual commitments on behalf of VHA within the limits of their delegated purchasing authority. From the statistical sample of purchases over $2,500, we found that for 19 of the 76 transactions, cardholders lacked warrant authority needed to make these types of purchases. Based on these results, we estimate that cardholders with only micro-purchase authority, made $111.9 million of the total fiscal year 2002 purchases that exceeded $2,500. In addition, we found that 12 of the 76 transactions lacked evidence of competition. Based on these results, we estimate that $60 million of the total fiscal year 2002 purchases totaling more than $2,500 lacked evidence of competition. For example, one cardholder made a purchase of 2,000 washcloths totaling $3,100, but could provide no evidence that competition was used. According to the cardholder, at the time of purchase, he was under the impression that VA had a contract with the vendor to procure the goods and therefore, did not seek competition. We also found one cardholder who purchased flu vaccine syringes for a VA pharmacy totaling $19,943, but was not a warranted contracting officer. In addition, we found instances where cardholders were warranted contracting officers, but not at the time of purchase for specific transactions we selected. Specifically, we found seven cardholders who made purchases over the micro-purchase threshold, with a combined total of $27,473, where the warrants provided were dated after the purchase of goods. These cardholders could not provide documentation to show that they were warranted contracting officers at the time these purchases were made. Incorrect procurement procedures used to obtain conference room rentals and other items. We identified 23 purchase card transactions totaling $112,924 in the nonstatistical sample related to the rental of conference room facilities used for internal VA meetings, conferences, and training. For these purchases, the cardholders could not provide documentation to show that efforts had been made to secure free conference space. VA’s acquisition regulations state that rental conference space will be obtained (paid for) only in the event that free space is not available and that complete documentation of efforts to secure free conference space will be maintained in the purchase order file. For one purchase, VHA paid $31,610 for conference room facilities and related services for 3 days at the Flamingo Hilton Hotel in Las Vegas. The cardholder provided no evidence that attempts to secure free facilities had been made. In addition, of the 23 purchase card transactions cited, 12 purchases totaling $103,662 occurred at one VHA facility. This included one transaction totaling $12,000 for a 3-day Training Course on Prevention and Management of Disruptive Behavior at the MGM Grand Hotel in Las Vegas. Again, we were not provided evidence that efforts had been made to secure free conference space. Two additional transactions totaling $755 were for different types of purchases where VA’s acquisition regulation was not followed. One purchase was a recruitment advertisement totaling $690. VA requires that approval be obtained prior to making this type of purchase and that evidence of this approval be maintained in the file. We found no evidence that approval had been obtained prior to making the purchase. For the second transaction, the cardholder paid annual membership dues associated with an international honor society of nursing in an employee's name totaling $65. VA used its general post funds to pay this charge despite the fact that VA policy prohibits the use of general post funds for membership fees. Additionally, as appropriated funds are not available to pay employees' membership fees in societies or associations, VA policy requires that membership in organizations be in the agency's name, not the employee's name. Improper use of the convenience checks. We identified improper use of convenience checks related to purchases that exceeded VA’s established limits of $2,500 and $10,000 and payments to vendors who accept the purchase card payments. VA’s convenience check guidance requires that a single draft transaction be limited to $2,500 or in some cases $10,000 unless a waiver has been obtained from Department of the Treasury, and restricts convenience check use to instances where vendors do not accept purchase cards. From our statistical testing of convenience check limits, we found that 91 of 105 convenience check purchases were paid using multiple checks because the total purchase amount exceeded the established convenience check limit. Based on these results, we estimate that $13.8 million of the total fiscal year 2002 convenience check transactions were improperly used to pay purchases exceeding the established limits. For example, we found 29 different purchases for metered postage from the United States Postal Service (USPS) where the purchase amount exceeded the convenience check limit. One purchase for postage totaled $50,000, but the single transaction limit on convenience checks for that facility is $2,500. In order to make payment, the agent cashier issued 20 different checks at $2,500 each. Regarding an explanation of the purchase, the agent cashier stated that separate checks were written because the convenience checks cannot be written over $2,500. The agent cashier also stated that since this purchase, the VHA facility has implemented new procedures that allow for electronic funds transfers (EFT) to USPS. During our review, we also found another VHA facility that is currently using EFTs as an alternate payment mechanism to USPS. Based on the explanations obtained for the various improper check purchases we identified, it appears to be routine practice for agent cashiers to issue numerous checks when the purchase amount exceeds the established check limit of $2,500 or $10,000. For example, at one VHA facility, the agent cashier provided a written explanation that it is their policy to issue numerous checks instead of increasing the check limit. We also found instances where convenience checks were used to pay vendors who accept the purchase card as payments. VA’s disbursement mechanism guidance provides that third party drafts (convenience checks) should be used in lieu of cash but only when the government purchase card cannot be used. From a statistical sample of 255 convenience checks transactions, we found 23 instances where vendors accepted the purchase card as payment, yet convenience checks were issued instead to make payments. In these instances, we were provided no documentation as to why the convenience check was used in lieu of the purchase card. Based on these results, we estimate that $2.6 million of the total fiscal year 2002 convenience check payments made to vendors in lieu of the purchase card lacked this type of documentation. For example, an agent cashier made a convenience check payment of $8,327.32 to a party rental vendor for the purchase of various stage equipment, chairs and tents used for an outside cemetery dedication. We contacted the vendor and found that it accepts credit cards as a form of payment. The agent cashier provided no documentation showing why the convenience check was used in lieu of the purchase card. In April 2003, VA issued new purchase card guidance that attempted to clarify the use of convenience checks. Specifically, this guidance provides that for micro-purchases, convenience checks may be used in lieu of the purchase card only when it is advantageous to the government and it has been documented as the most cost-effective and practical procurement and disbursement method. However, we found no established criteria for determining the “most cost-effective and practical procurement and disbursement method.” The inadequacies and ineffectiveness of internal controls were also evident in the number of transactions identified that we classified as wasteful— that is, excessive in cost compared to other available alternatives or for questionable government need. We also identified other transactions that we classified as questionable because there was insufficient or no documentation to determine what was purchased. Specifically, of the 982 nonstatistical sample transactions we reviewed, 250 transactions totaling $209,496 lacked key purchase documentation. As a result, we could not determine what was actually purchased, how many items were purchased, the cost of each of the items purchased, and, whether there was a legitimate government need for such items. Table 4 summarizes the number of transactions and dollar amounts that we determined to be wasteful or questionable. While not significant to the overall purchase card program, these transactions are indicative of what can occur when the use of the cards is not properly controlled. Because we tested only a small portion of the transactions that appeared to have a higher risk of fraud, waste, or abuse, there may be other improper, wasteful, and questionable purchases in the remaining untested transactions. We identified 20 purchases totaling $56,655 that we determined to be wasteful because they were excessive in cost relative to available alternatives or were of questionable government need. The limited number of wasteful purchases found in the nonstatistical sample demonstrates that cardholders are generally prudent in determining that prices of goods and services are reasonable prior to making credit card purchases. For items labeled as wasteful, we considered them excessive in cost when compared to available alternatives that would meet the same basic needs or questionable as government expenditures because they appeared to be items that were a matter of personal preference or convenience, were not reasonably required as part of the usual and necessary equipment for the work the employees were engaged in, or did not appear to be for the principal benefit of the government. Specifically, we identified 18 purchases totaling $55,156 for which we questioned the government need and 2 purchases totaling $1,499 that we considered excessive in cost. A majority of the purchases were related to office-wide and organizational awards. We noted several purchases for items to be presented as awards. Many of these types of purchases were for gift certificate and gift card awards. Although VA policy gives managers great latitude in determining the nature and extent of awards, we identified 10 purchases totaling $51,117 for award gifts for which VHA was unable to provide information on the recipients of the award or the purposes for which the recipients were being recognized. Therefore, we categorized these purchases as questionable government need. For example, we identified two transactions for 3,348 movie gift certificates totaling over $30,000. For these purchases, the cardholders and A/OPCs could not provide the award letters or justification for the awards. Consequently, it could provide no evidence that these purchases were truly used for awards. We also identified one purchase for an award event totaling $2,500 for which the cardholder was unable to provide a justification for the ceremony or detail what awards were presented. Also, based on VHA purchase order documentation provided, we noted one additional purchase of items to be used as awards totaling $250 for which no vendor documentation was provided to support the purchase. Therefore, we classified and reported this transaction under our missing invoice category. We also identified two purchases that we considered wasteful because of excessive cost. We identified a cardholder who purchased a $999 digital camera when there were other less costly digital cameras widely available. For example, during the same six-month period from February 2002 through July 2002, two other cardholders purchased digital cameras for $526 and $550. No documentation was available to show why that particular model camera was necessary. In the second example, we identified a purchase for a 20-minute magic show totaling $500 that was performed during a VA volunteer luncheon. Although VA policies allow for funds for volunteer events, this expenditure as roughly $25 per minute, seemed excessive. As discussed earlier in this report, we identified numerous transactions from the statistical samples that were missing adequate supporting documentation to identify what was actually purchased, how many items were purchased, and the cost of the items purchased. In these instances, we reported those sample transactions as exceptions for each attribute we tested. In addition, we requested supporting documentation for a nonstatistical sample of 982 transactions totaling $1.2 million. Of these, we identified 315 transactions totaling $246,596 that appeared to be improper or wasteful, but for which VHA either provided insufficient or no documentation to support the propriety of the transactions. We classified 250 of these 315 transactions, totaling $209,496, as missing invoices because the cardholders provided either VHA internal documentation, but no vendor documentation to support the purchase, or provided no documentation at all to support the purchase. VHA internal documentation includes purchase orders, reconciliation documents, and receiving reports. Vendor documentation includes invoices, sales receipts, and packing slips. Specifically, internal documentation was available for 184 of these transactions totaling $155,429 but no vendor documentation was available. No documentation was available at all for the remaining 66 transactions totaling $54,068. An example of a transaction with internal documentation, but no vendor documentation included a purchase from Circuit City where the cardholder stated that the purchase was for three $650 television sets and three $100 television stands, totaling $2,300 (including $50 shipping), that were needed to replace the existing ones in the VA facility’s waiting area. In another transaction, no vendor documentation was available for a transaction from Black & Gold Beer where the cardholder stated that the purchase of beer was for a patient. The purchase order shows that three cases were purchased at $12.50 each, totaling $38. The cardholder stated that the purchase was at the request of the pharmacy for a specific patient; however, no documentation was provided to support this claim. Table 5 illustrates some transactions in the nonstatistical sample for which cardholders provided no documentation to support what was purchased. Based on these examples and other transactions identified in the nonstatistical sample, we believe that at least some of these items may have been determined to be potentially fraudulent, improper, or wasteful had the documentation been provided or available. In addition, we noted that of the 66 transactions where VHA cardholders provided no documentation to support the purchase, 32 transactions (48 percent) represented 2 or more transactions to the same cardholder. For example, one cardholder did not provide documentation for 5 transactions totaling $5,799 from various types of merchants, including two restaurants, a movie theater, a country club, and an airport café. For 65 transactions totaling $37,100 that appeared to be either improper or wasteful, the documentation we received was not the correct supporting documentation or was inadequate, and we were unable to determine the propriety of the transactions. For example, one transaction was for $1,350 to Hollywood Entertainment; however, the purchase order and invoice listed Hear, Inc. as the vendor for closed captioning services. The cardholder stated that she believed Hollywood Entertainment is an associate company name for Hear, Inc.; however, they could not provide any documentation to support this statement. Additionally, from our Internet searches of both Hollywood Entertainment and Hear, Inc. we found no information to indicate that these two companies were associated in any way. In another example, the transaction was for $1,400 to Fabulous Pewterware, a company that sells handcrafted items made of pewter; however, the purchase order and invoice listed Ball Med & Associates Inc., a company that provides medical services, as the vendor and described the purchase as repairs. The A/OPC stated that Fabulous Pewterware is synonymous with Ball Med & Associates Inc.; however, he could not provide documentation supporting this claim. From our Internet search of Fabulous Pewterware, we found no information to indicate that these two companies were one and the same. We also identified 68 transactions totaling $31,772 involving the purchase of tickets for sporting events, plays, movies, amusement/theme parks, and other recreation activities for veterans and VA volunteers. The documentation provided for these transactions was inadequate or missing a vendor invoice; therefore, we could not determine whether these tickets were used in support of the volunteers or veterans. As a result, these purchases were also categorized as questionable. Various programs under VHA, such as Recreation Therapy, Voluntary Services, and Blind Rehabilitation Service, sponsor assorted activities for the benefit of veterans and for VA volunteers. From our review of these types of purchases, we found that VHA does not have procedures in place to ensure that the purchased items were used by the intended recipients and are properly accounted for. In most cases, there was inadequate or no documentation to account for how the tickets were distributed and who participated in the events. For example, we found one purchase of 62 theme park tickets to Six Flags totaling $997 for veterans. Upon request, we received a list of veterans to whom tickets were distributed and we noted that the list only accounted for 28 tickets. When we contacted the cardholder to obtain clarification for the discrepancy, we were told that the difference was due to veterans receiving additional tickets for their family members; however, there was no evidence to support this claim. As a result, we were unable to determine whether the remaining 34 tickets were provided to veterans for the intended purpose. In another example, we found a purchase of 46 tickets totaling $812 for veterans to attend a Pittsburgh Pirates baseball game. However, we were provided no documentation that identified who received the tickets or who attended the baseball game. Proper accountability over the distribution and receipt of tickets for such events is needed to help ensure that tickets are not improperly used for personal use. Overall, VHA’s internal controls were not designed to ensure improper purchases would be detected or prevented in the normal course of business. While VHA has some internal controls, they are often not operating as intended because cardholders and approving officials are not adhering to internal control requirements guidance, resulting in violations of federal acquisition regulations as well as VA/VHA’s own policies. In other instances, internal controls are lacking, as in the case of documentation requirements, in which there is not adequate guidance. The lack of compliance with established internal control requirements coupled with a lack of internal control guidance in some areas such as documentation, resulted in improper, wasteful, and questionable purchases. Although the total amount of these purchases is small in comparison with the size of the purchase card and convenience check program, it reveals a vulnerability from weak controls that could be exploited. Until controls are strengthened and guidance is expanded and clarified, VHA will continue to be at risk of improper payments through purchase card and convenience check transactions. We are making the following 36 recommendations to the Acting Under Secretary for Health and, in some instances, the Secretary of Veterans Affairs to strengthen internal controls and compliance in its purchase card program in order to reduce VHA’s vulnerability to improper, wasteful, and questionable purchases. With regard to improving internal controls over purchasing, we recommend that the Acting Under Secretary for Health do the following. Establish appropriate criteria, including types of items and dollar thresholds for requiring and documenting independent receiving and acceptance of items obtained with a purchase card. Establish specific procedures for documenting independent receiving, such as requiring the cardholder to maintain a signed copy of the receiving report showing the purchase was received in the warehouse, or requiring the approving official or supervisor to sign and date the vendor invoice, packing slip, sales or credit card receipt to verify that the items purchased were actually received. Require that VHA senior management at the VA headquarters in Washington, D.C. document its approval that the one VHA Agency/Organization Program Coordinator (A/OPC) can continue to function as a cardholder since this is inconsistent with VA/VHA policy. Establish procedures that require an independent person to periodically review this A/OPCs’ purchasing activities. Establish guidance dictating vendor documentation needed to support the purchase transactions (in description, quantity, and price) that provides the basis for reconciling electronically received charges from Citibank. Require cardholders to maintain documentation of timely and independent receiving and acceptance of items obtained with a purchase card. Incorporate into VHA’s existing purchase card guidance, file retention requirements as mandated by FAR Subpart 4.805 Storage, Handling, and Disposal of Contract Files. Identify cardholders who repeatedly fall outside the required timeframes for recording purchase card order information into the VA’s purchase card order system and for performing reconciliations of purchases. Identify approving officials who continually fail to meet the required timeframes for reviewing and certifying that cardholder purchases are legal and proper. Provide adequate retraining for these cardholders and approving officials and consider whether to suspend their responsibilities if the established timeframes continue not to be met. Establish procedures that require cardholders, at the time of purchase, to determine whether vendors offer purchase discounts when early payments are made for goods and services rendered. Establish procedures requiring internal management review auditors to identify loss of vendor-offered discounts, determine frequency of occurrences and actual dollars lost to the periodically report to VHA management for consolidation and further review so that appropriate actions can be taken. Establish timeframes for the prompt cancellation of purchase card accounts when the cardholder has left the agency and all outstanding purchase orders have been reconciled. Establish procedures to ensure prompt cancellation of purchase cards when cardholders leave VA, are reassigned, or no longer have valid needs for the cards. Establish procedures to periodically assess whether each cardholder continues to have a valid need for a purchase card. Review existing credit limits and monthly spending and develop policies and strategies on credit limits provided to cardholders with a focus on minimizing specific cardholder spending authority and minimizing the federal government’s financial exposure. Assess the adequacy of human capital resources devoted to the purchase card program, especially for oversight activities, at the A/OPC level, and provide needed resources. With regard to improving and enforcing compliance with purchasing requirements, we recommend that VHA develop written detailed procedures and guidelines to aid cardholders in complying with the Federal Acquisition Regulation, Veterans Affairs Acquisition Regulations and other internal policies and procedures when using the purchase cards and convenience checks as procurement and payment mechanisms for goods and services rendered. Such procedures could be either incorporated in VHA’s existing guidance over the purchase card program or presented separately. Specifically, we recommend that the Acting Under Secretary for Health do the following. Establish steps to be followed when circumstances permit the purchase of generally prohibited items such as clothing, food, and gifts. Establish steps to be followed when the purchase amount will exceed the $2,500 micro-purchase limit or the cardholders’ single purchase limit to prevent splitting the purchase. Establish steps to be followed if the cardholders, with only micro- purchase authority, need to make a purchase over the $2,500 micro- purchase threshold. Establish steps to be followed when cardholders request to make purchases of office supplies and other goods from other than a mandatory source supplier for items that are “essentially the same.” Establish steps on how to document the use of competition and circumstances under which it can be justified not to use competitive procedures. Establish steps on how to document efforts to secure free conference space before purchasing rental of conference room facilities. Reiterate in VHA’s refresher training to cardholders and approving officials areas discussed in this report, such as segregation of duties, documentation requirements and retention of supporting documentation, taking advantage of available vendor-offered discounts, canceling of departed cardholders’ accounts, applicable laws and regulations, and agency policies and procedures. Provide refresher training to agent cashiers on the areas discussed in this report, such as purchases that exceeded established check limits and payments to vendors who accept the purchase card as a form of payment. Consider whether to revoke or suspend purchasing authority of cardholders who are found to be frequently or flagrantly noncompliant with policies and procedures, such as cardholders making split purchases, procuring goods and services beyond their purchasing authority, or making purchases exceeding established dollar thresholds. With regard to purchases that may be at an excessive cost or for questionable government need, we recommend that the Acting Under Secretary for Health do the following. Require that cardholders or others track and document award purchases to the end user, including who received the award and the purposes for which the recipient is being recognized. Copies should also be maintained in the purchase card order file. Require that cardholders or others track and document ticket purchases for recreational activities to the end user, including who received the ticket, date received, and signature by the recipient as evidence of receipt. Copies should also be maintained in the purchase card order file. Follow up on transactions we identified for which no supporting documentation was provided to determine whether the items purchased were for a legitimate government need. Take appropriate disciplinary or corrective action for purchases determined to be not for a legitimate government need. Policies and procedures over convenience checks are established at the department level only. Therefore, we are making four recommendations to the Secretary of Veterans Affairs to strengthen and improve controls over convenience check usage in its purchase card program. Specifically, to improve internal controls over convenience check purchasing, we recommend that the Secretary of the Veterans Affairs, in conjunction with the Acting Under Secretary for Health, do the following. Require agent cashiers to maintain written documentation that authorizes the disbursement of funds to third parties. Establish detailed procedures that specify the types of documentation that agent cashiers must obtain from the requesting office that support the disbursement of funds to third parties via convenience checks. Establish detailed criteria in VA’s purchase card guidance for determining under what situations convenience checks provide the “most cost-effective and practical procurement and disbursement method” when using in lieu of the purchase card. Incorporate this criteria in VA’s convenience check guidance as well. Incorporate into VA’s existing convenience check guidance, file retention requirements as mandated by FAR Subpart 4.805 Storage, Handling, and Disposal of Contract Files. The Department of Veterans Affairs (VA) provided written comments on a draft of this report. In its response, VA generally agreed with our conclusions and expressly concurred with 32 of the 36 recommendations. For these recommendations, VA reported that it has actions either already in place or planned that meet the intent of the recommendations. For the remaining four recommendations, VA, in principle, concurred with three of these recommendations and presented reasons and/or alternative action steps to address the weaknesses identified in our report. Regarding these four recommendations, two recommendations addressed segregation of duties weaknesses related to an A/OPC that also functioned as a cardholder. We recommended that VHA senior management in Washington, D.C. approve this dual responsibility since this is inconsistent with VA/VHA policy and that procedures be established to require an independent person to periodically review this A/OPC’s purchasing activities. In essence, VA agreed that the dual responsibility of the A/OPC constituted a violation of department policy and stated that VHA headquarters never granted approval for the A/OPC to function in this dual capacity and would not do so. VA also reported that it has instructed the director of the facility in question that the dual responsibilities of the A/OPC is a violation of department policy and may not continue. We believe that VA’s planned action is an acceptable approach to solving the problem we identified, and if implemented will address the intent of our recommendations and resolve this segregation of duties issue and policy violation. We also recommended that VHA establish steps to be followed if cardholders, with only micro-purchase authority, need to make a purchase over the $2,500 micro-purchase threshold. VA responded that purchases greater than $2,500 should require a warrant and that any exception could complicate and thereby weaken existing policy. We agree that cardholders must have the applicable purchasing authority to make purchases over the $2,500 micro-purchase threshold and did not intend for VHA to establish procedures that were contrary to this FAR purchasing requirement. We believe VA has misinterpreted the intent of our recommendation. Our intent was to address the need for additional written purchase card guidance for cardholders who need to procure specific goods and services, yet the purchase amount exceeds their micro-purchase threshold. Such guidance could include instructing cardholders to contact their local procurement office so that a contracting officer can make the purchase instead. We believe additional written guidance to cardholders is needed as evidenced by our findings and similar findings reported by the OIG as far back as 1999. Lastly, we recommended that VHA require cardholders or others to track and document ticket purchases for recreational activities to the end user. VA reported that the burden of having each patient sign for each ticket would be onerous. As an alternative, VA stated that the cardholder should ensure that an accurate patient count is kept on file in the purchase card order file. We believe this proposed alternative method does not sufficiently address the accountability issue over these types of purchases. By only maintaining an accurate patient count, internal and external reviewers still will not have enough information available to determine who received the ticket or attended the event. A “patient count” provides only limited assurances over the accountability of tickets. Independent evidence from the recipient is needed to support that he/she received or attended such events and would increase the accountability over these types of purchases to help ensure that tickets are not improperly used for personal use. In a few instances, we found that VHA local offices had implemented, at varying degrees, tracking procedures of ticket purchases similar to those envisioned by our recommendation. For example, one field office, maintained an attendance sheet that identified the recreational activity, date and time of the activity, the particpants’ names and check marks as to whether or not participants attended the event. At another field office, we were provided a similar attendance sheet, including each recipient’s signature and last four digits of his/her social security number. Employing these types or similar procedures agencywide appears reasonable since some of the VHA field offices already have existing procedures in place. Also, in its response letter, VA included some technical comments that we have addressed in finalizing our report where appropriate. VA’s written comments and our evaluation of certain comments not addressed above are presented in appendix I. As arranged with your offices, unless you announce the contents of this report earlier, we will not distribute it until 2 days from its issuance date. We will then send copies of this report to the Secretary of the Department of Veterans Affairs, the Acting Under Secretary for Health, appropriate congressional committees, and other interested parties. We will also make copies available to others upon request. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. Should you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-6906 or williamsm1@gao.gov; or Alana Stanfield, Assistant Director, at (202) 512-3197 or stanfielda@gao.gov. Major contributors to this report are acknowledged in appendix II. The following are GAO’s comments on VA’s letter dated May 24, 2004. 1. We did not indicate that the VHA purchase card program operations were effective overall. During the exit conference meeting on April 26, 2004, we communicated that the weaknesses identified at VHA were similar to the internal control weaknesses we reported at other federal agencies, although the extent of fraud, waste, and abuse that we identified at some of those agencies were not as prevalent at VHA. We also communicated that our findings stemmed from weak internal controls over the purchase card program and that strengthening controls would reduce the program’s vulnerability to improper, wasteful, and questionable purchases. We further stated that we would be making a number of recommendations for each of the identified areas that were discussed at the meeting. Regarding the $435,900 cited as fraudulent activity, we reported that this amount was identified from the OIG’s work and not GAO’s work. However, VA should not be deriving unjustified levels of assurances that its program is “effectively managed” based on the OIG’s findings and our findings identified in this report from data mining and nonstatistical testing of transactions. As we indicated in our report, while the total amount of improper purchases we identified, based on limited scale audit work, is relatively small compared to the more than $1.4 billion in annual purchase card and convenience check transactions, we believe our results demonstrate vulnerabilities from weak controls that may have been exploited to a much greater extent. In addition, our internal control findings and noncompliance with federal and agency purchasing requirements identified from the statistical testing further illustrate that controls were ineffective and improved management is needed over program operations. 2. In our opinion, the approving official’s certification of the purchase card order for most micro-purchases does not provide sufficient assurance that purchased items are not acquired for personal use and that they come into the possession of the government. Various types of sensitive items such as personal digital assistants, cell phones, digital cameras, laptops, and computers can be purchased below the $2,500 micro-purchase threshold. These and other items that can be easily pilfered should go through a central receiving point to reduce the risk of error or fraud. 3. We recently provided VHA a schedule of purchase card transactions in which no documentation was provided during our fieldwork to support the purchases selected for review. Staff members who made key contributions to this report include: Sharon Byrd, Polly Cheung, Lisa Crye, Danielle Free, Carla Lewis, Julia Matta, Gloria Medina, Tarunkant Mithani, Donell Ries, and Stacey Smith. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: The Department of Veterans Affairs Office of Inspector General (OIG) has identified significant vulnerabilities in Veterans Affairs' (VA) use of government purchase cards. In its April 26, 2004 report, the OIG reported instances of fraudulent activity totaling $435,900, and numerous improper and questionable uses of the purchase cards totaling $1.1 million. Given that VHA comprised at least 90 percent of VA's dollar and transaction volume for fiscal year 2002, GAO was asked to determine whether existing controls at VHA were designed to provide reasonable assurance that in the future, improper purchases would be prevented or detected in the normal course of business, purchase card and convenience check expenditures were made in compliance with applicable laws and regulations, and purchases were made for a reasonable cost and a valid government need. Weaknesses in the Veterans Health Administration's (VHA) controls over use of purchase cards and convenience checks resulted in instances of improper, wasteful, and questionable purchases. These internal control weaknesses included inadequate segregation of duties; lack of key supporting documents; lack of timely recording, reconciling, and reviewing of transactions; and insufficient program monitoring activities. This lack of adequate internal controls resulted in numerous violations of applicable laws and regulations and VA/VHA purchase card policies that GAO identified as improper purchases. These included purchases intended for personal use, purchases made from an improper source, purchases split into two or more transactions to circumvent single purchase limits, noncompliance with simplified acquisition procedures, incorrect procurement procedures, and improper use of convenience checks. GAO's work also identified over $300,000 in purchases that were considered wasteful--that is, excessive in cost or for questionable government need--or were considered questionable because there was insufficient or no documentation to determine the propriety of the transaction. Examples of wasteful and questionable purchases included two purchases for 3,348 movie gift certificates totaling over $30,000 for employee awards that were not supported by award letters or justifications; a purchase for a digital camera totaling $999 when there were other less costly digital cameras widely available; and a purchase of 3 cases of beer totaling $38.