Effective internal controls are essential to achieving the proper conduct of government business with full accountability for the resources made available. Internal controls serve as the first line of defense for preventing and detecting fraud and help ensure that an agency meets its missions, goals, and objectives; complies with laws and regulations; and is able to provide reliable financial and other information concerning its programs, operations, and activities. The Accounting and Auditing Act of 1950 requires agency heads to establish and maintain effective internal controls. Since then, other laws have required renewed focus on internal controls. For example, the Federal Managers’ Financial Integrity Act (FMFIA) of 1982 was enacted by the Congress because of repeated reports of fraud, waste, and abuse caused by weak internal controls and control breakdowns. FMFIA requires agency heads to periodically evaluate their systems of internal control using the guidance issued by the Office of Management and Budget (OMB) and to report annually to the President and the Congress on whether their systems conform to internal control standards issued by GAO. Pursuant to FMFIA, OMB Circular A-123, Management Accountability and Control, provides the requirements for assessing controls and GAO’s Standards for Internal Control in the Federal Government provide the measure of quality against which controls in operation are assessed. Most recently, the Federal Financial Management Improvement Act of 1996, in focusing on financial management systems, identified internal control as an integral part of those systems. Over the years, we and Defense auditors have issued a number of reports that have pointed to serious internal control weaknesses in the Department of Defense’s (DOD) payment processes and systems. In part, because of the seriousness of these problems and other related problems, we identified DOD’s contract payment process as error prone and costly and designated DOD contract management as a high-risk area. In this regard, we have reported that serious internal control weaknesses have resulted in numerous erroneous and, in some cases, fraudulent payments. For example, $3 million in fraudulent payments were made to a former Navy supply officer on over 100 false invoices. Also, we have identified computer security as a governmentwide high-risk area. With respect to DOD, in May 1996, we reported that unknown and unauthorized individuals are increasingly attacking highly sensitive unclassified information on DOD’s computer systems, which we found were particularly susceptible to attack through Internet connections. During fiscal year 1997, the DFAS Denver Center and its accounting and disbursing offices processed a reported $17.2 billion in vendor payments for the Air Force. The DFAS Denver Center, which was activated in January 1991, is responsible for accounting, disbursing, collecting, and financial reporting for Air Force vendor contracts. As a result of DFAS consolidations between 1991 and 1998, Defense Accounting Offices were closed. Under the DFAS Denver Center, financial services for vendor contracts are now performed by the Directorate of Finance and Accounting Operations, in Denver, Colorado, and five DFAS operating locations at Dayton, Ohio; Limestone, Maine; Omaha, Nebraska; San Antonio, Texas; and San Bernardino, California. The vendor payment process includes the processing and approval of payments for operational support such as utilities, medical services, and administrative supplies and services. Payments must be supported by (1) a signed contractual document, such as a purchase order, (2) an obligation, (3) an invoice, and (4) a receiving report. If the process is operating as intended, vendor payment team members at the various operating locations are to review these documents for accuracy and completeness and enter information into the vendor payment system—the Integrated Accounts Payable System—to create a payment voucher, which is subsequently approved by a certifying officer. Certifying officers are to compare payment vouchers to invoices and receiving reports to ensure the accuracy of the payment information prior to disbursement. For the first and last payments on a contract, certifying officers are to verify contract information as well. Following certification, the payment information is loaded into the disbursing system—the Integrated Paying and Collecting system. Before funds are disbursed, an independent check of available obligations (prevalidation) is to be made by electronically comparing vendor payment system transactions to obligations recorded in the General Accounting and Finance System (general ledger). Once available obligations are confirmed, the disbursing system uses the payment transactions generated by the vendor payment system to make the disbursements and report the payment data to the Department of the Treasury. In addition, the vendor payment system generates payment transactions to update the accounting system. Finally, the Merged Accountability and Fund Reporting reconciliations between the accounting, vendor payment, and disbursing systems are performed on a daily basis to help ensure that detail transactions, such as contract expenditures, are in agreement. To reduce the risk of error, waste, or wrongful acts and to reduce the risk of them going undetected, GAO internal control standards require segregation of key duties and responsibilities in authorizing, processing, recording, and reviewing transactions and maintaining custody over assets. No one individual should control all key aspects of a transaction or event without appropriate compensating controls. Also, the individuals performing these duties are to receive qualified and continuous supervision to ensure that the agency’s internal control objectives are met. To ensure that financial reports provide timely, accurate information on the results of operations, internal control standards require that transactions and other significant events are to be promptly recorded and properly classified. In addition, periodic evaluations are required to assess risks, identify deficiencies, and effect corrective action. For the two fraud cases, the primary internal control weakness was the lack of segregation of duties. In each case, the individuals committing the fraud had authority or capability to perform functions that should have been segregated. For example, in the Bolling AFB case, the contracting officer’s technical representative (COTR) had authority to authorize, approve, verify, and process contract and payment documentation and receive and accept goods and services. In the Dayton case, the Staff Sergeant, who at different times held positions in accounting and payment processing, was responsible for recording contract data, including obligations; invoice and receiving report information; and remittance addresses. After the Staff Sergeant’s access to the Dayton vendor payment system was removed, he was able to perform these functions by obtaining and using the computer password of another employee who had a level of access to the vendor payment system comparable to the level of access the Staff Sergeant previously held. An Air Force civilian employee, who was the COTR on the two Bolling AFB contracts, had broad authority to request contract amendments, order goods and services, receive and accept the goods and services, and approve payment for the items received. In addition, this person was not adequately supervised. The COTR’s supervisor told investigators and us that she allowed the COTR to perform these duties independently without close supervision. The COTR was able to embezzle over $500,000 by creating fictitious invoices and receiving reports. In September 1992, the COTR requested that contractor employees submit five false invoices totaling $342,832, for billings of goods and services that had not been ordered or received. According to contractor employees, the COTR told them that he was requesting advance billings to prevent the expiration of unused funding. While DOD has some authority to make advance payments, advance billings are not authorized for this purpose. Contractor employees submitted the five false invoices, as well as false receiving reports for each invoice, as instructed by the COTR. The COTR also gave the contractor a memo dated October 14, 1992, instructing the contractor to order $500,000 of legislative consulting services from a subcontractor, Applied Quantitative Systems, and include a 25 percent markup ($125,000) for overhead to be retained as the contractor’s fee when submitting the invoice to the Air Force. The COTR’s memo listed the five false invoices discussed above as partial documentation of these services. However, Applied Quantitative Systems was a fictitious company created by the COTR that had not provided any services under this contract, and the remittance address on the invoice was for a post office box opened by the COTR to receive the $500,000 payment. Had the contractor followed through on the COTR’s instructions, it would have eventually billed the government $625,000, sent $500,000 to the COTR’s fictitious company address, and kept $125,000 as overhead. However, according to contractor internal review files, management determined that legislative services were outside the scope of the contract and, as a result, did not submit this invoice to the government. In November 1992, contractor management became aware of the five false invoices that had been submitted at the COTR’s request and retrieved from the bank four checks received from the Air Force totaling $322,032 for payment of three of the invoices. The contractor voided the checks and returned them to the Air Force. Reportedly at the request of the contractor, the COTR had the Air Force withdraw the remaining two invoices totaling $20,800. Then, in December 1992, the COTR, without the contractor’s involvement, prepared 11 false invoices resulting in $504,941 in fraudulent payments. As with the Applied Quantitative Systems invoice, the COTR used his own post office box as the remittance address on the 11 false invoices. The COTR retrieved the payment from the post office box and deposited the funds in two newly established accounts at a bank where he maintained a personal account. The COTR was able to accomplish this scheme without detection by Air Force officials because he took advantage of his broad authority and the lack of adequate supervision.