Sandia National Laboratories: Further Improvements Needed to	 
Strengthen Controls Over the Purchase Card Program (05-AUG-04,	 
GAO-04-989R).							 
                                                                 
The Sandia National Laboratories (Sandia) operate in Albuquerque,
New Mexico and Livermore, California. Sandia is a		 
government-owned, contractor-operated national laboratory of the 
Department of Energy's (DOE) National Nuclear Security		 
Administration (NNSA). During the fall of 2002, the Federal	 
Bureau of Investigation began investigating two Los Alamos	 
National Laboratory employees for alleged misuse of lab credit	 
cards. Other allegations of theft and misuse of government funds 
at Los Alamos soon followed. In light of the problems identified 
at Los Alamos, Congress asked us to review selected procurement  
and property management practices at two DOE and two NNSA	 
contractor labs, including Sandia. This report summarizes the	 
information provided during our June 14, 2004 briefing to	 
Congressional staff on these issues as they relate to Sandia.	 
Specifically, we reviewed Sandia's purchase card program and	 
property management practices to determine whether (1) internal  
controls over the lab's purchase card (Pcard) program provided	 
reasonable assurance that improper purchases would not occur or  
would be detected in the normal course of business, (2) purchase 
card expenditures made under the contract properly complied with 
lab policies and other applicable requirements and were 	 
reasonable in nature and amount and thus were allowable costs	 
payable to the contractor under the contract, and (3) property	 
controls over selected asset acquisitions provided reasonable	 
assurance that accountable assets would be properly recorded and 
tracked. Our review covered selected transactions that occurred  
during fiscal year 2002 and the first half of fiscal year 2003,  
which were the most current data available when we requested the 
data for our review.						 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-04-989R					        
    ACCNO:   A11466						        
  TITLE:     Sandia National Laboratories: Further Improvements Needed
to Strengthen Controls Over the Purchase Card Program		 
     DATE:   08/05/2004 
  SUBJECT:   Credit sales					 
	     Federal procurement				 
	     Fraud						 
	     GOCO						 
	     Internal controls					 
	     Inventory control systems				 
	     Laboratories					 
	     Procurement records				 
	     Program abuses					 
	     Property and supply management			 
	     Questionable procurement charges			 
	     Government purchase cards				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-04-989R

United States Government Accountability Office Washington, DC 20548

August 6, 2004

Congressional Requesters

Subject: Sandia National Laboratories: Further Improvements Needed to
Strengthen Controls Over the Purchase Card Program

The Sandia National Laboratories (Sandia) operate in Albuquerque, New
Mexico and Livermore, California. Sandia is a government-owned,
contractor-operated national laboratory of the Department of Energy's
(DOE) National Nuclear Security

1

Administration (NNSA). The Lockheed Martin Corporation manages the lab
under a cost-reimbursable contract with NNSA. Lockheed Martin is paid a
management fee to operate the lab and is reimbursed for all allowable
costs charged to the contract.

During the fall of 2002, the Federal Bureau of Investigation began
investigating two Los Alamos National Laboratory employees for alleged
misuse of lab credit cards. Other allegations of theft and misuse of
government funds at Los Alamos soon followed. In light of the problems
identified at Los Alamos, you asked us to review selected procurement and
property management practices at two DOE and two NNSA contractor labs,
including Sandia.2

This report summarizes the information provided during our June 14, 2004
briefing to your staff on these issues as they relate to Sandia. The
enclosed briefing slides highlight the results of our work and the
information provided.3 Specifically, we reviewed Sandia's purchase card
program and property management practices to determine whether (1)
internal controls over the lab's purchase card (Pcard) program provided
reasonable assurance that improper purchases would not occur or would be
detected in the normal course of business, (2) purchase card expenditures
made under the contract properly complied with lab policies and other
applicable requirements and were reasonable in nature and amount and thus
were allowable costs payable to the contractor under the contract, and (3)
property controls over selected asset acquisitions provided reasonable
assurance that accountable assets

1The National Nuclear Security Administration (NNSA) was created in fiscal
year 2000 as a separately
organized agency within DOE. As part of its national security mission,
NNSA has responsibility for the
institutional stewardship of three national security laboratories.
2The four labs we reviewed were DOE's Lawrence Berkeley National
Laboratory and Pacific Northwest
National Laboratory, and NNSA's Lawrence Livermore National Laboratory and
Sandia National
Laboratories.
3Separate briefings were provided for each of the labs reviewed, which we
also summarized in separate
letters.

                   GAO-04-989R Sandia Purchase Card Controls

would be properly recorded and tracked.4 Our review covered selected
transactions that occurred during fiscal year 2002 and the first half of
fiscal year 2003 (October 1, 2001, through March 31, 2003), which were the
most current data available when we requested the data for our review.
This report also includes 10 recommendations for action-9 related to
actions needed to be taken by Sandia and 1 related to action needed to be
taken by the NNSA contracting officer for Sandia.

Results in Brief

Internal control weaknesses in Sandia's Pcard program increased the lab's
risk of improper purchases. These control weaknesses primarily related to
the review and approval processes, which are key controls in the Pcard
program. Specifically, during the majority of our review period,
cardholders who were managers were allowed to approve their own purchases.
Of the nonstatistical selection of 141 transactions obtained through data
mining5 for fiscal years 2002 and the first half of fiscal year 2003, 15
purchases (11 percent) were made by such cardholders and thus did not have
any independent review and approval. In addition, approving officials did
not review cardholders' monthly statements in a timely manner for 14 of 49
(29 percent) transactions tested.6 For example, one purchase of a digital
camera wasn't approved until 16 months after purchase. We also found 7 of
the 141 nonstatistically selected transactions lacked an invoice, credit
card slip, or other sales documentation. This may partly be due to the
fact that lab policy did not require monthly approvers to verify purchases
listed in the cardholder statements against supporting documents. We
further found that Sandia required purchases of restricted items to be
preapproved, but did not require documentation of such approvals for the
majority of our review period. Thirty-one of the 36 (86 percent)
restricted item purchases we reviewed totaling $92,857 did not have any
documented preapproval. Consequently, neither we nor the lab could
determine whether this control was being effectively implemented.

These control weaknesses likely contributed to the approximately $479,645
in improper, wasteful, and questionable purchases we identified during our
review. While relatively small compared to the approximately $102 million
in purchase card activity that occurred during the review period, it
demonstrates vulnerabilities from weak controls that could be exploited to
a greater extent. Specifically, we found 10 improper split purchases-that
is, groups of two or more similar transactions that were split to
circumvent single purchase limits-consisting of 24 transactions totaling
$372,321. Eleven purchases totaling $3,606 we determined to be wasteful
because

4Throughout this document, references to purchases and transactions refer
to those made by the
contractor employees of the lab that are charged to the NNSA contract.
Although the lab's purchase
cards are issued by the contractor, purchases charged to the NNSA contract
are ultimately reimbursed
and thus paid for by the federal government. Similarly, property purchased
that is charged to NNSA
becomes government property.
5Data mining applies a search process to a data set, analyzing for trends,
relationships, and interesting
associations. For instance, it can be used to efficiently query
transaction data for characteristics that
may indicate potentially improper activity.

6We were unable to test the timeliness of supervisory approval for the
remaining 92 transactions
selected. According to Sandia officials, during a computer conversion all
of the approval dates were
changed to December 23, 2002. Thus, we could only perform this test on
transactions that occurred
after the conversion.

                Page 2 GAO-04-989R Sandia Purchase Card Controls

they were excessive in cost compared to other alternatives and/or of
questionable need, such as four laser pointers costing $228 each, when
other laser pointers were available for $90-$120 each. Another 15
transactions totaling $103,718 we considered questionable because they
were missing key documentation that would enable us or the lab to
determine what was purchased and whether the purchases were proper and
reasonable. Because we only tested a small portion of the transactions we
identified that appeared to have a higher risk of fraud, waste, or abuse,
there may be other improper, wasteful, and questionable purchases in the
remaining untested transactions.

Sandia also did not ensure that acquired property and equipment were
tracked properly and in a timely manner. Of 43 assets in our
nonstatistical selection of Pcard transactions, 21 (49 percent) totaling
$39,113 were not recorded in Sandia's property management system at the
time we provided the lab with the list of assets selected. We performed a
physical observation of 88 assets, which included selected assets
identified from the nonstatistical selection of 141 Pcard transactions as
well as assets selected from the property database because they were still
assigned to separated employees or there were multiple assets with the
same serial number. All 88 were either found or-in the case of 12
assets-the lab indicated that the items had been disposed of or written
off. However, because they only record the bar-code number and not the
asset's serial number on the disposal form or the write-off report, we
could not verify that the 12 assets had actually been disposed of or
written off. Furthermore, our physical observation revealed several
inaccuracies in the property database, including data discrepancies,
incorrect location information, and inaccurate property custodians listed.

The lab has made a number of recent policy and procedural changes that, if
properly implemented, should help improve internal controls over its Pcard
purchases. However, additional improvements are needed to further reduce
the risk of improper and wasteful purchases.

Recommendations for Executive Action

In order to address the issues identified in our review, we recommend that
the Administrator of NNSA direct the Sandia National Laboratories'
Director to take the following nine actions.

o  	To strengthen internal controls over the purchase card program and
reduce the lab's exposure to improper, wasteful, and questionable
purchases:

o  	Cancel purchase card accounts for cardholders who perform oversight
functions for the purchase card program to help ensure appropriate
independence and separation of duties between these functions.

o  	Require approving officials to attend initial and periodic refresher
training on Pcard policies and procedures to help ensure their knowledge
of purchasing requirements remains current.

                Page 3 GAO-04-989R Sandia Purchase Card Controls

o  	Emphasize during training for cardholders and approving officials the
laboratory's policies on (1) timely cardholder reconciliation and
supervisory review of transactions, (2) split purchases, (3) transaction
documentation requirements, (4) preapproval requirements for restricted
items, (5) prohibited purchases, and (6) considering best value in making
and approving purchases. Training should also include reminding these
staff of the criteria for accountable assets and the requirements to
notify property management to ensure accountable assets purchased are
identified, bar-coded, and entered into the property management system.

o  	Require approving officials to verify purchases on cardholders'
monthly statements to the detailed sales receipts, invoices or other
independent support showing the description, quantity, and price of
individual items for all purchases made to help ensure that purchases are
adequately documented and are proper purchases before approving. This
should include verifying that there is documented approval for all
purchases of restricted items.

o  	Implement tools, such as data mining, for use by Pcard program staff
in reviewing cardholder purchases for improper purchases. These tools
should be used to systematically monitor for potential split purchases,
unusual vendors, restricted items without approval, and other potentially
improper or wasteful purchases.

o  	Consider modifying the Pcard system so that purchases that are not
reconciled timely by the cardholder are charged to a temporary suspense
account rather than to each cardholder's default project and task codes.

o  	To help improve Sandia's controls over the purchasing, recording, and
safeguarding of assets, we recommend the following.

o  	Require that key information such as the property custodian, location,
serial number, and item description are verified against the information
entered into the property database during physical inventory counts.

o  	Develop a report to enable property management staff to review recent
Pcard purchases for accountable assets that require recording in the
property management system.

o  	Require that serial numbers for items being disposed or written off be
listed on the disposal forms or inventory write-off reports.

We also recommend that the Administrator of NNSA direct the NNSA
contracting officer for the lab to review the improper, wasteful, and
questionable items we identified to determine whether any of these
purchases should be repaid to NNSA.

                Page 4 GAO-04-989R Sandia Purchase Card Controls

Agency Comments

We obtained comments on a draft of this briefing from NNSA headquarters
officials. They generally agreed with the findings and recommendations,
and indicated that the lab has made a number of improvements to their
controls in light of the problems identified at Los Alamos.

We also obtained comments from NNSA's Sandia Site Office, who disagreed
with the recommendation to require approving officials to verify purchases
listed on cardholders' statements against detailed sales receipts or
invoices, indicating that to do so would be labor intensive and cost
prohibitive. They suggested periodic reviews of statistical samples and
data mining instead. While we endorse periodic reviews of sample
transactions and data mining as part of an overall system of internal
control, they are not a substitute for adequate supervisory review. The
approving official's review of transactions is one of the most critical
controls for helping to ensure that purchases are necessary and proper.
Without reviewing independent, detailed support for the individual items
purchased, a reviewer cannot ensure that the actual items purchased were
reasonable and proper, thus increasing the risk of improper purchases.

Lab officials indicated that their efforts over the past 18 months have
resulted in many process and internal control changes, and further changes
are being considered. For example, Sandia management is considering making
training for approving officials mandatory and is looking into the
purchase of data mining software. In addition, the Pcard manager informed
us that the account of the staff member responsible for monitoring Pcard
activities was cancelled on June 8, 2004.

The lab also provided technical and clarifying comments, which we
incorporated as appropriate.

Scope and Methodology

To determine if Sandia's internal controls over its Pcard program provided
reasonable assurance that improper purchases would not occur or would be
detected in the normal course of business, we reviewed Sandia's contract
with NNSA and applicable provisions of the DOE Acquisition Regulation
(DEAR) and the Federal Acquisition Regulation (FAR), performed
walkthroughs of key processes, interviewed Sandia and NNSA management and
staff, and compared the results to the lab's

7

policies and GAO's Standards for Internal Control in the Federal
Government.
These standards provide the overall framework for establishing
and maintaining internal control and for identifying and addressing major
performance and management challenges and areas at greatest risk of fraud,
waste,
abuse, and mismanagement and are based on internal control guidance for
the private
sector.8

7U.S. General Accounting Office, Standards for Internal Control in the
Federal Government,
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999).
8Internal Control-Integrated Framework, Committee of Sponsoring
Organizations of the Treadway
Commission (COSO).

                Page 5 GAO-04-989R Sandia Purchase Card Controls

To determine whether Pcard expenditures complied with lab policies and
other applicable requirements and were reasonable in nature and amount, we
performed data mining on fiscal year 2002 and the first half of fiscal
year 2003 Pcard transactions to identify indicators of potential
noncompliance with policies and procedures and to identify purchases that
appeared to be from unusual vendors, purchases made on weekends, during
the holidays, or at fiscal year-end, and purchases of attractive assets.
Based on the results, we (1) identified 50 potential split purchases and
tested all of them to determine whether they were in fact split purchases
and (2) tested a nonstatistical selection of 141 transactions for evidence
of supervisory review and approval, adequacy of supporting documentation,
and reasonableness of the purchases.

To determine if property controls over selected asset acquisitions
provided reasonable assurance that accountable assets would be properly
recorded and tracked, we performed walkthroughs to observe property
controls, reviewed property management policies and procedures, tested
accountable property items selected in the nonstatistical selection to
determine whether these assets had been entered into the lab's property
system prior to our review, performed data mining on the property database
to identify possible database errors or inaccuracies such as property
assigned to terminated employees and multiple property items with the same
serial number, and performed a physical observation of selected assets to
determine whether they could be properly accounted for.

We requested oral comments on a draft of the enclosed briefing slides from
the Administrator of NNSA or his designee and have included any comments
as appropriate in the letter and enclosed slides. While we identified some
improper, wasteful, and questionable purchases, our work was not designed
to determine the full extent of such purchases. We conducted our work on
all four labs from March 2003 through May 2004 in accordance with
generally accepted government auditing standards.

Unless you publicly announce its contents earlier, we plan no further
distribution of this report until 30 days after its date. At that time, we
will send copies of this report to the Ranking Minority Member, House
Committee on Energy and Commerce; the Secretary of Energy; the
Administrator of NNSA; and the Sandia National Laboratories Director.
Copies will also be made available to others upon request. In addition,
the report will be available at no charge on our home page at
http://www.gao.gov. If you have any questions about this report, please
contact me at (202) 512-9508 or Doreen Eng, Assistant Director, at (206)
287-4858. You may also reach us by e-mail at [email protected] or
[email protected]. Additional contributors to this assignment were Stephanie
Chen, David Elder, Barbara House, Kelly Lehr, Gail Luna, and Lien To.

Linda M. Calbom
Director, Financial Management and Assurance

Enclosure

                Page 6 GAO-04-989R Sandia Purchase Card Controls

List of Requesters

The Honorable Sherwood Boehlert, Chairman
The Honorable Bart Gordon, Ranking Minority Member
Committee on Science
House of Representatives

The Honorable Joe Barton, Chairman
Committee on Energy and Commerce
House of Representatives

The Honorable Jerry Costello
The Honorable James Greenwood
The Honorable W.J. "Billy" Tauzin
House of Representatives

                Page 7 GAO-04-989R Sandia Purchase Card Controls

June 14, 2004, Briefing

                          Sandia National Laboratories

Further Improvements Needed to Strengthen Controls Over the Purchase Card
Program

Briefing to the Staff of the Committees on Science and Energy and
Commerce, House of Representatives

June 14, 2004

Table of Contents

o  Introduction and Objectives  o Results in Brief

o  Background

o  Scope and Methodology

o  Internal Control Weaknesses

o  Improper, Wasteful, and Questionable Purchases

o  Property Management Weaknesses

o  Recent Policy and Procedural Changes

o  Conclusions

o  Recommendations

o  Agency Comments

Introduction and Objectives

o 	Sandia is a government-owned, contractor-operated national laboratory
of the Department of Energy's (DOE) National Nuclear Security
Administration (NNSA).1 It is managed by the Lockheed Martin Corporation
under a cost-reimbursable contract with NNSA. Lockheed Martin is paid a
management fee to operate the lab and is reimbursed for all allowable
costs charged to the contract.

o 	During the fall of 2002, the Federal Bureau of Investigation began
investigating two Los Alamos National Laboratory employees for alleged
misuse of lab credit cards. Other allegations of theft and misuse of
government funds at Los Alamos soon followed.

o 	In light of the problems identified at Los Alamos, you asked us to
review selected procurement and property management practices at two DOE
and two NNSA contractor labs, including Sandia.2

1NNSA was created in fiscal year 2000 as a separately organized agency
within DOE. As part of its national security mission, NNSA has
responsibility for the institutional stewardship of the three national

security laboratories which includes Sandia. 2The four labs we reviewed
were DOE's Lawrence Berkeley National Laboratory and Pacific Northwest
National Laboratory, and NNSA's Lawrence Livermore National Laboratory and
Sandia National

Laboratories.

Introduction and Objectives (cont'd)

o 	The objectives of our review of the Sandia National Laboratories were
to determine whether:

o 	Internal controls over Sandia's purchase card (Pcard) program provided
reasonable assurance that improper purchases would not occur or would be
detected in the normal course of business.

o 	Purchase card expenditures made under the contract (1) properly
complied with lab policies and other applicable requirements and (2) were
reasonable in nature and amount and thus were allowable costs payable to
the contractor under the contract.

o 	Property controls over selected asset acquisitions provided reasonable
assurance that accountable assets would be properly recorded and tracked.

Introduction and Objectives (cont'd)

o 	Our review covered selected transactions that occurred during fiscal
year 2002 and the first half of fiscal year 2003 (October 1, 2001, through
March 31, 2003), which were the most current data available when we
requested the data for our review.

o 	Throughout this document, references to purchases and transactions
refer to those made by the contractor employees of the lab that are
charged to the NNSA contract. Although the lab's purchase cards are issued
by the contractor, purchases charged to the NNSA contract are ultimately
reimbursed and thus paid for by the federal government. Similarly,
property purchased that is charged to NNSA becomes government property.

Results in Brief

Internal control weaknesses in Sandia's Pcard program increased the lab's
risk of improper purchases. Our review of a nonstatistical selection of
141 transactions, while not projectable to the universe of transactions,
indicated a number of control weaknesses. For example,

o 	During the majority of our review period, cardholders who were managers
were allowed to approve their own purchases. Fifteen of the 141 purchases
we reviewed were made by such cardholders and thus did not have any
independent review and approval.

o 	Approving officials did not timely review cardholders' monthly
statements for 14 of 49 transactions tested. In some instances, statements
were not approved up to 16 months after purchase.

o 	Sandia required purchases of restricted items to be preapproved, but
did not require documentation of such approvals for the majorityof our
review period. Thirty-one of the 36 restricted item purchases we reviewed
totaling $92,857 did not have any documented preapproval. Consequently,
neither we nor the lab could determine whether this control was being
effectively implemented.

Results in Brief (cont'd.)

These control weaknesses likely contributed to the approximately $479,645
in improper, wasteful, and questionable purchases we identified during our
review. These included:

o 	Ten improper split purchases-that is, groups of 2 or more similar
transactions that were split to circumvent single purchase limits-
consisting of 24 transactions totaling $372,321.

o 	Eleven purchases totaling $3,606 that we determined to be wasteful
because they were excessive in cost compared to other alternatives and/or
of questionable need, such as four laser pointers costing$228 each, when
other laser pointers were available for $90-$120 each.

o 	Fifteen transactions totaling $103,718 that we considered questionable
because they were missing key documentation that would enable us or the
lab to determine what was purchased and whether the purchases were proper
and reasonable.

Results in Brief (cont'd.)

Sandia also did not ensure that acquired property and equipment were
properly tracked.

o 	Of 43 assets tested, 21 (49 percent) totaling $39,113 were not recorded
in Sandia's property management system at the time we provided the lab
with the list of assets selected.

o 	Furthermore, our physical observation revealed several inaccuracies in
the property database, including data discrepancies, incorrect location
information, and inaccurate property custodians listed.

The lab has made a number of recent policy and procedural changes that, if
properly implemented, should help improve internal controls over its Pcard
purchases. We are making 10 recommendations to address issues raised in
our review that require additional action.

Results in Brief (cont'd.)

o 	NNSA headquarters officials generally agreed with the findings and
recommendations. The Sandia Site Office of NNSA disagreed with the
recommendation to require approving officials to verify cardholders'
purchases against receipts, suggesting instead to review samples and
perform data mining. While these are good controls, they are not a
substitute for adequate supervisory review of independent, detailed
support for individual items purchased. Lab officials indicated they have
made a number of improvements and additional actions are being considered.

Background

o 	Sandia is a nuclear weapons lab that was established in 1949 in
Albuquerque, New Mexico, and expanded to Livermore, California in 1956.

o 	The lab's 8,300 staff are employees of the Lockheed Martin Corporation.
Its fiscal year 2004 budget is expected to be about $2.2 billion.

o 	The lab's Pcard program was established in 1996 and has about 1,800
cardholders.

o 	During fiscal year 2002, the lab made about $68 million in Pcard
purchases.

Background (cont'd.)

o 	Most cardholders have a $25,000 single purchase limit and monthly
limit, although selected employees may have higher transaction and/or
monthly limits, which range from $35,000 to $500,000.

o 	Sandia's property management department provides policy and oversight
for property management at the lab.

o 	Staff within the property management department are responsible for
supporting Sandia employees in tracking and maintaining records of
accountable property.

Background (cont'd.)

o 	Items that qualify as accountable assets are recorded and tracked in
the lab's property management system. Sandia's accountable assets consist
of both "equipment" and "attractive" (sensitive or attractive to theft)
items.

o 	Equipment consists of items costing at least $5,000 with a useful life
of at least 2 years.

o 	Attractive property are items susceptible to misappropriation for
personal use or readily convertible into cash. This includes cameras,
personal computers, and portable power tools costing atleast $1,000; and
firearms and two-way radios regardless of acquisition cost.

o 	Pcards are not to be used to purchase accountable assets without prior
approval.

o 	The lab's property management system had about 52,000 NNSA-owned
accountable assets with a total recorded acquisition cost of about $1
billion.

Scope and Methodology

To determine if Sandia's internal controls over its Pcard program provided
reasonable assurance that improper purchases would be prevented or
detected in the normal course of business, we

o 	Reviewed Sandia's contract with NNSA and applicable provisions of the
DOE Acquisition Regulation (DEAR) and the Federal Acquisition Regulation
(FAR),

o 	Performed walkthroughs of key processes, interviewed Sandia and NNSA
management and staff, and compared the results to the lab's policies and
GAO's Standards for Internal Control in the Federal Government. These
standards provide the overall framework for establishing and maintaining
internal control and for identifying and addressing major performance and
management challenges and areas at greatest risk of fraud, waste, abuse,
and mismanagement and are based on internal control guidance for the
private sector.3

3Internal Control - Integrated Framework, Committee of Sponsoring
Organizations of the Treadway Commission (COSO).

Scope and Methodology (cont'd)

To test specific control activities and determine whether Pcard
expenditures complied with lab policies and other applicable requirements
and were reasonable in nature and amount, we first obtained from the lab
the database of purchase card transactions for fiscal year 2002 and the
first 6 months of fiscal year 2003. We separately obtained from the lab's
Pcard issuing bank the total dollar value of Pcard purchases for the
period to compare to the database for completeness.

o 	Data mining. We performed data mining on the Pcard transaction database
to identify indicators of potential noncompliance with policies and
procedures.

o 	We looked for potential split purchases (i.e., groups of two or more
similar transactions that potentially were split to circumvent single
purchase limits), cardholders with multiple purchase cards, and former
employees who had active purchase card accounts after their separation
dates.

Scope and Methodology (cont'd)

o  We forwarded the results of all transactions that met specific criteria
to the lab for a response and related documentation that we then used to
assess these transactions.

o 	Nonstatistical selection. We performed additional data mining on Pcard
transactions to first identify purchases that appeared to be from unusual
vendors, purchases made on the weekends, during the holidays, or at fiscal
year-end, and purchases of attractive assets.

o  As these analyses yielded thousands of transactions, we then made a
nonstatistical selection of 150 of these transactions totaling $246,035,
taking into account factors such as item description, amount, and
frequency of similar purchases, among other things.

Scope and Methodology (cont'd)

o 	After obtaining the supporting documentation, we found that nine
transactions were reversed for various reasons, such as three charges made
by unknown perpetrators with stolen Pcards, two due to vendor errors, and
one accidental personal use that was repaid the month after purchase.
Because we verified that all nine transactions had been reversed, we
eliminated these from the selection.

o 	We used the remaining 141 transactions totaling $225,727 to test
specific control activities, such as segregation of duties, evidence of
supervisory review and approval, and adequacy of supportingdocumentation,
as well as to examine the allowability and reasonableness of the
purchases.

To determine if property controls over selected asset acquisitions
provided reasonable assurance that accountable assets would be properly
recorded and tracked, we

o  Performed walkthroughs to observe property controls,

o  Reviewed property management policies and procedures,

Scope and Methodology (cont'd)

o 	Tested accountable property items selected in the nonstatistical
selection to determine whether these assets had been entered into the
lab's property system prior to our review,

o 	Performed data mining on the property database to identify possible
database errors or inaccuracies such as property assigned to terminated
employees and multiple property items with the same serial number, and

o 	Performed a physical observation of selected assets to determine
whether they could properly be accounted for.

While we identified some improper, wasteful, and questionable purchases,
our work was not designed to determine the full extent of improper
purchases. We conducted our work on all four labs from March 2003 through
May 2004 in accordance with generally accepted government auditing
standards.

Internal Control Weaknesses

During the period of our review, Sandia's internal controls did not
provide reasonable assurance that improper Pcard purchases would not occur
or would be detected in the normal course of business. Weaknesses we
identified included the following.

Segregation of Duties: Sandia did not ensure that Pcard duties were
adequately separated to minimize the risk of waste, fraud, or abuse.

o 	The Standards for Internal Control in the Federal Government states
that key duties and responsibilities should be divided or segregated among
different people to reduce the risk of error or fraud. This should include
separating the responsibilities for authorizing transactions, processing
and recording them, reviewing the transactions, and handling any related
assets.

Internal Control Weaknesses (cont'd.)

o 	During the majority of our review period, the lab's policy allowed
cardholders that were managers to approve their own purchases.
Consequently, 15 out of the 141 (11 percent) Pcard transactions we tested
totaling $18,253 had not been reviewed or approved by a second party
because the cardholder was a manager.

o 	In addition, one of the Pcard staff responsible for monitoring Pcard
activities for compliance was also a cardholder. This creates a conflict
of interest between the cardholder and program oversight role, elevating
the risk that spending improprieties would not be detected.

Internal Control Weaknesses (cont'd.)

Supervisory Review: The approving official's review of each purchase card
transaction is one of the most important controls to help ensure that all
purchases are appropriate. We found that this critical control was
compromised because of untimely supervisory review.

o 	After cardholders reconciled the charges listed on their monthly
statements to supporting documents, approving officials were required to
review and approve the monthly statements within about a month of the
statement date. However, we found that 14 of the 49 transactions we could
test4 (29 percent) totaling $21,437 were approved from 3 to 16 months
after the cardholder's statement date. For example, one purchase of a
digital camera wasn't approved until 16 months after purchase.

o 	Without timely review and approval of purchases, the lab's ability to
deter improper purchase card use, file a dispute, or return an item if the
charge or purchase is improper is severely limited.

4We were unable to test the timeliness of supervisory approval for the
remaining 92 transactions selected. According to Sandia officials, during
a computer conversion all of the approval dates were changed to December
23, 2002. Thus, we could only perform this test on transactions that
occurred after the conversion.

Internal Control Weaknesses (cont'd.)

Transaction Documentation: We also identified weaknesses in the
documentation of transactions, including transactions that lacked key
supporting documentation to identify specifically what was purchased and
the related cost, as well as documented approval for restricted purchases.

o GAO's Standards for Internal Control in the Federal Government states
that transactions and other significant events need to be clearly
documented, and the documentation should be readily available for
examination.

o 	Sandia cardholders were required to retain their receipts for 3 years
for purchases of $2,000 or less and 7 years for purchases over $2,000.

Internal Control Weaknesses (cont'd.)

o 	We found seven of the transactions (5 percent) totaling $4,845 in the
nonstatistical selection lacked an invoice, credit card slip, or other
sales documentation.

o  Without such documentation, the laboratory did not have any independent
evidence of the description and quantity of what was purchased and/or the
price paid.

o  One contributing factor to the missing documentation may partly be the
fact that lab policy did not require monthly approvers to verify purchases
listed in the cardholder statements against supporting documents.
Therefore, there was no supervisory review to help ensure such
documentation was retained.

Internal Control Weaknesses (cont'd.)

o 	Although Sandia required cardholders buying designated restricted items
to obtain approval before purchase, it did not require documentation of
such approvals until January 2003. As a result, 31 of the 36 (86 percent)
restricted item purchases we reviewed totaling $92,857, did not have any
documented preapproval for the purchase. Consequently, there was no
assurance that such approval had actually been obtained. Examples of some
of these included:

o  Radios: 20 2-way radios totaling $10,961.

o  Computers: 9 computers totaling $25,384.

o  Cameras: 3 cameras and accessories totaling $19,083.

Internal Control Weaknesses (cont'd.)

Reconciliation of transactions: Cardholders were to reconcile their
transactions electronically on the Pcard system to supporting documents
monthly to verify that the charges were correct, input the item
descriptions, and record the proper project and task codes for each
transaction. If the cardholder did not perform this reconciliation, the
Pcard system automatically charged the transactions to the cardholder's
default project and task codes which may or may not be appropriate for
each purchase.

o 	Each cardholder must establish a default project and task code when
they open a Pcard account. The project and task codes determine whether
costs are charged to the NNSA contract, a contract for another agency or
sponsor, or absorbed by the contractor as in the case of unallowable
costs. These codes also indicate the specific project or overhead account
that the expense is to be charged to.

Internal Control Weaknesses (cont'd.)

o 	Since each cardholder may make purchases for many requesters and
purposes, their default codes may not be appropriate for some purchases.
If the cardholder's default codes are for a specific NNSA project and they
make purchases that are not supposed to be charged to the contract,
failure to perform the monthly reconciliation will result in these
purchases initially being charged to NNSA. If uncorrected, NNSA may
reimburse the lab for these non-NNSA expenditures.

o 	Until December 2002, Pcard administrators did not run any exception
reports to identify cardholders who did not reconcile their purchases to
ensure such transactions were properly recorded.

Internal Control Weaknesses (cont'd.)

Training: Although approving officials play a critical role in helping to
ensure that purchases are allowable and reasonable, they were not required
to attend any training to help ensure they were knowledgeable about
current Pcard policies and procedures.

o GAO's Standards for Internal Control in the Federal Government states
that training should be aimed at developing and retaining employee skill
levels to meet changing organizational needs. Qualified and continuous
supervision should be provided to ensure that internal control objectives
are achieved.

o 	Lab officials told us that approving officials were given e-mail
reminders and periodic newsletters reminding them of Pcard policies. In
addition, Web-based and classroom training is available for approving
officials, but is voluntary. However, as discussed later, we identified
many instances where approving officials had approved improper purchases.
Consequently, required training for approving officials-who are
responsible for ensuring that the purchases they approve comply with
requirements-is essential.

Improper, Wasteful, and Questionable Purchases

We also identified improper, wasteful, and questionable purchases totaling
$479,645 indicating additional areas where controls could be improved. As
discussed below, most of these related to split purchases.

Improper Purchases: We identified 24 transactions totaling $372,321 of
improper purchases, which we defined as purchases that violated the NNSA
contract or lab policy. All of these improper purchases were improper
"split" purchases. Sandia's purchase card policy prohibits splitting
purchases into more than one transaction to circumvent single purchase
limits. Using data mining techniques, we identified 50 potential split
purchases-that is, groups of two or more similar transactions that
potentially were split to circumvent single purchase limits. After
reviewing the supporting documents, we determined 10 were in fact split
purchases consisting of 24 transactions totaling $372,321.

Improper, Wasteful, and Questionable Purchases (cont'd.)

o 	For example, a cardholder purchased one 61-inch plasma screen costing
$32,048. Because the total exceeded her single purchase limit of $25,000,
the total was split into two separate transactions so that the two
individual charges fell below the limit.

o 	We also identified three potential split purchases consisting of 10
transactions totaling $98,945 for which the lab was unable to provide
sufficient documentation to determine whether these were in fact split
purchases. However, based on the available information, these transactions
shared similar characteristics-i.e., multiple purchases by a cardholder at
one vendor on the same day that in total exceeded the cardholder's single
purchase limit-with the types of transactions that we were able to confirm
as being split purchases, and therefore, we considered these transactions
to be potentially improper.

Improper, Wasteful, and Questionable Purchases (cont'd.)

Wasteful Purchases: We also identified 11 purchases totaling $3,606 that
we determined to be wasteful-that is, were excessive in cost compared to
other available alternatives and/or were of questionable need.

o 	We considered them excessive in cost when compared to available
alternatives that would meet the same basic need, or of questionable need
when they appeared to be items that were a matter of personal preference
or convenience, were not part of the usual and necessary equipment for the
work the employees were engaged in, and/or did not appear to benefit NNSA.

Improper, Wasteful, and Questionable Purchases (cont'd.)

Examples of wasteful purchases we identified included:

o  $912 for four laser pointers costing $228 each. We found laser pointers
available ranging from $90 to $120 each.

o  $350 for an air purifier from Sharper Image. We question both the need
for this item as well as the cost, given that other air purifiers are
available for $100-$220, and there was no documented medical need.

o  $170 to a limousine service for a 15-passengervehicle and driver to
take a visiting researcher and his family to the airport. Door-to-door van
shuttle service costs about $65.

Improper, Wasteful, and Questionable Purchases (cont'd.)

Questionable Purchases: We identified 15 transactions totaling $103,718
that we classified as questionable because there was insufficient
documentation to determine what was actually purchased, and whether
purchases were proper and reasonable.

o 	Five of these transactions totaling $4,773 were purchases from the
following vendors, for which the cardholders or the lab indicated they
couldn't find the receipts:

o  Skymall.com -$175

o  Staples -$1,504

o  IGO.com5 -$114

o  CompUSA -$2,778

o  Hilton Hotels -$201

5This Internet vendor sells mobile electronics such as mobile phones,
notebook computers, and PDAs.

Improper, Wasteful, and Questionable Purchases (cont'd.)

o 	As mentioned previously, we also identified three potential split
purchases consisting of 10 transactions totaling $98,945 for which the lab
was unable to provide sufficient supporting documentation to determine
whether these were in fact split purchases. Because of this lack of
documentation, we also could not determine whether the purchases were
proper and therefore consider these to be questionable.

While the $479,645 of improper, wasteful, and questionable transactions is
relatively small compared to the $102 million in purchase card activity
that occurred during our review period, it demonstrates vulnerabilities
from weak controls that could be exploited to a greater extent. In
addition, because we only tested a small portion of the transactions we
identified that appeared to have a higher risk of fraud, waste, or abuse,
there may be other improper, wasteful, and questionable purchases in the
remaining untested transactions.

Property Management Weaknesses

Property Management: GAO's Standards for Internal Control in the Federal
Government requires agencies to establish physical control to secure and
safeguard vulnerable assets. Such assets should be periodically counted
and compared to control records. Sandia policy requires that equipment and
attractive property be tagged with bar-code property numbers and tracked
in the property management system through this unique identifier.

Sandia's property controls did not provide reasonable assurance that
accountable assets would be properly recorded and tracked. We identified
the following weaknesses in Sandia's controls over property:

Property Management Weaknesses (cont'd.)

o 	In our review of the nonstatistical selection of Pcard transactions, we
found that 21 out of the 43 accountable assets purchased (49 percent) with
a value of $39,113 had not been recorded in the lab's property management
system prior to the items being selected for our review. This can be
attributed at least in part to the following:

o 	Items purchased using a Pcard were not required to be delivered to the
lab's central receiving department. If they were delivered there, those
items were not opened by central receiving to determine the contents, but
were simply passed on unopened to the requestor's building.

o 	As a result, the end user was responsible for determining whether the
items were equipment or attractive assets and, if so, contacting property
management to bar-code the item(s) and enter them into the property
management system. Consequently, these assets were at greater risk of not
being recorded in the property management system.

Property Management Weaknesses (cont'd.)

o 	We performed a physical observation of 88 assets, which included
selected assets identified from the nonstatistical selection of Pcard
transactions as well as assets selected from the property database because
they were still assigned to separated employees or there were multiple
assets with the same serial number. While we did not find any missing
assets, we did note the following:

o 	Five items totaling $502,317 were entered under the wrong serial number
in the property database. For example, we observed two assets that had the
same serial number in the property database, and found that both had been
entered incorrectly in the database. In another example, the serial number
we obtained from the vendor matched the serial number on the asset, but
the serial number entered into the database under the bar-code number on
the asset was incorrect.

Property Management Weaknesses (cont'd.)

o 	Lab officials informed us that 12 items totaling $89,574 had been
subsequently disposed of or written off and provided us copies of the
documentation. However, because they only record the barcode number and
not the asset's serial number on the disposal form or the write-off
report, we could not verify whether the correct item was disposed of or
written off.

o 	Nine items totaling $231,438 were located in a different building than
that indicated in the property database. Inaccurate location information
makes it more difficult to maintain accountability for lab assets.

o 	Eight items totaling $233,809 were assigned to a different custodian
than that listed in the database. Consequently, the lab did not have the
proper accountable party recorded for the assets.

Recent Policy and Procedural Changes

During or subsequent to the period covered by our review, Sandia took a
number of steps to improve its oversight and control over purchases and
property. According to the Pcard program manager, these changes included
the following:

o 	Beginning in December 2002, the Pcard program office began running
monthly reports to monitor and follow up on potential problems, including
reports on the following:

o  Items that were reconciled to the default project and task codes,

o  Monthly statements that had not been approved by the supervisors, and,

o  Disputed items.

Recent Policy and Procedural Changes (cont'd)

o 	Beginning January 2003, managers who were cardholders were no longer
allowed to approve their own purchases. They are now required to have
their monthly statements approved by the next (higher) level manager.

o 	After January 2003, cardholders were required to obtain documented
approval from their manager and the Pcard office before purchasing
restricted items. In the case of approved purchases of property items, the
documented approval included instructions to the end user and their
management to obtain barcodes for the items and enter them into the
property management system.

Because these changes primarily occurred subsequent to our review period,
we have not assessed the effectiveness of the changes. If implemented
properly, these should help improve the lab's oversight of its Pcard
purchases. However, additional issues remain which, if not addressed, will
continue to expose the lab to improper and wasteful purchases.

Conclusions

Although Sandia had established some internal controls over its Pcard
program and property management functions, weaknesses in the design and
operation of these internal controls limited their effectiveness. The lab
has made some changes to its Pcard policies and procedures in response to
weaknesses identified. While these are positive steps, management needs to
ensure that it gives continued attention to ongoing monitoring of
compliance with policies and procedures, continually assessing and
addressing the risks and evaluating and improving the effectiveness of its
controls to reduce its exposure to improper, wasteful, or potentially
fraudulent purchases.

Recommendations

We recommend that the Administrator of NNSA direct the Sandia National
Laboratories' Director to take the following nine actions:

o 	To strengthen internal controls over the purchase card program and
reduce the lab's exposure to improper, wasteful, and questionable
purchases,

o 	Cancel purchase card accounts for cardholders who perform oversight
functions for the purchase card program to help ensure appropriate
independence and separation of duties between these functions.

o 	Require approving officials to attend initial and periodic refresher
training on Pcard policies and procedures to help ensure their knowledge
of purchasing requirements remains current.

Recommendations (cont'd.)

o 	Emphasize during training for cardholders and approving officials the
laboratory's policies on (1) timely cardholder reconciliation and
supervisory review of transactions, (2) split purchases, (3) transaction
documentation requirements, (4) preapproval requirements for restricted
items, (5) prohibited purchases, and (6) considering best value in making
and approving purchases. Training should also include reminding these
staff of the criteria for accountable assets and the requirements to
notify property management to ensure accountable assets purchased are
identified, bar-coded, and entered into the property management system.

o 	Require approving officials to verify purchases on cardholders' monthly
statements to the detailed sales receipts, invoices or other independent
support showing the description, quantity, and price of individual items
for all purchases made to help ensure that purchases are adequately
documented and are proper purchases before approving. This should include
verifying that there is documented approval for all purchases of
restricted items.

Recommendations (cont'd.)

o  Implement tools, such as data mining, for use by Pcard program staff in
reviewing cardholder purchases for improper purchases. These tools should
be used to systematically monitor for potential split purchases, unusual
vendors, restricted items without approval, and other potentially improper
or wasteful purchases.

o  Consider modifying the Pcard system so that purchases that are not
reconciled timely by the cardholder are charged to a temporary suspense
account rather than to each cardholder's default project and task codes.

Recommendations (cont'd.)

o 	To help improve Sandia's controls over the purchasing, recording, and
safeguarding of assets, we recommend the following:

o  Require that key information such as the property custodian, location,
serial number, and item description are verified against the information
entered into the property database during physical inventory counts.

o  Develop a report to enable property management staff to review recent
Pcard purchases for accountable assets that require recording in the
property management system.

Recommendations (cont'd.)

o  Require that serial numbers for items being disposed or written off be
listed on the disposal forms or inventory write-off reports.

o 	We also recommend that the Administrator of NNSA direct the NNSA
contracting officer for the lab to review the improper, wasteful, and
questionable items we identified to determine whether any of these
purchases should be repaid to NNSA.

Agency Comments

o 	We obtained comments on a draft of this briefing from NNSA headquarters
officials. They generally agreed with the findings and recommendations,
and indicated that the lab has made a number of improvements to their
controls in light of the problems identified at Los Alamos.

o 	We also obtained comments from NNSA's Sandia Site Office, who disagreed
with the recommendation to require approving officials to verify purchases
listed on cardholders' statements against detailed sales receipts or
invoices, indicating that to do so would be labor intensive and cost
prohibitive. They suggested periodic reviews of statistical samples and
data mining instead.

o 	While we endorse periodic reviews of sample transactions and data
mining as part of an overall system of internal control, they are not a
substitute for adequate supervisory review. The approving official's
review of transactions is one of the most critical controls for helping to
ensure that purchases are necessary and proper. Without reviewing
independent, detailed support for the individual items purchased, a
reviewer cannot ensure that the actual items purchased were reasonable and
proper, thus increasing the risk of improper purchases.

Agency Comments (cont'd)

o 	Lab officials indicated that their efforts over the past 18 months have
resulted in many process and internal control changes, and further changes
are being considered. For example, Sandia management is considering making
training for approving officials mandatory and is looking into the
purchase of data mining software. In addition, the Pcard manager informed
us that the account of the staff member responsible for monitoring Pcard
activities was cancelled on June 8, 2004.

o 	The lab also provided technical and clarifying comments, which we
incorporated as appropriate.

(190132) EUR

GAO's Mission	The Government Accountability Office, the audit, evaluation
and investigative arm of Congress, exists to support Congress in meeting
its constitutional responsibilities and to help improve the performance
and accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of The fastest and easiest way to obtain copies of GAO
documents at no cost

is through GAO's Web site (www.gao.gov). Each weekday, GAO postsGAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To Testimony have GAO e-mail you a list of newly posted products
every afternoon, go to

www.gao.gov and select "Subscribe to Updates."

Order by Mail or Phone	The first copy of each printed report is free.
Additional copies are $2 each. A check or money order should be made out
to the Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are discounted 25
percent. Orders should be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: 	Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

To Report Fraud, Contact:
Waste, and Abuse in Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: [email protected] Programs Automated answering system: (800)
424-5454 or (202) 512-7470

Congressional 	Gloria Jarmon, Managing Director, [email protected] (202)
512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125

Relations Washington, D.C. 20548

Public Affairs Jeff Nelligan, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
*** End of document. ***