According to our Standards for Internal Control in the Federal Government, transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. Although review of transactions by persons in authority is the principal means of assuring that transactions are valid, we found that the review and approval process for purchase card purchases was inadequate in all the agencies reviewed. At the Department of Education, we found that 10 of its 14 offices did not require cardholders to obtain authorization prior to making some or all purchases, although Education’s policy required that all requests to purchase items over $1,000 be made in writing to the applicable department executive officer. We also found that approving officials did not use monitoring reports that were available from Bank of America to identify unusual or unauthorized purchases. Additionally, Education’s 1990 purchase card policy, which was in effect during the time of our review (May 1998 through September 2000), stated that an approving official was to ensure that all purchase card transactions were for authorized Education purchases and in accordance with departmental and other federal regulations. The approving official signified that a cardholder’s purchases were appropriate by reviewing and signing monthly statements. To test the effectiveness of Education’s approving officials’ review, we analyzed 5 months of cardholder statements and found that 37 percent of the 903 monthly cardholder statements we reviewed were not approved by the appropriate official. The unapproved statements totaled about $1.8 million. Further, we found that Education employees purchased computers using their purchase cards, which was a violation of Education’s policy prohibiting the use of purchase cards for this purpose. As I will discuss later, several of the computers that were purchased with purchase cards were not entered in property records, and we could not locate them. If approving officials had been conducting a proper review of monthly statements, the computer purchases could have been identified and the practice halted, perhaps eliminating this computer accountability problem. Education implemented a new approval process during our review. We assessed this new process and found that while approving officials were generally reviewing cardholder statements, those officials were not ensuring that adequate supporting documentation existed for all purchases. Weaknesses in the approval process also existed at the two Navy units we reviewed. During our initial review, approving officials in these two units told us that they did not review support for transactions before certifying monthly statements for payment because (1) they did not have time and (2) Navy policy did not specifically require that approving officials review support. At one of the Navy units, one approving official was responsible for certifying summary billing statements covering an average of over 700 monthly statements for 1,153 cardholders. Further, Navy’s policy allows the approving official to presume that all transactions are proper unless notified to the contrary by the cardholder. The policy appears to improperly assign certifying officer accountability to cardholders and is inconsistent with Department of Defense regulations, which state that certifying officers are responsible for assuring that payments are proper. During our follow-up review, we found that throughout fiscal year 2001, approving officials in the two units still did not properly review and certify the monthly purchase card statements for payment. Although the Department of Defense Purchase Card Program Management Office issued new guidance in July 2001 that would reduce the number of cardholders for which each approving official was responsible, neither of the two units met the suggested ratio of five to seven cardholders to one approving official until well after the start of fiscal year 2002. Further, the Department of Defense agreed with our recommendation that Navy revise its policy to assure that approving officials review the monthly statements and the supporting documentation prior to certifying the statements for payment. However, for the last quarter of fiscal year 2001, one of the Navy units continued to inappropriately certify purchase card statements for payment. The other unit issued local guidance that partially implements our recommendation. IGs at the Departments of Agriculture, the Interior, and Transportation also identified weaknesses in the review and approval processes at these agencies. For example, Agriculture’s IG reported that the department has not effectively implemented an oversight tool in its Purchase Card Management System (PCMS), the system that processes purchase card transactions. This tool is an alert system that monitors the database for pre-established conditions that may indicate potential abuse by cardholders. Responsible officials are to periodically access their alert messages and review the details for questionable transactions. These reviewing officials should contact cardholders, if necessary, so that cardholders can verify any discrepancies or provide any additional information in order to resolve individual alert messages. In order to close out alert messages, reviewers must change the message status to “read” and explain any necessary details to resolve the alerts. According to Agriculture’s IG, only about 29,600 out of 50,500 alerts in the database during fiscal years 1999 and 2000 had been read as of January 9, 2001, and only about 6,100 of the alerts that were read contained responses. The inconsistent use of this oversight tool means that Agriculture management has reduced assurance that errors and abuse are promptly detected and that cardholders are complying with purchase card and procurement regulations. Interior’s IG reported that it reviewed the work of 53 reviewing officials and found that 42 of them performed inadequate reviews. The IG defined an adequate review as one in which the reviewing official, on a monthly basis, reconciled invoices and receipts to the purchase card statements to ensure that all transactions were legitimate and necessary. The IG found that several reviewing officials signed off on monthly statements indicating completed reviews where supporting documentation was not available. Another common internal control weakness we identified was lack of or inadequate training related to the use of purchase cards. Our Standards for Internal Control in the Federal Government emphasize that effective management of an organization’s workforce—its human capital—is essential to achieving results and is an important part of internal control. Training is key to ensuring that the workforce has the skills necessary to achieve organizational goals. Lack of or inadequate training contributed to the weak control environments at several agencies. Navy’s policies required that all cardholders and approving officials must receive initial purchase card training and refresher training every 2 years. We determined that the two Navy units lacked documentation to demonstrate that all cardholders and approving officials had received the required training. We tested $68 million of fiscal year 2000 purchase card transactions at the two Navy units and estimated that at least $17.7 million of transactions were made by cardholders for whom there was no documented evidence they had received either the required initial training or refresher training on purchase card policies and procedures. Although we found during our follow-up work that the two Navy units had taken steps to ensure cardholders receive training and to document the training, many cardholders at one of the units still had not completed the initial training or the required refresher training. Similarly, at Education, we found that although the policy required each cardholder and approving officials to receive training on their respective responsibilities, several cardholders and at least one approving official were not trained. Interior’s IG also reported a lack of training related to the purchase card program. Specifically, the IG reported that although Interior provided training to individual cardholders, it did not design or provide training to reviewing officials. According to the IG, several reviewing officials said that they did not know how to conduct a review of purchase card transactions, nor did they understand how and why to review supporting documentation. As previously mentioned, the IG found that many reviewing officials were not performing adequate reviews. Our Standards for Internal Control in the Federal Government state that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. Internal control monitoring should assess the quality of performance over time and ensure that findings of audits and other reviews are promptly resolved. Program and operational managers should monitor the effectiveness of control activities as part of their regular duties. At the two Navy units we reviewed, we found that management had not established an effective monitoring and internal audit function for the purchase card program. The policies and procedures did not require that the results of internal reviews be documented or that corrective actions be monitored to help ensure they are effectively implemented. The NAVSUP Instruction calls for semiannual reviews of purchase card programs, including adherence to internal operating procedures, applicable training requirements, micro-purchase procedures, receipt and acceptance procedures, and statement certification and prompt payment procedures. These reviews are to serve as a basis for initiating appropriate action to improve the program and correct problem areas. Our analysis of fiscal year 2000 agency program coordinator reviews at one of the Navy units showed that the reviews identified problems with about 42 percent of the monthly cardholder statements that were reviewed. The problems identified were consistent with the control weaknesses we found. Unit management considered the findings but directed that corrective actions not be implemented because of complaints about the administrative burden associated with the procedural changes that would be needed to address the review findings. These reviews generally resulted in the reviewer counseling the cardholders or in some instances, recommending that cardholders attend purchase card training. As a result, the agency program coordinator had not used the reviews to make systematic improvements in the program. During our follow-up work, we noted that this unit had recently made some efforts to implement new policies directed at improving internal review and oversight activities. However, these efforts are not yet complete. At the time of our review, Education did not have a monitoring system in place for purchase card activity. However, in December 2001, the department issued new policies and procedures that, among other things, establish a quarterly quality review of a sample of purchase card transactions to ensure compliance with key aspects of the department’s policy. Transportation’s IG reported that the Federal Aviation Administration (FAA) had not performed required internal follow-up reviews on purchase card usage since 1998. A follow-up review is to consist of an independent official (other than the approving official) reviewing a sample of purchase card transactions to determine whether purchases were authorized and that cardholders and approving officials followed policies and procedures. The types of weaknesses that I have just described create an environment where improper purchases could be made with little risk of detection.