oversight

Purchase Cards at the U.S. Department of Education.

Published by the Department of Education, Office of Inspector General on 2002-04-09.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                Audit of Purchase Cards
                         at the U.S. Department of Education




                                  FINAL AUDIT REPORT
                                           ED-OIG/A17-C0002
                                              April 2002




Our mission is to promote the efficiency,                     U.S. Department of Education
effectiveness, and integrity of the Department’s              Office of Inspector General
programs and operations.                                      Washington, DC
                                         NOTICE

Statements that management practices need improvement, as well as other conclusions and
recommendations in this report, represent the opinions of the Office of the Inspector General.
Determination of corrective action to be taken will be made by the appropriate Department of
Education officials.

In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office of
Inspector General are available, if requested, to members of the press and general public to the
extent information contained therein is not subject to exemptions in the Act.
Audit of Purchase Cards at the U.S. Department of Education                                                      ACN: ED-OIG/A17-C0002




                                             TABLE OF CONTENTS


EXECUTIVE SUMMARY................................................................................................................1



AUDIT RESULTS .............................................................................................................................2

   FINDING NO. 1 - ON-SITE INTERNAL CONTROL REVIEW GUIDELINES NEED TO BE DEVELOPED
                   AND REVIEWS CONDUCTED ....................................................................................2

      Recommendation …………………………………………………………………………………3

   FINDING NO. 2 - THE NUMBER OF CARDHOLDERS ASSIGNED TO AN APPROVING OFFICIAL
                   NEEDS TO BE REASSESSED ....................................................................................3

       Recommendations ………………………………………………………………………………4


OTHER MATTERS .........................................................................................................................5

BACKGROUND ……………………………………………………………………………………6

OBJECTIVES, SCOPE AND METHODOLOGY …………………………………………………7

STATEMENT ON MANAGEMENT CONTROLS ......................................................................8

ATTACHMENTS
   ATTACHMENT 1 - STATUS OF PRIOR OIG RECOMMENDATIONS ..........................................................9

   ATTACHMENT 2 - SYSTEM ENHANCEMENTS ...................................................................................14

   ATTACHMENT 3 - NUMBER OF CARDHOLDERS TO APPROVING OFFICIALS .......................................17

   ATTACHMENT 4 - AUDITEE COMMENTS ..........................................................................................19




                                                               Page i
Audit of Purchase Cards at the U.S. Department of Education                                    ACN: ED-OIG/A17-C0002




                                            EXECUTIVE SUMMARY

The objective of our audit was to determine if the U.S. Department of Education (ED or
Department) has addressed the internal control weaknesses and related issues identified in a prior
Office of Inspector General (OIG) report1 focusing on the current purchase card systems,
implemented before and after January 22, 2002.

Prior OIG review resulted in 22 recommendations. The Department has asserted that corrective
actions has been taken for all of the 22 recommendations. Attachment 1 sets forth the OIG
recommendations and corrective actions taken by the Department.

ED’s Administrative Communications Directive OCFO:3-104, Government-wide Commercial
Purchase Card Program, issued on January 23, 2002, sets forth policy for the use of purchase
cards and the responsibilities for all employees, education boards, commissions and councils who
participate in ED’s purchase card program for the procurement of and payment for goods and
services used by ED. The directive supercedes ED’s Commercial Credit Card Directive, originally
issued on March 12, 1990, and modified by pen and ink changes in March 1992.

ED’s Contracts and Purchasing Support System (CPSS) supports the micro-purchases and
simplified acquisition purchases, as well as the contract pre- and post-award processes. CPSS
interfaces with the Financial Management Systems Software (FMSS) at the detail level for fund
control, general ledger, accounts payable, and accounts receivable. Until recently, FMSS provided
the functionality for general ledger and funds management for ED. FMSS has been replaced by
Oracle Federal Financials (Oracle). With the implementation of Oracle on January 22, 2002,
enhancements were made to CPSS. Attachment 2 contains a summary of the system enhancements
that affect the purchase card program.

Our audit disclosed that ED has addressed the internal control weaknesses and related issues
identified in a prior OIG report over its purchase card program. However, additional internal
controls are needed over ED’s purchase card program. ED needs to (1) develop on-site2 guidelines
and conduct on-site internal control reviews, and (2) reassess the number of cardholders assigned to
an approving official. In addition, as reported in Other Matters, ED needs to address the account
information within CPSS.

We did not perform purchase card transaction testing as part of this audit. We plan to test such
transactions in the future after ED has had a chance to implement its new directive.

OCFO concurred with our findings and recommendations. We have summarized OCFO’s
comments in the report and included a copy of the comments as an attachment to the report.


1
  U.S. Department of Education Office of Inspector General, Results of the OIG Review of Internal Controls Over the
Use of Purchase Cards and Third Party Drafts, A&I 2000-15, October 13, 2000.
2
  The term on-site is defined as a review being conducted by Contracts and Purchasing Operations at the locations
where the purchase card activity and approval is performed.
                                                              Page 1
Audit of Purchase Cards at the U.S. Department of Education                        ACN: ED-OIG/A17-C0002




                                                    AUDIT RESULTS

Our audit disclosed that ED has addressed the internal control weaknesses and related issues
identified in a prior OIG report over its purchase card program. However, additional internal
controls are needed over ED’s purchase card program. ED needs to (1) develop on-site guidelines
and conduct on-site internal control reviews, and (2) reassess the number of cardholders assigned to
an approving official. In addition, as reported in Other Matters, ED needs to address the account
information within CPSS. Strengthening internal controls reduces the purchase card program
susceptibility to fraud, waste, and abuse.

FINDING NO. 1 – ON-SITE INTERNAL CONTROL REVIEW GUIDELINES NEED TO BE
                DEVELOPED AND REVIEWS CONDUCTED

Effective July 3, 2001, functional responsibility for ED’s purchase card program was transferred
from Financial Management Policies and Administrative Programs Group (FMPAP) to Contracts
and Purchasing Operations (CPO). CPO serves as ED’s purchase card Program Coordinator and
acts as the liaison with the Purchase Card Contractor (Bank of America). Recently, under the
direction of CPO, ED’s Commercial Credit Card Directive was revised. On January 23, 2002, ED
issued the Administrative Communications Directive OCFO:3-104, Government-wide Commercial
Purchase Card Program. This directive sets forth policy for the use of the purchase card and the
responsibilities for all employees, education boards, commissions, councils and independent
organizations who participate in ED’s purchase card program for the procurement of and payment
for goods and services.

One of 16 responsibilities to be fulfilled by CPO is to coordinate internal control reviews and
quality reviews of sample purchase card transactions on a quarterly basis. To date, no on-site
internal control review guidelines have been established or reviews conducted. Currently, CPO is
conducting quality reviews of transactions on a sample basis. Quality review transactions are
conducted through electronic medium, Electronic Account Government Ledger System (EAGLS),
made available to ED by the Bank of America (BoA) and through ED’s CPSS.

GAO’s Standards for Internal Control in the Federal Government, relating to monitoring states
that:

          Agency internal control monitoring should assess the quality of performance over time ....
          This is done by putting procedures in place to monitor internal control on an ongoing basis
          as a part of the process of carrying out its regular activities. It includes ensuring that
          managers know their responsibilities for internal control and control monitoring. In
          addition, separate evaluations of internal control are periodically performed and the
          deficiencies found are investigated. Procedures are in place to ensure that the findings of
          all … reviews are promptly evaluated, decisions are made about the appropriate response,
          and actions are taken to correct or otherwise resolve the issues promptly.

                                                              Page 2
Audit of Purchase Cards at the U.S. Department of Education                      ACN: ED-OIG/A17-C0002


While CPO is in the process of conducting quality reviews of purchase card transactions, it is
important that along with this effort, on-site internal control reviews be conducted to ensure
controls are in place and operating as intended within program offices, education boards,
commissions, councils and independent agencies.

Recommendation
We recommend that:

1.     CPO develop internal review guidelines and conduct on-site internal control reviews using a
       risk based approach and maintain results of the on-site reviews.

Auditee Comments

OCFO concurred with the recommendation. OCFO has designated the Financial Improvement and
Post Audit Group (FIPAO) as the responsible office for developing internal review guidelines in
accordance with program policy and to conduct the actual testing of purchase card transactions both
on-site and through documentation submission. Testing will include the review of single and
monthly purchase limits, split purchases, reconciliation and payment approval process, and internal
controls and quality reviews.

OCFO also stated that draft guidelines have been developed and FIPAO and CPO are in the process
of coordinating the final test plan.

A full text of the comments is included as Attachment 4.


FINDING NO. 2 – THE NUMBER OF CARDHOLDERS ASSIGNED TO AN APPROVING
                OFFICIAL NEEDS TO BE REASSESSED

Currently, 15 program offices, 1 council, and 4 independent organizations participate in the
Department’s Purchase Card Program. In reviewing data provided by CPO, as of December 2001,
3 offices -- Office of Intergovernmental and Interagency Affairs (OIIA), Office of Special
Education and Rehabilitative Services (OSERS), and Federal Student Aid (FSA) -- have a large
number of cardholders assigned to a small number of approving officials. Attachment 3 lists the
number of cardholders assigned to approving officials for each program office, council and
independent organization participating in ED’s Purchase Card Program.

Specifically, OIIA has a total of 15 cardholders assigned to 2 approving officials. OIIA
headquarters has 5 cardholders assigned to 1 approving official. The remaining 10 cardholders are
in 9 regional offices located throughout the country assigned to 1 approving official located in 1
regional office.




                                                              Page 3
Audit of Purchase Cards at the U.S. Department of Education                        ACN: ED-OIG/A17-C0002


OSERS has a total of 23 cardholders assigned to 1 approving official located at headquarters.
Seven cardholders are located in headquarters and 16 cardholders are in 10 regional offices located
throughout the country.

FSA has 71 cardholders assigned to 1 approving official located at headquarters. FSA
headquarters has 29 cardholders, and the remaining 42 cardholders are located in the 10 regional
offices throughout the country.

ED’s Government-wide Commercial Purchase Card Program directive, issued January 23, 2002,
assigns responsibility to a Principal Officer (Assistant Secretary or equivalent) in charge of a
program office to appoint approving officials. Approving officials appointed by the Principal
Officer or an Executive Officer when authority is designated, are responsible for designating who
will be cardholders with his/her principal office, and reviewing, validating, and approving for
payment the cardholder’s reconciled bank statement each billing cycle.

GAO’s Standards for Internal Control in the Federal Government, relating to risk assessment,
states that:

          Internal control should provide for an assessment of the risk the agency faces from both
          external and internal sources.

In appointing approving officials and in designating cardholders, the impact of the number of
approving officials to cardholders within each program office needs to be reassessed. It is critical
that the number of cardholders assigned to one approving official be manageable.

Recommendations

We recommend that:

2.1     CPO direct Principal Officers participating in ED’s Purchase Card Program to analyze and
        access the optimal number of cardholders assigned to approving officials. In conducting the
        assessment, the Principal Officers should take into consideration factors such as the locality
        of the approving official and cardholders, the volume of transactions normally processed, and
        any indications that cardholders or approving officials are not complying with the directive.

2.2     CPO, based on the results of the Principal Officer’s assessment, develop and establish
        organizational guidelines relating to the number of approving officials to the number of
        cardholders.

2.3     CPO implement the results of the assessment to achieve an appropriate level of approving
        officials to the number of cardholders.

Auditee Comments

OCFO concurred with recommendation 2.1. OCFO is currently in communication with OIIA,


                                                              Page 4
Audit of Purchase Cards at the U.S. Department of Education                      ACN: ED-OIG/A17-C0002


OSERS, and FSA as well as other offices to either increase the number of approving officials or
reduce the number of cardholders.

OCFO concurred with recommendation 2.2. OCFO will continue its work with program offices to
realign approving officials and cardholders to a manageable level. Upon completion, OCFO will
prepare general guidelines to aid program offices in maintaining proper internal controls over
purchases and payments as approving officials are appointed and cardholders are designated.

OCFO concurred with recommendation 2.3. Once the re-assessments of the number of approving
officials and cardholders by each program office is performed and the span of control has been
determined by OCFO to be at a manageable level for each office, OCFO will ensure that all newly
appointed approving officials are properly trained and in receipt of the program policy.

A full text of the comments is included as Attachment 4.




                                                  OTHER MATTERS

During our audit we found that within CPSS individual cardholders may access other purchase card
participants’ card numbers, names and sensitive administrative information, which allows for
possible unauthorized purchases to occur. As a result, ED’s purchase card program is vulnerable to
fraud and abuse. We issued an action memorandum to the Deputy CFO on March 14, 2002,
requesting a response to the memorandum indicating what corrective actions would be taken.

On March 28, 2002, the Deputy CFO’s response indicated concurrence with the finding that
purchase card numbers and administrative information are available to purchase cardholders. In
addition, as part of the OCFO’s review, they found that approving officials have similar access.

OCFO will develop new reports to limit cardholder and approving official access. In the meantime,
OCFO is relying on electronic reconciliations to identify transactions which should be disputed.

Management is responsible for establishing and maintaining internal controls. The objectives of
internal control are to provide management with reasonable, but not absolute, assurance that: assets
are safeguarded against loss from unauthorized use or disposition; transactions are executed in
accordance with management's authorization and recorded properly to permit the preparation of
financial statements in conformity with accounting principles generally accepted in the United
States; and data that support reported performance measures are properly recorded and accounted
for to permit preparation of reliable and complete performance information. Because of inherent
limitations in any internal control, errors or irregularities may nevertheless occur and not be
detected. Also, projection of any evaluation of internal control to future periods is subject to the
risk that procedures may become inadequate because of changes in conditions or that the
effectiveness of the design and operation of policies and procedures may deteriorate.



                                                              Page 5
Audit of Purchase Cards at the U.S. Department of Education                     ACN: ED-OIG/A17-C0002




                                                      BACKGROUND


Piloted in 1986, the purchase card program began with 24 agencies. The pilot program was so
successful, the Office of Management and Budget (OMB) requested that the General Services
Administration (GSA) acquire purchase card services on a government-wide basis. The first
contract was competitively awarded in 1989, and the second contact was competitively awarded in
1994.

In 1998, GSA initiated the SmartPay Program by awarding five contracts to financial institutions
that would run for five years (November 30, 1998 through November 29, 2003), with five
additional one-year options, thus providing federal agencies a new way to pay for commercial
goods and services. The Bank of America (formerly NationsBank) services ED.

The Department of Treasury/Financial Management Service requires each agency to develop
internal procedures for using purchase cards. ED’s Administrative Communications Directive
OCFO:3-104, Government-wide Commercial Purchase Card Program (issued on January 23, 2002)
implements Treasury’s guidance.

ED’s Contracts and Purchasing Support System (CPSS) supports the micro-purchases and
simplified acquisition purchases as well as the contract pre- and post-award processes. CPSS
interfaces with the Financial Management Systems Software (FMSS) at the detail level for fund
control, general ledger, accounts payable, and accounts receivable. Until recently, FMSS provided
the functionality for general ledger and funds management for ED. FMSS has been replaced by
Oracle.

With the implementation of Oracle on January 22, 2002 enhancements were made to CPSS.
Attachment 2 contains a summary of the system enhancements.




                                                              Page 6
Audit of Purchase Cards at the U.S. Department of Education                       ACN: ED-OIG/A17-C0002




                     OBJECTIVES, SCOPE AND METHODOLOGY

The objective of our audit was to determine if ED has addressed the internal control weaknesses
and related issues identified in a prior OIG report focusing on the current purchase card systems,
implemented before and after January 22, 2001.

To accomplish our audit objective, we obtained an understanding of the controls in place at ED
over the purchase card program. We conducted interviews with:

• CPO managers and staff responsible for coordinating the purchase card program within ED,

• FMPAP managers and staff responsible for insuring that invoices are paid in accordance with
  Prompt Payment Act deadlines, and

• Financial Systems Operations managers and staff responsible for CPSS and Oracle system
  operations and development.

We reviewed ED’s policies and procedures on the purchase card program, the operating manuals
for CPSS, the Federal Acquisition Regulations (FAR 48 CFR 1), Part 13; titled “Simplified
Acquisition Procedures”; the Department of Treasury/Financial Management Service (TFM 4-
4500) guidance to federal agencies for the use and control of purchase cards; the General Services
Administration (GSA) SmartPay contract, and the task order between ED and the Bank of America.

In evaluating ED’s internal controls, we determined the status of prior OIG recommendations and
reviewed documentation provided by OCFO in closing the recommendations. We observed OCFO
operations and activities for purchase card program oversight, monthly reconciliations and
payments.

We did not perform purchase card transaction testing as part of this audit. We plan to test such
transactions, in the future after ED has had a chance to implement its new purchase card directive.

The audit covered the period October 13, 2000, through March 5, 2002. Fieldwork was conducted
from November 2001 through March 5, 2002, in OCFO located in Washington, DC. The audit was
conducted in accordance with generally accepted government auditing standards applicable to the
scope of the audit.




                                                              Page 7
Audit of Purchase Cards at the U.S. Department of Education                         ACN: ED-OIG/A17-C0002




                    STATEMENT ON MANAGEMENT CONTROLS

As part of our review, we gained an understanding of ED’s management control structure over
purchase cards, as well as its policies, procedures, and practices applicable to the scope of the audit.

Our purpose was to determine if ED has addressed the internal control weaknesses and related
issues identified in a prior OIG report focusing on the purchase card systems implemented before
and after January 22, 2002.

Because of inherent limitations, a study and evaluation made for the limited purpose described
above would not necessarily disclose all material weaknesses in the management controls.
However, our assessment identified management control weaknesses that affect ED’s purchase card
program. These weaknesses included the lack of internal control review guidelines and on-site
internal control reviews, and the need to reassess the number of cardholders assigned to an
approving official. These weaknesses are fully discussed in the Audit Results section of this report.




                                                              Page 8
Audit of Purchase Cards at the U.S. Department of Education                                            ACN: ED-OIG/A17-C0002


                                                                                                              Attachment 1
                  STATUS OF PRIOR OIG RECOMMENDATIONS
                                 (as of March 4, 2002, except for Recommendation Number 1)


Control Environment: Management and employees should establish and maintain an environment
throughout the organization that sets a positive and supportive attitude toward internal controls and
conscientious management.

Recommendation: ED needs to strengthen the control environment over the use of purchase cards.

              Recommendation                                         Corrective Action Taken              Effective Date
1. Increase the scope of procurement                          Contracting and Purchasing Operations    On 03/04/02, ED
training to ensure that all cardholders,                      (CPO) has established training for all   requested closure.
approving officials, data entry personnel,                    individuals with procurement authority
authorizing officials, supervisors, and                       (cardholders, approving officials and    The
senior officials involved with simplified                     supervisors).                            recommendation
acquisitions have an adequate                                                                          closed on 03/14/02.
understanding of procurement                                  On 03/04/02, the CPO Director briefed
requirements and procedures                                   senior officials on the purchase card
                                                              program.
2. Establish a requirement for refresher                      CPO requires that all cardholders        05/29/01
training for all staff with procurement                       attend refresher training in purchase
authority.                                                    card usage every two years.

                                                              CPO determines suspense dates and
                                                              tracks cardholders to ensure refresher
                                                              training was attended.
3. Establish a training requirement for                       FMPAP trained staff on existing          09/18/2001
Financial Management Policies and                             established policies and procedures.
Administrative Programs Group (FMPAP)
– Office of the Chief Financial Officer
(OCFO) personnel, and ensure that
FMPAP staff adhere to established policies
and procedures.
4. Require that all staff with procurement                    Ethics in procurement is included in     05/29/01
authority, regardless of grade level, attend                  CPO’s purchase card program training.
annual ethics training or include an ethics
component in the procurement training.




                                                                  Page 9
Audit of Purchase Cards at the U.S. Department of Education                                          ACN: ED-OIG/A17-C0002


Risk Assessment: Internal controls should provide for an assessment of the risks the agency faces from both
external and internal sources.

Recommendation: ED needs to strengthen risk assessment in the use of purchase cards.

              Recommendation                                          Corrective Action Taken          Effective Date
1. Establish formal policies and                              CPO issued the Government-wide         02/13/2002
procedures to identify, analyze and, as                       Commercial Purchase Card Program
appropriate, take steps to mitigate                           directive on January 23, 2002.
procurement risks at all levels.
2. Require all principal offices to assess                    Policy has been provided in the ED’s   02/13/2002
the level of security clearance performed                     Government-wide Commercial
on their staff with procurement authority                     Purchase Card Program directive
and schedule appropriate updates as                           issued on January 23, 2002.
necessary.
                                                              Executive Officers are to assess the
                                                              level of employee security screening
                                                              required in accordance with ED’s
                                                              policy and the Personnel Security-
                                                              Suitability Program Handbook.




                                                                  Page 10
Audit of Purchase Cards at the U.S. Department of Education                            ACN: ED-OIG/A17-C0002


Control Activities: Internal control activities help ensure that employees carry out management directives.
The control activities should effectively and efficiently accomplish agency objectives.

Recommendation: ED needs to strengthen control activities over the use of purchase cards.
              Recommendation                         Corrective Action Taken            Effective Date
1. Update the Commercial Credit Card         CPO issued the Government-wide           02/13/2002
Directive and communicate it to all          Commercial Purchase Card Program
cardholders, approving officials and         directive OCFO:3-104 on January 23,
Executive Officers.                          2002.
2. Enforce Department policy that            CPO conducted a review of cross-         06/15/2001
approving officials must be at a managerial referenced list of cardholders and
level and may not serve as a cardholder or   approving officials to ensure
use a cardholder’s account.                  separation of duties.
3. Require that all approving officials      Electronic reconciliation process in the 09/18/2001
review and sign monthly purchase card        Contracts and Purchases Support
statements.                                  System (CPSS) has replaced a manual
                                             purchase card review.
4. Reduce spending limits for cardholders    CPO issued warrants to the appropriate 05/29/2001
until they obtain required warrants from     cardholders.
CPO.
5. Reestablish the policy of written         At the completion of the purchase card 05/15/2001
delegation from CPO to all cardholders as    training course, all cardholders receive
defined in the Department of Treasury        a memorandum from the Director,
Financial Manual.                            CPO delineating their responsibility
                                             under the program.
6. Require that each principal office        FMPAP notifies, reminds and              09/18/2001
submit their signed purchase card            electronically transmits late notices to
statements to FMPAP on time.                 principal offices regarding due dates.
7. Ensure that each principal office is      ED eliminated the Third Party Draft      07/11/2001
provided with a sequentially numbered        Program as of June 27, 2001.
stock of blank third party drafts and that
each principal office maintains a log of the
stock received and updates the log as each
draft is issued.
8. Require that each principal office have a ED eliminated the Third Party Draft      07/11/2001
manager, other than an authorizing official, Program as of June 27, 2001.
perform periodic reviews of the
Education’s Data Control Automated
Processing System (EDCAPS) reports on
third party draft activity and the log of
issued third party drafts.
9. Ensure that the Department’s              ED eliminated the Third Party Draft      07/11/2001
accounting system (currently                 Program as of June 27, 2001. The new
EDCAPS/Oracle) correctly records and         payment method requires that the
reports procurement activity.                obligations be established in CPSS in
                                             order to issue payment for transactions
                                             previously made with Third Party
                                             Drafts.




                                                              Page 11
Audit of Purchase Cards at the U.S. Department of Education                                               ACN: ED-OIG/A17-C0002


 Information and Communication: Employees should record and communicate information to
 management and others within the entity who need it in a form and within a time frame that enables them
 to carry out their internal control (and other) responsibilities effectively and efficiently.

 Recommendation: ED needs to strengthen information and communication regarding the use of purchase
 cards.

              Recommendation                                         Corrective Action Taken          Effective Date
   1. Maintain and publicize an updated,                      CPO developed a Web site                01/04/2002
   consolidated, user-friendly Web site on                    (http://connected1.ed.gov/po/ocfo/c
   the ED’s Intranet to convey                                po/credit/index.html) with current
   procurement requirements and                               policies, practices, and relevant
   information.                                               information for cardholders.

                                                              There is also a link to CPO’s page
                                                              from OCFO’s home page
                                                              Web site
                                                              (http://connected1.ed.gov/po/ocfo)


   2. Identify, obtain and distribute                         FMPAP send monthly detail reports       06/05/2001
   management reports necessary for                           of cardholder’s activity to each
   monitoring purchase cards.                                 program office. The reports are
                                                              generated from Bank of America’s
                                                              (BoA) Electronic Account
                                                              Government Ledger System
                                                              (EAGLS).
   3. Continuously update procurement                         CPO maintains records of                05/29/2001
   authority records.                                         cardholder’s limits and warrant
                                                              information.


   4. Provide to all staff with procurement                   Information on handling suspected       05/29/2001
   activity clear instructions on how to                      abuse and fraud is contained in a
   handle and reports suspected abuse of                      letter provided to all cardholders by
   fraud.                                                     CPO at the end of training.




                                                                   Page 12
Audit of Purchase Cards at the U.S. Department of Education                                        ACN: ED-OIG/A17-C0002


Monitoring: Internal controls monitoring should assess the quality of performance over time and ensure
that audit and other review findings are promptly resolved.

Recommendation: ED needs to strengthen monitoring over the use of purchase cards.
           Recommendation                                    Corrective Action Taken             Effective Date
1. Reconcile the monthly Department-                  FMPAP reconciles ED’s monthly           09/18/2001
wide purchase card statement to the                   purchase card statement to the
monthly statements from the principal                 monthly statements from the principal
offices and to the Department’s                       offices and to ED’s Central
accounting system.                                    Automated Processing System.

2. Manage and monitor primary                         Electronic reconciliation process in    09/18/2001
controls such as the approving official               Contracts and Purchasing Support
signature on monthly purchase card                    System (CPSS) has replaced manual
statements.                                           purchase card reviews.
3. Monitor information on staff with                  CPO monitors cardholder’s               05/29/2001
procurement authority provided by                     transactions using Bank of America’s
OCFO.                                                 Electronic Account Government
                                                      Ledger System (EAGLS) and CPSS.




                                                              Page 13
Audit of Purchase Cards at the U.S. Department of Education                                    ACN: ED-OIG/A17-C0002


                                                                                                      Attachment 2
                                        SYSTEM ENHANCEMENTS

ED’s Contracts and Purchasing Support System (CPSS) supports the micro-purchases and simplified
acquisition purchases, including the contract pre- and post-award processes, and interfaces with the Financial
Management Systems Software (FMSS) at the detail level for fund control, general ledger, accounts payable
and accounts receivable. Until recently, FMSS provided the functionality for general ledger and funds
management for ED. FMSS has been replaced by Oracle Federal Financials (Oracle).

With the implementation of Oracle on January 22, 2002 enhancements were made to CPSS. Additional
Oracle improvements are anticipated.

The information that follows reflects the purchase card process: before July 2001; improvements after July
2001 and prior to January 22, 2002; and Oracle improvements as of January 22, 2002.


Recording Purchases – The process of recording and obligating a purchase in the Contracts and Purchasing
Support System (CPSS) (performed by cardholder).

     Process before July 2001                        Process Improvements           Oracle Improvements
                                                       after July 2001 and                  as of
                                                    Prior to January 22, 2002,        January 22, 2002
                                                     Oracle Implementation
The cardholder records and                       No Changes                       No Changes
obligates the purchase in CPSS,
creating a Purchase Card
Document (PCD).

Receiving – The process of inspecting and accepting goods and/or services (performed by cardholder).

      Process before July 2001                        Process Improvements           Oracle Improvements
                                                        after July 2001 and                  as of
                                                     Prior to January 22, 2002,        January 22, 2002
                                                      Oracle Implementation
The requisitioner receives the                    No Changes                      No Changes
supplies and/or services and
provides written documentation of
receipts to the cardholder.

The cardholder marks the item as
received in CPSS.




                                                              Page 14
Audit of Purchase Cards at the U.S. Department of Education                                        ACN: ED-OIG/A17-C0002


Matching – The process of reconciling the purchase card transactions against the Bank of America statement
in CPSS (performed by cardholder).

     Process before July 2001                          Process Improvements               Oracle Improvements
                                                         after July 2001 and                      as of
                                                      Prior to January 22, 2002,            January 22, 2002
                                                       Oracle Implementation
The cardholder manually matches                  The cardholder initiates the          The cardholder groups the
transactions on the hard copy BoA                reconciliation process by             items before matching.
statement to the PCDs in CPSS.                   electronically matching BoA           Grouping assigns the
                                                 statement in CPSS to purchase card    statement transaction and
The cardholder fills out a hardcopy              documents in CPSS and makes any       obligated purchase card
BoA dispute form when necessary                  necessary adjustments.                documents a unique number.
and sends to BoA.
                                                 The cardholder electronically         Credit balances can be
                                                 generates a BoA dispute form in       grouped and matched.
                                                 CPSS when necessary and sends to
                                                 BoA.                                  Transaction information
                                                                                       defaults on dispute form.
                                                                                       The dispute is made on the
                                                                                       transaction not the obligation.


Generating Reports – The process of preparing the documentation on transaction for Approving Official
(AO) review (performed by the cardholder).

      Process before July 2001                        Process Improvements                 Oracle Improvements
                                                        after July 2001 and                        as of
                                                     Prior to January 22, 2002,              January 22, 2002
                                                      Oracle Implementation
The cardholder signs the hardcopy                The cardholder electronically         No Changes
BoA statement.                                   generates the activity log and the
                                                 BoA statement transaction report in
                                                 CPSS.
The cardholder prepares a package
containing the signed statement,                 These reports are electronically
activity log, and receipts and                   routed in CPSS to the AO.
forward to the AO.
                                                 The cardholder manually forwards
                                                 all hardcopy receipts to the AO.




                                                              Page 15
Audit of Purchase Cards at the U.S. Department of Education                                      ACN: ED-OIG/A17-C0002


Approving – The process of the AO reviewing the record and determining whether transactions are bona-
fide (performed by the AO).

      Process before July 2001                         Process Improvements               Oracle Improvements
                                                         after July 2001 and                      as of
                                                     Prior to January 22, 2002,             January 22, 2002
                                                       Oracle Implementation
The AO reviews the hardcopy                      The AO receives an email alert         No Changes
report package for approval or                   when the file arrives in his/her
disapproval                                      CPSS inbox, and reviews the
                                                 reports in CPSS and receipts.
The AO signs the BoA statement
for approval/disapproval.                        The AO approves or disapproves in
                                                 CPSS, and the file is routed to the
                                                 Cardholder.

                                                 • If disapproved, the AO identifies
                                                 disapproved items to the cardholder
                                                 for resolution.

                                                 • Partial payments of transactions
                                                 may occur.


Reconciling – The process of routing the approval record and supporting documents to OCFO/FMO for
payment to Bank of America (performed by the AO).

      Process before July 2001                          Process Improvements              Oracle Improvements
                                                         after July 2001 and                      as of
                                                      Prior to January 22, 2002,            January 22, 2002
                                                       Oracle Implementation
The AO forwards the approved                     The Approving Official completes       No Changes
hard copy package to Office of the               the final step in the reconciliation
Chief Financial Officer                          process by, electronically routing
(OCFO)/Financial Management                      approved records to the
Operations (FMO) for payment.                    OCFO/FMO System Administrator
                                                 in CPSS for payment to Bank of
                                                 America.




                                                              Page 16
Audit of Purchase Cards at the U.S. Department of Education                                                            ACN: ED-OIG/A17-C0002


                                                                                                                                   Attachment 3
              NUMBER OF CARDHOLDERS TO APPROVING OFFICIALS
                                                                 (as of December 2001)



U.S. Department of Education Program Offices3

                                                REGIONS
                HQ     I     II    III   IV    V     VI    VII  VIII   IX    X    Total
         PO    CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO

    OBEMLA       2    1                                                                                                        2     1

    OCFO         6    1                                                                                                        6     1

    OCR          5    2     1       1     2    1   1    1    2    1   2   2    1    1   1    1    1   1    1   1   1     1    18    13

    OERI        16 11                                                                                                         16    11

    OESE         4    1                                                                                                        4     1

    OGC          2    1                                                                                                        2     1

    OIG          5    3     3       1     2    1   4    2    1    1   3   2    3    2   2    1             3   2              26    15

    OIIA         5    1     1       1     1        1         1        1        1        2         1        1                  15     2

    OM          13    6                                      1    1                                        1   1              15     8

    OPE         12 10                                                                                                         12    10

    OS           7    1                                                                                                        7     1

    OSERS        7    1     1             1        2         2        2        2        2         2        1       1          23     1

    OUS          4    1                                                                                                        4     1

    OVAE         4    1                                                                                                        4     1

    FSA         29    1     4             5        3         4        5        4        3         3        8       3          71     1

                                        Number of cardholders and approving officials in Program Offices                     225    68


     HQ=       Headquarters
     CH =      Cardholder
     AO=       Approving Official
     PO=       Program Office




3
 OBEMLA = Office of Bilingual Education and Minority Languages; OCFO = Office of the Chief Financial Officer;
OCR = Office of Civil Rights; OERI = Office of Educational Research and Improvements; OESE = Office of
Elementary and Secondary Education; OGC = Office of the General Counsel; OIG = Office of Inspector General;
OIIA = Office of Intergovernmental and Interagency Affairs; OM = Office of Management; OPE = Office of
Postsecondary Education; OS = Office of the Secretary; OSERS = Office of Special Education and Rehabilitative
Service; OUS = Office of the Under Secretary; OVAE = Office of Vocational and Adult Education; FSA = Federal
Student Aid

                                                                       Page 17
Audit of Purchase Cards at the U.S. Department of Education                                                      ACN: ED-OIG/A17-C0002


Education Boards, Commissions and Councils4

                                                 REG IO NS
                 HQ     I     II    III   IV    V       VI  VII  VIII   IX    X    Total
          PO    CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO

    AC-FSA         1    1                                                                                              1    1
                Num ber of cardholders and approving officials in Education Boards, Com m issions and Councils         1    1




Independent Organizations Affiliated with the Department of Education5

                                                 REG IO NS
                 HQ     I     II    III   IV    V        VI VII  VIII   IX    X    Total
          PO    CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO CH AO

    NAG B          2    1                                                                                              2    1

    NEG P          1    1                                                                                              1    1

    NCLIS          2    1                                                                                              2    1

    NIL            1    1                                                                                              1    1
                Num ber of cardholders and approving officials in Independent Organizations                            6    4

                       Total num ber of cardholders and approving officials in the Departm ent of Education          232   73

    HQ=        Headquarters
    CH =       Cardholder
    AO=        Approving Official
    PO=        Program Office




4
 AC-FSA = Advisory Council - Federal Student Aid
5
 NAGB = National Assessment Governing Board; NEGP = National Education Goals Panel; NCLIS = National
Commission on Libraries & Information Science; NIL = National Institute for Literacy
                                                                   Page 18
Audit of Purchase Cards at the U.S. Department of Education             ACN: ED-OIG/A17-C0002



                                                                               Attachment 4




                                                              Page 19
Audit of Purchase Cards at the U.S. Department of Education             ACN: ED-OIG/A17-C0002




                                                              Page 20
Audit of Purchase Cards at the U.S. Department of Education             ACN: ED-OIG/A17-C0002




                                                              Page 21
Audit of Purchase Cards at the U.S. Department of Education                                      ACN: ED-OIG/A17-C0002


                                          REPORT DISTRIBUTION LIST
                                        Audit Control No.: ED-OIG/A17-C0002


ED Action Official

Jack Martin
Chief Financial Officer
Office of the Chief Financial Officer

                                       Other ED Officials/Staff (electronic copy)

Deputy Chief Financial Officer                                     Deputy Secretary
Office of the Chief Financial Officer                              Office of the Deputy Secretary

Director                                                           Chief of Staff
Contracts and Purchasing Operations                                Office of the Secretary
Office of the Chief Financial Officer

Director                                                           Under Secretary
Financial Management Operations                                    Office of the Under Secretary
Office of the Chief Financial Officer

Director                                                           Press Secretary
Financial Systems Operations                                       Office of Public Affairs
Office of the Chief Financial Officer

Audit Liaison Officer                                              Director
Post Audit Group                                                   Office of Public Affairs
Office of the Chief Financial Officer

Correspondence Control                                             Assistant Secretary
Office of General Counsel                                          Office of Legislation and Congressional
Affairs

Director                                                           Assistant Secretary
Budget Services                                                    Office of Intergovernmental and Interagency
Office of the Under Secretary                                         Affairs

Director                                                           General Operations Team
Financial Improvement and Post Audit                               Office of Inspector General
  Operations
Office of the Chief Financial Officer

                                                                   Headquarters and Regional Audit Managers
                                                                   Office of Inspector General

                                                              Page 22