Against this backdrop of long-standing concerns with DOD’s internal controls over its payment processes, I would like to briefly outline the specifics of the two recent fraud cases. The first case involved fraudulent activity between October 1992 and February 1993 related to two Bolling Air Force Base (AFB) office automation contracts resulting in an embezzlement of over $500,000. The Bolling AFB contracting officer’s technical representative (COTR) had authority to authorize, approve, verify, and process contract and payment documentation and receive and accept goods and services. In addition, this person was not adequately supervised. The COTR’s supervisor told investigators and us that she allowed the COTR to perform these duties independently without close supervision. The COTR was able to embezzle over $500,000 by creating fictitious invoices and receiving reports. The COTR was able to accomplish this scheme without detection by Air Force officials because he took advantage of his broad authority and the lack of adequate supervision. In addition, at the time of this incident, the address on the invoice was used as the remittance address, which is a control weakness. Therefore, directing the payments to himself was simply a matter of listing his post office box as the contractor address on the false invoices. Authorities were only alerted to the COTR’s embezzlement when he attempted to withdraw a large portion of the funds, and suspicious bank officials put a hold on the accounts and notified the U.S. Secret Service. After coming under suspicion, the COTR prepared a letter stating that overbilling errors had been made and returned the funds to the government. Following an investigation by the Air Force Office of Special Investigation, the COTR pleaded guilty and was sentenced to 3 years probation and ordered to pay $495. Further details on the COTR’s schemes can be found in GAO/OSI-98-15. We also were unable to determine whether the Air Force received the goods and services paid for under the two Air Force contracts associated with the Bolling AFB fraud because, in addition to missing records—another indicator of a weak internal control environment—a number of improper procedures were followed for receipt and control of equipment and services paid for under the contracts. For example, the COTR had also directed the contractor to falsify invoices and receiving reports by changing the type and quantity of items received under a delivery order. The second case covered fraudulent activities of a Staff Sergeant between October 1994 and June 1997 at two locations resulting in a $435,000 embezzlement and attempted theft of over $500,000. The first known location where fraudulent payments were made was Castle AFB, California, between October 1994 and May 1995. The Staff Sergeant, who was Chief of Material in the Accounting Branch, had broad access to the automated vendor payment system, which allowed him to enter contract information, including contract numbers, delivery orders, modifications, and obligations, as well as invoice and receiving report information and remittance addresses. The Staff Sergeant used this broad access to process invoices and receiving report documentation that resulted in eight fraudulent payments totaling $50,770 that were identified. The invoices prepared by the Staff Sergeant designated the name of a relative as the payee and his own mailing address as the remittance address, although any address, including a post office box, could have been used. Castle AFB closed in September 1995, and the Staff Sergeant was transferred to the Defense Finance and Accounting Service (DFAS) operating location at Dayton, Ohio. At DFAS Dayton, the Staff Sergeant was assigned as the Vendor Pay Data Entry Branch Chief in the Vendor Pay Division. As Vendor Pay Chief, the Staff Sergeant was allowed a level of access to the vendor payment system similar to the access he previously held at Castle AFB. Between November 1995 and January 1997, the Staff Sergeant prepared false invoices and receiving reports that resulted in nine fraudulent payments totaling $385,916. By designating the remittance address on the false invoices, the Staff Sergeant was able to direct fraudulent payments to an accomplice. In February 1997, the Staff Sergeant was reassigned to DFAS Dayton’s Accounting Branch and his access to the vendor payment system was removed. However, while assigned to the Accounting Branch, the Staff Sergeant created two false invoices totaling $501,851 and submitted them for payment in June 1997, using the computer password of another DFAS employee who had a level of access comparable to that previously held by the Staff Sergeant. The Staff Sergeant’s fraudulent activities were detected when, for an invoice totaling $210,000, an employee performing a reconciliation identified a discrepancy between the contract number associated with the invoice in the vendor payment system and in the accounting system. These two numbers should always agree. For this invoice, the Staff Sergeant failed to ensure that the contract cited was the same in both systems. Further research determined that the contract was not valid and the payment was fraudulent. A second fraudulent invoice for $291,851, the $50,770 in fraudulent payments at Castle AFB, and the $385,916 in fraudulent payments at DFAS Dayton were detected during the subsequent investigation of the DFAS Dayton fraud. The Staff Sergeant was convicted of embezzling over $435,000 and attempted theft of over $500,000. He was also convicted of altering invoices and falsifying information in the vendor payment system—a violation of 18 U.S.C. 1001—to avoid interest on late payments and improve reported performance for on-time payments, which is discussed later in this testimony. In July 1998, the Staff Sergeant was sentenced to 12 years imprisonment. The Dayton case also involved the altering of invoices to improve reported payment performance, thereby depriving government contractors of interest payments. Now, Mr. Chairman, I would like to turn our attention to the current control environment at the locations where these incidents occurred. Our work shows that similar internal control and system weaknesses continue to leave the Air Force vulnerable to fraudulent or improper vendor payments. For example, as of mid-June 1998, over 1,800 DFAS and Air Force employees had a level of access to the vendor payment system that allowed them to enter contract information, including the contract number, delivery orders, modifications, and obligations, as well as invoice and receiving report information and remittance addresses. In addition, the automated vendor payment system is vulnerable to penetration by unauthorized users due to weaknesses in computer security, including inadequate password controls. Finally, controls over remittance addresses remain a weakness. An August 1996 Air Force Audit Report disclosed that DFAS personnel did not properly control access to the vendor payment system and recommended that DFAS review and reduce vendor payment system access levels where appropriate. Our review of vendor payment system access levels as of mid-June 1998 showed that across DFAS and Air Force installations, individual users could enter contract data, including obligations, and invoice and receiving report information, and change remittance addresses for vendor payments. Currently, there are four access levels to the vendor payment system: inquiry, clerk, subsupervisor, and supervisor. Inquiry is read only access. Clerk access allows the user to enter data other than remittance addresses. Subsupervisor access allows the user to input or change contract data; information on obligations, invoices, and receiving reports; and remittance addresses. Supervisor access allows the user to perform all subsupervisor functions as well as assign or remove access. The Staff Sergeant who committed the DFAS Dayton fraud had supervisor access. Proper and effective internal controls would preclude allowing any individual user to have the ability to record an obligation, create and change invoices and receiving reports, and enter remittance addresses. Our review of the vendor payment process at DFAS Dayton and DFAS Denver’s Directorate of Finance and Accounting Operations confirmed that employees with supervisor and subsupervisor access to the vendor payment system could make fraudulent payments without detection by entering contract information and obligations, invoice and receiving report data, and changing or creating a remittance address. If the data on a false invoice and receiving report match the information on the voucher, certifying officers are not likely to detect a fraudulent payment through their certification process, a key prevention control. Second, problems with the lack of segregated access within the payment system application are compounded by the excessive and widespread access to the system throughout DFAS and the Air Force. Our review of vendor payment system access levels as of mid-June 1998 showed that 1,867 users across DFAS and Air Force installations had supervisor or subsupervisor access. Further, 94 of these users had not accessed the system since 1997, indicating that they may no longer be assigned to vendor payment operations. In addition, 171 users had not accessed the system at all, possibly indicating that access is not required as a regular part of their duties. DFAS officials told us they were unaware that such a large number of employees had broad access to the vendor payment system. After we briefed the DFAS Denver Center Director about our concerns, he told us that the current operational review program would be revised to place a greater focus on internal controls, including the review of vendor payment system access levels. DFAS officials told us that for Air Force employees outside the operating locations who had supervisor or subsupervisor access, but only need status reports, they have initiated action to reduce the level of access to inquiry only. They also told us that they would consider modifying the supervisor and subsupervisor access levels across DFAS locations to provide for greater segregation of duties within the vendor payment application for employees responsible for processing payments. Finally, with respect to access controls, there are significant weaknesses in the mainframe operating system security and the vendor payment system application that would allow unauthorized users to make fraudulent or improper payments.