We conducted our audit work from August 2000 through June 2001 in accordance with generally accepted U.S. government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. We briefed DOD managers, including officials in DOD’s Purchase Card Program Management Office and the Defense Finance and Accounting Service (DFAS), and Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego officials on the details of our review, including our objectives, scope, and methodology and our findings and conclusions. We referred instances of potentially fraudulent transactions that we identified during our work to our Office of Special Investigations for further investigation. Our work was not designed to identify, and therefore we did not determine, the extent of fraudulent, illegal, or abusive transactions. Our control tests were based on stratified random probability samples of 135 SPAWAR San Diego purchase card transactions and 121 Navy Public Works Center San Diego transactions. Further details on our objectives, scope, and methodology are included in appendix III. Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. A positive control environment is the foundation for all other standards. It provides discipline and structure as well as the climate which influences the quality of internal control. GAO’s Standards for Internal Control in the Federal Government (GAO/AIMD-00-21.3.1, November 1999) A weak internal control environment at SPAWAR San Diego and the Navy Public Works Center San Diego contributed to internal control weaknesses, fraud, and abuse. The importance of the “tone at the top” or the role of management in establishing a positive internal control environment cannot be overstated. GAO’s internal control standards go on to state that, “management plays a key role in demonstrating and maintaining an organization’s integrity and ethical values, especially in setting and maintaining the organization’s ethical tone, providing guidance for proper behavior, removing temptations for unethical behavior, and providing discipline when appropriate.” The specific factors that contributed to the lack of a positive control environment at these two units included a proliferation of purchase cardholders, ineffective training of cardholders and certifying officers, ineffective rebate management, and a lack of monitoring and oversight. SPAWAR San Diego and the Navy Public Works Center San Diego did not have specific policies governing the number of cards issued or establishing criteria for identifying employees eligible for the privilege of cardholder status. At both units, cards were given out on the basis of a request from an individual employee’s supervisor. The request was then forwarded to the unit’s purchase card agency program coordinator, who approved the request and began the process for obtaining a new card from Citibank. According to SPAWAR and Navy Public Works Center officials, specific criteria did not exist for either the supervisors or the program coordinators to use in requesting and approving purchase cards for employees. This flawed policy has resulted in a proliferation of purchase cards at the two units. For example, as of September 30, 2000, about one in three, or 36 percent of SPAWAR San Diego employees and about one in six, or 16 percent, of Navy Public Works Center San Diego employees were cardholders. As a result, at the end of fiscal year 2000, about 1,526 SPAWAR San Diego employees and 254 Navy Public Works Center San Diego employees were authorized to procure goods and services. Within this weak control environment, these two Navy units had given purchase cards to over 1,700 employees, most of whom had credit limits of $20,000 or more and the authority to make their own purchase decisions. Table 1 shows the proliferation of cardholders and the percentage of employees at SPAWAR and the Navy Public Works Center in San Diego that were cardholders as of September 30, 2000. Most of SPAWAR’s 1,526 cardholders had a $25,000 credit limit and most of the Navy Public Works Center’s 254 cardholders had a $20,000 credit limit. Information we obtained from six large defense contractors on their purchase card programs showed that the percent of the contractors’ employees that were cardholders ranged from about 2 percent to nearly 4 percent—significantly less than at SPAWAR and the Navy Public Works Center in San Diego. The proliferation of cardholders, particularly at SPAWAR San Diego, created a situation where it was virtually impossible to maintain a positive control environment. For example, at SPAWAR, a significant span of control issue existed, with one approving official responsible for certifying monthly summary billing statements covering an average of over 700 monthly purchase card statements relating to 1,526 purchase cardholders. At the Navy Public Works Center San Diego, the span of control problem was not as serious, with six approving officials responsible for certifying monthly summary statements covering an average of 55 monthly statements for 254 cardholders. The span of control issue is particularly important for purchase cards because supervisors and, in some cases, cardholders themselves, are responsible for authorizing purchases, rather than an independent contracting officer as is the case under the standard procurement process. Thus, the approving official serves as a key control in certifying cardholder purchases. The lack of documented evidence of purchase card training also contributed to a weak internal control environment at SPAWAR and the Navy Public Works Center in San Diego. GAO’s internal control standards emphasize that effective management of an organization’s workforce—its human capital—is essential to achieving results and is an important part of internal control. Training is key to ensuring that the workforce has the skills necessary to achieve organizational goals. In accordance with Navy Supply Command (NAVSUP) Instruction 4200.94, all cardholders and approving officials must receive purchase card training. Specifically, NAVSUP Instruction 4200.94 requires that prior to the issuance of a purchase card, all prospective cardholders and approving officials must receive training regarding both Navy policies and procedures as well as local internal operating procedures. Once initial training is received, the Instruction requires all cardholders to receive refresher training every 2 years. Although we found the training policies and procedures to be generally adequate, we determined that SPAWAR and the Navy Public Works Center lacked documentation to demonstrate that all cardholders and approving officials had received the required training. Based on our tests of fiscal year 2000 purchase card transactions, we estimate that about 40 percent of the SPAWAR transactions, totaling at least $6.8 million, and 56 percent of the Navy Public Works Center transactions, totaling at least $10.9 million, were made by cardholders for whom there was no documented evidence that they had received either the required initial training or refresher training on purchase card policies and procedures. SPAWAR San Diego management contended that we should accept training provided under the Navy’s previous purchase card program as meeting the training requirements under the new program. Although we determined that the policies and procedures related to cardholder responsibilities were essentially the same under the previous Navy purchase card program, we found that several cardholders had received the prior training as many as 2 years to 6 years before the current program began. Therefore, these cardholders had not received the required biennial refresher training. The Navy Public Works Center San Diego had no documented evidence that its cardholders had received any purchase card training prior to March 2000. We also found no documented evidence that two of six Navy Public Works Center approving officials had received training on purchase card policies and procedures prior to assuming certifying officer responsibilities. SPAWAR’s one approving official had received all required training. We found ineffective management of purchase card rebates by the Navy, SPAWAR San Diego, and the Navy Public Works Center San Diego. The Navy requested that Citibank defer payment of all of the purchase card rebates it earned since the current purchase card program began in November 1998 because, according to DOD and Navy officials, it had not yet determined how to record and allocate the rebates to Navy programs. According to Citibank officials, Citibank plans to pay cumulative purchase card rebates and accrued interest to the Navy on July 31, 2001, the payment date required in the Navy’s latest purchase card contract task order modification. Citibank estimates that the total payment will be about $8.8 million, including an estimated $8.3 million in cumulative rebates and an estimated $530,000 in accrued interest on these rebates. In addition, the Navy had not established policies and procedures for managing rebates and had not monitored its rebate earnings. As a result, the Navy, SPAWAR San Diego, and the Navy Public Works Center San Diego were not aware that Citibank had miscalculated the rebates that SPAWAR and the Navy Public Works Center should have earned during fiscal year 2000 by about $150,000. Specifically, the rebates due SPAWAR were understated by $136,760, while the Navy Public Works Center’s rebates were overstated by $12,039. Further, SPAWAR and Navy Public Works Center managers were not effectively managing purchase card payments to maximize the amount of rebates earned. We determined that delays in the receipt of monthly purchase card statements had precluded the opportunity for these two units to earn another $242,000 in fiscal year 2000 rebates. We do not know the extent to which these factors have adversely impacted the Navy’s total fiscal year 2000 purchase card rebates. SPAWAR and the Navy Public Works Center in San Diego had not established an effective monitoring and internal audit function for the purchase card program. Further, the Navy’s purchase card policies and procedures did not require that the results of internal reviews be documented or that corrective actions be monitored to help ensure that they are effectively implemented.