We conducted our audit work from November 2001 through February 2002 in accordance with U.S. generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. We briefed officials from the Department of Defense Purchase Card Program Management Office, Naval Supply Systems Command (NAVSUP), assistant secretaries of Navy for financial management (comptroller) and research development and acquisition, SPAWAR Systems Center, and NPWC on the details of our audit, including our objectives, scope, and methodology and our findings and conclusions. We referred instances of potentially fraudulent transactions that we identified during our work to our Office of Special Investigations for further investigation. Our control tests were based on stratified random probability samples of 50 SPAWAR Systems Center purchase card transactions and 94 NPWC transactions. We also reviewed a nonrepresentative selection of transactions using data mining intended to identify potentially fraudulent, improper, abusive, or otherwise questionable transactions. In total, we audited 161 SPAWAR Systems Center and 145 NPWC fiscal year 2001 transactions. Our work was not designed to identify, and therefore we did not determine, the extent of fraudulent, improper, or abusive transactions and related activities. Further details on our objectives, scope, and methodology are included in appendix II. In our follow-up audit, we found that both units had made some improvements in the overall control environment, primarily after the end of fiscal year 2001. However, the control environment at SPAWAR Systems Center continued to have significant weaknesses, while NPWC had made major strides towards a positive control environment. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) state that, “A positive control environment is the foundation for all other standards. It provides discipline and structure as well as the climate which influences the quality of internal control.” Our previous work found that a weak internal control environment at SPAWAR Systems Center and NPWC contributed to internal control weaknesses and fraudulent, improper, and abusive or questionable activity. In July 2001, we testified that the specific factors that contributed to the lack of a positive control environment at these two units included a proliferation of cardholders, ineffective training of cardholders and certifying officers, and a lack of monitoring and oversight. The following sections provide an update on the status of these conditions as well as information on several additional factors that affected the overall control environment at these Navy units. Although both units have reduced the number of cardholders, balancing the business needs of the unit with the training, monitoring, and oversight needed for a substantial number of cardholders remains a key issue. In October 2001, NAVSUP issued an interim change to its existing purchase card instructions to establish minimum criteria that prospective purchase card holders must meet before a purchase card account (including convenience check accounts) can be established in the employee’s name. The interim change issued by NAVSUP also established a maximum “span of control” of 5 to 7 cardholders to each approving official and required that Navy activities establish local policies and procedures for approving and issuing purchase cards to activity personnel. The Navy’s span of control requirement reflects guidance issued by the Department of Defense Purchase Card Program Management Office on July 5, 2001, shortly before the Subcommittee hearing. The revised guidance stated that, generally, an approving official’s span of control—cardholders per approving official— should not exceed a ratio of 7 to 1. Neither of the two units increased the number of approving officials to meet the suggested ratio until well after the start of fiscal year 2002. Table 1 summarizes the progress made by both units. The data in table 1 show that from September 21, 2000, to January 21, 2002, SPAWAR Systems Center had a net reduction in the number of cardholders of 360 (31 percent) and NPWC, 107 (37 percent). In addition, in fiscal year 2002, SPAWAR Systems Center increased the number of approving officials to 203 and NPWC, to 43. As a result, the approving official ratio for SPAWAR Systems Center and NPWC is now in line with DOD’s criterion of no more that 7 cardholders per official. However, as of January 21, 2002, SPAWAR Systems Center still had 23 approving officials who were responsible for more than 7 cardholders and therefore did not comply with the DOD and Navy span of control requirements. SPAWAR Systems Center records show that it significantly reduced the number of cardholders, primarily through canceling cards of those that did not need them and through employee attrition. According to SPAWAR Systems Center officials, some SPAWAR Systems Center purchase cards were canceled because of misuse; however, we were unable to determine from SPAWAR Systems Center records how many of the cards were canceled for this reason. We previously reported that SPAWAR Systems Center had a significant span-of-control issue with one approving official responsible for certifying monthly purchase card statements for all of its cardholders. According to Citibank and SPAWAR Systems Center records, effective for the billing period ending January 21, 2002, SPAWAR Systems Center increased from 1 to 203 the number of approving officials responsible for certifying monthly summary invoices. This change reduced SPAWAR Systems Center’s average span of control to 4 cardholders to each approving official, which is in line with DOD and Navy guidelines. We did not perform any testing for fiscal year 2002 transactions to determine whether the approving officials were in place and performing effective reviews. SPAWAR Systems Center management told us that they are continuing to evaluate the number of cardholders and the impact any further cuts would have on management’s ability to support operations and keep employees working efficiently. NPWC reduced the number of its cardholders through employee attrition and by canceling the cards of individuals who no longer needed them, had not taken required training, or had misused the card. Specifically, on July 6, 2001, the agency program coordinator (APC) gave each business line manager an analysis of monthly purchase card usage data for each of the cardholders under his or her supervision. The business line managers were instructed to analyze cardholder monthly transaction volume and reduce the number of cardholders by eliminating those cardholders they believed no longer needed a purchase card. NPWC also recently increased its number of approving officials from 7 as of September 21, 2001, to 43 by January 21, 2002. This significant increase brought the ratio of cardholders to approving officials in line with DOD and Navy guidelines. Another key factor in minimizing the government’s financial exposure is assessing the monthly credit limits available to cardholders. The undersecretary of defense for acquisition and technology emphasized in an August 2001 memorandum to the directors of all defense agencies, among others, that not every cardholder needs to have the maximum transaction or monthly limit and that supervisors should set reasonable limits based on what each person needs to buy as part of his or her job. We concur with the undersecretary’s statements and continue to recommend that cardholder spending authority be limited as a way of minimizing the federal government’s financial exposure. As shown in table 2, total financial exposure, as evidenced by monthly credit limits for SPAWAR Systems Center and NPWC cardholders, has decreased substantially. SPAWAR Systems Center reduced the overall credit limits of it cardholders by about $29 million primarily by (1) eliminating nearly $10 million of credit assigned to each of two cardholders and (2) reducing the net number of cardholders by 360. As we previously reported, most SPAWAR Systems Center cardholders had a $25,000 credit limit, and no cardholder had a credit limit of less than $25,000. We continue to believe that a $25,000 minimum credit limit is more than most SPAWAR Systems Center cardholders need to perform their mission. This point is best demonstrated by the fact that even when we used SPAWAR Systems Center’s reduced number of cardholders, the average monthly purchase card bill in fiscal year 2001 would have been less than $5,000. As shown in table 2, Citibank’s records indicate that between September 21, 2000, and January 21, 2002, NPWC reduced its cardholder exposure from about $13.5 million to $12.1 million—a $1.4 million reduction. NPWC achieved this reduction primarily by reducing by 107 the number of individuals who had purchase cards and by reevaluating cardholders’ monthly credit limits. We previously reported that most NPWC cardholders were granted a monthly credit limit of $20,000. Currently, about 20 NPWC cardholders have a credit limit of less than $20,000, about 42 percent still have a $20,000 credit limit, and the remaining cardholders have higher credit limits to meet job needs. Further, the average monthly purchase card bill (using the reduced number of cardholders) in fiscal year 2001 for NPWC cardholders would have been about $11,500. On September 7, 2001, the NPWC agency program coordinator distributed spreadsheet analyses of individual cardholder actual monthly and average charges, along with suggested new monthly cardholder limits, to the respective cardholder’s business line managers. The agency program coordinator required the business line managers to respond to the agency program coordinator with new limits for cardholders by the close of business on September 21, 2001. At the exit meeting we held with NPWC officials, NPWC provided Citibank records documenting that NPWC further reduced its cardholder credit limits to $5.6 million in February 2002. In addition to the reductions in the number of cardholders and aggregate financial exposure, the dollar volume of transactions decreased significantly in fiscal year 2001 when compared to fiscal year 2000, as shown in table 3.