GSA administers the federal government’s SmartPay® purchase card program, which has been in existence since the late 1980s. The purchase card program was created as a way for agencies to streamline federal acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services directly from vendors. The purchase card can be used for simplified acquisitions, including micropurchases, as well as to place orders and make payments on contract activities. The FAR designated the purchase card as the preferred method of making micropurchases. In addition, part 13 of the FAR, “Simplified Acquisition Procedures,” establishes criteria for using purchase cards to place orders and make payments. Figure 1 shows the dramatic increase in purchase card use since the inception of the SmartPay® program. As shown in figure 1, during the 10-year period from fiscal year 1996 through 2006, acquisitions made using purchase cards increased almost fivefold—from $3 billion in fiscal year 1996 to $17.7 billion in fiscal year 2006. Figure 2 provides further information on the number of purchase cardholder accounts. As shown, the number of purchase cardholder accounts peaked in 2000 at more than 670,000, but since then the number of purchase cardholder accounts has steadily decreased to around 300,000. Cardholder (in thouand) As the contract administrator of the program, GSA contracts with five different commercial banks in order to provide purchase cards to federal employees. The five banks with purchase card contracts are (1) Bank of America, (2) Citibank, (3) Mellon Bank, (4) JPMorgan Chase, and (5) U.S. Bank. GSA also has created several tools, such as the Schedules Program, so that cardholders can take advantage of favorable pricing for goods and services. Oversight of the purchase card program is also the responsibility of OMB. OMB provides overall direction for governmentwide procurement policies, regulations, and procedures to promote economy, efficiency, and effectiveness in the acquisition processes. Specifically, in August 2005, OMB issued Appendix B to Circular No. A-123, Improving the Management of Government Charge Card Programs, that established minimum requirements and suggested best practices for government charge card programs. From July 1, 2005, through June 30, 2006, GSA reported that federal agencies purchased over $17 billion of goods and services using government purchase cards. Our analysis of transaction data provided by the five banks found that micropurchases represented 97 percent of purchase card transactions and accounted for almost 57 percent of the dollars expended. Using purchase cards for acquisitions and payments over the micropurchase limit of $2,500 represented about 3 percent of purchase transactions and accounted for more than 44 percent of the dollars spent from July 1, 2005, through June 30, 2006. Internal control weaknesses in agency purchase card programs exposed the federal government to fraudulent, improper, and abusive purchases and loss of assets. Our statistical testing of two key transaction-level controls over purchase card transactions over $50 from July 1, 2005, through June 30, 2006, found that both controls were ineffective. In aggregate, we estimated that 41 percent of purchase card transactions were not properly authorized or purchased goods or services were not properly received by an independent party (independent receipt and acceptance). We also estimated that 48 percent of purchases over the micropurchase threshold were either not properly authorized or independently received. Further, we found that agencies could not provide evidence that they had possession of, or could otherwise account for, 458 of 1,058 accountable and pilferable items. According to Standards for Internal Control in the Federal Government, internal control activities help ensure that management’s directives are carried out. The control activities should be effective and efficient in accomplishing the agency’s control objectives and should occur at all levels and functions of an agency. The controls include a wide range of activities, such as approvals, authorizations, verifications, reconciliations, performance reviews, and the production of records and documentation. For this audit, we tested those control activities that we considered to be key in creating a system that prevents and detects fraudulent, improper, and abusive purchase card activity. To this end, we tested whether (1) cardholders were properly authorized to make their purchases and (2) goods and services were independently received and accepted. As shown in table 1, we estimated that the overall failure rate for the attributes we tested was 41 percent, with failure rates of 15 percent for authorization and 34 percent for receipt and acceptance. Lack of proper authorization. As shown in table 1, 15 percent of all transactions failed proper authorization. According to Standards for Internal Control in the Federal Government, transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority, as this is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. To test authorization, we accepted as reasonable evidence various types of documentation, such as purchase requests or requisitions from a responsible official, e-mails, and other documents that identify an official government need, including blanket authorizations for routine purchases with subsequent review by an approving official. The lack of proper authorization occurred because (1) the cardholder failed to maintain sufficient documentation, (2) the agency’s policy did not require authorization, or (3) the agency lacked the internal controls and management oversight to identify purchases that were not authorized— increasing the risk that agency cardholders will misuse the purchase card. Failure to require cardholders to obtain appropriate authorization and lack of management oversight increase the risk that fraudulent, improper, and other abusive activity will occur without detection. Lack of independent receipt and acceptance. As depicted in table 1, our statistical sampling of executive agency purchase card transactions also found that 34 percent of transactions failed independent receipt and acceptance, that is, goods or services ordered and charged to a government purchase card account were not received by someone other than the cardholder. According to Standards for Internal Control in the Federal Government, the key duties and responsibilities need to be divided or segregated among different people to reduce the risk of error or fraud. Segregating duties entails separating the responsibilities for authorizing transactions, processing and recording them, reviewing the transactions, and handling related assets. The standards further state that no one individual should control all key aspects of a transaction or event. As evidence of independent receipt and acceptance, we accepted any signature or initials of someone other than the cardholder on the sales invoice, packing slip, bill of lading, or any other shipping or receiving document. We found that lack of documented, independent receipt extended to all types of purchases, including pilferable items such as laptop computers. Independent receipt and acceptance helps provide assurance that purchased items are only acquired for legitimate government need and not for personal use. Although we did not test the same number of attributes as in previous audits of specific agencies’ purchase card programs, for those attributes we tested, the estimated governmentwide failure rates shown in this report are lower than the failure rates we have previously reported for certain individual agencies. Table 2 provides failure rates from our prior work related to proper approval and independent receipt and acceptance for certain individual agencies. As shown, estimated failure rates for independent receipt and acceptance from previous audits were as high as 87 percent for one Army location (as reported in 2002) and, most recently, 63 percent for DHS (as reported in 2006). In contrast, we are estimating a 34 percent failure rate for this audit. Because prior audits have been restricted to individual agencies, we cannot state conclusively that the lower failure rate is attributable to improvements in internal controls governmentwide. However, some agencies with large purchase card programs, such as DOD, have implemented improved internal controls in response to our previous recommendations. Further, in 2005, OMB also issued Appendix B to Circular No. A-123 prescribing purchase card program guidance and requirements. These changes are positive steps in improving internal controls over the purchase card program. While only 3 percent of governmentwide purchase card transactions from July 1, 2005, through June 30, 2006, were purchases above the micropurchase threshold of $2,500, these transactions accounted for 44 percent of the dollars spent during that period. Because of the large dollar amount associated with these transactions, and additional requirements related to authorization than are required for micropurchases, we drew a separate statistical sample to test controls over these larger purchases. Specifically, we tested (1) proper purchase authorization and (2) independent receipt and acceptance. As part of our test of proper purchase authorization, we looked for evidence that adequate competition was obtained. If competition was not obtained, we asked for supporting documentation showing that competition was not required, for example, that the purchase was acquired from sole-source vendors. We estimated that 48 percent of the purchase card transactions over the micropurchase threshold failed our attribute tests. As shown in table 3, for 35 percent of purchases over the micropurchase threshold, cardholders failed to obtain proper authorization. Additionally, in 30 percent of the transactions, cardholders failed to provide sufficient evidence of independent receipt of the goods or services. Lack of proper authorization for purchases over the micropurchase limit. As table 3 indicates, 35 percent of purchases over the micropurchase limit were not properly authorized. To test for proper authorization, we looked for evidence of prior approval, such as a contract or other requisition document. For purchases above the micropurchase threshold, we also required evidence that the cardholder either solicited competition or provided reasonable evidence for deviation from this requirement, such as sole source justification. Of the 34 transactions that failed proper authorization, 10 transactions lacked evidence of competition. For example, one Army cardholder purchased computer equipment totaling over $12,000 without obtaining and documenting price quotes from three vendors as required by the FAR. The purchase included computers costing over $4,000 each, expensive cameras that cost $1,000 each, and software and other accessories—items that are supplied by a large number of vendors.