Purchase Cards: Control Weaknesses Leave Two Navy Units
Vulnerable to Fraud and Abuse (30-JUL-01, GAO-01-995T).
This testimony discusses internal controls weaknesses that left
two San Diego Navy units open to credit fraud and abuse. GAO
found that the serious breakdown in internal controls at the
Space and Naval Warfare Systems Command San Diego and Navy Public
Works San Diego are the result of a weak overall internal control
environment, flawed or nonexistent policies and procedures, and
employees that do not adhere to valid policies. The proliferation
of cardholders at these two activities resulted in over 1,700
cardholders with essentially the authority to make their own
purchase decisions in an environment that lacked basic controls
over receipt of government property, certification of monthly
statements, and accountability over sensitive property items. GAO
found that these weak internal controls resulted in lost, stolen,
missing, or misused government property, potentially abusive use
of purchase cards, and payment of unauthorized and potentially
fraudulent charges. The combination of these factors also
contributed to the five known fraud cases and leaves the
government highly vulnerable to significant additional fraud,
waste, and abuse from the purchase card program at these two Navy
units.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-01-995T
ACCNO: A01486
TITLE: Purchase Cards: Control Weaknesses Leave Two Navy Units
Vulnerable to Fraud and Abuse
DATE: 07/30/2001
SUBJECT: Accounting procedures
Credit sales
Fraud
Internal controls
Naval procurement
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Testimony. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-01-995T
GAO United States General Accounting Office
Testimony Before the Subcommittee on Government Efficiency, Financial
Management and Intergovernmental Relations, Committee on Government Reform,
House of Representatives
For Release on Delivery Expected at 10 a. m. Monday, July 30, 2001 PURCHASE
CARDS
Control Weaknesses Leave Two Navy Units Vulnerable to Fraud and Abuse
Statement of Gregory D. Kutz Director, Financial Management and Assurance
Statement of Robert H. Hast Managing Director, Office of Special
Investigations
GAO- 01- 995T
Page 1 GAO- 01- 995T Navy Purchase Card Controls
Mr. Chairman, Members of the Subcommittee, and Senator Grassley: Thank you
for the opportunity to discuss Department of Defense (DOD) internal controls
and accounting practices for purchase card transactions and payments. DOD
reported that it used purchase cards- MasterCard or VISA cards issued to its
civilian and military personnel- for more than 10
million transactions valued at $5. 5 billion in fiscal year 2000. DOD has
increased the use of purchase cards with the intention of eliminating the
bureaucracy and paperwork long associated with making small purchases and
intends to expand the use of purchase cards over the next several years.
Given the rapid growth of purchase card use at DOD, ensuring that key
controls are in place over the program is critical to protecting the
government from fraud, waste, and abuse. We began looking into this issue at
the request of Senator Grassley, who was concerned about internal control
weaknesses that may have contributed to reports of purchase card fraud
related to Navy programs
based in San Diego, California. As a result, we agreed to obtain and review
DOD fraud case information related to Navy purchase card programs in the San
Diego area and to review purchase card controls and accounting for two Navy
units based in San Diego- the Space and Naval Warfare Systems Command
(SPAWAR) Systems Center and the Navy Public Works Center. 1 Further
background information on the Navy purchase card program is included in
appendix I.
Today, I will discuss the results of our review of Navy purchase card
controls, including (1) the purchase card control environment at the two
Navy units? San Diego activities and overall management issues that affect
the Navy- wide purchase card program, (2) the results of our test work on
statistical samples of purchase card transactions at the two Navy units,
which identified control weaknesses in four critical areas, and (3)
potentially fraudulent, improper, and abusive transactions made by the two
Navy units. Some of these transactions are similar to those involved in five
specific fraud cases related to Navy programs based in San Diego that had
been identified at the time of our work. Information on the five fraud cases
is presented in appendix II.
1 SPAWAR and the Navy Public Works Center are working capital fund
activities. SPAWAR performs research, engineering, and technical support,
and the Navy Public Works Center provides maintenance, construction, and
operations support to Navy programs. Both of these Navy programs have
locations throughout the United States. Our review focused on the purchase
card program at the San Diego units only.
Page 2 GAO- 01- 995T Navy Purchase Card Controls
Summary The two Navy units we reviewed had a significant breakdown in
internal controls over the $68 million in fiscal year 2000 purchase card
transactions that we tested, leaving SPAWAR San Diego and the Navy Public
Works Center San Diego vulnerable to fraudulent, improper, and abusive
purchases and theft and misuse of government property. The problems we found
with the use of purchase cards by these two Navy units resulted from a weak
overall internal control environment, flawed or nonexistent policies and
procedures, and a lack of adherence to valid policies and procedures. Within
this poor control environment, these two units had given purchase cards to
over 1, 700 employees, most of whom had credit limits of $20,000 or more and
contracting officer authority to make their own purchase decisions.
We found a weak overall internal control environment, including four key
weaknesses that contributed to the ineffective controls, particularly at
SPAWAR San Diego. First, neither SPAWAR San Diego nor the Navy Public Works
Center San Diego had effective policies over the issuance of
purchase cards, with any employee having supervisor approval able to get a
card. As a result, we found a proliferation of the authority to procure
goods and services, with 1, 526 SPAWAR San Diego employees (36 percent) and
254 Navy Public Works Center San Diego employees (16 percent) holding
purchase cards as of September 30, 2000. This purchase card proliferation
resulted in a virtually impossible span of control issue at SPAWAR San Diego
with only one approving official responsible for certifying summary billing
statements covering 700 monthly purchase card statements for the 1,526
purchase cardholders. Second, we found deficient policies for rebate
management, including a lack of procedures to maximize rebates and ensure
that bank calculations of rebates were correct. Consequently, we
found rebates were not maximized and errors in rebate calculations by the
bank went undetected. Third, we determined that nearly half of SPAWAR?s
fiscal year 2000 purchase card transactions and over half of the Navy Public
Works Center?s transactions were made by employees who did not have
documented evidence of timely training, which is required by the Navy?s
purchase card instruction. Fourth, we found that management was not
effectively utilizing internal reviews and audits to determine whether
purchase card internal controls were being effectively implemented. In fact,
we found evidence that SPAWAR management ignored internal review
results that demonstrated some of the serious problems discussed in this
testimony, primarily because of complaints from cardholders and their
supervisors regarding the administrative burden associated with procedural
changes that would be needed to address the review findings.
Page 3 GAO- 01- 995T Navy Purchase Card Controls
With the ineffective overall internal control environment, it is not
surprising that the three basic internal controls we tested-( 1) independent
documented receipt and acceptance of goods and services, (2) independent
documented certification of monthly purchase card statements, and (3) proper
and timely allocation of costs to customer accounts- were ineffective. We
found that the primary problem with the controls was that employees simply
did not follow them. In addition, we found that easily pilferable or
sensitive items in our sample, which are accountable property, were not
recorded in property records. Specifically, our tests of SPAWAR
and Navy Public Works Center fiscal year 2000 purchase card transactions
that included accountable property, the two units failed to record one or
more items in their property records for nearly all of the purchase card
transactions that included accountable property. Further, when we
analyzed the property items included in our sampled transactions, we found
that SPAWAR San Diego and the Navy Public Works Center San Diego did not
record 46 of the 65 accountable items included in our samples in their
property records, as required by Navy policies. Moreover,
when we asked to inspect these items, the two units could not provide
conclusive evidence that 31 of them- including laptop computers; personal
digital assistants (PDAs), such as Palm Pilots; and digital cameras- were in
the possession of the government. For example, for four items, the serial
numbers of the property we were shown did not match purchase or
manufacturer documentation. We were also told that five items were at other
Navy locations throughout the world. SPAWAR and the Public Works Center
officials were unable to conclusively demonstrate the existence and location
of these five items. We were unable to conclude whether any of these 31
pieces of government property were stolen, lost, or being misused.
Weak internal controls contributed to five recent cases of alleged purchase
card fraud related to Navy units in the San Diego area, including two
involving Navy Public Works Center employees. One case has been successfully
prosecuted, while the remaining four cases are still under investigation.
All five of these purchase card fraud cases, which so far total over
$660,000 in known and potential fraud, involved numerous purchases made over
a period of several months to more than 2 years. Items that were purchased
for personal use in these cases included home improvement items from The
Home Depot, numerous items from Wal- Mart, laptop
computers, Palm Pilots, DVD players, an air conditioner, clothing, jewelry,
and other items such as eyeglasses, pet supplies, and pizza. The control
breakdowns related to the frauds were so pervasive that the total dollar
amount of these frauds could not be determined.
Page 4 GAO- 01- 995T Navy Purchase Card Controls
One of the ongoing Navy purchase card fraud cases involved the compromise of
as many as 2,600 purchase card accounts assigned to Navy activities in the
San Diego area. Navy investigators were only able to obtain
a partial list consisting of 681 compromised accounts so the exact number is
not known. Although the account numbers showed up on a computer printer at a
community college library in San Diego in September 1999, the Navy has not
canceled all of the compromised accounts. Navy investigators estimated that
as of January 2001, at least 30 of the compromised account numbers were used
by 27 alleged suspects to make more than $27, 000 in fraudulent transactions
for pizza, jewelry, phone calls, tires, and flowers. However, with the lack
of controls over receipt of goods and services and proper certification of
purchase card statements for payment that we identified at the two units, it
will be difficult, if not impossible, for the Navy to identify fraudulent
purchases as they occur, or to determine the extent of the fraudulent use of
compromised accounts. As of May 21, 2001, we
identified 22 compromised SPAWAR San Diego purchase card accounts on the
partial listing that were still open. The financial exposure related to
credit limits associated with the 22 accounts was $900,000 per month. There
were no active Navy Public Works Center San Diego accounts on the
partial listing. The specific internal control weaknesses at the two
activities we reviewed contributed to additional purchases that we believe
are potentially fraudulent, improper, or abusive. The abusive and improper
purchases relate primarily to SPAWAR San Diego and include items where the
purchase was at an excessive cost, or of questionable government need, or
both. For example, we found purchases for flat panel computer monitors
costing from about $800 to $2,500 each, compared to standard GSA schedule
monitors costing about $300 each. In addition, we found routine purchases
without documented government need, including personal digital assistants,
such as Palm Pilots, as well as purchases of $100 designer Palm Pilot
carrying cases and a $400 Coach leather briefcase. Navy Public Works Center
San Diego also had numerous PDA purchases. However, neither unit had
documented policies and procedures to support the valid
government need for these types of items. We also found unauthorized,
potentially fraudulent purchases of personal items, including cosmetics,
gift certificates, and clothing at both SPAWAR San Diego and the Navy Public
Works Center San Diego. Our Office of Special Investigations is conducting a
further investigation of the potentially fraudulent transactions identified
during this review. Further, we identified a number of purchases made on the
same day from the same vendor, which appeared to circumvent cardholder
single transaction limits.
Page 5 GAO- 01- 995T Navy Purchase Card Controls
Following this hearing, we plan to issue a report that will summarize the
results of our review and make specific recommendations for corrective
action.
Scope and Methodology We conducted our audit work from August 2000 through
June 2001 in accordance with generally accepted U. S. government auditing
standards,
and we performed our investigative work in accordance with standards
prescribed by the President?s Council on Integrity and Efficiency. We
briefed DOD managers, including officials in DOD?s Purchase Card Program
Management Office and the Defense Finance and Accounting Service (DFAS), and
Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San
Diego, and Navy Public Works Center San
Diego officials on the details of our review, including our objectives,
scope, and methodology and our findings and conclusions. We referred
instances of potentially fraudulent transactions that we identified during
our work to our Office of Special Investigations for further investigation.
Our work was
not designed to identify, and therefore we did not determine, the extent of
fraudulent, illegal, or abusive transactions. Our control tests were based
on stratified random probability samples of 135 SPAWAR San Diego purchase
card transactions and 121 Navy Public Works Center San Diego transactions.
Further details on our objectives, scope, and methodology are included in
appendix III.
Weak Purchase Card Environment Contributed to Ineffective Controls
A weak internal control environment at SPAWAR San Diego and the Navy Public
Works Center San Diego contributed to internal control weaknesses, fraud,
and abuse. The importance of the ?tone at the top? or the role of management
in establishing a positive internal control environment cannot be
overstated. GAO?s internal control standards go on to state that,
?management plays a key role in demonstrating and maintaining an
organization?s integrity and ethical values, especially in setting and
maintaining the organization?s ethical tone, providing guidance for proper
Management and employees should establish and maintain an environment
throughout the organization that sets a positive and supportive attitude
toward internal control and conscientious management. A positive control
environment
is the foundation for all other standards. It provides discipline and
structure as well as the climate which influences the quality of internal
control. GAO?s Standards for Internal Control in the Federal Government
(GAO/ AIMD- 00- 21.3.1, November 1999)
Page 6 GAO- 01- 995T Navy Purchase Card Controls
behavior, removing temptations for unethical behavior, and providing
discipline when appropriate.? The specific factors that contributed to the
lack of a positive control environment at these two units included a
proliferation of purchase cardholders, ineffective training of cardholders
and certifying officers, ineffective rebate management, and a lack of
monitoring and oversight. Proliferation of Cardholders Resulting in
Unreasonable Span of Control SPAWAR San Diego and the Navy Public Works
Center San Diego did not
have specific policies governing the number of cards issued or establishing
criteria for identifying employees eligible for the privilege of cardholder
status. At both units, cards were given out on the basis of a request from
an individual employee?s supervisor. The request was then forwarded to the
unit?s purchase card agency program coordinator, who approved the request
and began the process for obtaining a new card from Citibank. According to
SPAWAR and Navy Public Works Center officials, specific criteria did not
exist for either the supervisors or the program coordinators to use in
requesting and approving purchase cards for employees. This
flawed policy has resulted in a proliferation of purchase cards at the two
units. For example, as of September 30, 2000, about one in three, or 36
percent of SPAWAR San Diego employees and about one in six, or 16 percent,
of Navy Public Works Center San Diego employees were
cardholders. As a result, at the end of fiscal year 2000, about 1, 526
SPAWAR San Diego employees and 254 Navy Public Works Center San Diego
employees were authorized to procure goods and services. Within this weak
control environment, these two Navy units had given purchase cards to over
1, 700 employees, most of whom had credit limits of $20,000 or more and the
authority to make their own purchase decisions. Table 1 shows the
proliferation of cardholders and the percentage of employees at SPAWAR and
the Navy Public Works Center in San Diego that were cardholders as of
September 30, 2000. Most of SPAWAR?s 1,526 cardholders had a $25, 000 credit
limit and most of the Navy Public Works Center?s 254 cardholders had a
$20,000 credit limit.
Page 7 GAO- 01- 995T Navy Purchase Card Controls
Table 1: Proliferation of Cardholders and Financial Exposure Information we
obtained from six large defense contractors on their purchase card programs
showed that the percent of the contractors? employees that were cardholders
ranged from about 2 percent to nearly 4 percent- significantly less than at
SPAWAR and the Navy Public Works Center in San Diego.
The proliferation of cardholders, particularly at SPAWAR San Diego, created
a situation where it was virtually impossible to maintain a positive control
environment. For example, at SPAWAR, a significant span of control issue
existed, with one approving official responsible for certifying monthly
summary billing statements covering an average of over 700
monthly purchase card statements relating to 1,526 purchase cardholders. At
the Navy Public Works Center San Diego, the span of control problem was not
as serious, with six approving officials responsible for certifying monthly
summary statements covering an average of 55 monthly statements for 254
cardholders. The span of control issue is particularly important for
purchase cards because supervisors and, in some cases, cardholders
themselves, are responsible for authorizing purchases, rather
than an independent contracting officer as is the case under the standard
procurement process. Thus, the approving official serves as a key control in
certifying cardholder purchases. Lack of Documented Evidence of Training for
Cardholders and Approving Officials
The lack of documented evidence of purchase card training also contributed
to a weak internal control environment at SPAWAR and the Navy Public Works
Center in San Diego. GAO?s internal control standards emphasize that
effective management of an organization?s workforce- its human capital- is
essential to achieving results and is an important part of internal control.
Training is key to ensuring that the workforce has the
skills necessary to achieve organizational goals. In accordance with Navy
Supply Command (NAVSUP) Instruction 4200.94, all cardholders and approving
officials must receive purchase card training. Specifically,
As of September 30, 2000 SPAWAR Navy Public Works Center
Number of cardholders 1, 526 254 Number of employees 4, 200 1, 600 Percent
of employees that were cardholders 36% 16%
Credit limit of most cardholders $25,000 $20, 000
Page 8 GAO- 01- 995T Navy Purchase Card Controls
NAVSUP Instruction 4200.94 requires that prior to the issuance of a purchase
card, all prospective cardholders and approving officials must receive
training regarding both Navy policies and procedures as well as local
internal operating procedures. Once initial training is received, the
Instruction requires all cardholders to receive refresher training every 2
years. Although we found the training policies and procedures to be
generally
adequate, we determined that SPAWAR and the Navy Public Works Center lacked
documentation to demonstrate that all cardholders and approving officials
had received the required training. Based on our tests of fiscal year 2000
purchase card transactions, we estimate that about 40 percent of the
SPAWAR transactions, totaling at least $6. 8 million, 2 and 56 percent of
the Navy Public Works Center transactions, totaling at least $10.9 million,
3 were made by cardholders for whom there was no documented evidence
that they had received either the required initial training or refresher
training on purchase card policies and procedures. SPAWAR San Diego
management contended that we should accept training
provided under the Navy?s previous purchase card program as meeting the
training requirements under the new program. Although we determined that the
policies and procedures related to cardholder responsibilities were
essentially the same under the previous Navy purchase card program, we found
that several cardholders had received the prior training as many as 2
years to 6 years before the current program began. Therefore, these
cardholders had not received the required biennial refresher training. The
Navy Public Works Center San Diego had no documented evidence that its
cardholders had received any purchase card training prior to March 2000.
We also found no documented evidence that two of six Navy Public Works
Center approving officials had received training on purchase card policies 2
The range of our confidence interval, at a 95- percent confidence level,
indicates that between 30 percent and 51 percent of the SPAWAR?s fiscal year
2000 purchase card transactions totaling between $6. 8 million and $16. 4
million were made by cardholders for
whom there was no documented evidence that required training was received. 3
The range of our confidence interval, at a 95- percent confidence level,
indicates that between 44 percent and 68 percent of the Navy Public Works
Center?s fiscal year 2000 purchase card transactions totaling between $10. 9
million and $26.3 million were made by cardholders for whom there was no
documented evidence that required training was
received.
Page 9 GAO- 01- 995T Navy Purchase Card Controls
and procedures prior to assuming certifying officer responsibilities.
SPAWAR?s one approving official had received all required training.
Purchase Card Rebates Not Effectively Managed
We found ineffective management of purchase card rebates 4 by the Navy,
SPAWAR San Diego, and the Navy Public Works Center San Diego. The Navy
requested that Citibank defer payment of all of the purchase card rebates it
earned since the current purchase card program began in November 1998
because, according to DOD and Navy officials, it had not yet determined how
to record and allocate the rebates to Navy programs.
According to Citibank officials, Citibank plans to pay cumulative purchase
card rebates and accrued interest to the Navy on July 31, 2001, the payment
date required in the Navy?s latest purchase card contract task order
modification. Citibank estimates that the total payment will be about $8. 8
million, including an estimated $8.3 million in cumulative rebates and an
estimated $530, 000 in accrued interest on these rebates. In addition, the
Navy had not established policies and procedures for managing rebates and
had not monitored its rebate earnings. As a result, the Navy, SPAWAR San
Diego, and the Navy Public Works Center San Diego were not aware that
Citibank had miscalculated the rebates that SPAWAR and the Navy Public Works
Center should have earned during fiscal year 2000 by about $150,000.
Specifically, the rebates due SPAWAR were understated by
$136,760, while the Navy Public Works Center?s rebates were overstated by
$12,039. Further, SPAWAR and Navy Public Works Center managers were not
effectively managing purchase card payments to maximize the amount of
rebates earned. We determined that delays in the receipt of monthly purchase
card statements had precluded the opportunity for these two units to earn
another $242,000 in fiscal year 2000 rebates. We do not know the extent to
which these factors have adversely impacted the Navy?s total fiscal year
2000 purchase card rebates. Program Monitoring and Audit Function Not
Effective SPAWAR and the Navy Public Works Center in San Diego had not
established an effective monitoring and internal audit function for the
purchase card program. Further, the Navy?s purchase card policies and
procedures did not require that the results of internal reviews be
4 Under the Navy?s purchase card contract task order with Citibank, the Navy
earns rebates (refunds) of up to 0. 8 percent based on sales volume
(payments) and payment timeliness.
Page 10 GAO- 01- 995T Navy Purchase Card Controls
documented or that corrective actions be monitored to help ensure that they
are effectively implemented. NAVSUP Instruction 4200.94 calls for agency
program coordinators 5 to perform semiannual reviews of their units?
purchase card program, including adherence to internal operating procedures,
applicable training requirements, micro- purchase procedures, receipt and
acceptance procedures, and statement certification and prompt payment
procedures. Further, these reviews are to serve as a basis for agency
program coordinators to initiate appropriate action to improve the local
program or correct problem areas. However, the Instruction does not require
written
reports on the results of internal reviews to be submitted to either local
management or a central Navy office for monitoring and oversight. As a
result, the Navy did not have a consistent process for documenting the
results of purchase card reviews, identifying systemic problems, and
monitoring corrective actions to help ensure that they are effectively
implemented. This weakness also impaired the Navy?s ability to assess
purchase card controls for possible inclusion in its Annual Statements of
Assurance pursuant to 31 U. S. C. 3512( d) (commonly referred to as the
Federal Managers? Financial Integrity Act of 1982), which requires agency
heads to make annual disclosures regarding the adequacy of their internal
controls. The Secretary of the Navy?s fiscal year 2000 Annual Statement of
Assurance did not disclose any control weaknesses related to the purchase
card program. Our analysis of SPAWAR San Diego Agency Program Coordinator
fiscal
year 2000 reviews showed that these reviews identified problems with about
42 percent of the monthly cardholder statements that were reviewed. The
problems identified were consistent with the control weaknesses discussed
later in this testimony, including lack of independent documentation that
the Navy received items ordered by purchase card, accountable items that
were not recorded in the property records, inadequate documentation for
transactions, split purchases, and transactions that did not appear to be
related to government business purposes.
5 NAVSUP Instruction 4200.94 authorizes agency program coordinators to
administer the purchase card program within their designated units and to
serve as the communication link between the purchase card issuing bank and
their unit, establish credit limits, issue cards to Navy employees, and
administer the purchase card program.
Page 11 GAO- 01- 995T Navy Purchase Card Controls
During our review, we saw correspondence and other documentation showing
that SPAWAR San Diego management had considered the findings identified in
its agency program coordinator evaluations, but directed that corrective
actions should not be implemented due to complaints from cardholders and
their supervisors regarding the administrative burden associated with
procedural changes that would be needed to address the review findings. As a
result, the agency program coordinator had not used these reviews to make
systematic improvements in the program. Rather, these reviews generally
resulted in the reviewer counseling the cardholders or, in some instances,
recommending that cardholders attend purchase card training. During fiscal
year 2000, the SPAWAR San Diego Office of Command Evaluation internal review
group had not conducted any reviews or audits of the purchase card program.
Further, although the SPAWAR San
Diego Command Inspector General 6 reviewed the SPAWAR purchase card program
during fiscal year 2000 and prepared a draft report summarizing the results
of this review, the final report has not yet been issued. Our review of the
draft report determined that the Command IG identified a
number of internal control problems that are consistent with our findings,
including issues related to receipt and acceptance, training, and split
purchases.
The Navy Public Works Center San Diego purchase card agency program
coordinator did not perform any systematic reviews of the program during
fiscal year 2000. He told us that his monitoring efforts consisted of
scanning some monthly invoices for duplicate payments, split purchases,
and other suspicious payments. However, he did not document these actions.
Further, the Public Works Center internal review group in the Office of
Command Evaluation did not perform any reviews during fiscal year 2000.
However, Navy Public Works Center managers told us that they
asked the Naval Audit Service to review the Center?s purchase card program
during fiscal year 2000 because of concerns about the growth of the program,
the adequacy of internal controls, and recent instances of fraud. Although
the Naval Audit Service completed its fieldwork in
November 2000 and briefed Navy Public Works Center San Diego management on
its findings, the results of that effort have yet to be
6 The SPAWAR Command Inspector General organization is an internal review
unit under the Navy Department?s Inspector General and is not a part of the
DOD Inspector General?s Office. As part of the Navy Inspector General
organization, the SPAWAR Command Inspector General makes inquiries and
reports on matters affecting military efficiency or discipline, proposes and
executes inspections, and cooperates with the DOD Inspector General.
Page 12 GAO- 01- 995T Navy Purchase Card Controls
externally reported. According to the Navy?s Deputy Assistant Auditor
General, the Naval Audit Service plans to finalize its work and issue a
report in the fall of 2001.
Breakdown of Critical Internal Controls
Basic internal controls over the purchase card program were ineffective at
the two units we reviewed. Based on our tests of statistical samples of
purchase card transactions, we determined that the three transaction- level
controls that we tested were ineffective, rendering SPAWAR San Diego and
Navy Public Works Center San Diego purchase card transactions vulnerable to
fraudulent and abusive purchases and theft and misuse of government
property. As shown in table 2, the specific controls that we tested were (1)
independent, documented receipt and acceptance of goods and services, (2)
independent, documented certification of monthly purchase card statements,
and (3) proper accounting for purchase card transactions.
Table 2: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests
a The numbers represent point estimates for the population based on our
sampling tests. The confidence intervals for our sampling estimates are
presented in appendix III of this testimony. b All seven approving officials
with certifying officer responsibilities told us that they did not review
support for transactions before certifying purchase card statements for
payment.
In addition, we tested whether the accountable items- easily pilferable or
sensitive items- included in some of the transactions in our samples were
recorded in the units? property records to help prevent theft, loss, and
misuse of government assets. Our tests of SPAWAR and Navy Public Works
Center fiscal year 2000 purchase card transactions that included accountable
property items, showed that the two units failed to record one or more
accountable items in their property records for nearly all of these
transactions. Further, when we analyzed the property items included in our
sampled transactions, we found that SPAWAR and the Navy Public Works Center
did not record 46 of the 65 accountable items included in our
Breakdowns in key purchase card controls a Independent, documented receipt
Proper payment certification Timely customer accounting
Navy Units in San Diego, CA Percent failure Projection
(millions) Percent failure Projection
(millions) Percent failure Projection
(millions)
SPAWAR 65% $14. 5 100% b $38 b 83% $20. 4 Navy Public Works Center 47% $12.
9 100% b $30 b 35% $11. 2
Page 13 GAO- 01- 995T Navy Purchase Card Controls
sampled transactions in their property records. Moreover, when we asked to
inspect these items, the two units could not provide conclusive evidence
that 31 of them, including laptop computers, Palm Pilots, and digital
cameras, were in the possession of the government. Lack of Independent
Documented Receipt and Acceptance
SPAWAR San Diego and the Navy Public Works Center San Diego generally did
not have independent, documented evidence that they received items ordered
by purchase card. That is, they generally did not have a receipt for the
acquired goods and services that was signed by someone other than the
cardholder. As a result, there is no documented evidence that the government
received the items purchased or that those items were not lost, stolen, or
misused. NAVSUP Instruction 4200. 94 generally requires segregation of
duties between the individual making the purchase and the
individual responsible for documenting receipt and acceptance of goods and
services acquired by purchase card. However, employees at the two units were
not following these procedures. In some instances employees were following
an alternative procedure permitted by the NAVSUP Instruction whereby
independent authorization of a purchase order can be substituted for
independent confirmation of receipt of the items purchased.
However, the alternative procedure does not provide any assurance that the
items ordered and paid for were received.
Key duties and responsibilities need to be divided or segregated among
different people to reduce the risk of error or fraud. This should include
separating the responsibilities for authorizing transactions, processing and
recording them, reviewing the transactions, and handling any related assets.
Simply put, no one individual should control all the key aspects of a
transaction or event. GAO?s
Standards for Internal Control in the Federal Government (GAO/ AIMD- 00-
21.3.1, November 1999)
Page 14 GAO- 01- 995T Navy Purchase Card Controls
Based on our test work, we estimate that SPAWAR San Diego did not have
independent, documented evidence to confirm the receipt and acceptance of
goods and services acquired with the purchase card for about 65 percent 7 of
its fiscal year 2000 transactions totaling at least $10. 1 million. For the
Navy Public Works Center San Diego, we estimated that 47 percent 8 of its
fiscal year 2000 purchase card transactions totaling at least $6. 6 million
did not include independent, documented receipt of goods and services.
The types of items in our sampled transactions that lacked independent
evidence of receipt and acceptance included computers, monitors, and compact
disk writers that were purchased at stores such as Byte and Floppy Computer,
Dell Computer, and CompUSA. Further, during fiscal year 2000, SPAWAR and the
Navy Public Works Center in San Diego made over 2,000 transactions totaling
over $468,000 for items from The Home Depot, Best Buy, Circuit City, and
Wal- Mart. Our review of the five purchase
card fraud cases related to Navy activities based in San Diego, discussed in
appendix II, showed that fraudulent purchases had been made to acquire items
for personal use from these same stores. Because the Navy purchases items
for valid, government purposes from stores that are widely used by consumers
to acquire items for personal use, verification of receipt
of goods and services by an individual other than the cardholder is
necessary to reduce the risk of fraudulent transactions. Lack of Proper
Certification of Monthly Purchase Card Statements
7 The range of our confidence interval, at a 95- percent confidence level,
indicates that the population estimate of SPAWAR purchase card transactions
that lacked independent confirmation of receipt of goods and services
purchased was between 55 percent and 75 percent and totaled between $10. 1
million and $18.9 million. 8 The range of our confidence interval, at a 95-
percent confidence level, indicates that the population estimate of Navy
Public Works Center purchase card transactions that lacked independent
confirmation of receipt of goods and services purchased was between 35
percent and 59 percent and totaled between $6. 6 million and $19.2 million.
Transactions and other significant events should be authorized and executed
only by persons acting within the scope of their authority. This is the
principal means of assuring that only valid transactions to exchange,
transfer, use, or commit resources and other events are initiated or entered
into. GAO?s Standards for Internal Control in the Federal Government (GAO/
AIMD- 00- 21.3. 1, November 1999)
Page 15 GAO- 01- 995T Navy Purchase Card Controls
We assessed a 100- percent failure rate at both units for this critical
control. NAVSUP Instruction 4200.94 and, to a greater extent, a policy
memorandum issued by the Navy Comptroller?s office on June 3, 1999, do not
provide adequate internal controls and are inconsistent with the
responsibilities of certifying officers reflected in statutes and DOD?s
fiscal policy guidance. Approving officials at the two units told us that
they were not following the existing procedures due to time constraints and
the Navy
Comptroller?s policy memorandum. Under 31 U. S. C. 3325 and DOD?s Financial
Management Regulation, 9 disbursements are required to be made on the basis
of a voucher certified by an authorized agency official. The certifying
official is responsible for ensuring (1) the adequacy of supporting
documentation, (2) the accuracy of payment calculations, and (3) the
legality of the proposed payment under the appropriation or fund charged.
Proper certification of bills for payment is a preventive control that
requires and provides the incentive for
certifying officers to maintain proper controls over public funds. It also
helps detect fraud and improper payments, including invalid (unsupported or
prohibited) transactions, split purchases, and duplicate payments. Further,
section 933 of the National Defense Authorization Act for Fiscal Year 2000
requires the Secretary of Defense to prescribe regulations that
ensure, among other things, that each purchase cardholder and approving
official is responsible for reconciling charges on a billing statement with
receipts and other supporting documentation.
According to NAVSUP Instruction 4200.94, upon receipt of the individual
cardholder statement, the cardholder has 5 days to reconcile the
transactions appearing on the statement by verifying their accuracy to the
supporting documents and notify the approving official in writing of any
discrepancies in the statement or sign and forward it to the approving
official. The approving official is responsible for ensuring that all
purchases made by the cardholders within his or her cognizance were
appropriate and that the charges are accurate. However, the Instruction
further states that within 5 days of receipt of the cardholders? statements,
the approving
official must review and certify the monthly summary statement for payment,
whether or not the cardholder has reviewed the statement and notified the
official of any discrepancies or agreement with the statement. That is, the
approving official is to presume that all transactions on the
9 DOD Financial Management Regulation, Volume 5, Chapter 33, ?Accountable
Officials and Certifying Officers."
Page 16 GAO- 01- 995T Navy Purchase Card Controls
monthly statements are proper unless notified in writing by the purchase
cardholder. Under this process, the certifying officer relies upon the
silence of a
cardholder who may have failed to timely forward corrections or exceptions
to the account statement or, even worse, may not have even reviewed the
statement. A certifying officer in these circumstances is not taking steps
to assure that a payment is proper and an agency therefore
cannot rely on the certification for assurance that a payment is for the
proper amount and a legal purpose. This NAVSUP policy is inconsistent with
the purpose of certifying vouchers prior to payment, which is to maintain
proper control over public funds and
assure that payments are made for proper amounts and purposes. Certifying
officers are responsible for the correctness of facts and computations in
the voucher, and the legality of the proposed payment under the
appropriation involved. A certifying officer is liable for losses resulting
from improper certifications, but may be relieved from liability if the
certification was based upon official records and the officer did not know,
and could not have reasonably discovered, the correct information.
While certifying officials may rely on systems, controls, and personnel that
process transactions rather than personally reviewing the supporting
documentation, they must show that their reliance was reasonable. Regardless
of what system is used, there is no authority to make known improper
payments. At SPAWAR and the Navy Public Works Center, the certifying
officers relied on a process without assurances that even a
minimal review of the facts and computations underlying the proposed payment
or the legality of such payment was carried out before certification was
made. Thus, the certifying officers may not be able to demonstrate that
their reliance on such a system is reasonable.
In addition to the problems with NAVSUP Instruction 4200.94, the Navy
Comptroller?s June 3, 1999, policy memorandum further weakens the
certification process. The policy memorandum does not explicitly state that
the cardholder must review the statement of account and notify the approving
official of any improper or incorrect items within 5 days of receipt.
Nonetheless, the approving official must certify the invoices based
on the presumption that all cardholder accounts are proper unless notified
in writing within 5 days of receipt of the invoice. Navy officials told us
that it is assumed that cardholders would review the statements and notify
the approving officials of any problems. While the cardholder?s review is
not explicitly required, the memorandum states that the change in policy
?will
Page 17 GAO- 01- 995T Navy Purchase Card Controls
ensure that the cardholder will inform the AO [approving official] in a
prompt manner of any duplicate payments or fraudulent or improper charges to
his account.? Again, by requiring certification within 5 days, whether or
not a cardholder has reviewed a statement, the June 3, 1999, policy
memorandum requires a certifying officer to rely upon a process that does
not require review of a proposed payment or otherwise assure that a payment
is properly payable before certification occurs.
All seven approving officials at the two activities (one at SPAWAR and six
at the Navy Public Works Center) told us that they never reviewed the
cardholders? supporting documentation before signing and submitting purchase
card statements for payment. Accordingly, we assessed the failure rate for
this control as 100 percent for both SPAWAR San Diego and the Navy Public
Works Center San Diego. Approving officials explained
that they certify purchase card statements for payment without reviewing
cardholders? supporting documentation because (1) they do not have time to
review the documentation and (2) the Navy Comptroller?s June 3, 1999,
guidance relieves them of this responsibility. With regard to the first
issue, both activities are faced with a significant span of control issue
that makes the overall purchase card environment difficult, if not
impossible, to control. With an average of over 700 monthly cardholder
statements at SPAWAR San Diego and only one approving official- who is also
the Agency Program Coordinator- proper certification of monthly summary
statements within 5 days of receipt is not physically possible. Thus, the
SPAWAR San Diego approving official told us that the certification process
is largely a ?rubber stamp? with no real verification of the underlying
cardholder support for the monthly summary
statements. The environment is somewhat more manageable at the Navy Public
Works Center San Diego, with six approving officials charged with certifying
summary statements that cover an average of 55 cardholder statements each
month. However, Public Works Center approving officials also told us that
they did not review all cardholder supporting documentation before
certifying purchase card statements for payment. As a result, these two Navy
units paid their monthly purchase card bills
without knowing whether the charges were valid. As discussed later in this
statement, this has contributed to payments being made for unauthorized and
improper transactions.
Page 18 GAO- 01- 995T Navy Purchase Card Controls
With regard to the second issue, the June 3, 1999, policy memorandum appears
to improperly assign certifying officer accountability to cardholders. The
policy memorandum stated that because it is not possible for the approving
official to personally review and verify individual cardholder transactions
and statements of account, the approving official is to certify the purchase
card statements for payment based on the presumption that all cardholder
accounts are proper unless the approving official has been notified to the
contrary by the cardholder. The memorandum goes on to say that, ?[ T] his
new policy recognizes that the ultimate responsibility for purchases being
proper is with the cardholder.? However, under 31 U. S. C. 3528 and DOD?s
Financial Management
Regulation, certifying officers are liable for an illegal, improper, or
incorrect payment as a result of an inaccurate or misleading certification.
An agency may not shift certifying officer liability to other employees. 10
The policy memorandum is also inconsistent with GAO?s internal control
standard for ensuring that only valid transactions are entered into.
According to DOD and Navy officials, this policy memorandum has created
confusion about whether the cardholder or the approving official is
responsible for proper certification of purchase card statements for
payment. Problems in Proper Accounting for Purchase Card Transactions
10 31 U. S. C. 3528 and Comp. Gen. Decision on ?Department of Defense
Authority to Impose Pecuniary Liability by Regulation? (B- 280764, May 4,
2000).
Transactions should be promptly recorded to maintain their relevance and
value to management in controlling operations and making decisions. This
applies to the entire process or life cycle of a transaction or event from
the initiation and authorization through its final classification in summary
records. GAO?s Standards for Internal Control in the Federal Government
(GAO/ AIMD- 00- 21.3.1, November 1999)
Page 19 GAO- 01- 995T Navy Purchase Card Controls
The two units we reviewed did not have controls in place to ensure that
purchase card transactions were recorded to customer accounts in a timely
manner and that local accounting records reflected the proper classification
of expense. The timely and accurate recording of purchase card transactions
is important to ensure the reliability of data and information used in day-
to- day management and decision- making, particularly for working capital
fund activities such as SPAWAR and the Navy Public Works Center. We have
previously reported 11 that DOD has long- standing problems accumulating and
reporting the full costs
associated with its working capital fund operations. Recording Purchase Card
Costs to Customer Accounts
The two units did not always record purchase card costs to customer accounts
within required time frames. Consistent with GAO?s internal control
standards and Statement of Federal Financial Accounting
Standards (SFFAS), No. 4, ?Managerial Cost Accounting Standards,? SPAWAR San
Diego and Navy Public Works Center San Diego operating procedures require
timely recording of purchase card costs to projects that received the goods
and services acquired by purchase card. This is an important control because
as working capital fund operations, SPAWAR and the Navy Public Works Center
are to provide their customers with information on the full cost of goods
and services provided- either through billing or other information. Further,
working capital fund activities are to operate on a break- even basis over
time- that is, not make a profit or incur a loss. Accurate and timely
recording of customer transactions are key to
ensuring that these working capital fund objectives are met. 11 Department
of Defense: Implications of Financial Management Issues (GAO/ TAIMD/ NSIAD-
00- 264, July 20, 2000).
Page 20 GAO- 01- 995T Navy Purchase Card Controls
However, based on our tests of fiscal year 2000 purchase card transactions,
we estimate that 83 percent 12 of the SPAWAR transactions totaling at least
$15.3 million and an estimated 35 percent 13 of the Navy Public Works
transactions totaling at least $5 million had not been recorded to customer
or overhead accounts within 5 days of receipt of the purchase card
statements. 14 As time passes, the likelihood that documentation will be
available to properly record transactions decreases. For example, because
SPAWAR did not have the documentation to support timely and accurate
recording of purchase card transactions, it wrote off as a loss $657,642 in
fiscal year 2000 transactions that could not be identified to a specific job
order. Further, according to the SPAWAR Accounting Officer, as of the end of
fiscal year 2000, SPAWAR had a backlog of about $5.6 million in purchase
card transactions that had not been recorded to customer accounts or its own
overhead account. As a result of unrecorded transactions, year- end
data on actual overhead costs used to estimate future overhead rates for
billing purposes were unreliable. Navy Public Works Center San Diego
officials were unable to provide reliable information on the amount of
unrecorded purchase card transactions at the end of fiscal year 2000
because systems weaknesses rendered their fiscal year- end data incomplete
and unreliable. 12 The range of our confidence interval, at a 95- percent
confidence level, indicates that the population estimate of SPAWAR purchase
card transactions that were not recorded to customer accounts in a timely
manner was between 74 percent and 90 percent and totaled between $15.3
million and $25. 5 million.
13 The range of our confidence interval, at a 95- percent confidence level,
indicates that the population estimate of Navy Public Works Center purchase
card transactions that were not recorded to customer accounts in a timely
manner was between 24 percent and 47 percent and totaled between $5 million
and $17.4 million. 14 For comparability, we used a 5- day criteria for
calculating timely recording of transactions to customer and overhead
accounts. Local SPAWAR San Diego policies and procedures required purchase
card transactions to be recorded within 3 days and local Navy Public Works
Center San Diego policies and procedures required these transactions to be
recorded within 5 days.
Page 21 GAO- 01- 995T Navy Purchase Card Controls
Classifying Purchase Card Costs by Object Class In addition to problems with
timely and accurate recording of transactions to customer accounts, SPAWAR
San Diego and the Navy Public Works
Center San Diego did not properly classify purchase card transactions in
their detail accounting records to show the nature and type of expenditures
made using purchase cards. Office of Management and Budget (OMB) Circular A-
11, Preparation and Submission of Budget Estimates, requires federal
agencies to report obligations and expenditures by object class,
such as salaries, benefits, travel, supplies, services, and equipment, to
indicate the nature of the expenditures of federal funds. Object
classification data are reported by appropriation in the President?s Annual
Budget Submissions to the Congress. OMB prepares summary reports of object
class data to support budget projections and other analyses. Accurate object
classification data are critical to the reliability of information reported
in the President?s budget submission and budget projections and other
analyses that are based on these data. In addition,
because the Congress has asked for and is using object class information for
its oversight activities, it is important that these data be properly
recorded. We previously reported 15 that inaccurate reporting by object
class hampers congressional oversight.
DOD Purchase Card Program Office guidance requires payments of monthly
purchase card statements to be recorded as summary records in the Navy?s
accounting systems and has directed that these summary records be recorded
to the object class for supplies and materials,
regardless of the nature of the expenses incurred. After purchase card
statements have been paid, SPAWAR San Diego and the Navy Public Works Center
San Diego are to record the individual transactions included in the summary
payment record in their local accounting records. However, we determined
that SPAWAR did not classify summary records related to payment of monthly
purchase card statements to any expense category in the Navy?s accounting
system and recorded all of the purchase card
transactions in our sample to object class 25, as services, in its local
accounting records. Consistent with DOD Purchase Card Joint Program
Management Office guidance, the Navy Public Works Center San Diego recorded
both the summary records related to payment of monthly purchase card
statements and the detailed transactions to object class 26, as supplies and
materials, in its local accounting system.
15 DOD Consulting Services: Erroneous Accounting and Reporting of Costs
(GAO/ NSIAD- 98- 136, May 18, 1998).
Page 22 GAO- 01- 995T Navy Purchase Card Controls
Because SPAWAR San Diego and the Navy Public Works Center San Diego did not
ensure that their detail transaction records reflected the proper
classification of expense, 100 percent of the SPAWAR and Navy Public Works
Center transactions in our samples were recorded to the wrong
object class. For example, although the majority of the SPAWAR purchase card
transactions in our sample- 76 transactions totaling over $73,000- were for
equipment purchases, none of these transactions were properly classified and
recorded. Further, SPAWAR did not maintain sufficient documentation to
determine the correct object class for 15 of the transactions in our sample
totaling about $12, 000. In addition, although the
Navy Public Works Center recorded all of the purchase card transactions in
our sample as supplies and materials, many of these transactions should have
been recorded as contractual services or equipment. Also, the Navy Public
Works Center did not maintain sufficient documentation to determine the
proper object class for nine of the transactions in our sample totaling
about $6, 000.
Failure to Record Accountable Items in Property Records
Most of the accountable items- easily pilferable or sensitive items- in our
samples were not recorded in property records. Recording these items in the
property records is an important step to ensure accountability and
financial control over these assets and, along with periodic inventory, to
prevent theft or improper use of government property. Consistent with GAO?s
internal control standards, DOD?s Property, Plant, and Equipment
Accountability Directive and Manual, which was issued in draft for
implementation on January 19, 2000, and the Appropriation, Cost and
Property Accounting procedures (referred to as the NAVSOP 1000- 3M) issued
by DFAS Cleveland, 16 require accountable property to be recorded in
property records as it is acquired. Accountable property includes easily
pilferable or sensitive items, such as computers and related equipment,
cameras, cell phones, and power tools. The NAVSOP property procedures
An agency must establish physical control to secure and safeguard vulnerable
assets. Examples include security for and limited access to assets such as
cash, securities, inventories, and equipment which might be vulnerable to
risk of loss or unauthorized use. Such assets should be periodically counted
and compared to control records. GAO?s Standards for Internal Control in the
Federal Government (GAO/ AIMD- 00- 21.3. 1, November 1999)
16 NAVSOP 1000- 3M, Chapter 6, Part D, ?Plant Property and Other Navy
Property,? (previously referred to as NAVCOMPT, Volume 3).
Page 23 GAO- 01- 995T Navy Purchase Card Controls
require such property to be recorded in property records along with a
description of the item, property identification number, model and serial
number, manufacturer, acquisition cost, and the location or custodian of the
property. Based on our tests of fiscal year 2000 purchase card transactions
that included accountable property items, we estimate that SPAWAR did not
record all accountable items in its property records for about 84 percent 17
of its purchase card transactions, covering at least $5.4 million in
accountable property. Based on our tests of Navy Public Works Center fiscal
year 2000 purchase card transactions that included accountable
property items we estimate that the Center did not record all accountable
items in its property records for about 95 percent 18 of its purchase card
transactions, covering at least $317,000 in accountable property. Our
analysis of the individual property items included in our sampled
SPAWAR and Navy Public Works Center fiscal year 2000 purchase card
transactions showed that the two units did not record a total of 46 of the
65 accountable items that were included in our sampled transactions in their
property records, including 36 SPAWAR items and 10 Public Works Center
items. SPAWAR officials told us that they were not aware of the requirement
to record items such as computer monitors, cameras, and palm pilots in the
property records. Moreover, when we asked to inspect these items, the two
units could not provide conclusive evidence that 31 of
them were in the possession of the government, including 19 SPAWAR items and
12 Public Works Center items. The unverified accountable items included
laptop computers, Palm Pilots, and digital cameras. Of the 31 items that
could not be verified, 5 items had been transferred to other
locations throughout the world and SPAWAR and the Public Works Center
officials were unable to conclusively demonstrate their existence and
location, serial numbers for 4 items did not match those on the purchase
documentation, 3 items were declared to be lost or stolen by employees who
had custody of these items, and the existence of the remaining 19 17 The
range of our confidence interval, at a 95- percent confidence level,
indicates that the
population estimate of SPAWAR purchase card transactions for which all
accountable items were not recorded in the property records was between 52
percent and 99 percent and totaled between $5. 4 million and $7. 6 million.
18 The range of our confidence interval, at a 95- percent confidence level,
indicates that the
population estimate of Navy Public Works Center purchase card transactions
for which all accountable items were not recorded in the property records
was between 68 percent and 100 percent and totaled between $317, 792 and
$484, 249.
Page 24 GAO- 01- 995T Navy Purchase Card Controls
items could not be verified because a serial number was not included in the
purchase documentation or a receipt for the item including a serial number
could not be located. The three items that were declared lost or stolen
included two Palm Pilots
that could not be located- one at SPAWAR San Diego and the other at the Navy
Public Works Center San Diego- and a video conferencing camera that was
reported stolen from a Public Works Center employee?s car. SPAWAR and Navy
Public Works Center officials directed the employees to prepare lost
property reports on the two Palm Pilots. Subsequently, in early
June 2001, Navy Public Works Center officials advised us that their lost
Palm Pilot had been located and showed us what they believed was the item in
question. However, because the serial number had been rubbed off, we could
not confirm that it was the accountable item acquired by purchase card. In
late June 2001, SPAWAR officials advised us that their lost Palm Pilot had
been located. Because we had already completed our review of SPAWAR property
controls, we did not attempt to view and confirm the existence of this Palm
Pilot. The third item was a video conferencing camera that was reported
stolen on January 27, 2001, by a Navy Public Works Center San Diego
employee.
According to the employee, the video camera was stolen from his car along
with a laptop computer that also belonged to the government. The employee
submitted a claim to his insurance company, and the claim was paid on
February 27, 2001. Although the stolen items cost about $3,876, the
employee?s insurance policy limited payment of claims for business property
to $2,500. However, about two months later, in May 2001, our investigators
determined that the insurance check in the amount of $2,500 was deposited in
the employee?s personal bank account instead of being endorsed to the
government. The employee admitted to our investigators that he had been
reimbursed for the stolen items from his insurance
company. On May 3, 2001, the employee issued a check to the government in
the amount of $2, 500. Navy Public Works Center officials told us that they
are considering assessing the employee for the remaining loss of $1, 376 and
taking possible disciplinary action for the failure to reimburse the
government for the equipment loss in a timely manner.
Page 25 GAO- 01- 995T Navy Purchase Card Controls
Potentially Fraudulent, Improper, and Abusive Transactions
We identified several cases of potentially fraudulent, improper, and abusive
transactions at both SPAWAR San Diego and the Navy Public Works Center San
Diego. Given the breakdown of controls described in this testimony, the two
units would have difficulty detecting and preventing these three types of
transactions. We considered potentially fraudulent purchases to be those
which were unauthorized and intended for personal use. Some of these
instances may involve the use of compromised accounts, in which an
account number was stolen and used to make fraudulent purchases. Other cases
involve the cardholder making unauthorized purchases for personal use. The
transactions we determined to be improper are those purchases intended for
government use, but are not for a purpose that is permitted by law or
regulation. We also identified as improper a number of purchases made on the
same day from the same vendor, which appeared to circumvent cardholder
single transaction limits. Federal Acquisition
Regulation and NAVSUP Instruction 4200.94 guidelines prohibit splitting
purchase card transactions into more than one segment to avoid the
requirement to obtain competitive bids on purchases over the $2, 500
micropurchase threshold or to circumvent higher single transaction limits
for payments on deliverables under requirements contracts. We defined
abusive transactions as those that were authorized, but the items
purchased were at an excessive cost or for a questionable government need,
or both. In these instances, it appears that cardholders were permitted to
purchase items for which there was not a reasonable, documented
justification. As discussed in our Objectives, Scope, and Methodology, our
work was not designed to identify, and we cannot determine, the extent of
fraudulent, improper, or abusive transactions.
Potentially Fraudulent Transactions Although both SPAWAR and the Navy Public
Works Center had policies and procedures that were designed to prevent
fraudulent purchases, our tests
showed that the controls were not implemented as intended. For example, as
discussed previously, controls for independent verification of receipt and
acceptance and proper certification of monthly statements prior to payment
were ineffective. Fraudulent activities must then be detected after
the fact during supervisor or internal reviews and disputed charge
procedures must be initiated to obtain a credit from Citibank. Table 3 shows
examples of potentially fraudulent transactions that we identified from the
universe of fiscal year 2000 purchases by SPAWAR San Diego and
Navy Public Works Center San Diego cardholders.
Page 26 GAO- 01- 995T Navy Purchase Card Controls
Table 3: Examples of Potentially Fraudulent Purchase Card Transactions Navy
Public Works Center San Diego officials told us that they were aware of the
potentially fraudulent transactions that we identified. The officials told
us that the apparently fraudulent Public Works Center transactions were all
made using a limited number of cardholder accounts and that they had
referred these transactions to the Naval Criminal Investigative Service.
SPAWAR officials also told us that they were aware of their potentially
fraudulent transactions. Both Public Works Center and SPAWAR officials said
that they had submitted disputed charged forms to Citibank and had received
credits for these transactions. However, given the extensive
breakdowns in purchase card controls that we identified, SPAWAR and the Navy
Public Works Center have no assurance that all fraudulent charges were
detected. Our Office of Special Investigations is conducting a further
investigation of the potentially fraudulent purchases we identified.
Improper Transactions We identified several SPAWAR San Diego transactions
that involved the
improper use of federal funds. For example, one case involved flowers
costing $97 purchased for Secretary?s Day. We also identified several
transactions for food for employee- related activities, including food
costing $75 for an office outing. The Federal Acquisition Regulation, 48 C.
F. R. 13. 301( a), provides that the Governmentwide Commercial Purchase Card
?may be used only for purchases that are otherwise authorized by law or
regulations.? Therefore, a procurement using the purchase card is lawful
only if it would be lawful using conventional procurement methods.
Type of items purchased Unit Vendor Total
amount
Cosmetics SPAWAR Mary Kay $500 Gift certificates Public Works Center
Nordstrom $1, 500 Clothing, electronics, and other personal items Public
Works Center Mervin?s, Macy?s,
Circuit City, others $10, 000 Gas Public Works Center Citgo 7 Eleven,
Exxon, Shell $360 CD recordings Both Sam Goody $700
Page 27 GAO- 01- 995T Navy Purchase Card Controls
Pursuant to 31 U. S. C. 1301( a), ?[ a] ppropriations shall only be applied
to the objects for which the appropriations were made . . . .? In the
absence of specific statutory authority, appropriated funds may only be used
to purchase items for official purposes, and may not be used to acquire
items for the personal benefit of a government employee. For example,
without statutory authority, appropriated funds may not be used to furnish
meals or
refreshments to employees within their normal duty stations. 19 Free food
and other refreshments normally cannot be justified as a necessary expense
of an agency?s appropriation because these items are considered
personal expenses that federal employees should pay for from their own
salaries. 20 Likewise, appropriated funds may not be used to purchase gifts
for employees or others unless an agency can demonstrate that the items
further the purposes for which the appropriation was enacted. 21 The
purchase of the flowers and food were both personal rather than official in
nature and, therefore, may not be paid for with appropriated funds.
Another transaction involved the purchase of a file cabinet from Macy?s at a
cost of $1, 462. Purchases of file cabinets are subject to rules prescribed
in Title 41 of the Code of Federal Regulations, Subtitle C, ?Federal
Property Management Regulations System,? which cover specific procedures
that must be followed to limit the purchases of new filing cabinets,
including disposing of all records that have been authorized for disposition
in accordance with authorized disposal schedules and transferring inactive
records not needed for daily business to approved agency records centers.
After taking appropriate steps to maximize the use of existing filing
cabinets, if the agency determines that additional filing cabinets are
required, the FAR requires the agency to submit a requisition to the General
Service Administration (GSA). We found no documented evidence that the
required procedures were followed. Further, we found no documented
justification for purchasing the file cabinet from Macy?s instead of through
GSA, as required.
Potentially Abusive Transactions
We also identified a number of potentially abusive transactions. These were
purchases of items supposedly for official use but without any documented
agency determination that these items were necessary for government
19 72 Comp. Gen. 178, 179 (1993); 65 Comp. Gen. 508, 509 (1986). 20 58 Comp.
Gen. 738, 739 (1986). 21 B- 260260, December 28, 1995; 70 Comp. Gen. 248
(1991).
Page 28 GAO- 01- 995T Navy Purchase Card Controls
business rather than merely to satisfy the personal preference of individual
employees. When a contracting official- in this case, a purchase cardholder-
purchases an item based on his or her own preferences (or the desires of
another agency official or employee) without a management
decision that the item is necessary, he or she is abusing the procurement
process. Some of these items fall into categories described in GAO?s Guide
for Evaluating and Testing Controls Over Sensitive Payments (GAO/ AFMD- 8.
1. 2, May 1993). The guide states that ?Abuse is distinct from illegal acts
(noncompliance). When abuse occurs, no law or regulation is violated.
Rather, abuse occurs when the conduct of a government organization, program,
activity, or function falls short of societal
expectations of prudent behavior.? Our review of the transactions in our
samples as well as our analytical review of the universe of SPAWAR and Navy
Public Works Center fiscal year 2000 transactions identified a number of
purchases that appear to be
abusive, as shown in table 4.
Table 4: Examples of Potentially Abusive Purchase Card Acquisitions
a The $900 amount represents the total cost of a Palm Pilot with
accessories, including external keyboards, travel kits, additional memory,
modems, and belt clips.
For example, SPAWAR San Diego cardholders purchased 9 flat- panel computer
monitors at a total cost of $13,192. The cost of each monitor ranged from
$800 to $2,500. In contrast, the current GSA schedule cost of a standard 17-
inch computer monitor is about $300. We were unable to find any pre-
purchase agency determination that the nature of the work performed by
SPAWAR officials or employees was such that standard monitors would not
satisfy their needs. SPAWAR?s commanding officer later told us that flat-
panel monitors save space and energy and are easier Type of items purchased
Unit Vendors Cost per item
Flat panel monitors SPAWAR Byte and Floppy Computers, Dell $800 - $2, 500
Personal digital assistants (e. g., Palm Pilots) SPAWAR and the
Public Works Center CompUSA, Staples $250 - $900 a Designer briefcases
SPAWAR The Coach Store, Nordstrom $400
Designer Palm Pilot holders SPAWAR Dooney and Bourke $100
Page 29 GAO- 01- 995T Navy Purchase Card Controls
on the eyes. However, his opinion did not constitute an official agency
determination that these monitors were needed. It appears more likely that
cardholders purchased these more costly monitors to satisfy the personal
preferences of individual SPAWAR officials or employees. Our sample
transactions also included four SPAWAR purchases of PDAs for a total cost of
$1,150.
We performed a similar review of the Navy Public Work Center?s fiscal year
2000 transactions and generally did not identify the same types of
potentially abusive transactions. We did, however, identify nine PDA
purchases for a total cost $3,642. Again, we were unable to find any
prepurchase agency determination that these officials or employees needed
PDAs to perform their work. Therefore, it again appears likely that the
PDAs were acquired to satisfy the personal preferences of the individuals
for whom they were purchased. Split Purchases Our analysis of the universe
of fiscal year 2000 Navy purchase card
payments made by DFAS San Diego identified nearly $100 million in purchases
made on the same day from the same vendor, which appeared to circumvent
cardholder single transaction limits- including about
$2. 5 million in potential SPAWAR split purchases and nearly $4. 7 million
in potential Navy Public Works Center split purchases. The Federal
Acquisition Regulation and Navy purchase card policies and procedures
prohibit splitting a transaction into more than one segment to avoid the
requirement to obtain competitive bids for purchases over the $2, 500 micro-
purchase threshold or to avoid other established credit limits. DOD and Navy
purchase card policies and procedures prohibit such actions as improper use
of the purchase card. Once items exceed the
$2, 500 micro- purchase threshold, they are to be purchased in accordance
with simplified acquisition procedures, which are more stringent than those
for micro- purchases.
Our analysis of the universe of fiscal year 2000 SPAWAR San Diego and Navy
Public Works Center San Diego transactions identified a number of potential
split purchases. To determine whether these were, in fact, split purchases,
we obtained and analyzed the supporting documentation for 20 purchases each
at SPAWAR and the Navy Public Works Center. We found that in many instances,
cardholders made multiple purchases from the
same vendor within a few minutes or a few hours for items such as computers,
computer- related equipment, and software, that involved the same, or
sequential or nearly sequential purchase order and vendor invoice
Page 30 GAO- 01- 995T Navy Purchase Card Controls
numbers. Based on our analyses, we concluded that 18 of the 20 SPAWAR
purchases and 14 of the 20 Navy Public Works Center purchases that we
examined were split into two or more transactions to avoid micro- purchase
thresholds. Tables 5 and 6 provide examples of cardholder purchases that we
believe represent split purchases intended to circumvent the $2, 500 micro-
purchase limit or cardholder transaction limits.
Table 5: Examples of Potential SPAWAR San Diego Split Purchases
Note: All cardholders making these purchases had $2,500 single transaction
limits.
Vendor Date Charge Items purchased Cost of items Indicator of split purchase
Byte & Floppy Computers 11/ 3/ 1999 1 Computer flat LCD panel monitor $2,408
Sequential invoice numbers 2 Computer flat LCD panel monitor $2,398 Byte &
Floppy Computers 9/ 25/ 2000 1 Computer, scanner $1, 809 No receipt provided
2 Flat panel monitor $2,459 Byte & Floppy Computers 1/ 26/ 2000 1 Laptop
computer $2, 418 Receipts timed 2 minutes apart
2 Desktop computer and flat LCD panel monitor $2, 428 CompUSA 9/ 17/ 2000 1
Computer supplies $1, 449 Receipt shows total purchase of $3,449
2 Computer $2,000 Fry?s Electronics 11/ 18/ 99 1 Computer equipment $1, 841
Receipts timed 7 minutes apart
2 Computer equipment $472 3 6 PC cameras and computer equipment $1, 510
Fry?s Electronics 9/ 25/ 2000 1 Laptop computer $2, 439 Sequential purchase
orders and all items purchased on same day 2 Printers $2,433 3 PDA and other
equipment $1,989 Circuit City 10/ 15/ 1999 1 Laptop computer $1, 500
Sequential purchase order
numbers 2 Laptop computer $1, 500
Page 31 GAO- 01- 995T Navy Purchase Card Controls
Table 6: Examples of Potential Navy Public Works Center San Diego Split
Purchases
Note: All cardholders making these transactions had $2,500 single
transaction limits.
In addition to the items in table 6, we identified three Navy Public Works
Center purchases totaling $147, 000 that were made to the same vendor on the
same day by a cardholder with a $100,000 transaction limit. The Navy
Public Works Center did not have receipts to document the items acquired.
Planned Actions to Mitigate Control Weaknesses
When we brought the control failures and other issues we identified to the
attention of the Executive Officer at the Navy Public Works Center San
Diego, he demonstrated a proactive position to identifying and correcting
the weaknesses. According to the Executive Officer, because of concerns
about recent instances of purchase card fraud, the Navy Public Works Center
requested a Naval Audit Service review of purchase card activity
and undertook a number of corrective actions as a result of auditor
findings. For example, in February 2000, the Navy Public Works Center San
Vendor Date Charge Items purchased Cost of items Indicator of split purchase
All Access Equipment 11/ 2/ 1999 1 Equipment rental $1, 893 Rental and
invoice were sequential 2 Equipment rental $1, 701 Apollo Electronics 4/ 20/
2000 1 Ejector and subracks $835 Vendor invoices are sequential
2 Components $2,013 Astra Coatings 12/ 8/ 1999 1 Install flooring $2, 285
Identical amount and
description, and sequential invoice numbers 2 Install flooring $2, 285
Barrett Engineered Pumps 10/ 20/ 1999 1 Rebar for retaining wall at
San Clemente $1, 112 Transactions were for same vendor invoice and job order
numbers
2 Rebar for chlorine contact tank at San Clemente $1, 667 Barrett Engineered
Pumps 12/ 08/ 99 1 Receiver $2,277 Both invoices were dated
11/ 12/ 999 2 Receiver $868 NPLTED Rentals 2/ 18/ 2000 1 Skip loader rental
$1, 544 Same day and time in and out
as other rental 2 Dump truck rental $1, 800 Perma Pipe, Inc. 5/ 1/ 2000 1
Leak detection cable $1,997 Sequential purchase order
numbers 2 Perma pipe services $1, 516
Page 32 GAO- 01- 995T Navy Purchase Card Controls
Diego started to reduce the number of purchase cardholders, which totaled
359 at that time, to about 250, and in September 2000, the Public Works
Center revised its purchase card policies and procedures to comply with
NAVSUP Instruction 4200.94. In addition, due to the time required for review
and proper certification of purchase card statements before payment, the
Executive Officer told us that he would consider further reducing the number
of cardholders to help ensure adequate review of documentation prior to
certifying statements for payment. During fiscal year 2001, according to a
SPAWAR acquisition official,
SPAWAR reduced the number of its cardholders from over 1,500 to 1,070;
however, it continued to have only one approving official who was
responsible for certifying monthly summary purchase card statements, and the
average number of individual monthly purchase card statements
remained about the same. In addition, the SPAWAR San Diego Commanding
Officer told us that SPAWAR planned to implement an Enterprise Resources
Planning (ERP) system. The ERP system is expected to help improve overall
controls for the purchase card program, including a
central electronic file of imaged documents supporting purchase card
transactions and an audit trail of actions by individuals executing various
purchase card processing functions. A SPAWAR official advised us that SPAWAR
implemented its ERP system in mid- July 2001. However, unless substantial
improvements are made in the overall control environment and
employees actually follow purchase card policies and procedures, the ERP
system will simply automate the same weaknesses as the current manual
process.
Conclusions The serious breakdown in internal controls at SPAWAR San Diego
and Navy Public Works San Diego are the result of a weak overall internal
control environment, flawed or nonexistent policies and procedures, and
employees that do not adhere to valid policies. The proliferation of
cardholders at these two activities resulted in over 1,700 cardholders with
essentially the authority to make their own purchase decisions in an
environment that lacked basic controls over receipt of government property,
certification of monthly statements, and accountability over sensitive
property items. Our work found that these weak internal controls resulted in
lost, stolen, missing, or misused government property, potentially abusive
use of purchase cards, and payment of unauthorized and potentially
fraudulent charges. The combination of these factors also contributed to the
five known fraud cases and leaves the government
Page 33 GAO- 01- 995T Navy Purchase Card Controls
highly vulnerable to significant additional fraud, waste, and abuse from the
purchase card program at these two Navy units. Following this testimony, we
plan to issue a report that will include recommendations to DOD and the Navy
for improving internal controls over purchase card activity.
Mr. Chairman, Members of the Subcommittee, and Senator Grassley, this
concludes my prepared statement. I would be pleased to respond to any
questions that you may have.
Contacts and Acknowledgements For future contacts regarding this testimony,
please contact Gregory D.
Kutz at (202) 512- 9095. Individuals making key contributions to this
testimony included Wendy Ahmed, Christie Arends, Bertram Berlin, Sharon
Byrd, Francine DelVecchio, Stephen Donahue, Michael Chambless, Douglas
Ferry, Gayle Fischer, Kenneth Hill, Wilfred Holloway, Jeffrey Jacobson, John
Kelly, Richard Larsen, John Ryan, and Sidney Schwartz.
Page 34 GAO- 01- 995T Navy Purchase Card Controls
Appendix I Background Appendi x I
The Navy?s purchase card program is part of the Governmentwide Commercial
Purchase Card Program, which was established to streamline federal agency
acquisition processes by providing a low- cost, efficient vehicle for
obtaining goods and services directly from vendors. DOD reported that it
used purchase cards for 95 percent of its eligible transactions- more than
10 million transactions, valued at $5. 5 billion- in fiscal year 2000. The
Navy?s reported purchase card activity represented nearly one third of the
reported DOD total during fiscal year 2000- 2.7 million transactions, valued
at $1.7 billion. According to unaudited DOD
data, SPAWAR and Navy Public Works Center San Diego- based activities
accounted for $68 million (about 15 percent) of the $451 million in fiscal
year 2000 Navy purchase card payments processed by DFAS San Diego. Although
SPAWAR San Diego and the Navy Public Works Center San Diego are both working
capital fund activities, their missions are very different. SPAWAR San Diego
is a highly technical systems operation staffed by scientists and engineers
who provide research, technology, and engineering support to other Navy
programs worldwide. The Navy Public Works Center
San Diego provides maintenance, construction, and operations support to
other Navy programs in the San Diego area.
Governmentwide Purchase Card Program Guidelines
Under the Federal Acquisition Streamlining Act of 1994, the Defense Federal
Acquisition Regulation Supplement guidelines, eligible purchases include (1)
micro- purchases (transactions up to $2,500 for which competitive bids are
not needed); (2) purchases for training services up to $25,000; and (3)
payment of items costing over $2,500 that are on the General Services
Administration?s (GSA) pre- approved schedule, including items on
requirements contracts. The streamlined acquisition threshold for
such contract payments is $100,000. Accordingly, cardholders may have single
transaction purchase limits of $2, 500 or $25,000, and a few cardholders may
have transaction limits of up to $100,000 or more. Under
the GSA blanket contract, the Navy has contracted with Citibank for its
purchase card services, while the Army and the Air Force have contracted
with U. S. Bank.
The Federal Acquisition Regulation, Part13, ?Simplified Acquisition
Procedures,? establishes criteria for using purchase cards to place orders
and make payments. U. S. Treasury regulations issued pursuant to provisions
of law in 31 U. S. C. 3321, 3322, 3325, 3327, and 3335, govern
purchase card payment certification, processing, and disbursement. DOD?s
Purchase Card Joint Program Management Office, which is in the office of
Appendix I Background
Page 35 GAO- 01- 995T Navy Purchase Card Controls
the Assistant Secretary of the Army for Acquisition, Logistics, and
Technology, has established departmentwide policies and procedures governing
the use of purchase cards. The Under Secretary of Defense (Comptroller) has
established related financial management policies and procedures in various
sections of DOD?s Financial Management Regulation.
Navy Purchase Card Acquisition And Payment Processes
The Navy Supply Systems Command is responsible for the overall management of
the Navy?s purchase card program, and has published the Navy Supply Command
(NAVSUP) Instruction 4200.94, Department of the Navy Policies and Procedures
for Implementing the Governmentwide Purchase Card Program. Under the NAVSUP
Instruction, each Navy Command?s head contracting officer authorizes
purchase card program coordinators in local Navy units to obtain purchase
cards and establish credit limits. The program coordinators are responsible
for administering the purchase card program within their designated span of
control and serve as the communication link between Navy units and the
purchase card issuing bank.
Designation of Cardholders When a supervisor requests that a staff member
receive a purchase card, the agency program coordinator is to first provide
training on purchase card policies and procedures and then establish a
credit limit and issue a purchase card to the staff member. The Navy had a
total of about 1, 700 purchase card program coordinators during fiscal year
2000, including one program coordinator at SPAWAR San Diego and one at the
Navy Public Works Center San Diego.
Ordering Goods and Services Purchase cardholders are delegated contracting
officer ordering responsibilities, but they do not negotiate or manage
contracts. SPAWAR San Diego and Navy Public Works Center San Diego
cardholders use
purchase cards to order goods and services for their units as well as their
customers. Cardholders may pick up items ordered directly from the vendor or
request that items be shipped directly to end users (requestors). Upon
receipt of items acquired by purchase cards, cardholders are to record the
transaction in their purchase log and obtain independent confirmation from
the end user, their supervisor, or another individual that the items have
been received and accepted by the government. They are
also to notify the property book officer of accountable items received so
that these items can be recorded in the accountable property records.
Appendix I Background
Page 36 GAO- 01- 995T Navy Purchase Card Controls
Payment Processing The purchase card payment process begins with receipt of
the monthly purchase card billing statements. Section 933 of the National
Defense Authorization Act for Fiscal Year 2000, Public Law 106- 65, requires
DOD to issue regulations that ensure that purchase card holders and each
official with authority to authorize expenditures charged to the purchase
card
reconcile charges with receipts and other supporting documentation. NAVSUP
Instruction 4200.94 states that upon receipt of the individual cardholder
statement, the cardholder has 5 days to reconcile the transactions appearing
on the statement by verifying their accuracy to the transactions appearing
on the statement and notify the approving official in writing of any
discrepancies in the statement. In addition, under the NAVSUP Instruction,
the approving official is responsible for (1) ensuring
that all purchases made by the cardholders within his or her cognizance are
appropriate and that the charges are accurate and (2) the timely
certification of the monthly summary statement for payment by DFAS. The
Instruction further states that within 5 days of receipt, the approving
official must review and certify for payment the monthly billing statement,
which is a summary invoice of all transactions of the cardholders under the
approving official?s purview. The approving official is to presume that all
transactions on the monthly statements are proper unless notified in writing
by the purchase cardholder. However, the presumption does not relieve the
approving official from reviewing for blatant improper purchase card
transactions and taking the appropriate action prior to certifying the
invoice for payment. In addition, the approving official is to forward
disputed charge forms to the unit?s comptroller?s office for submission to
Citibank for credit. Under the Navy?s contract, Citibank allows the Navy up
to 60 days after the statement date to dispute invalid transactions and
request a credit. Upon receipt of the certified monthly purchase card
summary statement, a DFAS vendor payment clerk is to (1) review the
statement and supporting documents to confirm that the prompt payment
certification form has been properly completed and (2) subject it to
automated and manual validations. The purpose of the automated validation is
to confirm that a SPAWAR or a
Navy Public Works Center obligation for a purchase card invoice has been
recorded in their respective cost accounting systems in an amount sufficient
to cover the payment. Quality control clerks manually verify that purchase
card statement and payment data were correctly entered in the Navy?s vendor
payment (disbursing) system- STARS 1- Pay. Once the payment has passed these
validation tests, the quality control supervisor authorizes the statement
for payment. The DFAS vendor payment system then batches all of the
certified purchase card payments for that day,
Appendix I Background
Page 37 GAO- 01- 995T Navy Purchase Card Controls
generates a tape for payment by electronic funds transfer to the purchase
card bank, and sends the file to the accounting station for recording the
payment as a summary record in the Navy?s accounting system. Figure 1
illustrates the current purchase card payment process used by SPAWAR and the
Naval Public Works Center in San Diego.
Figure 1: SPAWAR and Navy Public Works Center Purchase Card Process
Independent documentation that items have been received and accepted
Purchase cardholder
orders/ charges goods and services
Monthly purchase card statements are received from bank
Cardholder reconciles underlying receipts/ sales slips to monthly purchase
card statements, identifies any invalid charges, and prepares dispute forms
Approving official reviews cardholder support, establishes obligation, and
certifies monthly statements for payment
DFAS processes purchase card payments to Citibank Cardholder logs items
not received and follows up to (1) confirm receipt or (2) dispute the charge
Pilferable items are
recorded in accountable property records
Citibank reverses disputed charges and credits monthly statement
Items shipped Items picked up Vendor
Cardholder or approving official logs disputed charges and sends forms to
Citibank for credit
Navy accountants record detail transactions in accounting systems
DFAS enters summary payment record in Navy accounting system
Appendix I Background
Page 38 GAO- 01- 995T Navy Purchase Card Controls
The Navy earns purchase card rebate revenue from Citibank of up to 0.8
percent based on sales volume (purchases) and payment timeliness. According
to the DOD Deputy Director of DOD?s Purchase Card Joint Program Management
Office, rebate revenue is generally to be recorded to
the purchase card statements and used to offset monthly charges.
Page 39 GAO- 01- 995T Navy Purchase Card Controls
Appendix II San Diego Related Fraud Cases Investigated by NCIS Appendi x II
Pursuant to Senator Grassley?s request, we identified five fraud cases
related to Navy programs based in the San Diego, California, area and
investigated by the Naval Criminal Investigative Service (NCIS). All of
these cases can be linked to the types of internal control weaknesses
discussed in this testimony. Of these five cases, two involved Navy Public
Works Center San Diego employees and one involved 2,600 compromised purchase
card accounts, including 22 currently active SPAWAR San Diego accounts. One
of the remaining cases, which has been concluded, was related to a fraud
that occurred at the Navy?s Millington (Tennessee) Flying
Club- an activity of the Navy Morale, Welfare, and Recreation entity, which
is based in San Diego. The other case involved a military officer and other
service members who were assigned to the Marine Corps Station in Miramar,
near San Diego.
Case #1 The first San Diego- related purchase card fraud case is an example
of the lack of segregation of duties. This case involved the cardholder at
the Navy?s Millington (Tennessee) Flying Club, an entity of the U. S. Navy?s
Morale, Welfare, and Recreation activity, which is based in San Diego,
California. The cardholder, who was having financial problems, was hired by
her stepfather, who was the club?s treasurer. The stepfather delegated
nearly all purchase card duties to the cardholder, as well as the authority
for writing checks to pay the Flying Club?s monthly purchase card
statements. The cardholder made over $17,000 in fraudulent transactions to
acquire personal items from Wal- Mart, The Home Depot, shoe stores, pet
stores, boutiques, an eye care center, and restaurants over an 8- month
period from December 1998 through July 1999. The fraud was identified when
the club?s checking account was overdrawn due to excessively high purchase
card payments and a bank official contacted the president of the
Flying Club. The cardholder pleaded guilty and was sentenced to 15 months in
jail and assessed about $28,486 in restitution due to purchase card fraud
and bounced checks. The defendant commented that illegal use
of the card was ?too easy? and that she was the sole authorizer of the card
purchases.
Case #2 The second case involved a military officer and other service
members who were assigned to the Marine Corps Station in Miramar, near San
Diego,
California. This alleged fraud occurred through collusion, and internal
controls will not prevent collusion. However, adequate monitoring of
purchase card transactions along with enforcing controls such as
Appendix II San Diego Related Fraud Cases Investigated by NCIS
Page 40 GAO- 01- 995T Navy Purchase Card Controls
documentation of independent confirmation of receipt and acceptance and
recording accountable items in property records would have made detection
easier. In this instance, the military officer allegedly conspired with
cardholders under his supervision to make nearly $400,000 in fraudulent
purchases from five companies- two that he owned, one owned
by his sister, and the other two owned by friends or acquaintances. They
charged thousands of dollars for items such as DVD players, Palm Pilots, and
desktop and laptop computers. The officer also allegedly made cash payments
to employees to keep silent about the fraud and provided auditors with
falsified purchase authorizations and invoices to cover the fraud. The fraud
occurred from June 1999 through September 2000. The total amount of the
alleged fraud is unknown. The alleged fraud was identified based on a tip
from a service member. The U. S. Attorney?s Office in San Diego has accepted
the case for prosecution and four other active
service members are under investigation. Case #3 The third case involved a
Navy Public Works Center San Diego
maintenance/ construction supervisor who allegedly made at least $52,000 in
fraudulent transactions to a suspect contractor on work orders for which the
work was not performed by that contractor. Adequate monitoring of purchase
card transactions along with enforcing controls such as independent,
documented receipt and acceptance and recording accountable items in
property books would have made detection easier. Navy investigators believe
that the employee also may have used his government purchase card to make
unauthorized purchases for personal
use, including jewelry, an air conditioner, and other personal items from
The Home Depot from April 1997 through October 1998. The total amount of
this alleged purchase card fraud is unknown. The alleged fraud was
identified when the employee?s supervisor reviewed Navy Public Works Center
work orders and noticed that four work orders totaling approximately $7, 000
were completed by the employee and paid for with the suspect?s government
purchase card. Further inquiry by the supervisor
revealed that Navy Public Works Center employees, not the contractor, had
completed the work. NCIS investigators and Naval Audit Service auditors
identified approximately $52,000 in purchase card transactions made by
the employee to a suspect contractor for work that was performed by either
the Public Works Center or other legitimate contractors. The employee has
resigned and an investigation by the Federal Bureau of Investigation and
NCIS is ongoing. The U. S. Attorney?s Office in San Diego
has accepted the case for prosecution.
Appendix II San Diego Related Fraud Cases Investigated by NCIS
Page 41 GAO- 01- 995T Navy Purchase Card Controls
Case #4 The fourth case involved a Navy Public Works Center San Diego
purchasing agent that allegedly made at least $12,000 in fraudulent
purchases and
planned to submit approximately $103,000 in fraudulent disputed charge
forms, including payments for hotels, airline tickets, computers, phone
cards, and personal items from The Home Depot. The alleged fraud occurred
from April 1997 through July 1999. As with the other cases, adequate
monitoring of purchase card transactions along with enforcing controls such
as independent, documented receipt and acceptance and recording accountable
items in property books would have made detection easier. The alleged fraud
was identified during an investigation of a possible bribery/ kickback
scheme. The employee has resigned and an NCIS investigation is ongoing. The
U. S. Attorney?s Office in San Diego has accepted the case for prosecution.
Case #5 The fifth Navy purchase card fraud case is ongoing and involves the
compromise of up to 2, 600 purchase card accounts assigned to Navy
activities in the San Diego area. Investigators were only able to obtain a
partial list consisting of 681 compromised accounts so the exact number is
not known. At least 45 of the compromised accounts were for SPAWAR San Diego
and one of the compromised accounts was for the Navy Public Works Center in
San Diego. Of these 46 compromised accounts, 22 SPAWAR San Diego accounts
were still active in May 2001. None of the
active accounts on the partial listing found by investigators were for the
Navy Public Works Center San Diego. Although the account numbers showed up
on a computer printer in a community college library in San
Diego in September 1999, the Navy has not canceled all of the compromised
accounts. Instead, according to NCIS and Navy Supply Command officials, the
Navy is canceling the compromised accounts as fraudulent transactions are
identified. Naval Supply Systems Command, SPAWAR San Diego, and Navy Public
Works Center San Diego officials told us that they were aware of this
incident but did not have a listing of the
account numbers affected. As a result, the Navy did not take any measures to
flag the compromised accounts and implement special monitoring procedures to
detect any potential fraudulent use of these accounts. According to Navy
investigators, as of January 2001, at least 30 of the compromised account
numbers had been used by 27 alleged suspects to make more than $27,000 in
fraudulent transactions for pizza, jewelry, phone
calls, tires, and flowers. As of May 21, 2001, 22 of the compromised SPAWAR
accounts were still active. Our review of the monthly credit limits
Appendix II San Diego Related Fraud Cases Investigated by NCIS
Page 42 GAO- 01- 995T Navy Purchase Card Controls
associated with the 22 compromised accounts showed that SPAWAR continued to
have an aggregate monthly financial exposure of $900, 000 associated with
these accounts nearly 2 years after the compromised list was discovered in a
San Diego community college library in September
1999. Further, with the lack of controls over receipt of goods and
certification of purchase card statements that we identified at the two
activities we reviewed, it is impossible for the Navy to identify fraudulent
purchases as they occur or to determine the extent of the fraudulent use of
the compromised accounts. As a result, when fraudulent use of one of the
comprised accounts was identified, the Navy could not determine if the
incident was due to cardholder fraud or use of the compromised account by an
outside party. A joint task force in San Diego, comprised of NCIS, the U. S.
Secret Service, local police, and the U. S. Attorney?s Office, investigated
this fraud. The task force investigators recently traced the list of
compromised accounts to a vendor used by the Navy, which acknowledged that
the list came from its database. The vendor identified two former employees
as possible suspects.
Page 43 GAO- 01- 995T Navy Purchase Card Controls
Appendix III Objectives, Scope, and Methodology Appendi x I II
Pursuant to Senator Grassley?s request, we obtained and reviewed information
on five fraud cases related to Navy purchase card programs in the San Diego,
California, area and to review purchase card controls and
accounting for two Navy units based in San Diego- the Space and Naval
Warfare Systems Command (SPAWAR) Systems Center and the Navy Public Works
Center. Our assessment of SPAWAR San Diego and the Navy Public Works Center
San Diego purchase card controls covered
the overall management control environment, including (1) span of control
issues related to the number of cardholders, (2) training for cardholders
and accountable officers, 1 (3) management of rebates, and (4) monitoring
and audit of purchase card activity;
tests of statistical samples of key controls over purchase card
transactions, including (1) documentation of independent confirmation that
items ordered by purchase card were received, (2) proper certification of
purchase card statements for payment, and (3) proper accounting for purchase
card transactions;
substantive tests of accountable items in our sample transactions to
verify whether they were recorded in property records and whether they could
be found; and
analysis of the universe of transactions to identify (1) any potentially
improper, fraudulent, and abusive transactions and (2) purchases that were
split into one or more transactions to avoid micro- purchase
thresholds or other credit limits. We used as our primary criteria
applicable laws and regulations; our Standards for Internal Control in the
Federal Government; 2 and our Guide for Evaluating and Testing Controls Over
Sensitive Payments. 3 To assess the management control environment, we
applied the fundamental
1 We tested statistical samples of transactions to determine whether the two
units had documented evidence that cardholders had received required
purchase card training. 2 Standards for Internal Control in the Federal
Government (GAO/ AIMD- 00- 21.3.1), was prepared to fulfill our statutory
requirement under the Federal Managers? Financial Integrity Act to issue
standards that provide the overall framework for establishing and
maintaining internal control and for identifying and addressing major
performance and management challenges and areas at greatest risk of fraud,
waste, abuse, and mismanagement.
3 Guide for Evaluating and Testing Controls Over Sensitive Payments (GAO/
AFMD- 8. 1.2), provides a framework for evaluating and testing the
effectiveness of internal controls that have been established in various
sensitive payment areas.
Appendix III Objectives, Scope, and Methodology
Page 44 GAO- 01- 995T Navy Purchase Card Controls
concepts and standards in the GAO internal control standards to the
practices followed by management in the four areas reviewed.
To test controls, we selected stratified random probability samples of 135
SPAWAR San Diego purchase card transactions from a population of 47,035
transactions totaling $38,357,656, and 121 Navy Public Works Center San
Diego transactions from a population of 53, 026 transactions totaling
$29,824, 160 that were recorded by the Navy during fiscal year 2000. We
stratified the samples into two groups- transactions from computer
vendors and other vendors. With this statistically valid probability sample,
each transaction in the population had a nonzero probability of being
included, and that probability could be computed for any transaction. Each
sample element was subsequently weighted in the analysis to account
statistically for all the transactions in the population, including those
that were not selected. Table 7 presents our test results on three key
transaction- level controls and shows the confidence intervals for the
estimates for the universes of fiscal year 2000 purchase card transactions
made by SPAWAR and the Navy Public Works Center in San Diego.
Table 7: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests
a The projections represent point estimates for the population based on our
sampling tests at a 95- percent confidence level. b All seven approving
officials with certifying officer responsibilities told us that they did not
review support for transactions before certifying purchase card statements
for payment.
Our analytical reviews covered the universe of fiscal year 2000 purchase
card transactions for the two units? San Diego- based activities covered
about 47, 000 transactions totaling about $38 million at SPAWAR San Diego
and about 53, 000 transactions totaling about $30 million at the Navy Public
Works Center San Diego. For these reviews, we did not look for all
potential abuses of purchase cards. For example, because a large number
Breakdowns in key purchase card controls a Independent, documented
receipt Proper payment certification Timely customer accounting Navy units
in San Diego, CA Percent
failure Projection (millions) Percent
failure Projection (millions) Percent
failure Projection (millions)
SPAWAR 65% (+/- 10%) $14. 5
(+/- $4. 4) 100% b $38 b 83% (74- 90%) $20.4
(+/- $5.1) Navy Public Works Center 47%
(+/- 12%) $12. 9 (+/- $6. 3) 100% b $30 b 35%
(+/- 11.4%) $11.2 (+/- $ 6.2)
Appendix III Objectives, Scope, and Methodology
Page 45 GAO- 01- 995T Navy Purchase Card Controls
of store receipts (such as those from The Home Depot) were missing, we were
unable to determine whether certain purchases were made for personal use. In
addition, we did not physically examine purchases made to determine whether
goods and services were received and used for government purposes. While we
identified some improper and potentially fraudulent and abusive
transactions, our work was not designed to identify, and we cannot
determine, the extent of fraudulent, improper, or abusive transactions.
We briefed DOD managers, including officials in DOD?s Purchase Card Joint
Program Management Office and the Defense Finance and Accounting Service,
and Navy managers, including Navy Supply Command,
Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego
officials on the details of our review, including our objectives, scope, and
methodology and our findings and conclusions. We conducted our audit work
from August 2000 through June 2001 in accordance with generally accepted
government auditing standards, and we performed our investigative work in
accordance with standards prescribed by the
President?s Council on Integrity and Efficiency. Following this testimony,
we plan to issue a report, which will include recommendations to DOD and the
Navy for improving internal controls over purchase card activity.
(918994) Lett er
Orders by Internet: For information on how to access GAO reports on the
Internet, send an e- mail message with ?info? in the body to: info@ www.
gao. gov or visit GAO?s World Wide Web home page at: http:// www. gao. gov
To Report Fraud, Waste, or Abuse in Federal Programs
Contact one: Web site: http:// www. gao. gov/ fraudnet/ fraudnet. htm e-
mail: fraudnet@ gao. gov 1- 800- 424- 5454 (automated answering system)
United States General Accounting Office Washington, D. C. 20548- 0001
Official Business Penalty for Private Use $300
Address Correction Requested Presorted Standard
Postage & Fees Paid GAO Permit No. GI00
*** End of document. ***