Purchase Cards: Control Weaknesses Leave Two Navy Units 	 
Vulnerable to Fraud and Abuse (30-NOV-01, GAO-02-32).		 
								 
GAO studied purchase card activity at the Space and Naval Warfare
Systems Command (SPAWAR) Systems Center San Diego and the Navy	 
Public Works Center in San Diego. GAO reported that the two units
had a significant breakdown in internal controls over the $68	 
million in fiscal year 2000 purchase card transactions tested.	 
GAO found fraudulent, improper, and abusive purchases and theft  
and misuse of government property. Neither SPAWAR nor the Navy	 
Public Works Center had effective policies for issuance of	 
purchase cards, establishing credit limits, and minimizing the	 
federal government's financial exposure. Any employee having	 
supervisory approval could get a card. These units did not	 
perform credit checks on prospective cardholders. GAO also found 
that: (1) nearly half of SPAWAR's fiscal year 2000 purchase card 
transactions and over half of the Navy Public Works Center's	 
transactions were made by employees who did not have documented  
evidence of timely training; (2) policies for rebate management  
were deficient, including a lack of procedures to maximize	 
rebates and ensure that bank calculations of rebates were	 
correct; and (3) management was not effectively utilizing	 
internal reviews and audits to determine whether purchase card	 
internal controls were effectively implemented. These specific	 
internal control weaknesses contributed to additional purchases  
that are potentially fraudulent, improper, or abusive. GAO	 
summarized this report in testimony before Congress (GAO-01-995T,
July 2001).							 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-02-32						        
    ACCNO:   A02507						        
  TITLE:     Purchase Cards: Control Weaknesses Leave Two Navy Units  
Vulnerable to Fraud and Abuse					 
     DATE:   11/30/2001 
  SUBJECT:   Internal controls					 
	     Credit						 
	     Fraud						 
	     Accountability					 
	     San Diego (CA)					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-02-32
     
A

Report to Congressional Requesters

November 2001 PURCHASE CARDS Control Weaknesses Leave Two Navy Units
Vulnerable to Fraud and Abuse

GAO- 02- 32

Letter 1 Overview of Testimony 1 Conclusions 5 Recommendations for Executive
Action 5 Agency Comments and Our Evaluation 10

Appendix I: Testimony on Purchase Card Control Weakness at Two Navy Units 18

Appendix II: Comments From the Department of Defense 64 GAO Comments 75

Appendix III: GAO Contact and Staff Acknowledgements 77 GAO Contact 77
Acknowledgements 77

Lett er

November 30, 2001 The Honorable Charles E. Grassley Ranking Minority Member
Committee on Finance United States Senate The Honorable Stephen Horn

Chairman Subcommittee on Government Efficiency,

Financial Management, and Intergovernmental Relations Committee on
Government Reform House of Representatives

On July 30, 2001, we testified before the Subcommittee on Government
Efficiency, Financial Management, and Intergovernmental Relations on the
results of our review of internal controls over purchase card activity at
two Navy units in San Diego, California. 1 In our testimony, which is
reprinted in appendix I, we reported that the two Navy units we reviewed had
a significant breakdown in internal controls over the $68 million in fiscal
year 2000 purchase card transactions that we tested, leaving the Space and
Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public
Works Center 2 vulnerable to fraudulent, improper, and abusive purchases and
theft and misuse of government property. This report summarizes the results
of our review and makes specific recommendations for corrective action.

Overview of Testimony In our testimony, we stated that a weak internal
control environment at the SPAWAR Systems Center San Diego and the Navy
Public Works Center San

Diego contributed to internal control weaknesses, fraud, and abuse. Our
specific findings included the following. 1 Purchase Cards: Control
Weaknesses Leave Two Navy Units Vulnerable to Fraud and Abuse (GAO- 01-
995T, July 30, 2001). 2 SPAWAR and the Navy Public Works Center are working
capital fund activities. SPAWAR performs research, engineering, and
technical support, and the Navy Public Works Center provides maintenance,
construction, and operations support to Navy programs. Both of these Navy
programs have locations throughout the United States. Our review focused on
the purchase card program at the San Diego units only.

* Neither SPAWAR nor the Navy Public Works Center had effective policies for
issuance of purchase cards, establishing credit limits, and minimizing the
federal government?s financial exposure. Any employee having supervisory
approval could get a card. These units did not perform credit checks on
prospective cardholders.

 Nearly half of SPAWAR?s fiscal year 2000 purchase card transactions and
over half of the Navy Public Works Center?s transactions were made by
employees who did not have documented evidence of timely training.

 Policies for rebate management were deficient, including a lack of
procedures to maximize rebates and ensure that bank calculations of rebates
were correct.  Management was not effectively utilizing internal reviews
and audits to determine whether purchase card internal controls were being
effectively implemented.

Three basic internal controls that we tested- (1) independent, documented
receipt and acceptance of goods and services, (2) independent, documented
certification of monthly purchase card statements, and (3) proper accounting
for purchase card transactions- were ineffective. In addition, we found that
easily pilferable or sensitive items included in statistical samples of
transactions that we tested were not recorded in the units? accountable
property records, as required, to

help prevent theft, loss, and misuse of government assets. The two units did
not record a total of 46 of the 65 accountable items included in our sampled
transactions in their property records, and they were unable to provide
conclusive evidence that 31 of the 65 items, including laptop computers,
personal digital assistants (PDA) such as Palm Pilots, and digital cameras,
were in the possession of the government. Weak internal controls contributed
to five recent Naval Audit Service cases of alleged purchase card fraud
related to Navy units in the San Diego area, including two involving Navy
Public Works Center employees. One case has been successfully prosecuted,
while the remaining four cases are still under investigation. According to
Naval Criminal Investigative Service

investigators, one of the ongoing cases involved as many as 2,600
compromised Navy San Diego purchase card accounts, including 684 accounts
for which specific account number information was obtained. As of May 21,
2001, we identified 22 compromised SPAWAR accounts that

were still open. The financial exposure related to credit limits associated
with these 22 accounts is $900,000.

The specific internal control weaknesses that we identified at the two units
we reviewed contributed to additional purchases that we believe are
potentially fraudulent, improper, or abusive.

 We found records of unauthorized, potentially fraudulent purchases of
personal items, including cosmetics, gift certificates, and clothing at both
units. We referred these transactions to our Office of Special
Investigations for further investigation.

 The abusive purchases we identified relate primarily to SPAWAR San Diego
and include items purchased at excessive cost, or items of questionable
government need, or both. For example, we found

purchases for flat panel computer monitors costing from about $800 to $2,
500 each, compared to standard General Services Administration (GSA)
schedule monitors costing about $300 each.

 We also found routine purchases without documented government need at
SPAWAR, including personal digital assistants, such as Palm Pilots, as well
as purchases of $100 designer Palm Pilot carrying cases and two

$400 designer briefcases. The Navy Public Works Center San Diego also had
numerous purchases of personal digital assistants. It appears that these
items and the flat panel monitors were purchased to satisfy the personal
preferences of purchase cardholders.

 Improper transactions involved SPAWAR?s use of federal funds for personal
items, such as flowers for Secretary?s Day and food for employees, and the
purchase of a $1, 500 file cabinet from Macy?s. Although purchases of file
cabinets are subject to rules prescribed in Title 41 of the Code of Federal
Regulations, we found no documented

evidence that SPAWAR followed these rules.

 We also identified a number of purchases made on the same day from the
same vendor, which appeared to circumvent cardholder single transaction
limits and the more stringent $2,500 micropurchase

threshold. Split purchases are specifically prohibited by the Federal
Acquisition Regulation.

In response to concerns raised by Chairman Horn during the hearing, we
stated that we question whether the purchase card- rather than negotiated

contracts- was the right vehicle for acquiring certain types of items.
Chairman Horn also asked whether the purchase card should be used to acquire
computers and other equipment or property items individually that could be
more economically and efficiently procured through bulk purchases. DOD and
Navy witnesses stated that they would examine these issues.

When we brought the control failures and other issues we identified to the
attention of the Executive Officer at the Navy Public Works Center San
Diego, he demonstrated a proactive position to identifying and correcting
the weaknesses. In addition, the SPAWAR Systems Center San Diego Commanding
Officer stated that he planned to implement an automated enterprise resource
planning system to help improve controls. However,

the Commanding Officer also testified that for the most part, SPAWAR had
good controls and employees that could be trusted. However, as noted in our
testimony, we found significant problems with every management aspect of the
SPAWAR Systems Center San Diego purchase card program.

This report contains our recommendations for improvements in controls over
the purchase card acquisition, payment, and accounting processes. In
commenting on a draft of this report, DOD concurred with the majority of our
recommendations. However, DOD did not concur with three recommendations, and
it partially concurred with seven other recommendations. In addition, DOD
stated that the SPAWAR Systems

Center in San Diego and the Navy Public Works Center San Diego had initiated
or completed corrective actions on some of our recommendations. As agreed
with your offices, we plan to assess the adequacy and effectiveness of these
two San Diego Navy units? corrective actions during the next few months and
advise you of the results of our work. See the "Agency Comments and Our
Evaluation" section of this report for our discussion of DOD?s comments,
which are reprinted in

appendix II. We performed our work from August 2000 through June 2001 in
accordance with generally accepted government auditing standards, and we
performed our investigative work in accordance with standards prescribed by
the President?s Council on Integrity and Efficiency. Our testimony, which
includes our detailed findings and our objectives, scope, and methodology,
is reprinted in appendix I.

Conclusions The serious breakdown in internal controls at the SPAWAR Systems
Center San Diego and the Navy Public Works Center San Diego are the result
of a weak overall internal control environment, flawed or nonexistent
policies and procedures, and employees that do not adhere to valid policies.
We found significant problems with every aspect of purchase card

management that we reviewed at SPAWAR and the Navy Public Works Center. To
fix these problems, SPAWAR and Navy Public Works Center management will need
to demonstrate leadership in this area and establish accountability, proper
incentives, and consequences for their employees in order to ensure
acceptable behavior.

Recommendations for The following are our recommendations to address the key
findings related

Executive Action to the weak management control environment discussed in our
testimony. Proliferation of Cardholders We recommend that the Commanding
Officer of the SPAWAR Systems

Center San Diego and the Commanding Officer of the Navy Public Works Center
San Diego work with the Naval Supply Systems Command and DOD?s Purchase Card
Joint Program Management Office to do the following.

 Establish specific policies and strategies governing the number of
purchase cards to be issued with a focus on minimizing the number of
cardholders.

 Develop criteria for identifying employees eligible for the privilege of
cardholder status. As part of the effort to develop these criteria, assess
the feasibility and cost- benefit of performing credit checks on

employees prior to assigning them cardholder responsibilities to ensure that
employees authorized to use government purchase cards have demonstrated
credit worthiness and financial integrity.

 Develop policies and strategies on credit limits provided to cardholders
with a focus on minimizing specific cardholder spending authority and
minimizing the federal government?s financial exposure.

Training We recommend that the Commander of the Naval Supply Systems Command

 confirm that required training has been completed and documented, and

 incorporate into purchase card training programs any relevant changes in
policies and procedures made as a result of the recommendations in this
report.

Rebates We recommend that the Commander of the Naval Supply Systems Command
work with the Navy Comptroller and the Defense Finance and Accounting
Service to  investigate ways to maximize potential rebates, such as (1)
working

with Citibank to facilitate timely receipt of monthly purchase card
statements and (2) reducing the time associated with mailing and receipt of
hard copy billing statements,

 establish effective policies and procedures for routinely calculating and
verifying Citibank rebates, and

 develop guidance for routine distribution of rebate earnings to Navy units
and activities. Monitoring and Review We recommend that the Commander of the
Naval Supply Systems Command

 establish in NAVASUP Instruction 4200.94, further guidelines for an
effective internal review program, such as having reviewers analyze monthly
summary statements to identify (1) potentially fraudulent, improper, and
abusive purchases and (2) any patterns of improper cardholder transactions,
such as purchases of food or other prohibited

items,

 revise NAVSUP Instruction 4200. 94 to require that (1) written reports on
the results of internal reviews along with any recommendations for
corrective actions be prepared and submitted to local management and
cognizant commands and (2) commands identify and report systemic weaknesses
and corrective action plans to the Naval Supply Systems

Command for monitoring and oversight,

 require purchase card Agency Program Coordinators to report in writing to
the unit commander and the Commander of Naval Supply Systems Command any
internal control weakness identified during the semiannual program reviews,
and

 disclose systemic purchase card control weaknesses along with corrective
action plans in the Secretary of the Navy?s Annual Statement of Assurance
prepared under 31 U. S. C. 3512( d) (commonly referred to as the Federal
Managers? Financial Integrity Act of 1982).

The following are our recommendations to address breakdowns in key controls
over the purchase card program at the SPAWAR Systems Center San Diego and
the Navy Public Works Center San Diego.

Receipt of Goods and We recommend that

Services

 the Commander of the Naval Supply Systems Command revise NAVSUP
Instruction 4200. 94 to eliminate ambiguous language suggesting that advance
independent authorization of a purchase can be substituted for

independent confirmation that goods and services ordered and paid for with a
purchase card have been received and accepted by the government, and

 the Commanding Officer of the SPAWAR Systems Center San Diego and the
Commanding Officer of the Navy Public Works Center San Diego implement
procedures to require and document independent confirmation of receipt of
goods and services acquired with a purchase card.

Proper Payment To provide assurance that certifications of monthly purchase
card

Certification statements for payment reflect certifying officer
responsibilities in 31

U. S. C. 3325, 3528, and the approving official?s informed judgment that
purchases are proper, we recommend that  the Commander of the Naval Supply
Systems Command revise NAVSUP

Instruction 4200. 94 to require that (1) cardholders notify approving
officials prior to payment that purchase card statements have been
reconciled to supporting documentation, (2) approving officials certify

monthly statements only after reviewing them for potentially fraudulent,
improper, and abusive transactions, and (3) approving officials verify, on a
sample basis, supporting documentation for various cardholders? transactions
prior to certifying monthly statements for payment, and

 the Navy Comptroller withdraw the June 3, 1999, policy memorandum or
revise the policy guidance to be consistent with the preceding
recommendation for revising payment certification guidance in NAVSUP
Instruction 4200. 94.

Proper and Timely We recommend that Accounting

 the Commanding Officer of the SPAWAR Systems Center San Diego and the
Commanding Officer of the Navy Public Works Center San Diego monitor and
confirm that purchase card transactions are recorded to projects that
benefited from the goods and services or to relevant overhead accounts in a
timely manner, in accordance with internal control standards and federal
accounting standards,

 the Commander of the Naval Supply Systems Command revise NAVSUP
Instruction 4200. 94 to require that purchase card expenses be properly
classified in the Navy?s detail accounting records, and

 the Commanding Officer of the SPAWAR Systems Center San Diego and the
Commanding Officer of the Navy Public Works Center San Diego verify that
their detail purchase card transaction records reflect the proper object
classification of expense.

Accountable Property We recommend that the Commanding Officer of the SPAWAR
Systems Center San Diego and the Commanding Officer of the Navy Public Works
Center San Diego require and verify that accountable property obtained

using a purchase card is promptly recorded in property records as it is
acquired, in accordance with DOD and Navy policies and procedures. The
following are our recommendations to identify and address potentially
fraudulent, abusive and improper purchase card transactions prior to
payment.

Fraudulent, Improper, and We recommend that the Commander of the Naval
Supply Systems Abusive Transactions

Command do the following.

 Act immediately to cancel all known active compromised purchase card
accounts.

 Determine whether purchases of excessive cost, questionable government
need, or both, such as items for personal use, including personal digital
assistants (such as Palm Pilots), and flat screen computer monitors, that
were identified by GAO are proper government purchases. If not, the
Commander should prohibit their purchase.  Establish written policies and
criteria requiring documented justifications and procurement management
approval for types of items

that can be acquired with a government purchase card.

 Examine purchase card acquisition guidance to determine whether the
purchase card is the right vehicle for acquiring certain goods and services,
such as vehicle and equipment maintenance, installation of upgraded computer
software, and other recurring or installationwide services, or whether these
items should be subject to negotiated

contracts.

 Work with the Under Secretary for Acquisition, Technology, and Logistics
and DOD?s Purchase Card Joint Program Office to determine whether the
purchase card should be used to acquire computers and other equipment or
property items individually that could be more economically and efficiently
procured through bulk purchases.

 Revise NAVSUP Instruction 4200.94 to make the Instruction consistent with
the Federal Acquisition Regulation, 48 C. F. R. 13. 301( a), which states
that the ?card may be used only for purchases that are otherwise authorized
by law or regulation.? The clarifying guidance should specifically state
that in the absence of specific statutory authority, purchases of items for
the personal benefit of government employees,

such as flowers or food, are not permitted and are therefore improper
transactions.

Split Purchases We recommend that the Commanding Officer of the SPAWAR
Systems Center San Diego and the Commanding Officer of the Navy Public Works
Center San Diego

 prohibit splitting purchases into multiple transactions as required by the

Federal Acquisition Regulation and emphasize this prohibition in purchase
card training provided to cardholders and approving officials, and  require
approving officials to monitor monthly purchase card statements and identify
and report to them regarding any split

purchases and the names of cardholders who made the transactions. Overall
Accountability To help ensure that cardholders adhere to applicable purchase
card laws,

regulations, internal control and accounting standards, and policies and
procedures, we recommend that the Commander of the Naval Supply Systems
Command revise NAVSUP Instruction 4300.94 to include specific

consequences for noncompliance with these guidelines and enforce the
guidelines.

Agency Comments and In commenting on a draft of this report, DOD stated that
it was in overall

Our Evaluation agreement with 19 of our 29 recommendations. DOD did not
concur with

three recommendations, and it partially concurred with seven other
recommendations. In addition, DOD indicated that the SPAWAR Systems Center
San Diego and the Navy Public Works Center San Diego have initiated or
completed corrective actions on certain of our

recommendations. We plan to assess the adequacy and effectiveness of the
corrective actions during the next few months and advise you of the results
of our assessment. The DOD comment letter is reprinted in appendix II.

The recommendations that DOD disagreed with related to four major issues
addressed in our work-( 1) the need for specific policies and strategies on
minimizing the number of cardholders, (2) the need for Navywide criteria on
the types of items that can be acquired using a government purchase card,
(3) whether their purchases of food and flowers are proper, and (4) the need
for Navy guidelines setting forth specific consequences for

noncompliance with applicable purchase card laws, regulations, internal
controls and accounting standards, and policies and procedures.

DOD stated that the Navy executes the department?s purchase card program in
a decentralized manner consistent with DOD policy. We are concerned that the
lack of adequate Navy- wide guidance and the delegation of policy- making
responsibility to local commands without Navy Department oversight will
continue to result in a weak management control environment and the types of
problem transactions identified in this report. We plan to examine this
issue as part of our ongoing, broader review of the Navy's purchase card
program.

Minimizing the Number of DOD stated that it believed that the intent of our
recommendation to Cardholders establish specific policies and strategies
governing the number of credit cards to be issued was to encourage a
manageable span of control between

billing officials and cardholders. DOD maintained that in accordance with
DOD policy, the Navy's decentralized execution of the purchase card program
allows individual commands to issue purchase cards to employees as mission
requirements warrant. DOD noted that the Naval Supply Systems Command?s
recently released policy implementing DOD ?Span of Control Goals? will
result in approving officials being responsible for review and payment
certification of a reasonable number of cardholder statements. DOD's "Span
of Control Goals" states that as a general rule,

billing officials should have no more than five to seven cardholders
assigned to them for oversight. We agree with DOD that our recommendation is
intended, in part, to ensure a manageable span of control between approving,
or billing, officials and cardholders. At SPAWAR, we found only one
approving official responsible for reviewing and certifying payment of 1,526
cardholders' monthly purchase card statements, creating a substantial span
of control issue. Providing several hundred approving officials to create a
reasonable span

of control over SPAWAR's 1,526 cardholders would not be a practical or
economical course of action for SPAWAR. We found no valid justification for
1,526, 36 percent, of SPAWAR's employees to have purchase cards. Further,
the intent of our recommendation is broader than the span of control issue.
We are also concerned about the financial exposure

associated with the excessive number of cardholders. As stated in our
testimony, the two Navy units had given purchase cards to over 1,700
employees, most of whom had credit limits of $20,000 or more and the
authority to make their own purchase decisions. For example, most of
SPAWAR's 1,526 cardholders had a $25,000 credit limit and most of the

Navy Public Works Center's 254 cardholders had a $20,000 credit limit. The
proliferation of cardholders, particularly at SPAWAR San Diego,

significantly increased the government's financial exposure and created a
situation where it was virtually impossible to maintain a positive control
environment. To reduce the financial exposure associated with the large
number of cardholders, we continue to recommend that the two Navy commands
establish specific policies and strategies governing the number

of purchase cards to be issued with a focus on minimizing the number of
cardholders. In addition, the Naval Supply Systems Command guidance
implementing the Department's "Span of Control Goals" merely restates DOD?s
guideline that approving officials should have no more than five to seven
cardholders under their purview- it does not provide specific guidance for
reducing the number of cardholders.

DOD also stated that the criteria for employees being issued purchase cards
should be a function of mission requirements and the level of trust between
the cardholder and supervisor. Further, DOD stated that the Navy believes
the supervisor's judgment is sufficient as to the trustworthiness of the
employee to obligate on the part of the government. We continue to believe
that DOD should assess the feasibility and cost benefit of performing credit
checks on employees prior to issuing a purchase card.

Individuals who have a history of personal credit problems are more likely
to improperly use their government purchase cards if their access to
personal credit has been limited. In fact, our review of the Navy purchase
card fraud cases discussed in our testimony shows this to be true for at
least one of the cases. Further, as discussed in our testimony, we
identified several cases of potentially fraudulent, improper, and abusive
transactions

at both the SPAWAR Systems Center San Diego and the Navy Public Works Center
San Diego that had been certified as proper for payment. We are continuing
to investigate several of these cases as part of our follow- up work and
plan to assess the correlation between fraudulent, abusive, and improper use
of the government purchase card and cardholders who have personal credit
problems.

Criteria on the Types of DOD stated that it is the responsibility of the
local Navy commands to Items That Can Be Acquired establish written policies
and procedures and ensure that purchases are

Using a Purchase Card made for official use, meet mission requirements, and
are made at a fair and reasonable price. DOD also stated that due to
differing and unique

mission requirements throughout the Navy, it is difficult to develop a
general listing of what items can be purchased with or without special
justification. For example, DOD stated that ticket purchases to Disneyland

may be an appropriate purchase not requiring special justification within a

?Non- Appropriated Funded activity,? but may require such documentation for
an ?Appropriated Funded activity.? We continue to believe there is a need
for Navy- wide guidance in the form

of written policies and criteria requiring documented justifications and
procurement management approval for types of items can be acquired with a
government purchase card. For example, we found some instances where
employees were buying flat panel monitors costing from $800 to $2, 500 each
while others were buying traditional monitors costing about $300 each. In
addition, at SPAWAR, we found that employees made abusive purchases of high-
cost personal items, including two designer brief cases

costing about $400 each and several designer palm pilot cases costing about
$100 each. In these instances, the decision of what to buy and the quality
of the items purchased often appeared to be a matter of cardholder
preference. Further, the fact that such purchases were not questioned
supports our recommendation that specific written guidelines be established
for purchases of these types of items. DOD?s example of the purchase of
tickets for Disneyland is another example of the type of

purchase card use that should be specifically addressed in the NAVSUP
Instruction 4200. 94 to avoid misuse of the card and abusive purchases.
Establishing criteria for determining the propriety of purchases of highcost
items and prohibiting the purchase of personal preference items, such as
designer brief cases and designer palm pilot cases, would help prevent
abusive purchases in the future and avoid unnecessary federal

expenditures. Propriety of Buying Food

DOD stated that the present language in the policy section of NAVSUP and
Flowers Using a

Instruction 4200. 94 provides clear guidance on the propriety of buying food
Purchase Card

and flowers using the purchase card. We disagree. The policy section of
NAVSUP Instruction 4200.94 merely states that the ?purchase card shall only
be used for authorized U. S. Government purchases.? We found numerous
potentially fraudulent, improper, and abusive purchases that had been
approved by supervisors as authorized government purchases. The

Federal Acquisition Regulation (FAR), 48 C. F. R. 13.301( a), states that
the Governmentwide Commercial Purchase Card "may be used only for purchases
that are otherwise authorized by law or regulations." Therefore,

a procurement using the purchase card is lawful only if it would be lawful
using conventional procurement methods. Further, the Treasury

Financial Manual (TFM) 3 requires agencies to establish guidance on approved

uses of the government purchase card and limitations on types of
transactions permitted. The NAVSUP Instruction 4200.94 policy statement does
not address these specific purchase card requirements of the FAR or the TFM.

As stated in our testimony, without statutory authority, appropriated funds
may not be used to furnish meals or refreshments to employees within their
normal duty stations. 4 Free food and other refreshments normally cannot be
justified as a necessary expense of an agency's appropriation because these
items are considered personal expenses that federal employees should pay for
from their own salaries. 5 Likewise, appropriated funds may not be used to
purchase gifts for employees or others unless an agency can

demonstrate that the items further the purposes for which the appropriation
was enacted. 6 The purchase of the flowers and food were both personal
rather than official in nature and, therefore, may not be paid for with
appropriated funds. Given the problems we found, clarifyng the current
guidance on the propriety of purchasing food, flowers, and similar

personal items could help reduce improper purchase card use for these items.

Consequences for DOD stated that the present language in the NAVSUP
Instruction 4200.94 Noncompliance With policy section clearly identifies the
consequences for fraud, abuse, and

Purchase Card Controls misuse of the purchase card. We disagree. The policy
section of the

NAVSUP Instruction only states that deliberate misuse of the purchase card
may be prosecuted as fraud. It does not identify any specific consequences
for failure to follow control requirements, such as the failure to (1)
obtain independent documentation of receipt and acceptance of goods and

services, (2) notify property book officers of accountable items acquired
with a purchase card, (3) properly certify purchase card statements for
payment, and (4) comply with prohibitions on certain purchases and split
transactions. Our work identified pervasive failures to follow established
controls in these and other areas. To ensure that the Navy's purchase card

3 TFM Volume 1, Part 4, Chapter 4500, "Government Purchase Cards." 4 72
Comp. Gen. 178, 179 (1993); 65 Comp. Gen. 508, 509 (1986). 5 65 Comp. Gen.
738, 739 (1986). 6 B- 260260, December 28, 1995; 70 Comp. Gen. 248 (1991).

controls are effective, it is critical that the Navy enforce those controls
by establishing specific disciplinary consequences- such as removal of
cardholder status, reprimands, suspension from employment for several days,
and firing- for those employees who fail to follow established controls even
if their action does not amount to fraud against the United States. Unless
cardholders and approving officials are held accountable for

following key internal controls, the Navy is likely to continue to
experience the types of fraudulent, abusive, and improper transactions
identified in our work.

As agreed with your offices, unless you announce the contents of this report
earlier, we will not distribute this report until 30 days from its date. At
that time, we will send copies of this report to the Secretary of Defense,
the Under Secretary of Defense (Acquisition, Technology, and Logistics), the
Director of the Department?s Purchase Card Joint Program Management Office,
the Under Secretary of Defense (Comptroller), the Secretary of the Navy, the
Navy Comptroller, the Commander of the Naval Supply Systems Command, the
Commander of the Space and Naval Warfare Systems Command, the Commanding
Officer of the Space and

Naval Warfare Systems Command?s Systems Center in San Diego, the Commander
of the Navy Public Works Center, the Commanding Officer of the Navy Public
Works Center in San Diego, and the Director of the

Defense Finance and Accounting Service. We are also sending copies to the
Chairman of the Senate Committee on Finance; the Chairman and Ranking
Minority Member of the Senate Committee on Governmental Affairs; the
Chairman and Ranking Minority Member of the House Committee on Government
Reform; the Ranking Minority Member of the Subcommittee on Government
Efficiency, Financial Management, and Intergovernmental Relations, House
Committee on Government Reform; other interested congressional committees;
and the Director of the Office

of Management and Budget. Copies will be made available to others upon
request.

Please contact Gregory D. Kutz at (202) 512- 9095 or kutzg@ gao. gov, Robert
H. Hast at (202) 512- 7455 or hastr@ gao. gov, or Gayle Fischer, Assistant
Director at (202) 512- 9577 or fischerg@ gao. gov, if you or your staff have
any questions concerning this report. Major contributors to this work are
acknowledged in appendix III.

Gregory D. Kutz Director Financial Management and Assurance

Robert H. Hast Managing Directors Office of Special Investigations

Testimony on Purchase Card Control

Appendi x I

Weakness at Two Navy Units United States General Accounting Office

GAO Testimony Before the Subcommittee on Government Efficiency,

Financial Management and Intergovernmental Relations, Committee on
Government Reform, House of Representatives

For Release on Delivery Expected at 10 a. m.

PURCHASE CARDS Monday, July 30, 2001 Control Weaknesses Leave

Two Navy Units Vulnerable to Fraud and Abuse

Statement of Gregory D. Kutz Director, Financial Management and Assurance

Statement of Robert H. Hast Managing Director, Office of Special
Investigations

GAO- 01- 995T

Mr. Chairman, Members of the Subcommittee, and Senator Grassley: Thank you
for the opportunity to discuss Department of Defense (DOD) internal controls
and accounting practices for purchase card transactions and payments. DOD
reported that it used purchase cards- MasterCard or VISA cards issued to its
civilian and military personnel- for more than 10

million transactions valued at $5. 5 billion in fiscal year 2000. DOD has
increased the use of purchase cards with the intention of eliminating the
bureaucracy and paperwork long associated with making small purchases and
intends to expand the use of purchase cards over the next several years.
Given the rapid growth of purchase card use at DOD, ensuring that key
controls are in place over the program is critical to protecting the

government from fraud, waste, and abuse. We began looking into this issue at
the request of Senator Grassley, who was concerned about internal control
weaknesses that may have contributed to reports of purchase card fraud
related to Navy programs based in San Diego, California. As a result, we
agreed to obtain and review DOD fraud case information related to Navy
purchase card programs in the San Diego area and to review purchase card
controls and accounting for two Navy units based in San Diego- the Space and
Naval Warfare Systems Command (SPAWAR) Systems Center and the Navy Public
Works Center. 1 Further background information on the Navy purchase card
program is included in appendix I.

Today, I will discuss the results of our review of Navy purchase card
controls, including (1) the purchase card control environment at the two
Navy units? San Diego activities and overall management issues that affect
the Navy- wide purchase card program, (2) the results of our test work on
statistical samples of purchase card transactions at the two Navy units,

which identified control weaknesses in four critical areas, and (3)
potentially fraudulent, improper, and abusive transactions made by the two
Navy units. Some of these transactions are similar to those involved in five
specific fraud cases related to Navy programs based in San Diego that had
been identified at the time of our work. Information on the five fraud cases

is presented in appendix II. 1 SPAWAR and the Navy Public Works Center are
working capital fund activities. SPAWAR performs research, engineering, and
technical support, and the Navy Public Works Center provides maintenance,
construction, and operations support to Navy programs. Both of these Navy
programs have locations throughout the United States. Our review focused on
the purchase card program at the San Diego units only.

Page 1 GAO- 01- 995T Navy Purchase Card Controls

Summary The two Navy units we reviewed had a significant breakdown in
internal controls over the $68 million in fiscal year 2000 purchase card
transactions that we tested, leaving SPAWAR San Diego and the Navy Public
Works Center San Diego vulnerable to fraudulent, improper, and abusive
purchases and theft and misuse of government property. The problems we found
with the use of purchase cards by these two Navy units resulted from a weak
overall internal control environment, flawed or nonexistent policies and
procedures, and a lack of adherence to valid policies and procedures. Within
this poor control environment, these two units had given purchase cards to
over 1, 700 employees, most of whom had credit limits of $20,000 or more and
contracting officer authority to make their own purchase decisions.

We found a weak overall internal control environment, including four key
weaknesses that contributed to the ineffective controls, particularly at
SPAWAR San Diego. First, neither SPAWAR San Diego nor the Navy Public Works
Center San Diego had effective policies over the issuance of

purchase cards, with any employee having supervisor approval able to get a
card. As a result, we found a proliferation of the authority to procure
goods and services, with 1, 526 SPAWAR San Diego employees (36 percent) and

254 Navy Public Works Center San Diego employees (16 percent) holding
purchase cards as of September 30, 2000. This purchase card proliferation
resulted in a virtually impossible span of control issue at SPAWAR San Diego
with only one approving official responsible for certifying summary billing
statements covering 700 monthly purchase card statements for the 1,526
purchase cardholders. Second, we found deficient policies for rebate
management, including a lack of procedures to maximize rebates and ensure
that bank calculations of rebates were correct. Consequently, we

found rebates were not maximized and errors in rebate calculations by the
bank went undetected. Third, we determined that nearly half of SPAWAR?s
fiscal year 2000 purchase card transactions and over half of the Navy Public
Works Center?s transactions were made by employees who did not have
documented evidence of timely training, which is required by the Navy?s
purchase card instruction. Fourth, we found that management was not
effectively utilizing internal reviews and audits to determine whether
purchase card internal controls were being effectively implemented. In fact,
we found evidence that SPAWAR management ignored internal review

results that demonstrated some of the serious problems discussed in this
testimony, primarily because of complaints from cardholders and their
supervisors regarding the administrative burden associated with procedural
changes that would be needed to address the review findings.

Page 2 GAO- 01- 995T Navy Purchase Card Controls

With the ineffective overall internal control environment, it is not
surprising that the three basic internal controls we tested-( 1) independent
documented receipt and acceptance of goods and services, (2) independent
documented certification of monthly purchase card statements, and (3) proper
and timely allocation of costs to customer accounts- were ineffective. We
found that the primary problem with the controls was that employees simply
did not follow them. In addition, we found that easily pilferable or
sensitive items in our sample, which are accountable property, were not
recorded in property records. Specifically, our tests of SPAWAR

and Navy Public Works Center fiscal year 2000 purchase card transactions
that included accountable property, the two units failed to record one or
more items in their property records for nearly all of the purchase card
transactions that included accountable property. Further, when we

analyzed the property items included in our sampled transactions, we found
that SPAWAR San Diego and the Navy Public Works Center San Diego did not
record 46 of the 65 accountable items included in our samples in their
property records, as required by Navy policies. Moreover,

when we asked to inspect these items, the two units could not provide
conclusive evidence that 31 of them- including laptop computers; personal
digital assistants (PDAs), such as Palm Pilots; and digital cameras- were in

the possession of the government. For example, for four items, the serial
numbers of the property we were shown did not match purchase or manufacturer
documentation. We were also told that five items were at other Navy
locations throughout the world. SPAWAR and the Public Works Center officials
were unable to conclusively demonstrate the existence and location of these
five items. We were unable to conclude whether any of these 31 pieces of
government property were stolen, lost, or being misused.

Weak internal controls contributed to five recent cases of alleged purchase
card fraud related to Navy units in the San Diego area, including two
involving Navy Public Works Center employees. One case has been successfully
prosecuted, while the remaining four cases are still under investigation.
All five of these purchase card fraud cases, which so far total over
$660,000 in known and potential fraud, involved numerous purchases made over
a period of several months to more than 2 years. Items that were purchased
for personal use in these cases included home improvement items from The
Home Depot, numerous items from Wal- Mart, laptop

computers, Palm Pilots, DVD players, an air conditioner, clothing, jewelry,
and other items such as eyeglasses, pet supplies, and pizza. The control
breakdowns related to the frauds were so pervasive that the total dollar
amount of these frauds could not be determined.

Page 3 GAO- 01- 995T Navy Purchase Card Controls

One of the ongoing Navy purchase card fraud cases involved the compromise of
as many as 2,600 purchase card accounts assigned to Navy activities in the
San Diego area. Navy investigators were only able to obtain

a partial list consisting of 681 compromised accounts so the exact number is
not known. Although the account numbers showed up on a computer printer at a
community college library in San Diego in September 1999, the Navy has not
canceled all of the compromised accounts. Navy investigators estimated that
as of January 2001, at least 30 of the compromised account numbers were used
by 27 alleged suspects to make more than $27, 000 in fraudulent transactions
for pizza, jewelry, phone calls, tires, and flowers. However, with the lack
of controls over receipt of goods and services and proper certification of
purchase card statements for payment that we identified at the two units, it
will be difficult, if not impossible, for the Navy to identify fraudulent
purchases as they occur, or to determine the extent of the fraudulent use of
compromised accounts. As of May 21, 2001, we

identified 22 compromised SPAWAR San Diego purchase card accounts on the
partial listing that were still open. The financial exposure related to
credit limits associated with the 22 accounts was $900,000 per month. There
were no active Navy Public Works Center San Diego accounts on the partial
listing. The specific internal control weaknesses at the two activities we
reviewed

contributed to additional purchases that we believe are potentially
fraudulent, improper, or abusive. The abusive and improper purchases relate
primarily to SPAWAR San Diego and include items where the purchase was at an
excessive cost, or of questionable government need, or

both. For example, we found purchases for flat panel computer monitors
costing from about $800 to $2,500 each, compared to standard GSA schedule
monitors costing about $300 each. In addition, we found routine purchases
without documented government need, including personal digital assistants,
such as Palm Pilots, as well as purchases of $100 designer Palm Pilot
carrying cases and a $400 Coach leather briefcase. Navy Public Works Center
San Diego also had numerous PDA purchases. However, neither unit had
documented policies and procedures to support the valid

government need for these types of items. We also found unauthorized,
potentially fraudulent purchases of personal items, including cosmetics,
gift certificates, and clothing at both SPAWAR San Diego and the Navy Public
Works Center San Diego. Our Office of Special Investigations is conducting a
further investigation of the potentially fraudulent transactions identified
during this review. Further, we identified a number of purchases made on the
same day from the same vendor, which appeared to circumvent cardholder
single transaction limits.

Page 4 GAO- 01- 995T Navy Purchase Card Controls

Following this hearing, we plan to issue a report that will summarize the
results of our review and make specific recommendations for corrective
action.

Scope and We conducted our audit work from August 2000 through June 2001 in
Methodology accordance with generally accepted U. S. government auditing
standards,

and we performed our investigative work in accordance with standards
prescribed by the President?s Council on Integrity and Efficiency. We
briefed DOD managers, including officials in DOD?s Purchase Card Program
Management Office and the Defense Finance and Accounting Service (DFAS), and
Navy managers, including Navy Supply Command, Navy Comptroller, SPAWAR San
Diego, and Navy Public Works Center San

Diego officials on the details of our review, including our objectives,
scope, and methodology and our findings and conclusions. We referred
instances of potentially fraudulent transactions that we identified during
our work to our Office of Special Investigations for further investigation.
Our work was

not designed to identify, and therefore we did not determine, the extent of
fraudulent, illegal, or abusive transactions. Our control tests were based
on stratified random probability samples of 135 SPAWAR San Diego purchase
card transactions and 121 Navy Public Works Center San Diego transactions.
Further details on our objectives, scope, and methodology are included in
appendix III.

Weak Purchase Card Environment

Management and emplo ees should establish and maintain an environment
throughout the organization that sets a positive and supportive attitude
toward

Contributed to

internal control and conscientious management. A positive control
environment is the foundation for all other standards. It provides
discipline and structure as

Ineffective Controls

well as the climate which influences the quality of internal control. GAO s
Standards or Internal Control in the Federal Government ( GAO/ AIMD- 00- 21.
3.1, November 1999)

A weak internal control environment at SPAWAR San Diego and the Navy Public
Works Center San Diego contributed to internal control weaknesses, fraud,
and abuse. The importance of the ?tone at the top? or the role of management
in establishing a positive internal control environment cannot be
overstated. GAO?s internal control standards go on to state that,
?management plays a key role in demonstrating and maintaining an
organization?s integrity and ethical values, especially in setting and

maintaining the organization?s ethical tone, providing guidance for proper
Page 5 GAO- 01- 995T Navy Purchase Card Controls

behavior, removing temptations for unethical behavior, and providing
discipline when appropriate.? The specific factors that contributed to the
lack of a positive control environment at these two units included a
proliferation of purchase cardholders, ineffective training of cardholders
and certifying officers, ineffective rebate management, and a lack of
monitoring and oversight.

Proliferation of Cardholders SPAWAR San Diego and the Navy Public Works
Center San Diego did not

Resulting in Unreasonable have specific policies governing the number of
cards issued or establishing Span of Control criteria for identifying
employees eligible for the privilege of cardholder status. At both units,
cards were given out on the basis of a request from an individual employee?s
supervisor. The request was then forwarded to the unit?s purchase card
agency program coordinator, who approved the request and began the process
for obtaining a new card from Citibank. According to SPAWAR and Navy Public
Works Center officials, specific criteria did not exist for either the
supervisors or the program coordinators to use in requesting and approving
purchase cards for employees. This

flawed policy has resulted in a proliferation of purchase cards at the two
units. For example, as of September 30, 2000, about one in three, or 36
percent of SPAWAR San Diego employees and about one in six, or 16 percent,
of Navy Public Works Center San Diego employees were

cardholders. As a result, at the end of fiscal year 2000, about 1, 526
SPAWAR San Diego employees and 254 Navy Public Works Center San Diego
employees were authorized to procure goods and services. Within this weak
control environment, these two Navy units had given purchase cards to over
1, 700 employees, most of whom had credit limits of $20,000 or more and the
authority to make their own purchase decisions. Table 1 shows the
proliferation of cardholders and the percentage of employees at SPAWAR and
the Navy Public Works Center in San Diego that were cardholders as of
September 30, 2000. Most of SPAWAR?s 1,526 cardholders had a $25, 000 credit
limit and most of the Navy Public Works

Center?s 254 cardholders had a $20,000 credit limit.

Page 6 GAO- 01- 995T Navy Purchase Card Controls

Table 1: Proliferation of Cardholders and Financial Exposure As of September
30, 2000 SPAWAR Nav Public Works Center

Number of cardholders 1, 526 254 Number of employees 4, 200 1, 600 Percent
of employees that were

36% 16% cardholders Credit limit of most cardholders $ 25,000 $ 20, 000

Information we obtained from six large defense contractors on their purchase
card programs showed that the percent of the contractors? employees that
were cardholders ranged from about 2 percent to nearly 4

percent- significantly less than at SPAWAR and the Navy Public Works Center
in San Diego.

The proliferation of cardholders, particularly at SPAWAR San Diego, created
a situation where it was virtually impossible to maintain a positive control
environment. For example, at SPAWAR, a significant span of control issue
existed, with one approving official responsible for certifying monthly
summary billing statements covering an average of over 700

monthly purchase card statements relating to 1,526 purchase cardholders. At
the Navy Public Works Center San Diego, the span of control problem was not
as serious, with six approving officials responsible for certifying monthly
summary statements covering an average of 55 monthly statements for 254
cardholders. The span of control issue is particularly important for
purchase cards because supervisors and, in some cases,

cardholders themselves, are responsible for authorizing purchases, rather
than an independent contracting officer as is the case under the standard
procurement process. Thus, the approving official serves as a key control in
certifying cardholder purchases.

Lack of Documented The lack of documented evidence of purchase card training
also Evidence of Training for contributed to a weak internal control
environment at SPAWAR and the

Cardholders and Approving Navy Public Works Center in San Diego. GAO?s
internal control standards

Officials emphasize that effective management of an organization?s
workforce- its

human capital- is essential to achieving results and is an important part of
internal control. Training is key to ensuring that the workforce has the
skills necessary to achieve organizational goals. In accordance with Navy
Supply Command (NAVSUP) Instruction 4200.94, all cardholders and approving
officials must receive purchase card training. Specifically,

Page 7 GAO- 01- 995T Navy Purchase Card Controls

NAVSUP Instruction 4200.94 requires that prior to the issuance of a purchase
card, all prospective cardholders and approving officials must receive
training regarding both Navy policies and procedures as well as local
internal operating procedures. Once initial training is received, the
Instruction requires all cardholders to receive refresher training every 2
years.

Although we found the training policies and procedures to be generally
adequate, we determined that SPAWAR and the Navy Public Works Center lacked
documentation to demonstrate that all cardholders and approving officials
had received the required training. Based on our tests of fiscal year 2000
purchase card transactions, we estimate that about 40 percent of the

SPAWAR transactions, totaling at least $6. 8 million, 2 and 56 percent of
the Navy Public Works Center transactions, totaling at least $10.9 million,
3 were made by cardholders for whom there was no documented evidence

that they had received either the required initial training or refresher
training on purchase card policies and procedures. SPAWAR San Diego
management contended that we should accept training

provided under the Navy?s previous purchase card program as meeting the
training requirements under the new program. Although we determined that the
policies and procedures related to cardholder responsibilities were
essentially the same under the previous Navy purchase card program, we found
that several cardholders had received the prior training as many as 2

years to 6 years before the current program began. Therefore, these
cardholders had not received the required biennial refresher training. The
Navy Public Works Center San Diego had no documented evidence that its
cardholders had received any purchase card training prior to March 2000.

We also found no documented evidence that two of six Navy Public Works
Center approving officials had received training on purchase card policies 2
The range of our confidence interval, at a 95- percent confidence level,
indicates that between 30 percent and 51 percent of the SPAWAR?s fiscal year
2000 purchase card transactions totaling between $6. 8 million and $16. 4
million were made by cardholders for

whom there was no documented evidence that required training was received. 3
The range of our confidence interval, at a 95- percent confidence level,
indicates that between 44 percent and 68 percent of the Navy Public Works
Center?s fiscal year 2000 purchase card transactions totaling between $10. 9
million and $26.3 million were made by cardholders for whom there was no
documented evidence that required training was received.

Page 8 GAO- 01- 995T Navy Purchase Card Controls

and procedures prior to assuming certifying officer responsibilities.
SPAWAR?s one approving official had received all required training.

Purchase Card Rebates Not We found ineffective management of purchase card
rebates 4 by the Navy,

Effectively Managed SPAWAR San Diego, and the Navy Public Works Center San
Diego. The

Navy requested that Citibank defer payment of all of the purchase card
rebates it earned since the current purchase card program began in November
1998 because, according to DOD and Navy officials, it had not yet determined
how to record and allocate the rebates to Navy programs.

According to Citibank officials, Citibank plans to pay cumulative purchase
card rebates and accrued interest to the Navy on July 31, 2001, the payment
date required in the Navy?s latest purchase card contract task order
modification. Citibank estimates that the total payment will be about $8. 8
million, including an estimated $8.3 million in cumulative rebates and an
estimated $530, 000 in accrued interest on these rebates. In addition, the
Navy had not established policies and procedures for managing rebates and
had not monitored its rebate earnings. As a result, the Navy, SPAWAR San
Diego, and the Navy Public Works Center San Diego were not aware that
Citibank had miscalculated the rebates that SPAWAR and the Navy Public

Works Center should have earned during fiscal year 2000 by about $150,000.
Specifically, the rebates due SPAWAR were understated by $136,760, while the
Navy Public Works Center?s rebates were overstated by $12,039.

Further, SPAWAR and Navy Public Works Center managers were not effectively
managing purchase card payments to maximize the amount of rebates earned. We
determined that delays in the receipt of monthly purchase card statements
had precluded the opportunity for these two units to earn another $242,000
in fiscal year 2000 rebates. We do not know the extent to which these
factors have adversely impacted the Navy?s total fiscal year 2000 purchase
card rebates.

Program Monitoring and SPAWAR and the Navy Public Works Center in San Diego
had not Audit Function Not

established an effective monitoring and internal audit function for the
Effective purchase card program. Further, the Navy?s purchase card policies
and

procedures did not require that the results of internal reviews be 4 Under
the Navy?s purchase card contract task order with Citibank, the Navy earns
rebates (refunds) of up to 0. 8 percent based on sales volume (payments) and
payment timeliness.

Page 9 GAO- 01- 995T Navy Purchase Card Controls

documented or that corrective actions be monitored to help ensure that they
are effectively implemented. NAVSUP Instruction 4200.94 calls for agency
program coordinators 5 to perform semiannual reviews of their units?
purchase card program, including adherence to internal operating procedures,
applicable training requirements, micro- purchase procedures, receipt and
acceptance procedures, and statement certification and prompt payment
procedures. Further, these reviews are to serve as a basis for agency
program coordinators to initiate appropriate action to improve the local
program or correct problem areas. However, the Instruction does not require
written

reports on the results of internal reviews to be submitted to either local
management or a central Navy office for monitoring and oversight. As a
result, the Navy did not have a consistent process for documenting the
results of purchase card reviews, identifying systemic problems, and
monitoring corrective actions to help ensure that they are effectively
implemented. This weakness also impaired the Navy?s ability to assess
purchase card controls for possible inclusion in its Annual Statements of

Assurance pursuant to 31 U. S. C. 3512( d) (commonly referred to as the
Federal Managers? Financial Integrity Act of 1982), which requires agency
heads to make annual disclosures regarding the adequacy of their internal
controls. The Secretary of the Navy?s fiscal year 2000 Annual Statement of
Assurance did not disclose any control weaknesses related to the purchase

card program. Our analysis of SPAWAR San Diego Agency Program Coordinator
fiscal year 2000 reviews showed that these reviews identified problems with
about 42 percent of the monthly cardholder statements that were reviewed.
The problems identified were consistent with the control weaknesses
discussed later in this testimony, including lack of independent

documentation that the Navy received items ordered by purchase card,
accountable items that were not recorded in the property records, inadequate
documentation for transactions, split purchases, and transactions that did
not appear to be related to government business purposes.

5 NAVSUP Instruction 4200.94 authorizes agency program coordinators to
administer the purchase card program within their designated units and to
serve as the communication link between the purchase card issuing bank and
their unit, establish credit limits, issue cards to Navy employees, and
administer the purchase card program.

Page 10 GAO- 01- 995T Navy Purchase Card Controls

During our review, we saw correspondence and other documentation showing
that SPAWAR San Diego management had considered the findings identified in
its agency program coordinator evaluations, but directed that corrective
actions should not be implemented due to complaints from cardholders and
their supervisors regarding the administrative burden associated with
procedural changes that would be needed to address the review findings. As a
result, the agency program coordinator had not used these reviews to make
systematic improvements in the program. Rather, these reviews generally
resulted in the reviewer counseling the cardholders

or, in some instances, recommending that cardholders attend purchase card
training. During fiscal year 2000, the SPAWAR San Diego Office of Command
Evaluation internal review group had not conducted any reviews or audits of
the purchase card program. Further, although the SPAWAR San Diego Command
Inspector General 6 reviewed the SPAWAR purchase card program during fiscal
year 2000 and prepared a draft report summarizing the results of this
review, the final report has not yet been issued. Our review of the draft
report determined that the Command IG identified a

number of internal control problems that are consistent with our findings,
including issues related to receipt and acceptance, training, and split
purchases.

The Navy Public Works Center San Diego purchase card agency program
coordinator did not perform any systematic reviews of the program during
fiscal year 2000. He told us that his monitoring efforts consisted of
scanning some monthly invoices for duplicate payments, split purchases,

and other suspicious payments. However, he did not document these actions.
Further, the Public Works Center internal review group in the Office of
Command Evaluation did not perform any reviews during fiscal year 2000.
However, Navy Public Works Center managers told us that they asked the Naval
Audit Service to review the Center?s purchase card program during fiscal
year 2000 because of concerns about the growth of the program, the adequacy
of internal controls, and recent instances of fraud. Although the Naval
Audit Service completed its fieldwork in

November 2000 and briefed Navy Public Works Center San Diego management on
its findings, the results of that effort have yet to be

6 The SPAWAR Command Inspector General organization is an internal review
unit under the Navy Department?s Inspector General and is not a part of the
DOD Inspector General?s Office. As part of the Navy Inspector General
organization, the SPAWAR Command Inspector General makes inquiries and
reports on matters affecting military efficiency or discipline, proposes and
executes inspections, and cooperates with the DOD Inspector General.

Page 11 GAO- 01- 995T Navy Purchase Card Controls

externally reported. According to the Navy?s Deputy Assistant Auditor
General, the Naval Audit Service plans to finalize its work and issue a
report in the fall of 2001.

Breakdown of Critical Basic internal controls over the purchase card program
were ineffective at Internal Controls

the two units we reviewed. Based on our tests of statistical samples of
purchase card transactions, we determined that the three transaction- level
controls that we tested were ineffective, rendering SPAWAR San Diego and
Navy Public Works Center San Diego purchase card transactions vulnerable to
fraudulent and abusive purchases and theft and misuse of government
property. As shown in table 2, the specific controls that we tested were (1)
independent, documented receipt and acceptance of goods and services, (2)
independent, documented certification of monthly purchase card statements,
and (3) proper accounting for purchase card transactions.

Table 2: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests
Breakdowns in ke purchase card controls a Independent, documented receipt
Proper pa ment certification Timel customer accounting

Percent Projection

Percent Projection

Percent Projection

Navy Units in San Diego, CA failure ( millions) failure ( millions) failure
( millions)

SPAWAR 65% $ 14.5 100% b $ 38 b 83% $ 20. 4 Navy Public Works Center 47% $
12.9 100% b $ 30 b 35% $ 11. 2

a The numbers represent point estimates for the population based on our
sampling tests. The confidence intervals for our sampling estimates are
presented in appendix III of this testimony b All seven approving officials
with certifying officer responsibilities told us that they did not review
support for transactions before certifying purchase card statements for
payment

In addition, we tested whether the accountable items- easily pilferable or
sensitive items- included in some of the transactions in our samples were
recorded in the units? property records to help prevent theft, loss, and
misuse of government assets. Our tests of SPAWAR and Navy Public Works
Center fiscal year 2000 purchase card transactions that included

accountable property items, showed that the two units failed to record one
or more accountable items in their property records for nearly all of these
transactions. Further, when we analyzed the property items included in our
sampled transactions, we found that SPAWAR and the Navy Public Works Center
did not record 46 of the 65 accountable items included in our

Page 12 GAO- 01- 995T Navy Purchase Card Controls

sampled transactions in their property records. Moreover, when we asked to
inspect these items, the two units could not provide conclusive evidence
that 31 of them, including laptop computers, Palm Pilots, and digital
cameras, were in the possession of the government.

Lack of Independent Documented Receipt and

Key duties and responsibilities need to be divided or segregated among
different

Acceptance

people to reduce the risk of error or fraud. This should include separating
the responsibilities for authorizing transactions, processing and recording
them, reviewing the transactions, and handling any related assets. Simpl
put, no one individual should control all the key aspects of a transaction
or event. GAO s Standards or Internal Control in the Federal Government (
GAO/ AIMD- 00- 21. 3.1,

November 1999)

SPAWAR San Diego and the Navy Public Works Center San Diego generally did
not have independent, documented evidence that they received items ordered
by purchase card. That is, they generally did not have a receipt for the
acquired goods and services that was signed by someone other than the
cardholder. As a result, there is no documented evidence that the government
received the items purchased or that those items were not lost, stolen, or
misused. NAVSUP Instruction 4200. 94 generally requires segregation of
duties between the individual making the purchase and the

individual responsible for documenting receipt and acceptance of goods and
services acquired by purchase card. However, employees at the two units were
not following these procedures. In some instances employees were following
an alternative procedure permitted by the NAVSUP Instruction whereby
independent authorization of a purchase order can be substituted for
independent confirmation of receipt of the items purchased.

However, the alternative procedure does not provide any assurance that the
items ordered and paid for were received.

Page 13 GAO- 01- 995T Navy Purchase Card Controls

Based on our test work, we estimate that SPAWAR San Diego did not have
independent, documented evidence to confirm the receipt and acceptance of
goods and services acquired with the purchase card for about 65 percent 7 of
its fiscal year 2000 transactions totaling at least $10. 1 million.

For the Navy Public Works Center San Diego, we estimated that 47 percent 8
of its fiscal year 2000 purchase card transactions totaling at least $6. 6
million did not include independent, documented receipt of goods and
services.

The types of items in our sampled transactions that lacked independent
evidence of receipt and acceptance included computers, monitors, and compact
disk writers that were purchased at stores such as Byte and Floppy Computer,
Dell Computer, and CompUSA. Further, during fiscal year 2000, SPAWAR and the
Navy Public Works Center in San Diego made over 2,000 transactions totaling
over $468,000 for items from The Home Depot, Best Buy, Circuit City, and
Wal- Mart. Our review of the five purchase

card fraud cases related to Navy activities based in San Diego, discussed in
appendix II, showed that fraudulent purchases had been made to acquire items
for personal use from these same stores. Because the Navy purchases items
for valid, government purposes from stores that are widely used by consumers
to acquire items for personal use, verification of receipt of goods and
services by an individual other than the cardholder is necessary to reduce
the risk of fraudulent transactions.

Lack of Proper Certification of Monthly Purchase Card Transactions and other
significant events should be authorized and executed onl Statements

b persons acting within the scope of their authority. This is the principal
means of assuring that onl valid transactions to exchange, transfer, use, or
commit resources and other events are initiated or entered into. GAO s
Standards or Internal Control in the Federal Government ( GAO/ AIMD- 00-
21.3. 1, November 1999)

7 The range of our confidence interval, at a 95- percent confidence level,
indicates that the population estimate of SPAWAR purchase card transactions
that lacked independent confirmation of receipt of goods and services
purchased was between 55 percent and 75 percent and totaled between $10. 1
million and $18.9 million. 8 The range of our confidence interval, at a 95-
percent confidence level, indicates that the population estimate of Navy
Public Works Center purchase card transactions that lacked independent
confirmation of receipt of goods and services purchased was between 35
percent and 59 percent and totaled between $6. 6 million and $19.2 million.

Page 14 GAO- 01- 995T Navy Purchase Card Controls

We assessed a 100- percent failure rate at both units for this critical
control. NAVSUP Instruction 4200.94 and, to a greater extent, a policy
memorandum issued by the Navy Comptroller?s office on June 3, 1999, do not
provide adequate internal controls and are inconsistent with the
responsibilities of certifying officers reflected in statutes and DOD?s
fiscal policy guidance. Approving officials at the two units told us that
they were not following the existing procedures due to time constraints and
the Navy

Comptroller?s policy memorandum. Under 31 U. S. C. 3325 and DOD?s Financial
Management Regulation, 9 disbursements are required to be made on the basis
of a voucher certified by an authorized agency official. The certifying
official is responsible for ensuring (1) the adequacy of supporting
documentation, (2) the accuracy of payment calculations, and (3) the
legality of the proposed payment under the appropriation or fund charged.
Proper certification of bills for payment is a preventive control that
requires and provides the incentive for

certifying officers to maintain proper controls over public funds. It also
helps detect fraud and improper payments, including invalid (unsupported or
prohibited) transactions, split purchases, and duplicate payments. Further,
section 933 of the National Defense Authorization Act for Fiscal Year 2000
requires the Secretary of Defense to prescribe regulations that ensure,
among other things, that each purchase cardholder and approving official is
responsible for reconciling charges on a billing statement with receipts and
other supporting documentation.

According to NAVSUP Instruction 4200.94, upon receipt of the individual
cardholder statement, the cardholder has 5 days to reconcile the
transactions appearing on the statement by verifying their accuracy to the
supporting documents and notify the approving official in writing of any

discrepancies in the statement or sign and forward it to the approving
official. The approving official is responsible for ensuring that all
purchases made by the cardholders within his or her cognizance were
appropriate and that the charges are accurate. However, the Instruction
further states that within 5 days of receipt of the cardholders? statements,
the approving official must review and certify the monthly summary statement
for payment, whether or not the cardholder has reviewed the statement and

notified the official of any discrepancies or agreement with the statement.
That is, the approving official is to presume that all transactions on the

9 DOD Financial Management Regulation, Volume 5, Chapter 33, ?Accountable
Officials and Certifying Officers."

Page 15 GAO- 01- 995T Navy Purchase Card Controls

monthly statements are proper unless notified in writing by the purchase
cardholder.

Under this process, the certifying officer relies upon the silence of a
cardholder who may have failed to timely forward corrections or exceptions
to the account statement or, even worse, may not have even reviewed the
statement. A certifying officer in these circumstances is not taking steps
to assure that a payment is proper and an agency therefore

cannot rely on the certification for assurance that a payment is for the
proper amount and a legal purpose. This NAVSUP policy is inconsistent with
the purpose of certifying vouchers

prior to payment, which is to maintain proper control over public funds and
assure that payments are made for proper amounts and purposes. Certifying
officers are responsible for the correctness of facts and computations in
the voucher, and the legality of the proposed payment under the
appropriation involved. A certifying officer is liable for losses resulting
from improper certifications, but may be relieved from liability if the
certification was based upon official records and the officer did not know,
and could not have reasonably discovered, the correct information.

While certifying officials may rely on systems, controls, and personnel that
process transactions rather than personally reviewing the supporting
documentation, they must show that their reliance was reasonable. Regardless
of what system is used, there is no authority to make known improper
payments. At SPAWAR and the Navy Public Works Center, the certifying
officers relied on a process without assurances that even a

minimal review of the facts and computations underlying the proposed payment
or the legality of such payment was carried out before certification was
made. Thus, the certifying officers may not be able to demonstrate that
their reliance on such a system is reasonable.

In addition to the problems with NAVSUP Instruction 4200.94, the Navy
Comptroller?s June 3, 1999, policy memorandum further weakens the
certification process. The policy memorandum does not explicitly state that
the cardholder must review the statement of account and notify the approving
official of any improper or incorrect items within 5 days of receipt.
Nonetheless, the approving official must certify the invoices based

on the presumption that all cardholder accounts are proper unless notified
in writing within 5 days of receipt of the invoice. Navy officials told us
that it is assumed that cardholders would review the statements and notify
the approving officials of any problems. While the cardholder?s review is
not explicitly required, the memorandum states that the change in policy
?will Page 16 GAO- 01- 995T Navy Purchase Card Controls

ensure that the cardholder will inform the AO [approving official] in a
prompt manner of any duplicate payments or fraudulent or improper charges to
his account.? Again, by requiring certification within 5 days, whether or
not a cardholder has reviewed a statement, the June 3, 1999, policy
memorandum requires a certifying officer to rely upon a process that

does not require review of a proposed payment or otherwise assure that a
payment is properly payable before certification occurs. All seven approving
officials at the two activities (one at SPAWAR and six at the Navy Public
Works Center) told us that they never reviewed the cardholders? supporting
documentation before signing and submitting purchase card statements for
payment. Accordingly, we assessed the failure rate for this control as 100
percent for both SPAWAR San Diego and the Navy Public Works Center San
Diego. Approving officials explained

that they certify purchase card statements for payment without reviewing
cardholders? supporting documentation because (1) they do not have time to
review the documentation and (2) the Navy Comptroller?s June 3, 1999,

guidance relieves them of this responsibility. With regard to the first
issue, both activities are faced with a significant span of control issue
that makes the overall purchase card environment difficult, if not
impossible, to control. With an average of over 700 monthly cardholder
statements at SPAWAR San Diego and only one approving official- who is also
the Agency Program Coordinator- proper certification of monthly summary
statements within 5 days of receipt is not physically possible. Thus, the
SPAWAR San Diego approving official told us that the certification process
is largely a ?rubber stamp? with no real verification of the underlying
cardholder support for the monthly summary

statements. The environment is somewhat more manageable at the Navy Public
Works Center San Diego, with six approving officials charged with certifying
summary statements that cover an average of 55 cardholder statements each
month. However, Public Works Center approving officials also told us that
they did not review all cardholder supporting documentation before
certifying purchase card statements for payment. As a result, these two Navy
units paid their monthly purchase card bills

without knowing whether the charges were valid. As discussed later in this
statement, this has contributed to payments being made for unauthorized and
improper transactions.

Page 17 GAO- 01- 995T Navy Purchase Card Controls

With regard to the second issue, the June 3, 1999, policy memorandum appears
to improperly assign certifying officer accountability to cardholders. The
policy memorandum stated that because it is not possible for the approving
official to personally review and verify individual cardholder transactions
and statements of account, the approving official is to certify the purchase
card statements for payment based on the presumption that all cardholder
accounts are proper unless the approving official has been notified to the
contrary by the cardholder. The memorandum goes on to say that, ?[ T] his
new policy recognizes that the ultimate responsibility for purchases being
proper is with the cardholder.? However, under 31 U. S. C. 3528 and DOD?s
Financial Management

Regulation, certifying officers are liable for an illegal, improper, or
incorrect payment as a result of an inaccurate or misleading certification.
An agency may not shift certifying officer liability to other employees. 10
The policy memorandum is also inconsistent with GAO?s internal control
standard for ensuring that only valid transactions are entered into.
According to DOD and Navy officials, this policy memorandum has created
confusion about whether the cardholder or the approving official is
responsible for proper certification of purchase card statements for

payment. Problems in Proper Accounting for Purchase

Transactions should be promptl recorded to maintain their relevance and
value Card Transactions

to management in controlling operations and making decisions. This applies
to the entire process or life c cle of a transaction or event from the
initiation and authorization through its final classification in summar
records. GAO s Standards or Internal Control in the Federal Government (
GAO/ AIMD- 00- 21. 3.1,

November 1999)

10 31 U. S. C. 3528 and Comp. Gen. Decision on ?Department of Defense
Authority to Impose Pecuniary Liability by Regulation? (B- 280764, May 4,
2000).

Page 18 GAO- 01- 995T Navy Purchase Card Controls

The two units we reviewed did not have controls in place to ensure that
purchase card transactions were recorded to customer accounts in a timely
manner and that local accounting records reflected the proper classification
of expense. The timely and accurate recording of purchase card transactions
is important to ensure the reliability of data and information used in day-
to- day management and decision- making, particularly for working capital
fund activities such as SPAWAR and the Navy Public Works Center. We have
previously reported 11 that DOD has long- standing problems accumulating and
reporting the full costs

associated with its working capital fund operations. Recording Purchase Card
Costs

The two units did not always record purchase card costs to customer to
Customer Accounts

accounts within required time frames. Consistent with GAO?s internal control
standards and Statement of Federal Financial Accounting Standards (SFFAS),
No. 4, ?Managerial Cost Accounting Standards,? SPAWAR San Diego and Navy
Public Works Center San Diego operating

procedures require timely recording of purchase card costs to projects that
received the goods and services acquired by purchase card. This is an
important control because as working capital fund operations, SPAWAR and the
Navy Public Works Center are to provide their customers with information on
the full cost of goods and services provided- either through billing or
other information. Further, working capital fund activities are to operate
on a break- even basis over time- that is, not make a profit or incur a
loss. Accurate and timely recording of customer transactions are key to

ensuring that these working capital fund objectives are met. 11 Department
of Defense: Implications of Financial Management Issues (GAO/ TAIMD/ NSIAD-
00- 264, July 20, 2000). Page 19 GAO- 01- 995T Navy Purchase Card Controls

However, based on our tests of fiscal year 2000 purchase card transactions,
we estimate that 83 percent 12 of the SPAWAR transactions totaling at least
$15.3 million and an estimated 35 percent 13 of the Navy Public Works
transactions totaling at least $5 million had not been recorded to customer
or overhead accounts within 5 days of receipt of the purchase card

statements. 14 As time passes, the likelihood that documentation will be
available to properly record transactions decreases. For example, because
SPAWAR did not have the documentation to support timely and accurate
recording of purchase card transactions, it wrote off as a loss $657,642 in
fiscal year 2000 transactions that could not be identified to a specific job
order. Further, according to the SPAWAR Accounting Officer, as of the end

of fiscal year 2000, SPAWAR had a backlog of about $5.6 million in purchase
card transactions that had not been recorded to customer accounts or its own
overhead account. As a result of unrecorded transactions, year- end

data on actual overhead costs used to estimate future overhead rates for
billing purposes were unreliable. Navy Public Works Center San Diego
officials were unable to provide reliable information on the amount of
unrecorded purchase card transactions at the end of fiscal year 2000

because systems weaknesses rendered their fiscal year- end data incomplete
and unreliable.

12 The range of our confidence interval, at a 95- percent confidence level,
indicates that the population estimate of SPAWAR purchase card transactions
that were not recorded to customer accounts in a timely manner was between
74 percent and 90 percent and totaled between $15.3 million and $25. 5
million.

13 The range of our confidence interval, at a 95- percent confidence level,
indicates that the population estimate of Navy Public Works Center purchase
card transactions that were not recorded to customer accounts in a timely
manner was between 24 percent and 47 percent

and totaled between $5 million and $17.4 million. 14 For comparability, we
used a 5- day criteria for calculating timely recording of transactions to
customer and overhead accounts. Local SPAWAR San Diego policies and
procedures required purchase card transactions to be recorded within 3 days
and local Navy Public Works Center San Diego policies and procedures
required these transactions to be recorded within 5 days.

Page 20 GAO- 01- 995T Navy Purchase Card Controls

Classifying Purchase Card In addition to problems with timely and accurate
recording of transactions Costs by Object Class to customer accounts, SPAWAR
San Diego and the Navy Public Works

Center San Diego did not properly classify purchase card transactions in
their detail accounting records to show the nature and type of expenditures
made using purchase cards. Office of Management and Budget (OMB) Circular A-
11, Preparation and Submission of Budget Estimates, requires federal
agencies to report obligations and expenditures by object class,

such as salaries, benefits, travel, supplies, services, and equipment, to
indicate the nature of the expenditures of federal funds. Object
classification data are reported by appropriation in the President?s Annual

Budget Submissions to the Congress. OMB prepares summary reports of object
class data to support budget projections and other analyses. Accurate object
classification data are critical to the reliability of information reported
in the President?s budget submission and budget projections and other
analyses that are based on these data. In addition, because the Congress has
asked for and is using object class information for its oversight
activities, it is important that these data be properly recorded. We
previously reported 15 that inaccurate reporting by object class hampers
congressional oversight.

DOD Purchase Card Program Office guidance requires payments of monthly
purchase card statements to be recorded as summary records in the Navy?s
accounting systems and has directed that these summary records be recorded
to the object class for supplies and materials,

regardless of the nature of the expenses incurred. After purchase card
statements have been paid, SPAWAR San Diego and the Navy Public Works Center
San Diego are to record the individual transactions included in the summary
payment record in their local accounting records. However, we determined
that SPAWAR did not classify summary records related to payment of monthly
purchase card statements to any expense category in the Navy?s accounting
system and recorded all of the purchase card

transactions in our sample to object class 25, as services, in its local
accounting records. Consistent with DOD Purchase Card Joint Program
Management Office guidance, the Navy Public Works Center San Diego recorded
both the summary records related to payment of monthly purchase card
statements and the detailed transactions to object class 26, as supplies and
materials, in its local accounting system.

15 DOD Consulting Services: Erroneous Accounting and Reporting of Costs
(GAO/ NSIAD- 98- 136, May 18, 1998).

Page 21 GAO- 01- 995T Navy Purchase Card Controls

Because SPAWAR San Diego and the Navy Public Works Center San Diego did not
ensure that their detail transaction records reflected the proper
classification of expense, 100 percent of the SPAWAR and Navy Public Works
Center transactions in our samples were recorded to the wrong object class.
For example, although the majority of the SPAWAR purchase card transactions
in our sample- 76 transactions totaling over $73,000- were for equipment
purchases, none of these transactions were properly classified and recorded.
Further, SPAWAR did not maintain sufficient documentation to determine the
correct object class for 15 of the transactions in our sample totaling about
$12, 000. In addition, although the

Navy Public Works Center recorded all of the purchase card transactions in
our sample as supplies and materials, many of these transactions should have
been recorded as contractual services or equipment. Also, the Navy Public
Works Center did not maintain sufficient documentation to determine the
proper object class for nine of the transactions in our sample

totaling about $6, 000. Failure to Record Accountable Items in

An agency must establish ph sical control to secure and safeguard vulnerable
Property Records

assets. Examples include security for and limited access to assets such as
cash, securities, inventories, and equipment which might be vulnerable to
risk of loss or unauthorized use. Such assets should be periodicall counted
and compared to control records. GAO s Standards or Internal Control in the
Federal Government ( GAO/ AIMD- 00- 21.3. 1, November 1999)

Most of the accountable items- easily pilferable or sensitive items- in our
samples were not recorded in property records. Recording these items in the
property records is an important step to ensure accountability and

financial control over these assets and, along with periodic inventory, to
prevent theft or improper use of government property. Consistent with GAO?s
internal control standards, DOD?s Property, Plant, and Equipment
Accountability Directive and Manual, which was issued in draft for
implementation on January 19, 2000, and the Appropriation, Cost and

Property Accounting procedures (referred to as the NAVSOP 1000- 3M) issued
by DFAS Cleveland, 16 require accountable property to be recorded in
property records as it is acquired. Accountable property includes easily
pilferable or sensitive items, such as computers and related equipment,
cameras, cell phones, and power tools. The NAVSOP property procedures

16 NAVSOP 1000- 3M, Chapter 6, Part D, ?Plant Property and Other Navy
Property,? (previously referred to as NAVCOMPT, Volume 3).

Page 22 GAO- 01- 995T Navy Purchase Card Controls

require such property to be recorded in property records along with a
description of the item, property identification number, model and serial
number, manufacturer, acquisition cost, and the location or custodian of the
property. Based on our tests of fiscal year 2000 purchase card transactions
that included accountable property items, we estimate that SPAWAR did not
record all accountable items in its property records for about 84 percent 17
of its purchase card transactions, covering at least $5.4 million in
accountable property. Based on our tests of Navy Public Works Center

fiscal year 2000 purchase card transactions that included accountable
property items we estimate that the Center did not record all accountable
items in its property records for about 95 percent 18 of its purchase card
transactions, covering at least $317,000 in accountable property. Our
analysis of the individual property items included in our sampled

SPAWAR and Navy Public Works Center fiscal year 2000 purchase card
transactions showed that the two units did not record a total of 46 of the
65 accountable items that were included in our sampled transactions in their
property records, including 36 SPAWAR items and 10 Public Works Center

items. SPAWAR officials told us that they were not aware of the requirement
to record items such as computer monitors, cameras, and palm pilots in the
property records. Moreover, when we asked to inspect these items, the two
units could not provide conclusive evidence that 31 of

them were in the possession of the government, including 19 SPAWAR items and
12 Public Works Center items. The unverified accountable items included
laptop computers, Palm Pilots, and digital cameras. Of the 31 items that
could not be verified, 5 items had been transferred to other

locations throughout the world and SPAWAR and the Public Works Center
officials were unable to conclusively demonstrate their existence and
location, serial numbers for 4 items did not match those on the purchase

documentation, 3 items were declared to be lost or stolen by employees who
had custody of these items, and the existence of the remaining 19 17 The
range of our confidence interval, at a 95- percent confidence level,
indicates that the

population estimate of SPAWAR purchase card transactions for which all
accountable items were not recorded in the property records was between 52
percent and 99 percent and totaled between $5. 4 million and $7. 6 million.
18 The range of our confidence interval, at a 95- percent confidence level,
indicates that the

population estimate of Navy Public Works Center purchase card transactions
for which all accountable items were not recorded in the property records
was between 68 percent and 100 percent and totaled between $317, 792 and
$484, 249. Page 23 GAO- 01- 995T Navy Purchase Card Controls

items could not be verified because a serial number was not included in the
purchase documentation or a receipt for the item including a serial number
could not be located. The three items that were declared lost or stolen
included two Palm Pilots

that could not be located- one at SPAWAR San Diego and the other at the Navy
Public Works Center San Diego- and a video conferencing camera that was
reported stolen from a Public Works Center employee?s car. SPAWAR and Navy
Public Works Center officials directed the employees to prepare lost
property reports on the two Palm Pilots. Subsequently, in early

June 2001, Navy Public Works Center officials advised us that their lost
Palm Pilot had been located and showed us what they believed was the item in
question. However, because the serial number had been rubbed off, we could
not confirm that it was the accountable item acquired by purchase card. In
late June 2001, SPAWAR officials advised us that their lost Palm Pilot had
been located. Because we had already completed our review of SPAWAR property
controls, we did not attempt to view and confirm the existence of this Palm
Pilot. The third item was a video conferencing camera that was reported
stolen

on January 27, 2001, by a Navy Public Works Center San Diego employee.
According to the employee, the video camera was stolen from his car along
with a laptop computer that also belonged to the government. The employee
submitted a claim to his insurance company, and the claim was paid on
February 27, 2001. Although the stolen items cost about $3,876, the

employee?s insurance policy limited payment of claims for business property
to $2,500. However, about two months later, in May 2001, our investigators
determined that the insurance check in the amount of $2,500 was deposited in
the employee?s personal bank account instead of being endorsed to the
government. The employee admitted to our investigators

that he had been reimbursed for the stolen items from his insurance company.
On May 3, 2001, the employee issued a check to the government in the amount
of $2, 500. Navy Public Works Center officials told us that

they are considering assessing the employee for the remaining loss of $1,
376 and taking possible disciplinary action for the failure to reimburse the
government for the equipment loss in a timely manner. Page 24 GAO- 01- 995T
Navy Purchase Card Controls

Potentially Fraudulent, We identified several cases of potentially
fraudulent, improper, and abusive Improper, and Abusive

transactions at both SPAWAR San Diego and the Navy Public Works Center San
Diego. Given the breakdown of controls described in this testimony,
Transactions

the two units would have difficulty detecting and preventing these three
types of transactions. We considered potentially fraudulent purchases to be
those which were unauthorized and intended for personal use. Some of these
instances may involve the use of compromised accounts, in which an

account number was stolen and used to make fraudulent purchases. Other cases
involve the cardholder making unauthorized purchases for personal use. The
transactions we determined to be improper are those purchases intended for
government use, but are not for a purpose that is permitted by law or
regulation. We also identified as improper a number of purchases made on the
same day from the same vendor, which appeared to circumvent cardholder
single transaction limits. Federal Acquisition

Regulation and NAVSUP Instruction 4200.94 guidelines prohibit splitting
purchase card transactions into more than one segment to avoid the
requirement to obtain competitive bids on purchases over the $2, 500
micropurchase threshold or to circumvent higher single transaction limits
for payments on deliverables under requirements contracts. We defined
abusive transactions as those that were authorized, but the items

purchased were at an excessive cost or for a questionable government need,
or both. In these instances, it appears that cardholders were permitted to
purchase items for which there was not a reasonable, documented
justification. As discussed in our Objectives, Scope, and Methodology, our
work was not designed to identify, and we cannot determine, the extent of
fraudulent, improper, or abusive transactions.

Potentially Fraudulent Although both SPAWAR and the Navy Public Works Center
had policies and Transactions procedures that were designed to prevent
fraudulent purchases, our tests

showed that the controls were not implemented as intended. For example, as
discussed previously, controls for independent verification of receipt and
acceptance and proper certification of monthly statements prior to payment
were ineffective. Fraudulent activities must then be detected after

the fact during supervisor or internal reviews and disputed charge
procedures must be initiated to obtain a credit from Citibank. Table 3 shows
examples of potentially fraudulent transactions that we identified from the
universe of fiscal year 2000 purchases by SPAWAR San Diego and

Navy Public Works Center San Diego cardholders.

Page 25 GAO- 01- 995T Navy Purchase Card Controls

Table 3: Examples of Potentiall Fraudulent Purchase Card Transactions T pe
of items

Total purchased Unit Vendor amount

Cosmetics SPAWAR Mary Kay $ 500 Gift certificates Public Works Center
Nordstrom $ 1, 500 Clothing, electronics, and

Public Works Center Mervin s, Macy s, $ 10, 000

other personal items Circuit City, others Gas Public Works Center Citgo 7
Eleven, $ 360 Exxon, Shell CD recordings Both Sam Goody $ 700

Navy Public Works Center San Diego officials told us that they were aware of
the potentially fraudulent transactions that we identified. The officials
told us that the apparently fraudulent Public Works Center transactions were
all made using a limited number of cardholder accounts and that they had
referred these transactions to the Naval Criminal Investigative Service.
SPAWAR officials also told us that they were aware of their potentially
fraudulent transactions. Both Public Works Center and SPAWAR officials said
that they had submitted disputed charged forms to Citibank and had received
credits for these transactions. However, given the extensive

breakdowns in purchase card controls that we identified, SPAWAR and the Navy
Public Works Center have no assurance that all fraudulent charges were
detected. Our Office of Special Investigations is conducting a further
investigation of the potentially fraudulent purchases we identified.

Improper Transactions We identified several SPAWAR San Diego transactions
that involved the improper use of federal funds. For example, one case
involved flowers costing $97 purchased for Secretary?s Day. We also
identified several transactions for food for employee- related activities,
including food costing

$75 for an office outing. The Federal Acquisition Regulation, 48 C. F. R.
13. 301( a), provides that the Governmentwide Commercial Purchase Card

?may be used only for purchases that are otherwise authorized by law or
regulations.? Therefore, a procurement using the purchase card is lawful
only if it would be lawful using conventional procurement methods.

Page 26 GAO- 01- 995T Navy Purchase Card Controls

Pursuant to 31 U. S. C. 1301( a), ?[ a] ppropriations shall only be applied
to the objects for which the appropriations were made . . . .? In the
absence of specific statutory authority, appropriated funds may only be used
to purchase items for official purposes, and may not be used to acquire
items for the personal benefit of a government employee. For example,
without statutory authority, appropriated funds may not be used to furnish
meals or

refreshments to employees within their normal duty stations. 19 Free food
and other refreshments normally cannot be justified as a necessary expense
of an agency?s appropriation because these items are considered personal
expenses that federal employees should pay for from their own salaries. 20
Likewise, appropriated funds may not be used to purchase gifts for employees
or others unless an agency can demonstrate that the items

further the purposes for which the appropriation was enacted. 21 The
purchase of the flowers and food were both personal rather than official in
nature and, therefore, may not be paid for with appropriated funds.

Another transaction involved the purchase of a file cabinet from Macy?s at a
cost of $1, 462. Purchases of file cabinets are subject to rules prescribed
in Title 41 of the Code of Federal Regulations, Subtitle C, ?Federal
Property Management Regulations System,? which cover specific procedures
that must be followed to limit the purchases of new filing cabinets,
including disposing of all records that have been authorized for disposition
in accordance with authorized disposal schedules and transferring inactive
records not needed for daily business to approved agency records centers.
After taking appropriate steps to maximize the use of existing filing
cabinets, if the agency determines that additional filing cabinets are
required, the FAR requires the agency to submit a requisition to the General
Service Administration (GSA). We found no documented evidence that the

required procedures were followed. Further, we found no documented
justification for purchasing the file cabinet from Macy?s instead of through
GSA, as required.

Potentially Abusive We also identified a number of potentially abusive
transactions. These were

Transactions purchases of items supposedly for official use but without any
documented

agency determination that these items were necessary for government 19 72
Comp. Gen. 178, 179 (1993); 65 Comp. Gen. 508, 509 (1986). 20 58 Comp. Gen.
738, 739 (1986). 21 B- 260260, December 28, 1995; 70 Comp. Gen. 248 (1991).

Page 27 GAO- 01- 995T Navy Purchase Card Controls

business rather than merely to satisfy the personal preference of individual
employees. When a contracting official- in this case, a purchase cardholder-
purchases an item based on his or her own preferences (or the desires of
another agency official or employee) without a management

decision that the item is necessary, he or she is abusing the procurement
process. Some of these items fall into categories described in GAO?s Guide
for Evaluating and Testing Controls Over Sensitive Payments (GAO/ AFMD- 8.
1. 2, May 1993). The guide states that ?Abuse is distinct from illegal acts
(noncompliance). When abuse occurs, no law or regulation is violated.
Rather, abuse occurs when the conduct of a government organization, program,
activity, or function falls short of societal

expectations of prudent behavior.? Our review of the transactions in our
samples as well as our analytical review of the universe of SPAWAR and Navy
Public Works Center fiscal year 2000 transactions identified a number of
purchases that appear to be abusive, as shown in table 4.

Table 4: Examples of Potentiall Abusive Purchase Card Acquisitions T pe of
items purchased Unit Vendors Cost per item

Flat panel monitors SPAWAR Byte and Floppy $ 800 - $ 2, 500 Computers, Dell
Personal digital assistants SPAWAR and the

CompUSA, Staples $ 250 - $ 900 a ( e. g. , Palm Pilots) Public Works Center
Designer briefcases SPAWAR The Coach Store,

$ 400 Nordstrom Designer Palm Pilot SPAWAR Dooney and Bourke $ 100

holders a The $ 900 amount represents the total cost of a Palm Pilot with
accessories, including external keyboards, travel kits, additional memory,
modems, and belt clips

For example, SPAWAR San Diego cardholders purchased 9 flat- panel computer
monitors at a total cost of $13,192. The cost of each monitor ranged from
$800 to $2,500. In contrast, the current GSA schedule cost of a standard 17-
inch computer monitor is about $300. We were unable to find any pre-
purchase agency determination that the nature of the work

performed by SPAWAR officials or employees was such that standard monitors
would not satisfy their needs. SPAWAR?s commanding officer later told us
that flat- panel monitors save space and energy and are easier Page 28 GAO-
01- 995T Navy Purchase Card Controls

on the eyes. However, his opinion did not constitute an official agency
determination that these monitors were needed. It appears more likely that
cardholders purchased these more costly monitors to satisfy the personal

preferences of individual SPAWAR officials or employees. Our sample
transactions also included four SPAWAR purchases of PDAs for a total cost of
$1,150.

We performed a similar review of the Navy Public Work Center?s fiscal year
2000 transactions and generally did not identify the same types of
potentially abusive transactions. We did, however, identify nine PDA
purchases for a total cost $3,642. Again, we were unable to find any
prepurchase agency determination that these officials or employees needed
PDAs to perform their work. Therefore, it again appears likely that the PDAs
were acquired to satisfy the personal preferences of the individuals for
whom they were purchased.

Split Purchases Our analysis of the universe of fiscal year 2000 Navy
purchase card payments made by DFAS San Diego identified nearly $100 million
in purchases made on the same day from the same vendor, which appeared to
circumvent cardholder single transaction limits- including about

$2. 5 million in potential SPAWAR split purchases and nearly $4. 7 million
in potential Navy Public Works Center split purchases. The Federal
Acquisition Regulation and Navy purchase card policies and procedures
prohibit splitting a transaction into more than one segment to avoid the
requirement to obtain competitive bids for purchases over the $2, 500 micro-
purchase threshold or to avoid other established credit limits. DOD and Navy
purchase card policies and procedures prohibit such

actions as improper use of the purchase card. Once items exceed the $2, 500
micro- purchase threshold, they are to be purchased in accordance with
simplified acquisition procedures, which are more stringent than those for
micro- purchases.

Our analysis of the universe of fiscal year 2000 SPAWAR San Diego and Navy
Public Works Center San Diego transactions identified a number of potential
split purchases. To determine whether these were, in fact, split purchases,
we obtained and analyzed the supporting documentation for 20 purchases each
at SPAWAR and the Navy Public Works Center. We found that in many instances,
cardholders made multiple purchases from the

same vendor within a few minutes or a few hours for items such as computers,
computer- related equipment, and software, that involved the same, or
sequential or nearly sequential purchase order and vendor invoice

Page 29 GAO- 01- 995T Navy Purchase Card Controls

numbers. Based on our analyses, we concluded that 18 of the 20 SPAWAR
purchases and 14 of the 20 Navy Public Works Center purchases that we
examined were split into two or more transactions to avoid micro- purchase

thresholds. Tables 5 and 6 provide examples of cardholder purchases that we
believe represent split purchases intended to circumvent the $2, 500 micro-
purchase limit or cardholder transaction limits.

Table 5: Examples of Potential SPAWAR San Diego Split Purchases Cost of
Vendor Date Charge Items purchased items Indicator of split purchase

Byte & Floppy 11/ 3/ 1999 1 Computer flat LCD panel monitor $ 2, 408
Sequential invoice numbers Computers 2 Computer flat LCD panel monitor $
2,398

Byte & Floppy 9/ 25/ 2000 1 Computer, scanner $ 1, 809 No receipt provided
Computers 2 Flat panel monitor $ 2, 459

Byte & Floppy 1/ 26/ 2000 1 Laptop computer $ 2,418 Receipts timed 2 minutes
Computers apart 2 Desktop computer and flat LCD $ 2, 428

panel monitor CompUSA 9/ 17/ 2000 1 Computer supplies $ 1,449 Receipt shows
total purchase of $ 3,449 2 Computer $ 2,000 Fry s Electronics 11/ 18/ 99 1
Computer equipment $ 1, 841 Receipts timed 7 minutes apart

2 Computer equipment $ 472 3 6 PC cameras and computer

$ 1, 510 equipment Fry s Electronics 9/ 25/ 2000 1 Laptop computer $ 2, 439
Sequential purchase orders and all items purchased on same day

2 Printers $ 2,433 3 PDA and other equipment $ 1,989 Circuit City 10/ 15/
1999 1 Laptop computer $ 1,500 Sequential purchase order

numbers 2 Laptop computer $ 1, 500 Note: All cardholders making these
purchases had $ 2, 500 single transaction limits

Page 30 GAO- 01- 995T Navy Purchase Card Controls

Table 6: Examples of Potential Navy Public Works Center San Diego Split
Purchases Vendor Date Charge Items purchased Cost of items Indicator of
split purchase

All Access 11/ 2/ 1999 1 Equipment rental$ 1, 893 Rental and invoice were
Equipment sequential

2 Equipment rental$ 1, 701 Apollo Electronics 4/ 20/ 2000 1 Ejector and
subracks $ 835 Vendor invoices are sequential

2 Components $ 2,013 Astra Coatings 12/ 8/ 1999 1 Install flooring $ 2, 285
Identical amount and

description, and sequential invoice numbers

2 Install flooring $ 2, 285 Barrett Engineered 10/ 20/ 1999 1 Rebar for
retaining wall at

$ 1, 112 Transactions were for same Pumps San Clemente vendor invoice and
job order

numbers 2 Rebar for chlorine contact

$ 1, 667 tank at San Clemente Barrett Engineered 12/ 08/ 99 1 Receiver $
2,277 Both invoices were dated Pumps 11/ 12/ 999

2 Receiver $ 868 NPLTED Rentals 2/ 18/ 2000 1 Skip loader rental $ 1, 544
Same day and time in and out as other rental

2 Dump truck rental$ 1, 800 Perma Pipe, Inc. 5/ 1/ 2000 1 Leak detection
cable $ 1,997 Sequential purchase order

numbers 2 Perma pipe services $ 1, 516 Note: All cardholders making these
transactions had $ 2, 500 single transaction limits.

In addition to the items in table 6, we identified three Navy Public Works
Center purchases totaling $147, 000 that were made to the same vendor on the
same day by a cardholder with a $100,000 transaction limit. The Navy

Public Works Center did not have receipts to document the items acquired.
Planned Actions to

When we brought the control failures and other issues we identified to the
Mitigate Control attention of the Executive Officer at the Navy Public Works
Center San

Diego, he demonstrated a proactive position to identifying and correcting
Weaknesses

the weaknesses. According to the Executive Officer, because of concerns
about recent instances of purchase card fraud, the Navy Public Works Center
requested a Naval Audit Service review of purchase card activity

and undertook a number of corrective actions as a result of auditor
findings. For example, in February 2000, the Navy Public Works Center San

Page 31 GAO- 01- 995T Navy Purchase Card Controls

Diego started to reduce the number of purchase cardholders, which totaled
359 at that time, to about 250, and in September 2000, the Public Works
Center revised its purchase card policies and procedures to comply with
NAVSUP Instruction 4200.94. In addition, due to the time required for review
and proper certification of purchase card statements before payment, the
Executive Officer told us that he would consider further reducing the number
of cardholders to help ensure adequate review of documentation prior to
certifying statements for payment.

During fiscal year 2001, according to a SPAWAR acquisition official, SPAWAR
reduced the number of its cardholders from over 1,500 to 1,070; however, it
continued to have only one approving official who was responsible for
certifying monthly summary purchase card statements, and the average number
of individual monthly purchase card statements

remained about the same. In addition, the SPAWAR San Diego Commanding
Officer told us that SPAWAR planned to implement an Enterprise Resources
Planning (ERP) system. The ERP system is expected to help improve overall
controls for the purchase card program, including a

central electronic file of imaged documents supporting purchase card
transactions and an audit trail of actions by individuals executing various
purchase card processing functions. A SPAWAR official advised us that

SPAWAR implemented its ERP system in mid- July 2001. However, unless
substantial improvements are made in the overall control environment and
employees actually follow purchase card policies and procedures, the ERP
system will simply automate the same weaknesses as the current manual
process.

Conclusions The serious breakdown in internal controls at SPAWAR San Diego
and Navy Public Works San Diego are the result of a weak overall internal

control environment, flawed or nonexistent policies and procedures, and
employees that do not adhere to valid policies. The proliferation of
cardholders at these two activities resulted in over 1,700 cardholders with

essentially the authority to make their own purchase decisions in an
environment that lacked basic controls over receipt of government property,
certification of monthly statements, and accountability over sensitive
property items. Our work found that these weak internal controls

resulted in lost, stolen, missing, or misused government property,
potentially abusive use of purchase cards, and payment of unauthorized and
potentially fraudulent charges. The combination of these factors also
contributed to the five known fraud cases and leaves the government Page 32
GAO- 01- 995T Navy Purchase Card Controls

highly vulnerable to significant additional fraud, waste, and abuse from the
purchase card program at these two Navy units. Following this testimony, we
plan to issue a report that will include recommendations to DOD and the Navy
for improving internal controls over purchase card activity.

Mr. Chairman, Members of the Subcommittee, and Senator Grassley, this
concludes my prepared statement. I would be pleased to respond to any
questions that you may have.

Contacts and For future contacts regarding this testimony, please contact
Gregory D. Acknowledgements

Kutz at (202) 512- 9095. Individuals making key contributions to this
testimony included Wendy Ahmed, Christie Arends, Bertram Berlin, Sharon
Byrd, Francine DelVecchio, Stephen Donahue, Michael Chambless, Douglas
Ferry, Gayle Fischer, Kenneth Hill, Wilfred Holloway, Jeffrey Jacobson, John
Kelly, Richard Larsen, John Ryan, and Sidney Schwartz.

Page 33 GAO- 01- 995T Navy Purchase Card Controls

Appendix I

Appendi x I

Background The Navy?s purchase card program is part of the Governmentwide
Commercial Purchase Card Program, which was established to streamline
federal agency acquisition processes by providing a low- cost, efficient
vehicle for obtaining goods and services directly from vendors. DOD reported
that it used purchase cards for 95 percent of its eligible transactions-
more than 10 million transactions, valued at $5. 5 billion- in fiscal year
2000. The Navy?s reported purchase card activity represented nearly one
third of the reported DOD total during fiscal year 2000- 2.7 million
transactions, valued at $1.7 billion. According to unaudited DOD

data, SPAWAR and Navy Public Works Center San Diego- based activities
accounted for $68 million (about 15 percent) of the $451 million in fiscal
year 2000 Navy purchase card payments processed by DFAS San Diego.

Although SPAWAR San Diego and the Navy Public Works Center San Diego are
both working capital fund activities, their missions are very different.
SPAWAR San Diego is a highly technical systems operation staffed by
scientists and engineers who provide research, technology, and engineering
support to other Navy programs worldwide. The Navy Public Works Center

San Diego provides maintenance, construction, and operations support to
other Navy programs in the San Diego area.

Governmentwide Under the Federal Acquisition Streamlining Act of 1994, the
Defense Purchase Card

Federal Acquisition Regulation Supplement guidelines, eligible purchases
include (1) micro- purchases (transactions up to $2,500 for which Program
Guidelines

competitive bids are not needed); (2) purchases for training services up to
$25,000; and (3) payment of items costing over $2,500 that are on the
General Services Administration?s (GSA) pre- approved schedule, including
items on requirements contracts. The streamlined acquisition threshold for

such contract payments is $100,000. Accordingly, cardholders may have single
transaction purchase limits of $2, 500 or $25,000, and a few cardholders may
have transaction limits of up to $100,000 or more. Under

the GSA blanket contract, the Navy has contracted with Citibank for its
purchase card services, while the Army and the Air Force have contracted
with U. S. Bank.

The Federal Acquisition Regulation, Part13, ?Simplified Acquisition
Procedures,? establishes criteria for using purchase cards to place orders
and make payments. U. S. Treasury regulations issued pursuant to provisions
of law in 31 U. S. C. 3321, 3322, 3325, 3327, and 3335, govern

purchase card payment certification, processing, and disbursement. DOD?s
Purchase Card Joint Program Management Office, which is in the office of

Page 34 GAO- 01- 995T Navy Purchase Card Controls

Appendix I Background

the Assistant Secretary of the Army for Acquisition, Logistics, and
Technology, has established departmentwide policies and procedures governing
the use of purchase cards. The Under Secretary of Defense (Comptroller) has
established related financial management policies and procedures in various
sections of DOD?s Financial Management Regulation.

Navy Purchase Card The Navy Supply Systems Command is responsible for the
overall Acquisition And

management of the Navy?s purchase card program, and has published the Navy
Supply Command (NAVSUP) Instruction 4200.94, Department of the Payment
Processes

Navy Policies and Procedures for Implementing the Governmentwide Purchase
Card Program. Under the NAVSUP Instruction, each Navy Command?s head
contracting officer authorizes purchase card program coordinators in local
Navy units to obtain purchase cards and establish credit limits. The program
coordinators are responsible for administering the purchase card program
within their designated span of control and serve as the communication link
between Navy units and the purchase card issuing bank.

Designation of Cardholders When a supervisor requests that a staff member
receive a purchase card, the agency program coordinator is to first provide
training on purchase card policies and procedures and then establish a
credit limit and issue a purchase card to the staff member. The Navy had a
total of about 1, 700 purchase card program coordinators during fiscal year
2000, including one program coordinator at SPAWAR San Diego and one at the
Navy Public Works Center San Diego.

Ordering Goods and Services Purchase cardholders are delegated contracting
officer ordering responsibilities, but they do not negotiate or manage
contracts. SPAWAR San Diego and Navy Public Works Center San Diego
cardholders use

purchase cards to order goods and services for their units as well as their
customers. Cardholders may pick up items ordered directly from the vendor or
request that items be shipped directly to end users (requestors). Upon
receipt of items acquired by purchase cards, cardholders are to record the
transaction in their purchase log and obtain independent confirmation from
the end user, their supervisor, or another individual that

the items have been received and accepted by the government. They are also
to notify the property book officer of accountable items received so that
these items can be recorded in the accountable property records.

Page 35 GAO- 01- 995T Navy Purchase Card Controls

Appendix I Background

Payment Processing The purchase card payment process begins with receipt of
the monthly purchase card billing statements. Section 933 of the National
Defense Authorization Act for Fiscal Year 2000, Public Law 106- 65, requires
DOD to issue regulations that ensure that purchase card holders and each
official with authority to authorize expenditures charged to the purchase
card

reconcile charges with receipts and other supporting documentation. NAVSUP
Instruction 4200.94 states that upon receipt of the individual cardholder
statement, the cardholder has 5 days to reconcile the transactions appearing
on the statement by verifying their accuracy to the transactions appearing
on the statement and notify the approving official in writing of any
discrepancies in the statement. In addition, under the NAVSUP Instruction,
the approving official is responsible for (1) ensuring

that all purchases made by the cardholders within his or her cognizance are
appropriate and that the charges are accurate and (2) the timely
certification of the monthly summary statement for payment by DFAS. The
Instruction further states that within 5 days of receipt, the approving
official must review and certify for payment the monthly billing statement,
which is a summary invoice of all transactions of the cardholders under the
approving official?s purview. The approving official is to presume that all
transactions on the monthly statements are proper unless notified in writing
by the purchase cardholder. However, the presumption does not

relieve the approving official from reviewing for blatant improper purchase
card transactions and taking the appropriate action prior to certifying the
invoice for payment. In addition, the approving official is to forward
disputed charge forms to the unit?s comptroller?s office for submission to
Citibank for credit. Under the Navy?s contract, Citibank allows the Navy up
to 60 days after the statement date to dispute invalid transactions and

request a credit. Upon receipt of the certified monthly purchase card
summary statement, a DFAS vendor payment clerk is to (1) review the
statement and supporting documents to confirm that the prompt payment
certification form has been properly completed and (2) subject it to
automated and manual validations. The purpose of the automated validation is
to confirm that a SPAWAR or a

Navy Public Works Center obligation for a purchase card invoice has been
recorded in their respective cost accounting systems in an amount sufficient
to cover the payment. Quality control clerks manually verify that purchase
card statement and payment data were correctly entered in the Navy?s vendor
payment (disbursing) system- STARS 1- Pay. Once the payment has passed these
validation tests, the quality control supervisor authorizes the statement
for payment. The DFAS vendor payment system then batches all of the
certified purchase card payments for that day, Page 36 GAO- 01- 995T Navy
Purchase Card Controls

Appendix I Background

generates a tape for payment by electronic funds transfer to the purchase
card bank, and sends the file to the accounting station for recording the
payment as a summary record in the Navy?s accounting system. Figure 1
illustrates the current purchase card payment process used by SPAWAR and the
Naval Public Works Center in San Diego.

Figure 1: SPAWAR and Navy Public Works Center Purchase Card Process

Purchase cardholder Items picked up orders/ charges goods

Vendor and services

Items shipped Independent

Pilferable items are documentation that items

recorded in accountable have been received and

property records accepted

Citibank reverses Monthly purchase card disputed charges and

statements are received credits monthly statement

from bank Cardholder reconciles underlying receipts/ sales

Cardholder logs items slips to monthly purchase

not received and follows card statements,

up to ( 1) confirm receipt identifies any invalid

or ( 2) dispute the charge charges, and prepares

dispute forms Cardholder or

Approving official reviews approving official logs

cardholder support, DFAS processes

disputed charges and establishes obligation,

purchase card payments sends forms to Citibank

and certifies monthly to Citibank

for credit statements for payment

Navy accountants DFAS enters summary record detail

payment record in Navy transactions in

accounting system accounting systems

Page 37 GAO- 01- 995T Navy Purchase Card Controls

Appendix I Background

The Navy earns purchase card rebate revenue from Citibank of up to 0.8
percent based on sales volume (purchases) and payment timeliness. According
to the DOD Deputy Director of DOD?s Purchase Card Joint Program Management
Office, rebate revenue is generally to be recorded to

the purchase card statements and used to offset monthly charges.

Page 38 GAO- 01- 995T Navy Purchase Card Controls

Appendix II San Diego Related Fraud Cases Investigated

Appendi x II

by NCIS Pursuant to Senator Grassley?s request, we identified five fraud
cases related to Navy programs based in the San Diego, California, area and
investigated by the Naval Criminal Investigative Service (NCIS). All of
these cases can be linked to the types of internal control weaknesses
discussed in this testimony. Of these five cases, two involved Navy Public

Works Center San Diego employees and one involved 2,600 compromised purchase
card accounts, including 22 currently active SPAWAR San Diego accounts. One
of the remaining cases, which has been concluded, was related to a fraud
that occurred at the Navy?s Millington (Tennessee) Flying Club- an activity
of the Navy Morale, Welfare, and Recreation entity, which is based in San
Diego. The other case involved a military officer and other service members
who were assigned to the Marine Corps Station in Miramar, near San Diego.

Case #1 The first San Diego- related purchase card fraud case is an example
of the lack of segregation of duties. This case involved the cardholder at
the Navy?s Millington (Tennessee) Flying Club, an entity of the U. S. Navy?s

Morale, Welfare, and Recreation activity, which is based in San Diego,
California. The cardholder, who was having financial problems, was hired by
her stepfather, who was the club?s treasurer. The stepfather delegated
nearly all purchase card duties to the cardholder, as well as the authority
for writing checks to pay the Flying Club?s monthly purchase card

statements. The cardholder made over $17,000 in fraudulent transactions to
acquire personal items from Wal- Mart, The Home Depot, shoe stores, pet
stores, boutiques, an eye care center, and restaurants over an 8- month
period from December 1998 through July 1999. The fraud was identified when
the club?s checking account was overdrawn due to excessively high purchase
card payments and a bank official contacted the president of the

Flying Club. The cardholder pleaded guilty and was sentenced to 15 months in
jail and assessed about $28,486 in restitution due to purchase card fraud
and bounced checks. The defendant commented that illegal use of the card was
?too easy? and that she was the sole authorizer of the card purchases.

Case #2 The second case involved a military officer and other service
members who were assigned to the Marine Corps Station in Miramar, near San
Diego,

California. This alleged fraud occurred through collusion, and internal
controls will not prevent collusion. However, adequate monitoring of
purchase card transactions along with enforcing controls such as

Page 39 GAO- 01- 995T Navy Purchase Card Controls

Appendix II San Diego Related Fraud Cases Investigated by NCIS

documentation of independent confirmation of receipt and acceptance and
recording accountable items in property records would have made detection
easier. In this instance, the military officer allegedly conspired with
cardholders under his supervision to make nearly $400,000 in fraudulent
purchases from five companies- two that he owned, one owned

by his sister, and the other two owned by friends or acquaintances. They
charged thousands of dollars for items such as DVD players, Palm Pilots, and
desktop and laptop computers. The officer also allegedly made cash payments
to employees to keep silent about the fraud and provided auditors with
falsified purchase authorizations and invoices to cover the fraud. The fraud
occurred from June 1999 through September 2000. The total amount of the
alleged fraud is unknown. The alleged fraud was identified based on a tip
from a service member. The U. S. Attorney?s Office in San Diego has accepted
the case for prosecution and four other active

service members are under investigation. Case #3 The third case involved a
Navy Public Works Center San Diego

maintenance/ construction supervisor who allegedly made at least $52,000 in
fraudulent transactions to a suspect contractor on work orders for which the
work was not performed by that contractor. Adequate monitoring of purchase
card transactions along with enforcing controls such as independent,
documented receipt and acceptance and recording accountable items in
property books would have made detection easier. Navy investigators believe
that the employee also may have used his government purchase card to make
unauthorized purchases for personal

use, including jewelry, an air conditioner, and other personal items from
The Home Depot from April 1997 through October 1998. The total amount of
this alleged purchase card fraud is unknown. The alleged fraud was

identified when the employee?s supervisor reviewed Navy Public Works Center
work orders and noticed that four work orders totaling approximately $7, 000
were completed by the employee and paid for with the suspect?s government
purchase card. Further inquiry by the supervisor

revealed that Navy Public Works Center employees, not the contractor, had
completed the work. NCIS investigators and Naval Audit Service auditors
identified approximately $52,000 in purchase card transactions made by the
employee to a suspect contractor for work that was performed by either the
Public Works Center or other legitimate contractors. The employee has
resigned and an investigation by the Federal Bureau of Investigation and
NCIS is ongoing. The U. S. Attorney?s Office in San Diego

has accepted the case for prosecution.

Page 40 GAO- 01- 995T Navy Purchase Card Controls

Appendix II San Diego Related Fraud Cases Investigated by NCIS

Case #4 The fourth case involved a Navy Public Works Center San Diego
purchasing agent that allegedly made at least $12,000 in fraudulent
purchases and

planned to submit approximately $103,000 in fraudulent disputed charge
forms, including payments for hotels, airline tickets, computers, phone
cards, and personal items from The Home Depot. The alleged fraud

occurred from April 1997 through July 1999. As with the other cases,
adequate monitoring of purchase card transactions along with enforcing
controls such as independent, documented receipt and acceptance and

recording accountable items in property books would have made detection
easier. The alleged fraud was identified during an investigation of a
possible bribery/ kickback scheme. The employee has resigned and an NCIS
investigation is ongoing. The U. S. Attorney?s Office in San Diego has
accepted the case for prosecution.

Case #5 The fifth Navy purchase card fraud case is ongoing and involves the
compromise of up to 2, 600 purchase card accounts assigned to Navy

activities in the San Diego area. Investigators were only able to obtain a
partial list consisting of 681 compromised accounts so the exact number is
not known. At least 45 of the compromised accounts were for SPAWAR San Diego
and one of the compromised accounts was for the Navy Public Works Center in
San Diego. Of these 46 compromised accounts, 22 SPAWAR San Diego accounts
were still active in May 2001. None of the

active accounts on the partial listing found by investigators were for the
Navy Public Works Center San Diego. Although the account numbers showed up
on a computer printer in a community college library in San

Diego in September 1999, the Navy has not canceled all of the compromised
accounts. Instead, according to NCIS and Navy Supply Command officials, the
Navy is canceling the compromised accounts as fraudulent transactions are
identified. Naval Supply Systems Command, SPAWAR San Diego, and Navy Public
Works Center San Diego officials told

us that they were aware of this incident but did not have a listing of the
account numbers affected. As a result, the Navy did not take any measures to
flag the compromised accounts and implement special monitoring procedures to
detect any potential fraudulent use of these accounts.

According to Navy investigators, as of January 2001, at least 30 of the
compromised account numbers had been used by 27 alleged suspects to make
more than $27,000 in fraudulent transactions for pizza, jewelry, phone

calls, tires, and flowers. As of May 21, 2001, 22 of the compromised SPAWAR
accounts were still active. Our review of the monthly credit limits Page 41
GAO- 01- 995T Navy Purchase Card Controls

Appendix II San Diego Related Fraud Cases Investigated by NCIS

associated with the 22 compromised accounts showed that SPAWAR continued to
have an aggregate monthly financial exposure of $900, 000 associated with
these accounts nearly 2 years after the compromised list was discovered in a
San Diego community college library in September

1999. Further, with the lack of controls over receipt of goods and
certification of purchase card statements that we identified at the two
activities we reviewed, it is impossible for the Navy to identify fraudulent

purchases as they occur or to determine the extent of the fraudulent use of
the compromised accounts. As a result, when fraudulent use of one of the
comprised accounts was identified, the Navy could not determine if the
incident was due to cardholder fraud or use of the compromised account by an
outside party. A joint task force in San Diego, comprised of NCIS, the U. S.
Secret Service, local police, and the U. S. Attorney?s Office, investigated
this fraud. The task force investigators recently traced the list of
compromised accounts to a vendor used by the Navy, which acknowledged

that the list came from its database. The vendor identified two former
employees as possible suspects.

Page 42 GAO- 01- 995T Navy Purchase Card Controls

Appendix III

Appendi x I II

Objectives, Scope, and Methodology Pursuant to Senator Grassley?s request,
we obtained and reviewed information on five fraud cases related to Navy
purchase card programs in the San Diego, California, area and to review
purchase card controls and accounting for two Navy units based in San Diego-
the Space and Naval Warfare Systems Command (SPAWAR) Systems Center and the
Navy Public Works Center. Our assessment of SPAWAR San Diego and the Navy
Public Works Center San Diego purchase card controls covered

 the overall management control environment, including (1) span of control
issues related to the number of cardholders, (2) training for cardholders
and accountable officers, 1 (3) management of rebates, and (4) monitoring
and audit of purchase card activity;

 tests of statistical samples of key controls over purchase card
transactions, including (1) documentation of independent confirmation that
items ordered by purchase card were received, (2) proper certification of
purchase card statements for payment, and (3) proper accounting for purchase
card transactions;

 substantive tests of accountable items in our sample transactions to
verify whether they were recorded in property records and whether they could
be found; and

 analysis of the universe of transactions to identify (1) any potentially
improper, fraudulent, and abusive transactions and (2) purchases that were
split into one or more transactions to avoid micro- purchase thresholds or
other credit limits.

We used as our primary criteria applicable laws and regulations; our
Standards for Internal Control in the Federal Government; 2 and our Guide
for Evaluating and Testing Controls Over Sensitive Payments. 3 To assess the
management control environment, we applied the fundamental 1 We tested
statistical samples of transactions to determine whether the two units had
documented evidence that cardholders had received required purchase card
training. 2 Standards for Internal Control in the Federal Government (GAO/
AIMD- 00- 21.3.1), was prepared to fulfill our statutory requirement under
the Federal Managers? Financial Integrity Act to issue standards that
provide the overall framework for establishing and maintaining internal
control and for identifying and addressing major performance and management
challenges and areas at greatest risk of fraud, waste, abuse, and
mismanagement.

3 Guide for Evaluating and Testing Controls Over Sensitive Payments (GAO/
AFMD- 8. 1.2), provides a framework for evaluating and testing the
effectiveness of internal controls that have been established in various
sensitive payment areas. Page 43 GAO- 01- 995T Navy Purchase Card Controls

Appendix III Objectives, Scope, and Methodology

concepts and standards in the GAO internal control standards to the
practices followed by management in the four areas reviewed.

To test controls, we selected stratified random probability samples of 135
SPAWAR San Diego purchase card transactions from a population of 47,035
transactions totaling $38,357,656, and 121 Navy Public Works Center San
Diego transactions from a population of 53, 026 transactions totaling
$29,824, 160 that were recorded by the Navy during fiscal year 2000. We
stratified the samples into two groups- transactions from computer

vendors and other vendors. With this statistically valid probability sample,
each transaction in the population had a nonzero probability of being
included, and that probability could be computed for any transaction. Each
sample element was subsequently weighted in the analysis to account
statistically for all the transactions in the population, including those
that were not selected. Table 7 presents our test results on three key
transaction- level controls and shows the confidence intervals for the

estimates for the universes of fiscal year 2000 purchase card transactions
made by SPAWAR and the Navy Public Works Center in San Diego.

Table 7: Estimate of Fiscal Year 2000 Transactions That Failed Control Tests
Breakdowns in ke purchase card controls a Independent, documented

receipt Proper pa ment certification Timely customer accounting Percent

Projection Percent

Projection Percent

Projection Navy units in San Diego, CA failure ( millions) failure (
millions) failure ( millions)

65% $ 14. 5

100% b $ 38 b 83% $ 20. 4

SPAWAR ( + / - 10% ) ( + / - $ 4. 4) ( 74- 90% ) ( + / - $ 5. 1) 47%

$ 12. 9 100% b $ 30 b 35%

$ 11. 2 Navy Public Works Center ( + / - 12% ) ( + / - $ 6. 3) ( + / - 11.
4% ) ( + / - $ 6. 2)

a The projections represent point estimates for the population based on our
sampling tests at a 95- percent confidence level. b All seven approving
officials with certifying officer responsibilities told us that they did not
review support for transactions before certifying purchase card statements
for payment

Our analytical reviews covered the universe of fiscal year 2000 purchase
card transactions for the two units? San Diego- based activities covered
about 47, 000 transactions totaling about $38 million at SPAWAR San Diego
and about 53, 000 transactions totaling about $30 million at the Navy Public
Works Center San Diego. For these reviews, we did not look for all potential
abuses of purchase cards. For example, because a large number Page 44 GAO-
01- 995T Navy Purchase Card Controls

Appendix III Objectives, Scope, and Methodology

of store receipts (such as those from The Home Depot) were missing, we were
unable to determine whether certain purchases were made for personal use. In
addition, we did not physically examine purchases made to determine whether
goods and services were received and used for government purposes. While we
identified some improper and potentially fraudulent and abusive
transactions, our work was not designed to identify, and we cannot
determine, the extent of fraudulent, improper, or abusive

transactions. We briefed DOD managers, including officials in DOD?s Purchase
Card Joint Program Management Office and the Defense Finance and Accounting
Service, and Navy managers, including Navy Supply Command,

Navy Comptroller, SPAWAR San Diego, and Navy Public Works Center San Diego
officials on the details of our review, including our objectives, scope, and
methodology and our findings and conclusions. We conducted our audit work
from August 2000 through June 2001 in accordance with generally accepted
government auditing standards, and we performed our investigative work in
accordance with standards prescribed by the

President?s Council on Integrity and Efficiency. Following this testimony,
we plan to issue a report, which will include recommendations to DOD and the
Navy for improving internal controls over purchase card activity.

(918994) Lett er Page 45 GAO- 01- 995T Navy Purchase Card Controls

Appendi x II Comments From the Department of Defense

See comment 1. See comment 1.

See comment 2.

See comment 3.

See comment 1. See comment 1.

See comment 4. See comment 4.

See comment 1.

See comment 1.

The following are GAO?s comments on the DOD letter dated October 3, 2001.
GAO Comments Comment 1. See the "Agency Comments and Our Evaluation" section
of this report.

Comment 2. We are concerned that DOD?s support of the current process
whereby Agency Program Coordinators report the results of their purchase
card internal reviews to their unit?s contracting activity or their local
commanding officer will not ensure that the results of purchase card
internal reviews are fully communicated to central Navy management to
support oversight and corrective actions on systemic control weaknesses.
During our review, we found documented evidence that SPAWAR management
ignored written reports on results of Agency Program Coordinator internal
reviews, which identified problems that are consistent with the control
weaknesses discussed in our testimony and summarized in

this report. For example, SPAWAR Agency Program Coordinator reviews
identified the lack of independent documentation that the Navy had received
items ordered by purchase card, accountable items that were not recorded in
the property records, inadequate documentation for transactions, split
purchases, and transactions that did not appear to be related to government
business purposes. SPAWAR San Diego management ignored the internal review
results, primarily due to complaints from cardholders and their supervisors
regarding the

administrative burden associated with procedural changes that would be
needed to address the review findings. Further, although the Naval Audit
Service reviewed Navy Public Works Center San Diego purchase card activity
and the SPAWAR San Diego Command Inspector General reviewed SPAWAR Systems
Center San Diego purchase card activities, reports were not issued on the
results of either of these reviews. Therefore, we continue

to recommend that Agency Program Coordinators report any internal control
weaknesses identified during semiannual reviews to the Commander of the
Naval Supply Systems Command in addition to their unit commanders.

Comment 3. While DOD stated that using a single object class for all
micropurchases streamlines the accounting process and reduces the numbers of
problem disbursements resulting from manual keystrokes when entering such
data, this practice results in unreliable expense data. As we stated in our
testimony, aggregating all micro- purchases under one object class does not
show the nature and type of expenditures made using purchase cards.

Because SPAWAR San Diego and the Navy Public Works Center San Diego did not
ensure that their detail transaction records reflected the proper
classification of expense, 100 percent of the SPAWAR and Navy Public Works
Center transactions in our samples were recorded to the wrong

object class. For example, although the majority of the SPAWAR purchase card
transactions in our sample- 76 transactions totaling over $73,000- were for
equipment purchases, none of these transactions were properly classified and
recorded. Further, SPAWAR did not maintain sufficient documentation to
determine the correct object class for 15 of the transactions in our sample
totaling $12,000. Office of Management and

Budget (OMB) Circular A- 11, Preparation and Submission of Budget Estimates,
requires federal agencies to report obligations and expenditures by object
class, such as salaries, benefits, travel, supplies, services, and
equipment, to indicate the nature of expenditures of federal funds. Accurate
object classification data are critical to the reliability of information
reported in the President's budget submission and budget projections and
other analyses that are based on these data. In addition,

because the Congress has asked for and is using object class information for
its oversight activities, it is important that these data be properly
recorded. Therefore, we continue to recommend that detail purchase card
transaction records reflect the proper object classification of expense.
Further, an appropriate procedure for summarizing detail purchase card

transactions would be to record a separate summary record for each
classification of expense-- such as services, supplies, and equipment.

Comment 4. The steps outlined in DOD's response do not ensure that
cardholders will obtain reasonable prices or the best value. For example, we
found numerous examples of individual purchases of computers and property
items, and purchases of services, such as the installation of upgraded
computer software, that were not made as part of a negotiated contract or a
bulk purchase. Because these purchases did not appear to be

cost- effective, we continue to recommend that the Navy determine whether
the purchase card is (1) the right vehicle for acquiring certain items and
services and (2) if items, such as computers, should be procured
individually or through bulk purchases. The intent of our recommendation is
that these determinations would result in Navy- wide policy guidance on the
cost- effective use of purchase cards.

Appendi x I II

GAO Contact and Staff Acknowledgements GAO Contact Gayle Fischer (202) 512-
9577 Acknowledgements Staff making key contributions to this report were
Bertram Berlin,

Francine DelVecchio, Steve Donahue, Douglas Ferry, Kenneth Hill, Jeffrey
Jacobson, John Kelly, and John Ryan.

(192025) Lett er

GAO?s Mission The General Accounting Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of
the federal government for the American people. GAO examines the use of
public funds; evaluates federal programs and

policies; and provides analyses, recommendations, and other assistance to
help Congress make informed oversight, policy, and funding decisions. GAO?s
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents is through the Internet. GAO?s Web site (www. gao. gov) contains
abstracts and full- text files of GAO Reports and current reports and
testimony and an expanding archive of older products. The Testimony Web site
features a search engine to help you locate documents using key words and
phrases. You can print these documents in their entirety, including charts
and other graphics.

Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as ?Today?s Reports,? on its Web
site daily. The list contains links to the full- text document files. To
have GAO E- mail this list to you every afternoon, go to our home page and
complete the easy- to- use electronic order form found under ?To Order GAO
Products.?

Order by Mail or Phone The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out to
the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U. S. General Accounting Office P. O. Box 37050 Washington, D. C. 20013

To order by Phone: Voice: (202) 512- 6000 TDD: (301) 413- 0006 Fax: (202)
258- 4066

Visit GAO?s Document GAO Building Distribution Center

Room 1100, 700 4th Street, NW (corner of 4th and G Streets, NW) Washington,
D. C. 20013

To Report Fraud, Contact: Waste, and Abuse in

Web site: www. gao. gov/ fraudnet/ fraudnet. htm, E- mail: fraudnet@ gao.
gov, or

Federal Programs 1- 800- 424- 5454 (automated answering system).

Public Affairs Jeff Nelligan, Managing Director, NelliganJ@ gao. gov (202)
512- 4800 U. S. General Accounting Office, 441 G. Street NW, Room 7149,
Washington, D. C. 20548

a

GAO United States General Accounting Office

Page i GAO- 02- 32 Navy Purchase Card Controls

Contents

Page ii GAO- 02- 32 Navy Purchase Card Controls

Page 1 GAO- 02- 32 Navy Purchase Card Controls United States General
Accounting Office

Washington, D. C. 20548 Page 1 GAO- 02- 32 Navy Purchase Card Controls

A

Page 2 GAO- 02- 32 Navy Purchase Card Controls

Page 3 GAO- 02- 32 Navy Purchase Card Controls

Page 4 GAO- 02- 32 Navy Purchase Card Controls

Page 5 GAO- 02- 32 Navy Purchase Card Controls

Page 6 GAO- 02- 32 Navy Purchase Card Controls

Page 7 GAO- 02- 32 Navy Purchase Card Controls

Page 8 GAO- 02- 32 Navy Purchase Card Controls

Page 9 GAO- 02- 32 Navy Purchase Card Controls

Page 10 GAO- 02- 32 Navy Purchase Card Controls

Page 11 GAO- 02- 32 Navy Purchase Card Controls

Page 12 GAO- 02- 32 Navy Purchase Card Controls

Page 13 GAO- 02- 32 Navy Purchase Card Controls

Page 14 GAO- 02- 32 Navy Purchase Card Controls

Page 15 GAO- 02- 32 Navy Purchase Card Controls

Page 16 GAO- 02- 32 Navy Purchase Card Controls

Page 17 GAO- 02- 32 Navy Purchase Card Controls

Page 18 GAO- 02- 32 Navy Purchase Card Controls

Appendix I

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 19 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 20 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 21 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 22 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 23 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 24 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 25 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 26 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 27 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 28 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 29 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 30 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 31 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 32 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 33 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 34 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 35 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 36 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 37 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 38 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 39 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 40 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 41 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 42 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 43 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 44 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 45 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 46 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 47 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 48 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 49 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 50 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 51 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 52 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 53 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 54 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 55 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 56 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 57 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 58 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 59 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 60 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 61 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 62 GAO- 02- 32 Navy Purchase Card Controls

Appendix I Testimony on Purchase Card Control Weakness at Two Navy Units

Page 63 GAO- 02- 32 Navy Purchase Card Controls

Page 64 GAO- 02- 32 Navy Purchase Card Controls

Appendix II

Appendix II Comments From the Department of Defense

Page 65 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 66 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 67 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 68 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 69 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 70 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 71 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 72 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 73 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 74 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 75 GAO- 02- 32 Navy Purchase Card Controls

Appendix II Comments From the Department of Defense

Page 76 GAO- 02- 32 Navy Purchase Card Controls

Page 77 GAO- 02- 32 Navy Purchase Card Controls

Appendix III

United States General Accounting Office Washington, D. C. 20548- 0001

Official Business Penalty for Private Use $300

Address Correction Requested Presorted Standard

Postage & Fees Paid GAO Permit No. GI00
*** End of document. ***