Purchase Cards: Control Weaknesses Leave Two Navy Units Vulnerable to Fraud and Abuse

On October 17, 2001 the Navy modified their agency wide policies by issuing interim change #PC02-5 - DON PURCHASE CARD PROGRAM INTERNAL MANAGEMENT CONTROLS to NAVSUP 4200.94 purchase card instructions, which among other things, established minimum criteria prospective cardholders must meet prior to being issued a purchase card. As a result of these actions by the Navy, by January 21, 2002 NPWC had reduced the number of its cardholders to 185 (12% of employees), and as a result, accomplished a significant reduction in its financial exposure from excessive purchase cards. Similarly, SPAWAR subsequently took actions to increase the number of its AOs, and combined with actions to reduce cardholders, SPAWAR substantially moved towards compliance with the Navy instruction by January 21, 2002. In addition, on September 19, 2002, the Navy issued revised eBusiness Operations Office Instruction 4200.1 that incorporates the Department of Defense "Span of Controls Goals" which resulted in approving officials having a reasonable number of cardholders. The instruction also require that, no less than semiannually, agency program coordinators review the continuing need of each account under their purview.

In response to our recommendation, the Navy established separate Navy-wide purchase card desk guidelines. These guidelines were updated in September 2003, and describe individual functions and responsibilities for cardholders, approving officials, and agency program coordinators, and the criterion for who should be selected as a cardholder. Navy reported that it considered the feasibility of conducting credit checks and determined that DOD should issue a DOD-wide policy on credit checks. These actions significantly improve agency program coordinators, approving officials, and cardholderss understanding of their respective roles and responsibilities related to the purchase card program.

On August 31, 2001, the Navy issued Navy-wide instructions to commanders to review purchase cardholder accounts and credit limits and to revise or cancel those considered inappropriate or excessive. As of January 21, 2002 NPWC had reduced its total monthly cardholder purchase limit to $12.1 million, and by February 2002 had further reduced that limit to $5.6 million, resulting in an overall reduction in annual financial exposure from excessive credit limits on purchase cards by $94.8 million ((from $13.5 million down to $5.6 million) x 12 months) or 60 percent. On September 19, 2002, the Navy issued revised eBusiness Operations Office Instruction 4200.1 which defines the policy for credit limits. In addition, the eBusiness Operations Office monitors credit limits quarterly and takes action when it appears that existing credit limits exceed mission requirements. Credit cards are now a critical element in the revised semiannual review procedures.

The Navy concurred, and on August 31, 2001, Navy issued Navy-wide instructions for stand down training of all cardholders and approving officials, with the results to be reported to Navy Supply Systems headquarters. In June through September 2001, NPWC held and provided the required documentation showing that all but 15 NPWC cardholders and approving officials attended the training sessions. NPWC subsequently canceled the accounts of those 15 personnel that did not take the required training.

Our November 2001 report on the two Navy sites recommended that the Navy develop guidance for routine distribution of rebate earnings to Navy units and activities. The Department of Defense Appropriations Act, 2002 (P.L. 107-117, January 10, 2002) includes language in section 8103 that government purchase card refunds "may be credited to operation and maintenance accounts of the Department of Defense which are current when the refunds are received." This appropriations act section clarifies the appropriate account and fiscal year to credit for purchase card rebates. On July 10, 2003, the Naval Audit Service reported that in response to the legislative change, the Navy received purchase card rebates totaling $16.3 million. Thus, this action resulted in the Navy increasing its FY 2003 operation and maintenance account funding by that $16.3 million.

The Navy made a determination to retain the rebates at the department level in lieu of disbursing them to lower echelons.

We recommended that the Commander of the Naval Supply Systems Command establish in NAVASUP Instruction 4200.94 further guidelines for an effective internal review program, such as having reviewers analyze monthly summary statements to identify (1) potentially fraudulent, improper, and abusive purchases and (2) any patterns of improper cardholder transactions. On September 19, 2002, the Navy issued revised DONEBUSOPSOFF Instruction 4200. Among other requirements, the instruction included a section on agency program coordinator review. One requirement responding to GAO's recommendation is that the APC conduct a monthly review of all card accounts under the APC's cognizance and report the results to the commanding officer. The review is supposed to target fraudulent, improper, abusive and wasteful transactions. The Navy actions should improve monitoring and review of purchase card activities.

On September 19, 2002, the Navy issued revised DONEBUSOPSOFF Instruction 4200. Among other requirements, the instruction included a section on agency program coordinator (APC) review. That section required the APC to conduct and document semi-annual reviews of local operating procedures, internal management controls and transactions, and provide a copy of the report to the commanding officer. According to the revised procedures the report will list all recommended actions to improve program management, and identify all actions taken to improve the deficiencies noted in the semi-annual review. The instruction also requires major Naval claimants to report semi-annually to the Department of Navy eBusiness Operations Office on purchase card activities, including questionable transactions and weaknesses in internal management controls. The Navy actions should improve monitoring and review of purchase card activities.

On September 19, 2002, the Navy issued revised DONEBUSOPSOFF Instruction 4200. Among other requirements, the instruction included a section on agency program coordinator (APC) review. That section required the APC to conduct and document semi-annual reviews of local operating procedures, internal management controls and transactions, and provide a copy of the report to the commanding officer. According to the revised procedures the report will list all recommended actions to improve program management, and identify all actions taken to improve the deficiencies noted in the semi-annual review. The instruction also requires major Naval claimants to report semi-annually to the Department of Navy eBusiness Operations Office on purchase card activities including questionable transactions and weaknesses in internal management controls. The Navy actions should improve monitoring and review of purchase card activities.

Navy included systematic purchase card weaknesses identified from the semiannual report in the Secretary of the Navy's Annual Statement of Assurance.

As a result of GAO's recommendation, on September 19, 2002, the Navy issued revised instruction, DONEBUSOPSOFF 4200.1, which identified specific duties for cardholders and approving officials requiring that cardholders document that receipt, acceptance, and inspection has been accomplished on all items acquired with a purchased card prior to being certified for payment. As a result of GAO's work, the Navy revised its instruction to ensure better accountability for receipt and acceptance of items acquired with a purchase card.

As a result of GAO's recommendation, on September 19, 2002, the Navy issued revised instruction, DONEBUSOPSOFF 4200.1, which identified specific duties for cardholders and approving officials requiring that cardholders document that receipt, acceptance, and inspection has been accomplished on all items acquired with a purchased card prior to being certified for payment. As a result of GAO's work, the Navy revised its instruction to ensure better accountability for receipt and acceptance of items acquired with a purchase card.

As a result of GAO's work, the Navy revised its DONEBUSOPSOFF instruction 4200.1 on September 19, 2002. The revised instruction establishes specific duties for both cardholders and approving officials. Cardholders duties now specifically require cardholders to review the monthly purchase card statement to ensure that all charges are proper and accurate and forward the monthly statement to the approving official with the appropriate supporting documentation, i.e, sales slips, documentation of receipt and acceptance, purchase log, etc., in a timely manner. Approving officials are now required to ensure that cardholders purchases are appropriate and that proper receipt, acceptance, and inspection is accomplished in a timely manner before certification for payment. As a result of GAO's work, some abusive and questionable purchases will not go undetected by the Navy.

On March 12, 2002 the Navy rescinded the Comptroller policy letter dated June 3, 1999.

Both Public Works Center San Diego and SPAWAR Systems Center San Diego concurred and are complying. Internal operating procedures at both sites include guidance on the issue.

The Navy PCPMO issued policy as an interim change to NAVSUP Instruction 4200.94 -- Standards of Compliance for Timely Recording and Classifying of Navy Purchase Card Commitments and Obligations, which reiterates existing Navy and DOD Financial Management Regulation policy regarding the issue.

Both Public Works Center San Diego and SPAWAR Systems Center San Diego concurred and are complying. The Navy issued policy as an interim change to NAVSUP Instruction 4200.94 - Standards of Compliance for Timely Recording and Classifying of Navy Purchase Card Commitments and Obligations, which reiterated existing Navy and DOD Financial Management Regulation policy regarding the issue.

In response to the recommendation, the Navy issued a revised purchase card instruction, DONEBUSOPSOFF 4200.1 on September 19, 2002. The revised instruction requires units to establish local operating procedures for property management, cardholders to promptly notify that property accountability officer concerning the acquisition of pilferable property with a purchase card, and approving officials to monitor cardholder adherence to the new policy. In addition, the new policy discusses additional record keeping requirements for pilferable items that have a ready resale value or application to personal possession and are, therefore, especially subject to theft. In late 2003 Navy officials reported to us that SWAWAR and NPWC San Diego implemented these policies. As a result of GAO's work, the Navy issued revised instructions that will better protect pilferable items acquired with purchase cards.

The Navy concurred with GAO's recommendation, and took action to cancel all 2,600 compromised accounts. This action by the Navy resulted in an immediate and significant reduction in its exposure to loss from fraudulent use of these compromised purchase card account numbers.

At the direction of the Navy PCPMO, a 100% transactional review was conducted at all activities, with one of the review elements being purchases made at excessive cost and/or of questionable need. Where activities identified items of excessive cost or questionable need, they certified to the Navy PCPMO that appropriate action was taken.

In September 2003, the Navy updated their policies and procedures for the operation and management of the government commercial purchase card program which requires the purchase cardholder to maintain a purchase card log. The log and supporting documents, including the request for procurement document or email request, provide an audit trail supporting the decision to use the card and any required special approvals that were obtained. The new guidance also states that the purchase cardholder will be held peculiarly liable for misuse of the card and indicates appropriate remedies or penalties for unauthorized use of the card.

In September 2003, the Navy updated their policies and procedures for the operation and management of the government commercial purchase card program, which provided as a general rule that cardholders are not authorized to purchase fuel, oil, services, or maintenance and repairs of GSA vehicles. The policy also noted that payment of certain recurring services must be documented and approved by the commanding officer. Navy also revised instructions to provide expanded guidance with regard to purchasing special attention items, such as mandatory sources of supply, utility bills, and video teleconferencing equipment.

In September 2003, the Navy updated their policies and procedures for the operation and management of the government commercial purchase card program and required Department of the Navy activities to "bulk" fund to the maximum extent practical for all purchase card transactions. Department of the Navy describes "bulk" funding as an advance reservation for funds where a commitment or obligation is recorded in the aggregate rather than by individual transaction.

In response to our recommendation, the Navy issued eBusiness Operations Office Instruction (EBUSOPSOFFINST) 4200.1 on September 19, 2002. This instruction states "In the absence of specific statutory authority purchase of items for the personal benefit of government employees, such as flowers, food, etc., are not permitted and are therefore, improper transactions. The use of the purchase card for personal purchases for any reason is strictly prohibited." The Navy's action of clarifying the current guidance on the propriety of purchasing food, flowers, and similar personal items could help reduce improper purchase card use for these items.

In response to our recommendation, the Navy issued eBusiness Operations Office Instruction (EBUSOPSOFFINST) 4200.1 on September 19, 2002, which discusses the prohibition of split purchases. Specifically, the instruction states that cardholders shall not split requirements that exceed the micro-purchase threshold to avoid competition requirements or break down requirements to circumvent single purchase limits. In addition, the Navy has training modules that emphasize the prohibition of split purchases, as do all monthly and semiannual program reviews. Further, Navy's agency program coordinators within the purchase card program have an online tool to monitor split purchases. These actions should help the Navy to promptly prevent or identify potentially improper, abusive, and questionable transactions.

As part of the audit of key internal controls over purchase card activity at two Navy units based in San Diego, California--Navy Public Works Center and Space and Naval Warfare Systems command--we found that neither unit had established an effective monitoring and internal audit function for the purchase card program. Further, the Navy's purchase card policies and procedures did not require that the results of internal reviews be documented or that actions be monitored to help ensure that they are effectively implemented. To correct this internal control weakness, we recommended that the Commander of the Naval Supply Systems Command establish in NAVASUP Instruction 4200.94 further guidelines for an effective internal review program, such as having reviewers analyze monthly summary statements to identify (1) potentially fraudulent, improper, and abusive purchases and (2) any patterns of improper cardholder transactions. On September 19, 2002, the Navy issued revised DONEBUSOPSOFF Instruction 4200. Among other requirements, the instruction included a section on agency program coordinator review. One requirement responding to GAO recommendation is that the APC conduct a monthly review of all card accounts under the APC's cognizance and report the results to the commanding officer. The review is suppose to target fraudulent, improper--including split purchases, abusive and wasteful transactions. The Navy actions should improve monitoring and review of purchase card activities.

To make purchase card program officials accountable for their actions, GAO recommended that the Director, Department of Navy eBusiness Operations Office modify NAVSUP Instruction 4200.94 to include a schedule of disciplinary actions that could be used as a guide for taking action against cardholders who make improper or abusive acquisitions with the purchase card. In response to the recommendation, DOD issued a schedule of disciplinary actions that Navy incorporated in the revised Navy EBUSOPSOFF instruction 4200.1A. As a result of GAO's work, the Navy has deterrence for improper or abusive use of the purchase card by establishing a schedule of disciplinary consequences for cardholders who abuse their card carrying responsibilities.

In response to our recommendation, the Navy reported that role-based training for APCs, AOs, and cardholders have been developed and distributed to all participants on CD ROM and are also posted to the DON EBUSOPSOFF Web site for downloading. This version contains seven training modules and a desk guide for each module for use by APCs. This action by the Navy helps to ensure that its training program is effective by being individually tailored and, thus, ensuring that individuals acquire the knowledge needed for the different tasks in the purchase card management.