HUD’s purchase card program is part of the governmentwide commercial credit card program established to simplify federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services from vendors. According to Federal Acquisition Regulation (FAR) Part 13.201(b), government purchase cards should be used for micropurchases, which are purchases up to $2,500. The Department of the Treasury also requires agencies to establish approved uses and limitations on the types of purchases and spending limits. GSA administers the master contract and HUD’s purchase card policy was derived from the GSA governmentwide credit card program and tailored by HUD to meet its specific needs. During the period of our review—October 2000 through September 2001—HUD was operating under a policy dated October 1995. HUD is currently updating its purchase card policy. HUD’s purchase card policy states that purchase cards are intended to procure general-purpose office supplies and other support needs. The policy requires each approving official to develop a preapproval process to ensure that all purchase card transactions are authorized and in accordance with departmental and other federal regulations. The approving official signifies that a cardholder’s purchases are appropriate by reviewing and signing monthly statements. As required by the Department of the Treasury, HUD’s purchase card policy established approved uses and limitations on the types of purchases and dollar amounts in its purchase card policy. This policy also includes a detailed list of items that cardholders are prohibited from buying with their government purchase cards. For example, purchase or rental of nonexpendable property (generally defined as property of a durable nature with a life expectancy of at least 1 year), meals, drinks, entertainment or lodging, and construction costs exceeding $2,000 are generally prohibited. Fiscal year 2001 single purchase limits for individual cardholders, which are required to be established by the approving officials and approved by the departmental directors, ranged from $100 to $80,000, and their monthly limits ranged from $100 to $300,000. HUD was in the process of reevaluating and where applicable, lowering these limits. Bank One currently services the purchase card program at HUD. Internal control is a major part of managing an organization and is key to ensuring proper use of government resources. As mandated by 31 U.S.C. 3512, commonly known as the Federal Managers’ Financial Integrity Act of 1982, the Comptroller General issues standards for internal control in the federal government. These standards provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives. Control activities are the policies, procedures, techniques, and mechanisms that enforce management’s directives and help ensure that actions are taken to address risks. Control activities are an integral part of an entity’s planning, implementation, review, and accountability for stewardship of government resources and achieving effective results. They include a wide range of diverse activities. Some examples of control activities include controls over information processing, physical control over vulnerable assets, segregation of duties, proper execution of transactions and events, and access restrictions to and accountability for resources and records. To determine whether HUD’s existing controls over the purchase card program provided assurance that improper purchases would be detected or prevented in the normal course of business, we interviewed HUD staff and performed walk-throughs of the process. We reviewed HUD’s policies and procedures and prior GAO reports as well as reports by HUD’s Office of Inspector General (OIG) and independent auditors on this topic. To test the effectiveness of internal controls, we selected a stratified random sample of 222 purchase card transactions made during fiscal year 2001 totaling over $1.8 million from a population of purchase card transactions totaling $10.6 million. To identify potential improper purchases we requested and obtained fiscal year 2001 transaction data from Bank One and used data mining techniques and other computer analyses to identify unusual transactions and payment patterns in HUD’s fiscal year 2001 purchase card transaction data that may be indicative of improper purchases. In order to determine if fiscal year 2001 purchases were adequately supported and for a valid government use, we requested and analyzed supporting documentation for those transactions that we identified as potentially improper and questionable. While we identified some improper, potentially improper, and questionable purchases, our work was not designed to determine the full extent of improper purchases. We requested comments from the Secretary of Housing and Urban Development. We conducted our work from November 2001 through November 2002 in accordance with generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President’s Council on Integrity and Efficiency. HUD staff did not comply with key elements of its purchase card policies that would have helped minimize the risk of improper purchases, including (1) obtaining preapproval for purchases, (2) retaining adequate supporting documentation, (3) conducting supervisory review of all purchases, and (4) periodically reviewing purchase card transactions to ensure compliance with key aspects of the department’s policy. This created an environment where improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases we identified through our data mining efforts. GAO’s Standards for Internal Control in the Federal Government states that transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. To address these internal control standards, HUD’s purchase card policy contains fundamental controls designed to minimize the agency’s exposure to improper purchases. HUD’s policy requires each approving official to establish a preapproval process for each cardholder to ensure that all purchases are appropriate and for official government use. Further, HUD’s policy states that the approving official is required to review, certify, and monitor all cardholder purchases to ensure that they have the necessary approvals before purchases are made. Additionally, HUD’s purchase card policy requires that approving officials review each purchase along with the applicable supporting documentation in order to certify that the purchases were appropriate and a valid use of government funds. Based on our review of HUD’s purchase card process, we found that most approving officials had not established a preapproval process to ensure the appropriateness of purchases before they are made. Only the Information Technology Office routinely obtained authorization prior to purchasing items with the purchase card. The approving official’s review of each purchase card transaction is one of the most important controls to ensure that all purchases are a valid use of government funds. We found that this critical control was seriously compromised because of inadequate supervisory review of supporting documentation by approving officials. To test the effectiveness of this key internal control, we selected and tested a stratified random sample of 222 purchase card transactions made during fiscal year 2001. Of the total $1.8 million purchase card transactions selected in the statistical sample, $1.4 million lacked adequate supporting documentation for the approving official to determine the validity of the purchase. Based on the results of this sample, we estimate that $4,753,253 of the total sampled population of purchases ($10,590,461) made during fiscal year 2001 lacked adequate supporting documentation. Our Standards for Internal Control in the Federal Government states that internal control activities help ensure that management’s directives are carried out. One such activity is the appropriate documentation of transactions. Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. All documentation should be properly managed and maintained. We determined that some of HUD’s records supporting the purchase card program were not properly managed or maintained. For instance, HUD could not provide a complete and accurate list of all approving officials. When we attempted to contact cardholders and their respective approving officials to request supporting documentation using the list the agency provided, at least 28 approving officials provided written notification that cardholders assigned to them according to HUD records were not their responsibility. According to HUD officials, the purchase card program administrator is not routinely informed of changes in approving officials and often does not have the time to update the list regularly. Because HUD does not know who should be approving purchases, there is an increased risk of collusion as well as a general lack of accountability for ensuring the proper use of government funds. Another control activity that was available but not being used by HUD is blocking Merchant Category Codes (MCC). Blocking categories of merchants allows agencies to prohibit certain types of transactions that are clearly not business related, such as purchases from jewelry stores or entertainment establishments. During our review, we found that HUD was not blocking any MCCs. These blocks are available as part of HUD’s purchase card task order, under the GSA SmartPay Master Contract with Bank One. Because HUD did not take advantage of this control, there were no restrictions on the types of purchases employees could make during fiscal year 2001—the period of our audit. As a result of our audit work, on March 6, 2002, HUD began using selected MCC blocks. Our Standards for Internal Control in the Federal Government states that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. Internal control monitoring should assess the quality of performance over time and ensure that findings of audits and other reviews are promptly resolved. Program and operational managers should monitor the effectiveness of control activities as part of their regular duties. HUD’s purchase card policy requires the department to perform annual program reviews and report the results, including findings and recommendations, to the purchase card program administrator. However, HUD officials could locate only one such report.