The General Services Administration (GSA) administers the federal government’s contracts in support of agencies’ purchase card programs. GSA contracts with commercial banks to issue purchase cards to federal employees to make official government purchases. Citibank issues purchase cards to VA operating administrations, including VHA. Use of the purchase card is intended to streamline federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. VA’s purchase card program, including VHA, also includes the use of convenience checks to pay vendors that do not accept purchase cards as payment. VA is subject to the Federal Acquisition Regulation (FAR), which governs the acquisition of goods and services by all executive agencies. To implement and supplement these regulations, VA issues the Department of Veterans Affairs Acquisition Regulations (VAAR), which prescribes VA procurement policies and procedures. To implement and supplement the VAAR, VA issues directives that set forth policy, and handbooks, that prescribe procedures for implementing the applicable policy. For the purchase card program, VA issued departmentwide guidance, VA Directive 4080, Government Purchase Card Policy, and VA Handbook 4080, Government Purchase Card Procedures, both dated April 4, 2003. VA has separate policies and procedures for the use of convenience checks related to the purchase card program: VA Directive 4010, Agent Cashier Policy, and VA Handbook 4010, Agent Cashier Procedures, both dated October 17, 1994; and VA Directive 4070, Cash Management, and VA Handbook 4070.2, Disbursement Mechanisms, both dated April 21, 1997. VHA Directive 1730.1 Use of the Government Purchase Card in VHA, (May 19, 2003) and VHA Handbook 1730.1, Use and Management of the Government Purchase Card Program (June 14, 2000) provide policies and procedures that VHA facilities and program offices must follow when using the government purchase card. VHA uses this guidance, in conjunction with VA’s departmentwide guidance, to operate its VHA purchase card program. VA and VHA mandate the use of the purchase card for all micro- purchases – acquisitions of supplies and services generally at or below $2,500 and provides that the purchase card must be used to the maximum extent practical for all purchases up to the simplified acquisition threshold, currently $100,000. In fiscal year 2002, VHA used purchase cards and convenience checks to make 2.8 million purchases totaling $1.4 billion. During this time frame, about 14,000 of the approximately 188,000 VHA employees, or 7 percent of the VHA workforce, had purchase cards or convenience check accounts. For the purchase cards, a majority of the cardholders had single purchase limits between $2,500 and $25,000. For the convenience checks, the single purchase limits were either set at $2,500 or $10,000. The VHA Chief Financial Officer (CFO) has overall responsibility for the implementation and oversight of the purchase card program within VHA. A facility director and/or regional office director at each of VHA’s 21 Veterans Integrated Service Network (VISN) is responsible for implementing the purchase card program at the local level. These officials are also responsible for designating an agency or organization program coordinator (A/OPC) to oversee the purchase card program at each facility within the director’s geographic area. There are approximately 162 VHA medical centers and about 148 local A/OPCs responsible for the primary management of the purchase card activity at their facilities. Generally, at each facility, personnel in three positions – A/OPC, cardholder, and approving official – are collectively responsible for providing reasonable assurance that purchase card transactions are appropriate and meet a valid government need. The A/OPC is responsible for the day-to-day management, administration, and oversight of the program such as ensuring appropriate training has been provided, setting up cardholder and approving official accounts, retrieving and canceling all unneeded cards, and performing reviews of purchase card activity to ensure compliance with applicable laws, regulations, policies and procedures. VHA’s purchase card guidance states that the A/OPC cannot be a cardholder or an approving official. The cardholders are responsible for making purchases, inputting purchase information in the local purchasing system, maintaining supporting documentation, and electronically reconciling their purchases by matching the payment charges from the purchase card program contractor to the local purchasing system. The approving officials, who typically are responsible for more than one cardholder, are charged with monitoring purchase card usage to ensure compliance with applicable laws and regulations and VA/VHA policies and procedures, are to ensure applicable documentation is maintained, and according to VHA guidance, certify, through an electronic signature, that all procurements are legal and proper and that the items have been received. VA’s guidance also provides that in most cases, the approving official should not be a cardholder. However, where staffing levels necessitate, the approving official may be a cardholder, but cannot approve his or her own transactions. VHA’s purchase card program also allows the use of convenience checks to pay vendors that do not accept credit cards. VA’s disbursement mechanism policy provides that convenience checks be used in lieu of cash but only when the government purchase card cannot be used. Agent cashiers are responsible for making payments to the payee upon receiving authorization and supporting purchase documentation from the office requesting payment, reconciling the check payments as they clear VA’s purchase card account, and maintaining a copy or carbon copy of the check for a period of one year. On February 12, 1999, the OIG issued a report of VA’s purchase card program. The OIG reported that management controls were not effectively implemented to ensure the integrity of the purchase card program and that maximum benefits were not being realized. Among other things, the OIG found weaknesses related to account reconciliation and certification, documentation, split purchases, and safeguarding of purchase cards. The OIG made several recommendations for corrective action. During the period March 1999 through September 2003, the OIG issued an additional 83 reports that continued to identify internal control weaknesses in the VA’s purchase card program. A summarization of these results, was reported in the OIG’s April 26, 2004 report on its evaluation of VA’s purchase card program. Specifically, during this time frame, the OIG reported 5 fraud cases totaling $435,900. The fraud cases involved former and current employees and in one instance, a non-VA employee. Items purchased included computers, televisions, stereos, DVD and CD players, a diamond ring, and other merchandise. The OIG reported that generally, cardholders were able to commit purchase card fraud because approving officials did not ensure that purchases were legal and proper and that items had been received and were for official government use. In addition, the OIG reported it had identified 457 improper or questionable purchases totaling $1.1 million that did not comply with the FAR, VA policy, or were not adequately supported by documentation. The improper and questionable purchases included (1) procurements over the $2,500 micro- purchase threshold without the use of competition, (2) purchases split into two or more transactions to circumvent the micro-purchase limit, (3) use of the purchase card by someone other than the cardholder, and (4) recurring purchases from the same vendor where the cardholders did not maintain vendor documentation to support the purchases. The OIG made two new recommendations in its 2004 report that (1) direct VA facility managers to conduct quarterly audits, (2) provide for the development and implementation of procedures and checklists for approving officials to use in monitoring cardholder activity, (3) update VA’s purchase card policy to include span of control criteria for approving officials, and (4) expand internal audit procedures to include identifying questionable purchases through data mining. The OIG reported that the Under Secretary for Health, the Under Secretary for Benefits, and the Assistant Secretary for Management agreed with the findings and recommendations and provided acceptable improvement plans. To determine whether existing controls at VHA were designed to provide reasonable assurance that improper purchases would be prevented or detected in a normal course of business, we obtained an understanding of VA/VHA’s purchase card and convenience check policies and procedures, and the related internal controls. We then assessed the adequacy of those controls using various GAO prescribed guidance and by performing detailed tests of transactions. Specifically, we reviewed applicable laws and regulations, VA and VHA directives and handbooks, and previous reports issued by VA’s OIG, conducted walkthroughs and telephone interviews with VHA personnel to identify key purchase card and convenience check policies and procedures, assessed the adequacy of internal controls, using our Audit Guide: Auditing and Investigating the Internal Control of Government Purchase Card Programs, Standards for Internal Control in the Federal Government, Internal Control Management and Evaluation Tool, Guide for Evaluating and Testing Controls Over Sensitive Payments, and Executive Guide: Strategies to Manage Improper Payments, and performed tests of those control activities that we considered to be key in creating a system to provide reasonable assurance that transactions are correct and proper throughout the purchase card procurement process and convenience check payment process. The key internal control activities we tested included the following.