United States General Accounting Office GAO Report to the Chairman, Committee on Transportation and Infrastructure, House of Representatives March 2003 FAA PURCHASE CARDS Weak Controls Resulted in Instances of Improper and Wasteful Purchases and Missing Assets GAO-03-405 a March 2003 FAA PURCHASE CARDS Weak Controls Resulted in Instances of Highlights of GAO-03-405, a report to the Chairman, House Committee on Improper and Wasteful Purchases and Transportation and Infrastructure Missing Assets In May 2002, GAO reported on Weaknesses in FAA’s purchase card controls resulted in instances of breakdowns in purchasing controls improper, wasteful, and questionable purchases, as well as missing and at the Federal Aviation stolen assets. These internal control weaknesses included inadequate Administration’s (FAA) Alaskan segregation of duties, lax supervisory review and approval, missing purchase Region that resulted in improper documentation, inadequate training, and insufficient program monitoring and wasteful purchases. Many of the weaknesses were associated activities, all of which created an environment vulnerable to fraud, waste, with the use of government credit and abuse. cards—referred to as purchase cards—and raised concerns that These weaknesses contributed to the $5.4 million of improper purchases similar problems might exist FAA- GAO identified. Among these were purchases that were split into two or wide. As a result, GAO was asked more segments to circumvent single purchase limits. GAO also identified to determine whether FAA’s over $630,000 in purchases that were considered wasteful—that is, excessive purchase card controls reasonably in cost, for questionable government needs, or both—or were considered ensured that purchases were questionable because they were missing a receipt to show what was actually proper, at a reasonable cost, and purchased. Some examples of these are shown in the table below. for valid government needs. GAO also assessed whether assets bought with purchase cards were Examples of Wasteful and Questionable Purchases being properly safeguarded and Item descriptions Examples of vendors Amount recorded. Personal digital assistants and Palm Computing, CompUSA, accessories such as keyboards and HPShopping.com, SeikoSmart.com, leather cases Staples, Franklin Covey, and Coach $66,684 Individual subscriptions to Internet America Online, CompuServe, and service providers EarthLink 16,894 GAO is making a number of Store gift cards Home Depot, Wal-Mart, Safeway, recommendations to strengthen and Kroger 2,284 FAA’s internal controls and Retirement and farewell gifts including Hecht’s Waterford, Macy’s, Things compliance in its purchase card Waterford crystal, a glass clock, and an Remembered, TJ Maxx, and Daniels engraved statue Get Personal 1,203 program, decrease wasteful purchases, and improve the Source: GAO. accountability of assets in order to reduce vulnerability to improper Note: GAO’s analysis of FAA purchase card and convenience check transactions selected for fiscal and wasteful purchases. year 2001. FAA emphasized its commitment to a sound purchase card program In addition, over half of the asset purchases—such as computers and other and highlighted a number of equipment—that GAO examined had not been recorded in FAA’s property completed or ongoing actions to system, increasing the risk of loss or theft. As a result, FAA could not locate strengthen controls. or document the location of over a third of the 692 items that GAO attempted to observe. These missing items totaled almost $300,000. In separate internal reviews, one FAA location identified over 800 items, totaling almost $2 million, that were lost or stolen in fiscal years 2001 through 2002. Given systemic weaknesses in FAA’s property controls, the actual amount of missing or stolen equipment FAA-wide could be much higher. www.gao.gov/cgi-bin/getrpt?GAO-03-405. To view the full report, including the scope and methodology, click on the link above. For more information, contact Linda Calbom at (202) 512-9508 or firstname.lastname@example.org. Contents Letter 1 Results in Brief 2 Background 5 Scope and Methodology 9 Internal Controls Were Lacking or Ineffective 12 Noncompliance with Policies and Procedures Resulted in Some Improper Purchases 25 Poor Controls Resulted in Some Wasteful and Questionable Purchases 33 Poor Controls Contributed to Wasted or Missing Assets 42 Conclusions 45 Recommendations for Executive Action 46 Agency Comments and Our Evaluation 50 Appendixes Appendix I: Comments from the Department of Transportation 52 Appendix II: Staff Acknowledgments 54 Acknowledgments 54 Tables Table 1: Transactions Not in Compliance with Purchasing Requirements 26 Table 2: Transactions Identified as Wasteful or Questionable 34 Table 3: Examples of Transactions Where Invoice Documentation Was Missing 40 Page i GAO-03-405 FAA Purchase Cards Contents Abbreviations AMS Acquisition Management System APC Agency Program Coordinator DOT Department of Transportation EAGLS Electronic Account Government Ledger System FAA Federal Aviation Administration GSA General Services Administration JWOD Javits-Wagner-O'Day OIG Office of Inspector General OMB Office of Management and Budget PDA Personal Digital Assistants PPIMS Personal Property In-use Management System UNICOR Federal Prison Industries, Inc. This is a work of the U.S. Government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. It may contain copyrighted graphics, images or other materials. Permission from the copyright holder may be necessary should you wish to reproduce copyrighted materials separately from GAO’s product. Page ii GAO-03-405 FAA Purchase Cards A United States General Accounting Office Washington, D.C. 20548 March 21, 2003 Leter The Honorable Don Young Chairman Committee on Transportation and Infrastructure House of Representatives Dear Mr. Chairman: The use of purchase cards in the federal government has dramatically increased in past years as agencies have sought to eliminate the bureaucracy and paperwork long associated with making small purchases. The benefits of using purchase cards are lower costs and less red tape for both the government and the vendor community. However, given the nature, scale, and increasing use of purchase cards, it is important for agencies to have adequate internal controls in place to help ensure proper use of purchase cards and thus to protect the government from waste, fraud, and abuse. In September 2001, the Department of Transportation’s (DOT) Office of Inspector General (OIG) issued a report on the results of its audit of DOT’s government purchase card program.1 That review examined 785 fiscal year 2000 purchase card and convenience check transactions made by 9 of DOT’s 11 operating administrations.2 Based on its review of this limited sample of transactions, the OIG reported that purchases were reasonable, valid, and received. However, the OIG also noted that within the Federal Aviation Administration (FAA), internal controls were weak concerning verification of purchases, splitting purchases to avoid purchase card limits, and performing reviews of purchase card usage. Subsequently, we reviewed purchasing controls and activities—including those involving the use of purchase cards—within the Airway Facilities Division at FAA’s Alaskan Region and found similar internal control weaknesses.3 These included an inadequate supervisory review and approval process, an 1 U.S. Department of Transportation Office of Inspector General, Department of Transportation Use of Government Credit Cards, FI-2001-095 (Washington, D.C.: Sept. 24, 2001). 2 Operating administrations are the agencies within DOT such as the U.S. Coast Guard, the Federal Aviation Administration, and the Federal Highway Administration. 3 U.S. General Accounting Office, FAA Alaska: Weak Controls Resulted in Improper and Wasteful Purchases, GAO-02-606 (Washington, D.C.: May 30, 2002). Page 1 GAO-03-405 FAA Purchase Cards inadequate segregation of duties, and a lack of oversight of spending that allowed improper and wasteful expenditures to occur. Given these results, you requested that we conduct an in-depth audit of FAA’s purchase card and convenience check transactions for fiscal year 2001 to determine the validity of purchase card and convenience check usage.4 Consequently, we designed our review to determine if FAA’s (1) internal controls provided reasonable assurance that improper purchase card and convenience check purchases would not occur or would be detected in the normal course of business, (2) purchase card and convenience check expenditures were made in accordance with established policies and procedures, (3) purchases were made for reasonable costs and valid government needs, and (4) controls over purchase card and convenience check asset acquisitions were adequate to properly record and safeguard assets. Results in Brief Significant internal control weaknesses in FAA’s purchase card program made the agency vulnerable to and in some cases resulted in improper, wasteful, and questionable purchases, as well as missing assets. These weaknesses included inadequate segregation of duties over purchases; lax supervisory review and approval of purchases; lack of required documentation for purchases; inadequate training for cardholders, approving officials, and agency program coordinators; and a lack of or inadequate monitoring activities. For example, we found instances where supervisors had approved payment of transactions even though key documentation to support the purchases was missing. Despite prior audit reports dating back to 1997 communicating some of these weaknesses, we found the same weaknesses continued during our review, which covered fiscal year 2001. Because of these internal control breakdowns, FAA did not have reasonable assurance that improper purchases would be prevented or detected in the normal course of business. 4 Convenience checks issued are charged against the cardholder’s purchase card account and are used when the merchant does not accept credit cards. Page 2 GAO-03-405 FAA Purchase Cards The lack of adequate internal controls and monitoring of the program created an environment in which improper purchases—meaning those that violated law, regulation, or FAA policy—could be made with little risk of detection. Inadequate controls over expenditures, combined with the inherent risk of fraud and abuse associated with the purchase cards, resulted in improper purchases totaling $5.4 million. This included 997 transactions totaling $5.1 million associated with purchases that had been split into two or more segments to avoid the cardholder’s single purchase limit. We also found 54 instances of unauthorized purchase actions, whereby someone other than the cardholder had made the purchase.5 For example, at the direction of one cardholder’s supervisor, other staff in the office used the cardholder’s purchase card number to make 21 purchases of computer and office equipment totaling over $149,000. Although these types of policy violations are subject to disciplinary action, we generally found that action had not been taken against the cardholders or approving officials. Failure to comply with applicable policies and procedures lessens FAA’s ability to ensure that funds are being properly obligated and spent. The inadequacy and ineffectiveness of internal controls was also evident in 114 purchase transactions totaling $222,602 that we considered wasteful because they were excessive in cost, for questionable government need, or both. For example, we identified 25 purchases for 123 personal digital assistants (PDA) that ranged in cost from $100 to $558 each, and accessories such as six high-cost leather PDA cases purchased from the Coach store totaling $717. In addition, we identified almost $17,000 paid to Internet service providers such as America Online for individual FAA employees, despite the fact that FAA provides Internet access for all staff. We also found 162 transactions totaling $407,356 that we considered questionable, such as purchases from BestBuy.com totaling $2,440 and Ashford.com (a jewelry Web site) for $78. While such merchandise could easily have been for personal use and not for official government use, missing documentation prevented us and other reviewers from determining the reasonableness and validity of these purchases. While the $6.1 million of improper, wasteful, and questionable purchase card and convenience check purchases we identified is relatively small compared to the over $150 million in total annual purchase card and convenience check activity, 5 Of these transactions, 12 were identified during our detailed sampling, and 42 additional transactions were identified by two of the cardholders who had unauthorized purchases in our detailed sample. Page 3 GAO-03-405 FAA Purchase Cards it demonstrates vulnerabilities from weak controls that could easily be exploited to a greater extent. In addition, because we only tested a small portion of the transactions we identified that appeared to have a higher risk of fraud, waste, or abuse, there may be other improper, wasteful, and questionable purchases in the remaining untested transactions. Inadequate internal controls over computers and other property acquired with the purchase card contributed to unrecorded and missing equipment. Specifically, from our detailed testing of transactions, we found that FAA had not recorded 262 asset-related transactions totaling $4.1 million in its property management system. In addition, during our unannounced physical inventory, we identified 238 items, totaling $287,766, that FAA could not locate. Of these, 202 items were missing, and FAA reported that the remaining 36 items had been transferred to other FAA locations or returned for repair or replacement, but could not provide documentation to support these claims. In addition to the items we found missing, we noted that at one FAA location, the property management division identified 405 items totaling over $900,000 that were lost or stolen in fiscal year 2001 and another 437 items totaling over $1 million that were lost or stolen in fiscal year 2002. These lost or stolen items were primarily identified through physical inventory counts performed during those years. We also noted poor physical controls over FAA’s computer-related assets. Given the systemic weaknesses we identified in FAA’s property controls, the actual amount of missing or stolen equipment agencywide could be much higher. Decentralized procedures for receiving property acquisitions, inadequate safeguarding of assets, and inconsistent recording of those assets in FAA’s property management system created an environment in which assets could be easily lost or stolen without detection. Management’s commitment to addressing and correcting these problems is necessary to reduce FAA’s vulnerability to improper and wasteful expenditures and lost or stolen assets. We are making a number of recommendations that, if properly implemented, will improve internal controls over FAA’s purchase card and convenience check program to help ensure that improper and wasteful purchases are prevented or detected in the future and vulnerable assets are better accounted for and protected. In its comments on a draft of this report, DOT described several actions completed or under way to address our recommendations and expressed its commitment to running a sound purchase card program in compliance with applicable requirements. Page 4 GAO-03-405 FAA Purchase Cards Background The General Services Administration (GSA) administers the federal government’s credit card program. GSA contracts with commercial banks to issue credit cards to federal employees to make official government purchases. FAA’s purchase cards6 are issued by Bank of America. The FAA purchase card, unless otherwise prohibited, is intended to be the primary purchasing method when vendors accept purchase cards as payment. This payment method is intended to streamline procurement and payment procedures and reduce administrative burden by reducing the number of procurement requests, purchase orders, and vendor payments issued. FAA’s purchase card program also includes the use of convenience checks to pay vendors that do not accept credit cards. In fiscal year 2001, FAA made over 364,000 purchases using purchase cards and convenience checks totaling $151 million. This reflects a significant increase over the prior fiscal year, when FAA made a total of 271,000 purchase card and convenience check purchases (a 34 percent increase) totaling $126 million (a 20 percent increase). The Department of Transportation and Related Agencies Appropriations Act of 1996 exempted FAA from the Federal Acquisition Regulation and other provisions of acquisition law, and directed the FAA Administrator to develop and implement FAA’s own acquisition system. The resulting system, called the FAA Acquisition Management System (AMS), took effect April 1, 1996. AMS establishes policy for all aspects of the acquisition life cycle. It was intended to simplify acquisition management into a system providing more timely and cost-effective acquisition of equipment and materials. Although FAA is exempted from certain federal acquisition requirements, many of these requirements have been incorporated into FAA’s policies. FAA also established the FAA Acquisition System Toolset that supplements AMS by providing additional acquisition policy and guidance, such as the Commercial and Simplified Purchase Method guidance, which provides guidance on purchase cards and convenience checks.7 Within this 6 The government also uses commercial credit cards for government-related travel expenditures (travel cards) and for expenditures related to the maintenance and operation of government-owned vehicles (fleet cards). Travel and fleet cards are not covered within the scope of this report. 7 References to FAA policies in this report refer to policies established in AMS, the Toolset, or other FAA orders. Page 5 GAO-03-405 FAA Purchase Cards guidance, FAA delegates to each acquisition office within a region or center, or within headquarters the responsibility of managing its own purchase card program and establishing its own internal processes for issuing purchase cards and monitoring the program. In addition, FAA’s internal Purchase Card/Check User Guide assists cardholders and approving officials in carrying out their responsibilities. GSA and Bank of America also provide purchase card guidance and GSA provides training that is available to cardholders, approving officials, and program coordinators. For example, GSA’s Blueprint For Success: Purchase Card Oversight was prepared by a working group of agency program coordinators (APC) and provides general program guidance to APCs in performing their responsibilities. Beginning in fiscal year 2003, GSA made available to APCs a Web-based on-line training course covering such topics as APC responsibilities, reporting tools, and preventive measures to use in monitoring the purchase card program. APCs are generally responsible for setting up and maintaining all accounts, developing internal program guidelines and procedures, ensuring that cardholders and approving officials receive proper training, and monitoring for fraud and misuse. Each agency must designate an APC to function as the agency’s primary liaison to the contract bank and to GSA. FAA’s operating guidance also requires the chief of the contracting office within each region or center and within headquarters to delegate a person or persons to act as the APC for that location. As a result, FAA has a different APC at each of its 12 major locations,8 with the headquarters APC designated agencywide responsibility for the program. Cardholders are responsible for understanding and complying with purchasing policies and procedures, maintaining records and receipts of all purchases, reconciling their purchases to their monthly statements, and preparing and submitting required property management forms for assets purchased. Each cardholder’s designated approving official—which is normally the next level supervisor—is responsible for reviewing the cardholder’s transactions to assure they are properly documented, comply with purchasing policies, and are necessary for accomplishing the mission of the agency. Approving officials are also responsible for reporting fraudulent or improper use of the card. As of January 2002, 8,534 out of 8 FAA’s organization consists of nine geographical regions, two major centers, and its headquarters office. Page 6 GAO-03-405 FAA Purchase Cards 51,062 (17 percent) FAA employees had commercial purchase cards, most of which had a single purchase limit between $2,500 and $10,000 and a monthly purchase limit between $5,000 and $120,000. Each convenience check issued is not to exceed $2,500. Other key roles affecting purchases include the accounting certification officer (also known as the funds certification officer), and the property custodian. FAA’s procurement guidance specifies that, prior to purchase, the program office funds certification officer shall determine whether the expenditure is authorized by the appropriation and provide either a written certification that adequate funds are available or condition the purchase upon availability of funds. Property custodians are responsible for reviewing and processing source documents for the receipt, transfer, or disposal of accountable property9 in their assigned custodial areas, conducting physical inventories, and ensuring that property is adequately safeguarded. 9 FAA Order 4650.21C, Management and Control of In-Use Personal Property, defines accountable property as a term used to identify government property that is required to be recorded in a formal personal property accounting system and controlled by an identification system and supporting records from acquisition through disposal. The type of asset and its cost determine whether it is considered accountable property. For example, mandatory sensitive items, such as photographic and automated data processing equipment costing $500 and above, and all items $2,500 and above are required to be recorded in FAA’s property management system. Page 7 GAO-03-405 FAA Purchase Cards In September 2001, DOT’s OIG issued a report on the results of its audit of DOT’s purchase card program.10 The OIG examined a total of 785 purchase card and convenience check transactions totaling $1.2 million made by FAA, the U.S. Coast Guard, and seven other DOT operating administrations. Based on this limited sample, the OIG reported that generally, purchases were reasonable, valid, and received. However, it also reported that (1) approving officials were not verifying that purchases were authorized, (2) cardholders were splitting single purchases into multiple transactions to avoid purchase card limits, and (3) FAA was not conducting periodic follow-up reviews of purchase card usage. The OIG also found instances of purchase card fraud and violations of DOT policies and internal control procedures. These results were similar to those found during the OIG’s previous review of DOT’s purchase card program. In November 1997, the OIG reported that approving officials were not performing required reviews of documentation, cardholders were splitting purchases, and periodic follow-up reviews were not being conducted.11 It recommended at that time that DOT reemphasize the requirement for approving officials to review supporting documentation for cardholder purchases and provide guidance for conducting periodic follow-up reviews. The OIG indicated in these reports that DOT and FAA actions taken and planned to address the recommendations sufficiently addressed the recommendations made. However, based on our findings the corrective actions taken were not fully effective. In May 2002, we issued a report on the results of our review of purchasing controls and activities within the Airway Facilities Division at FAA’s Alaskan Region.12 This was the only unit in FAA to implement a pilot program, called the Corporate Maintenance Philosophy, from 1997 to 2001. Due to controversy surrounding this program, including allegations of inappropriate spending, we reviewed this unit’s internal controls and selected expenditures. With respect to its purchase card program, we found 10 FI-2001-095. 11 U.S. Department of Transportation Office of Inspector General, Government Credit Card Program Departmentwide, MA-1998-004 (Washington, D.C.: Nov. 4, 1997). 12 GAO-02-606. Page 8 GAO-03-405 FAA Purchase Cards • inadequacies in the segregation of purchasing duties, the supervisory review and approval process, and the tracking of accountable property and award inventories; • improper purchases, such as purchases that were split to circumvent purchase limits, restricted items that were purchased without required approvals, and items that were not bought from required vendors and lacked the necessary waivers to do so; • purchases of expensive items such as flat panel computer monitors costing over $3,000 each and PDAs ranging from $300 to over $500 each; and • a decentralized operating environment and a lack of training that contributed to these weaknesses. Our report resulted in 18 recommendations to FAA to address these issues. In its response to this report, FAA agreed with the recommendations and indicated it had initiated action to address all of the issues. Scope and The scope of our review included FAA headquarters, FAA’s two centers, and eight of its nine regional offices.13 We conducted site visits to six of Methodology these locations. To obtain an understanding of FAA’s purchase card and convenience check policies and procedures, the related internal controls, and policies and controls over assets purchased, we • reviewed FAA’s AMS policy, procurement guidance, purchase card/check user guide, property management policies, and local operating procedures over the purchase card program, and • conducted walkthroughs and structured telephone interviews with FAA management and staff to identify key purchase card, convenience check, and accountable property policies, procedures, and initiatives. 13 We excluded FAA’s Alaskan Region from the scope of our review due to our ongoing work at that region that included a review of purchase card controls and selected purchase card transactions (GAO-02-606). FAA’s other regions are the Central, Eastern, Great Lakes, New England, Northwest Mountain, Southern, Southwest, and Western Pacific regions. The two centers are the Michael Monroney Aeronautical Center and the William J. Hughes Technical Center. FAA headquarters consists of the Washington, D.C., metropolitan area. Page 9 GAO-03-405 FAA Purchase Cards To assess the adequacy of internal controls, we used our Standards for Internal Control in the Federal Government,14 Internal Control Management and Evaluation Tool,15 Guide for Evaluating and Testing Controls Over Sensitive Payments,16 and Strategies to Manage Improper Payments.17 To test internal controls over transactions and determine whether expenditures were made in compliance with policies and procedures, were reasonable, and had a valid government need, we selected transactions using three different methods. For each method of selection, we provided FAA with the transactions selected and obtained and reviewed related supporting documentation. The three methods are as follows. • Data mining.18 We performed data mining on Bank of America’s database of FAA’s fiscal year 2001 purchase card and convenience check transactions for indicators of potential noncompliance with established policies and procedures. Specifically, we looked for purchases that exceeded cardholder or convenience check spending limits, split purchases, cardholders with multiple purchase cards, former employees who had active purchase card accounts after their separation dates, cardholders who were payees on convenience checks, and cash advances. We forwarded the results of all transactions that met specific criteria to the cognizant APCs for their responses and related documentation, which we used to assess whether in fact these were violations of policy. 14 U.S. General Accounting Office, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 2000). 15 U.S. General Accounting Office, Internal Control Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). 16 U.S. General Accounting Office, Guide for Evaluating and Testing Controls Over Sensitive Payments, GAO/AFMD-8.1.2 (Washington, D.C.: May 1993). 17 U.S. General Accounting Office, Strategies to Manage Improper Payments: Learning From Public and Private Sector Organizations, GAO-02-69G (Washington, D.C.: October 2001). 18 Data mining applies a search process to a data set, analyzing for trends, relationships, and interesting associations. For instance, it can be used to efficiently query transaction data for characteristics that may indicate potentially improper activity. Page 10 GAO-03-405 FAA Purchase Cards • Statistical sampling. We selected a stratified random (statistical) sample of 333 transactions totaling $4.2 million from the population of transactions paid from October 1, 2000, through September 30, 2001, to test specific control activities, such as segregation of duties, evidence of approving official review and approval, and adequacy of supporting documentation; whether the purchases complied with purchasing policies; and whether the purchases appeared reasonable and had a valid government need. Results from the statistical sample were projected to the population19 of FAA purchase card and convenience check transactions for fiscal year 2001. • Nonstatistical sampling. We also selected transactions on a nonstatistical basis to allow us to identify transactions that appeared to have a higher risk of fraud, waste, or abuse, although the results cannot be projected to the overall population of purchases. To select these transactions, we first performed data mining on fiscal year 2001 transactions to identify purchases from certain vendors that would more likely be selling unauthorized or personal use items; purchases made on the weekends, during holidays, or at fiscal year-end; and purchases of sensitive assets. This resulted in tens of thousands of transactions identified, from which we then selected 1,874 transactions totaling $7.9 million to test whether these purchases were made at excessive cost and/or for questionable government needs, and whether they complied with select purchasing policies and procedures. To determine if controls over purchase card and convenience check equipment acquisitions were adequate to properly record and safeguard assets, we did the following. • Reviewed policies and procedures over the management and control of accountable property and sensitive items.20 • Tested accountable property selected in the statistical and nonstatistical samples to determine whether these assets had been entered into FAA’s property management system prior to our review. 19 The sample population consisted of purchase card charges totaling $148.3 million. This excludes adjustments for returned items and reversals of disputed charges, as well as Alaskan Region transactions since this region was not included in the scope of our audit. 20 Sensitive property items are especially susceptible to theft, loss, or conversion to personal use. Page 11 GAO-03-405 FAA Purchase Cards • Selected 81 transactions for equipment purchases made by four FAA locations to conduct an unannounced inventory of desktop computers, laptops, and other sensitive items that were purchased with government purchase cards or convenience checks. While we identified some improper purchases, our work was not designed to identify all fraudulent or otherwise improper purchases made by FAA. We conducted our review from January through December 2002 in accordance with generally accepted government auditing standards. We requested written comments on a draft of this report from the Secretary of Transportation or his designee. Written comments were received from the department’s Assistant Secretary for Administration and are reprinted in appendix I. Internal Controls Were FAA’s internal controls did not provide reasonable assurance that improper purchase card and convenience check purchases would not occur or would Lacking or Ineffective be detected in the normal course of business. Internal controls serve as the first line of defense in safeguarding assets and in preventing and detecting fraud, waste, and abuse. Our Standards for Internal Control in the Federal Government requires that (1) key duties and responsibilities be divided or segregated among different people to reduce the risk of error or fraud, (2) transactions and other significant events be authorized and executed only by persons acting within the scope of their authority, (3) all transactions and other significant events be clearly documented, and the documentation be readily available for examination, (4) management ensure that its workforce has the required skills necessary to achieve organizational goals, and (5) internal control monitoring be performed to assess the quality of performance over time and ensure that audit findings are promptly resolved. We found that FAA lacked these key internal controls or had not adequately implemented them, increasing the risk that improper purchases could occur. Page 12 GAO-03-405 FAA Purchase Cards Segregation of Purchasing We identified limited segregation of duties during our detailed tests of Duties Was Inadequate transactions. From the statistical sample of 333 purchase card and convenience check transactions, 93 lacked evidence of adequate segregation of duties. Based on the results of our review of these transactions, we estimate that $44 million21 of the total sampled population of purchase card and convenience check transactions lacked adequate segregation of duties. What we found most often was that the cardholder requested the purchase, placed the order, and picked up or received the acquired goods without any other review or approval. Although 68 of the 93 transactions had evidence of the approving official’s review and approval, we determined that adequate segregation of duties did not exist because the cardholder had performed a majority of the purchasing duties with little if any oversight. For example, we noted an instance where an employee at one location served as the funds certification officer, approving official, and property custodian for purchases in her area. Consequently, she certified that funds were available for purchases; reviewed and approved purchases made by cardholders under her supervision; and accounted for, recorded, and maintained property inventory records for assets purchased. We also found that 7 of FAA’s 12 APCs and 4 alternates were also cardholders. One of these APCs also served as an approving official. Because APCs are responsible for monitoring cardholders’ and approving officials’ activities for indications of potential fraud, waste, and abuse, these APCs were essentially monitoring their own activities. In fact, the cardholder with the largest dollar volume of charges in FAA during fiscal year 2001, totaling $4 million, was an APC. Several factors contributed to these segregation of duties weaknesses. From our discussions with several APCs, we noted that generally, segregation of duties was not an area of focus in the training for cardholders and approving officials. We also were told that certain field offices may not be able to adequately segregate purchasing duties because of the small number of employees located at those sites. In addition, we found that FAA’s operating guidance did not specify how purchasing duties should be separated. Although the guidance describes key duties and responsibilities involved in the purchasing process, it generally does not 21 We are 95 percent confident that the total dollar value of transactions that lacked adequate segregation of duties was between $36 million and $52 million. Page 13 GAO-03-405 FAA Purchase Cards specify that these key duties and responsibilities be segregated among different people. For example, the guidance states that an approving official is normally the cardholder’s immediate supervisor. However, the guidance does not require other key roles, such as the funds certification officer and the property custodian, to be filled by someone other than the cardholder and the approving official. Lacking appropriate segregation, FAA cannot ensure that purchases are appropriate, have been duly authorized, and comply with purchase requirements. Supervisory Review and Because the only segregation of duties required by FAA policy is between Approval Process Was the purchaser and approving official for a particular transaction, the approving official often may be the only party aside from the purchaser Inadequate who reviews the transaction. Consequently, the approving official’s review is a critical internal control for ensuring that purchases are appropriate and comply with FAA requirements. However, we found FAA’s supervisory review and approval process was inadequate for ensuring that purchases were proper. Specifically, we found numerous transactions that did not have evidence of supervisory approval, had been approved even though they were missing key documents, did not comply with one or more purchasing policies or procedures, or were wasteful purchases. We also identified duplicate charges that had not been promptly disputed with the bank to ensure that they were removed from accounts and refunded to FAA. Review of transactions by persons in authority is the principle means of assuring that transactions are valid. Although FAA requires that approving officials review and approve cardholders’ purchases, this was not consistently done. For example, of the 333 purchase card and convenience check transactions in the statistical sample, 52 transactions lacked evidence of approving official review. Based on the results of our review of these transactions, we estimate that $27 million22 of the total sampled population of purchase card and convenience check transactions lacked evidence of approving official review. We also nonstatistically selected 1,874 transactions from fiscal year 2001 that appeared to have a higher susceptibility to fraud, waste, and abuse, and found that 419 of these transactions (22 percent) also lacked evidence of supervisory review. Because the approving official review is the first, and sometimes only, line 22 We are 95 percent confident that the total dollar value of transactions that lacked evidence of approving official review was between $20 million and $34 million. Page 14 GAO-03-405 FAA Purchase Cards of defense for detecting improper transactions, it is critical that approving officials perform and document adequate, timely reviews. The number of purchase transactions that had been approved even though they were missing key documents further illustrates FAA’s inadequate supervisory review and approval. Specifically, from our statistical and nonstatistical samples, we noted 155 transactions totaling $402,439 were missing key purchase documents such as a credit card slip or invoice, yet approving officials still approved 66 of these purchases.23 Missing invoice documentation raises questions about the adequacy of the approving official’s review, since without such documentation, it can be difficult to determine what was purchased based on the cardholder’s monthly credit card statement alone. For example, we identified a $1,240 transaction at Sears, Roebuck and Co. that the cardholder claimed was used to purchase a refrigerator. However, the monthly billing statement only indicated where the purchase was made, and did not contain a description of what was purchased. Without a credit card receipt or invoice, we could not verify what was purchased or whether it was being used for government purposes. As noted later in this report, we also found that cardholders throughout the agency made numerous improper purchases (i.e., purchases that did not comply with one or more purchasing policies or procedures) and wasteful purchases (i.e., purchases that were excessive in cost or for questionable government needs) that nevertheless were approved. 23 The remaining 89 transactions provided no evidence of supervisory review. Page 15 GAO-03-405 FAA Purchase Cards Without documented approval and a thorough review of all supporting documentation by approving officials, there is no assurance that items purchased comply with purchasing requirements and have a legitimate government purpose. For example, in fiscal year 2001 a former FAA employee was convicted of illegally making over $58,000 in personal charges with his government purchase card over at least a 9-month period, including numerous purchases made at various auto specialty businesses and a custom auto body shop. We could not determine from the case documentation provided to us whether the cardholder’s supervisor approved any of these purchases. However, had the approving official timely and thoroughly reviewed the credit card statements and supporting documentation for each transaction, he could have identified numerous improper purchases at vendors such as Commercial Van Interiors, Exclusive Window Tint, The Custom Shop, and Fairway Chevrolet on the government purchase card. In another case, a cardholder made six cash advances totaling $1,800 that occurred over four monthly billing cycles. File documentation contained a copy of one of the cardholder’s bank statements from that period. Although cash advances are prohibited, the authorizing official approved this statement even though the charges on that statement included three cash advances. In addition, the cash advances were made at two gambling establishments, including one called the Normandie Club, which should have raised at least some suspicions on the part of the approving official in reviewing the cardholder’s statement.24 These violations were not identified by the approving official, but were identified by the accounting department. The cardholder was reprimanded and the account was closed. However, FAA officials informed us that because the cardholder repaid the cash advances, no further disciplinary actions were taken against the cardholder. In addition, no disciplinary actions were taken against the approving officials in either case, despite the fact that approving officials are responsible for reviewing all transactions against supporting documentation and reporting potential fraud and abuse by cardholders. We also noted that three transactions totaling $3,712 were charged twice to cardholders’ accounts and had not been credited at the time of our review. Bank of America only allows a cardholder 60 days from the time a disputed transaction first appears on a cardholder’s monthly credit card statement to submit a written dispute form to the bank, but the cardholders in these 24 The name of the second establishment was abbreviated on the bank statement, making it less obvious where the charges were made. Page 16 GAO-03-405 FAA Purchase Cards three cases did not do so. In each case, the cardholders initiated verbal inquiries to the vendor or to Bank of America regarding the duplicate charges, but did not follow through with written dispute forms as required. In addition, approving officials did not perform timely follow up with the cardholders to ensure that the written dispute forms were submitted promptly. Therefore, these erroneous charges were not credited back to the cardholders’ accounts, and FAA was not reimbursed for the duplicate payments made to the bank. One factor that might contribute to FAA’s inadequate supervisory review is that, in certain instances, there was a high ratio of cardholders to approving officials. Having a manageable number of cardholders is essential for approving officials to be able to conduct timely, thorough reviews of transactions to help facilitate detection of possible purchase card misuse and fraud. Although there is no definitive requirement, GSA’s Blueprint for Success: Purchase Card Oversight indicates that most approving officials are assigned from 4 to 10 cardholders each. However, we found that 228 of FAA’s 1,741 approving officials, or 13 percent, were assigned from 11 to 47 cardholders each.25 FAA’s operating guidance does not address the number of cardholders that would be appropriate to enable approving officials to adequately perform their supervisory responsibilities. However, approving officials who have more cardholders than they can effectively supervise are less likely to adequately perform their responsibilities in a timely manner. Some Purchases Lacked We found that some of FAA’s purchase card transactions lacked key Key Documentation supporting documentation. FAA’s procurement guidance requires that all purchase transactions made by a cardholder must be supported by a certification of funds availability and an invoice or credit card slip. Furthermore, FAA Order 1350.15B, Records Organization, Transfer, and Destruction Standards, requires that acquisition records for purchases of $25,000 or less be maintained for 3 years after final payment. Acquisition records for purchases exceeding $25,000 should be maintained for 6 years and 3 months after final receipt of goods or services. 25 The remaining 1,513 approving officials were responsible for 10 or fewer cardholders. Page 17 GAO-03-405 FAA Purchase Cards Of the 333 transactions tested in the statistical sample, we found 18 instances where FAA lacked an invoice, credit card slip, or other store receipt. Based on these results, we estimate that $8 million26 of the total fiscal year 2001 purchase card and convenience check transactions lacked key supporting documentation. Similarly, our review of 1,874 nonstatistically selected transactions identified 131 transactions (7 percent) totaling $356,487 that were missing such key purchase documents.27 In some instances, cardholders or FAA employees indicated that the invoice had been lost, shredded, or not retained when the cardholder retired or separated from FAA. However, we also found instances where no explanation was provided as to why cardholders could not submit supporting documentation as of the end of our fieldwork. The invoice is the basic document that cardholders are required to attach to their monthly statements for approving official review. Without such documentation, FAA does not have any independent evidence of the description and quantity of what was purchased and the price paid. Therefore, it cannot determine whether the purchase was appropriate. Although the percentage of missing invoices was lower than the exceptions for other internal control activities we tested, we believe it is still unacceptable for such a key document. A valid invoice to show what was purchased and the price paid is a basic document for these transactions, and a missing invoice could be an indicator of potential fraud. A near zero failure rate is a reasonable goal considering that invoices are easily obtained or replaced when inadvertently lost. We also identified 178 instances in the statistical sample where FAA lacked a written certification from the responsible fiscal authority that funds were available to make the specific purchase. Based on the results of our review of these transactions, we estimate that $84 million28 of the total sampled population of purchase card and convenience check transactions lacked a written certification that adequate funds were available. FAA requires this 26 We are 95 percent confident that the total dollar value of transactions that lacked key supporting documentation was between $3 million and $13 million. 27 This category also included several transactions in which FAA provided purchase documentation, but the purchase amount on the vendor’s invoice, credit card slip, or other store receipt did not agree to the amount included on the cardholder’s monthly statement and the cardholder was unable to reconcile these two amounts. 28 We are 95 percent confident that the total dollar value of transactions that lacked a written certification that adequate funds were available was between $75 million and $93 million. Page 18 GAO-03-405 FAA Purchase Cards documentation to help ensure compliance with the Anti-Deficiency Act (31 U.S.C. 1341) and other fiscal laws that require that specific expenditures be authorized under the particular appropriation to be charged, and that funds are available in the appropriation for the expenditure. Training Was Inadequate to With the many purchase requirements that cardholders, approving officials, Perform Key Functions and APCs must follow, adequate training is essential for them to perform their duties effectively. However, we found that FAA had not provided adequate training for these key purchase card program participants. Our Standards for Internal Control in the Federal Government states that training should be aimed at developing and retaining employee skill levels to meet changing organizational needs. FAA’s purchase card procurement guidance requires APCs to ensure that both cardholders and approving officials receive proper training on the policies and procedures for use of the card. However, it does not specify how frequently such training must be provided. Although APCs are required to provide initial training to cardholders and approving officials, they are not required to provide any refresher training on an ongoing basis. The lack of refresher training may have contributed to the numerous policy violations we identified during our detailed testing (as discussed later in this report), such as purchases that exceeded various purchasing limits, purchases that were not made from required vendors, and purchases of accountable property that were not recorded in the property management system. Cardholder responses to our questions on these control areas also indicated that they were not aware of key requirements. For example, during our transaction testing, one cardholder said that certification of funds availability—which FAA policy clearly states must be performed for all transactions prior to purchase—was not required at the time of purchase. Another cardholder said it was not required because the particular transaction was under $2,500, while a third cardholder noted that the manager’s signature on the credit card statement constituted certification of funds. FAA recently began implementing steps to ensure that existing cardholders and approving officials obtain refresher training on the purchase card program. For example, an FAA memorandum from the Assistant Administrator for Regional and Center Operations, dated April 25, 2002, emphasized that all cardholders and approving officials under her line of reporting would be required to obtain refresher training, although no final date for completion of training was given. Another FAA memorandum, Page 19 GAO-03-405 FAA Purchase Cards dated April 30, 2002, from the Assistant Administrator for Financial Services and Chief Financial Officer also recommended, but did not require, that all parties involved in the purchase card program take periodic refresher training. Since then, some APCs have taken actions to implement the applicable requirements/recommendations at their locations. For example, at one FAA location the APC began requiring all cardholders and approving officials to complete purchase card retraining, including reading FAA’s internal purchase card operating procedures and certifying completion, reading GSA’s Blueprint for Success: Purchase Card Oversight, completing GSA’s on-line quiz, and submitting the certificate of completion to the APC. We were informed that the APC closed 40 cardholders’ accounts for failure to comply with the retraining requirement. This APC also held six “special emphasis” training sessions for all cardholders and approving officials, which emphasized areas of weakness that we had identified during our site visit. Another APC developed a database for her location to track the dates that cardholders and approving officials completed the initial and updated training. While FAA has begun to address the lack of refresher training for its cardholders and approving officials, the agency still has no specific training requirement or courses for its APCs. Adequate training for APCs is critical because they are responsible for overseeing the entire purchase card program. While FAA’s procurement guidance requires APCs to ensure that cardholders and approving officials receive proper training, the guidance is silent on ensuring the same for APCs. Consequently, the training available to APCs during fiscal year 2001 was limited to training offered by GSA and Bank of America; however, these sources were not fully utilized. For example, GSA conducts an annual governmentwide conference to train APCs on account administration, program management, reporting tools available for monitoring the program, and the banks’ various electronic access systems. However, we noted that only 6 of FAA’s 12 APCs attended GSA’s August 2002 training conference, and only 1 of the APCs attended any bank-sponsored training during fiscal years 2001 and 2002 for the purchase card program. As FAA makes changes to strengthen controls over the purchase card program, APCs require detailed guidance and training for carrying out some of these initiatives. However, they have not always received this. For example, an April 30, 2002, FAA memorandum, required each region and center, and the headquarters office to begin conducting annual reviews of Page 20 GAO-03-405 FAA Purchase Cards purchase card and convenience check transactions effective fiscal year 2002. Although the memorandum provided information regarding the type of sampling methodology to use, what to review, and the criteria to be used when conducting the annual review, there was no discussion regarding the population to be used in selecting the sample or specific data analysis techniques to be performed to identify potentially fraudulent, improper, or questionable transactions. In addition, the annual review only focused on reviewing the cardholder’s records for compliance with limited policies and procedures, and did not include an assessment of key control activities such as assessing the ongoing need for cards, appropriate segregation of duties, and record retention. Without detailed guidance and commensurate training, locations may not conduct adequate annual reviews. In addition, inconsistent methodologies used to perform reviews may not provide meaningful results for determining how the overall program is functioning. As noted later in this report, we identified instances where APCs were unaware of the monitoring tools available to them or were untrained in how to use them. Without proper training, APCs are limited in how effectively they can manage their programs, which in turn limits their ability to prevent and detect fraud, waste, and abuse. Program Monitoring Was FAA did not adequately monitor and evaluate the effectiveness of controls Inadequate over its purchase card program to ensure that findings of audits were promptly resolved. The OIG reported deficiencies in DOT’s departmentwide purchase card program, which included FAA, as far back as 1997, yet FAA did not take sufficient action to address these weaknesses. For example, in the 1997 review29 the OIG reported that cardholders purchased restricted and prohibited items and made split purchases to circumvent cardholders’ single purchase limits; approving officials did not adequately perform required supervisory reviews, such as reviewing the documentation to support cardholder purchases; and operating administrations did not statistically sample purchase card transactions for potentially improper purchases in part because they lacked adequate guidelines or procedures to do so. 29 MA-1998-004. Page 21 GAO-03-405 FAA Purchase Cards DOT’s primary response was to issue memorandums reiterating purchasing requirements, and issue guidance for conducting statistical reviews. However, it did not follow up to determine whether those actions were sufficient to resolve the cited weaknesses. Consequently, the OIG reported similar audit results in 2001,30 finding that cardholders continued to make split purchases, primarily at FAA; approving officials were not verifying that purchases were authorized; FAA was not sampling purchase card transactions to determine if purchases were authorized and complied with purchasing requirements; and disciplinary actions were inconsistent when cardholders or approving officials violated policies. As in 1997, DOT and FAA responded primarily by issuing memorandums and guidance. Although FAA management stated that the headquarters APC would begin performing internal audits of the purchase card program, the headquarters APC informed us that these internal reviews would be limited to headquarters’ purchase card activity and would not cover the controls or transactions at FAA’s 11 regions and centers. Without adequate monitoring to determine whether policies are being properly implemented, the issuance of new policies and guidance was generally ineffective. Our May 2002 report on FAA’s Alaskan Region purchases31 and this report identified many of the same weaknesses reported by the OIG as well as other findings. While the work performed by the OIG and us differed as to the specific scope and periods covered, the nature and scope of weaknesses identified were indicative of insufficient attention by management to establish and maintain sound internal controls over its purchase card program. Despite these repeated warnings, FAA management has not ensured that its efforts to address audit findings have actually corrected the problems. In April 2002, the Office of Management and Budget (OMB) directed all federal agencies to prepare a remedial action plan for their purchase card programs about the adequacy of internal control systems that monitor the use of purchase cards. DOT’s plan, which was approved by OMB on August 8, 2002, set forth several actions it planned to complete by November 30, 2002, such as reviewing cardholder spending limits to ensure that limits match cardholders’ needs, and reviewing, adjusting, and restricting certain merchant category codes to lessen the risk of fraud or 30 FI-2001-095. 31 GAO-02-606. Page 22 GAO-03-405 FAA Purchase Cards misuse. We noted that FAA was still in the process of implementing these actions at the end of our fieldwork. The inadequate follow-up on prior audit findings may be due in part to the lack of centralized oversight of FAA’s purchase card program. During our entrance conference with FAA officials, they admitted that no oversight or monitoring was performed at the FAA-wide level due to FAA’s decentralized operations and reporting structure. Consequently, they were unable to provide us even basic information about their overall purchase card program, such as the total number of cardholders and approving officials, or the volume of purchase card activity. FAA officials stated that the headquarters APC was FAA’s designated national representative, which the APC acknowledged. However, we found no monitoring activities directed at assessing overall program results, evaluating internal control and compliance with purchasing procedures, or ensuring that local purchase card policies and procedures were consistent with FAA acquisition policy. With the lack of centralized oversight of the purchase card program, FAA has had to rely upon the 12 individual APCs (1 at each location) to manage activities within their jurisdictions. However, we found that APCs’ primary attention appeared to focus on basic program activities such as opening and closing cardholder accounts and providing training for new cardholders and approving officials, with little if any attention paid to monitoring for compliance with program requirements or for improper purchases. Consequently, we found that APCs generally were not (1) consistently utilizing Bank of America’s Electronic Account Government Ledger System (EAGLS)32 reporting functions to detect potential misuse and/or fraud within their programs, (2) canceling accounts of departed employees in a timely manner, and (3) monitoring for increased risk of improper purchases due to cardholders with multiple accounts, as further discussed below. Given that FAA makes thousands of purchase card transactions annually, which, in fiscal year 2001, exceeded $150 million, it is essential that FAA management devote adequate attention to monitoring its purchase card program to ensure that it is properly managed and to reduce the risk of fraud, waste, or abuse. • EAGLS reports. EAGLS can generate account activity reports, which identify trends such as purchases from merchants that would not be 32 EAGLS is a Web-based system designed to help APCs perform administrative and accounting tasks and analyze program activities on-line. Page 23 GAO-03-405 FAA Purchase Cards expected to be traditional suppliers or unusually high spending patterns; dispute reports, which identify cardholders with excessive disputes that may indicate cardholder misuse or fraudulent activity; and various other exception reports that can track information such as unallowable automated teller machine transactions or cash withdrawals or charges at specific merchant category codes for businesses unrelated to FAA’s mission. Several APCs told us that they did not know that some of these essential reports existed or were not sure how to access the data to print these reports from EAGLS. As a result, they were not using them to systematically monitor cardholder activity for potential fraud or abuse. • Separated employees. We also found that accounts of cardholders who resign, retire, or otherwise leave FAA employment were not promptly closed upon their departure. Although FAA’s procedures require that the APC be notified via an employee clearance form when cardholders leave the agency, some APCs acknowledged that they did not always receive the forms or receive them timely. However, at the time of our review, only 1 of the 11 APCs33 actively reviewed cardholder names against monthly personnel reports to ensure that departed employees’ accounts were canceled soon after their departure. Consequently, our data mining identified five cardholders from three FAA locations whose accounts remained open a month or more after their fiscal year 2001 separation dates. Although we did not identify any associated fraudulent activity, charges continued to be made to four of the five accounts from automatic monthly billings, such as Internet service fees, or when other employees incurred charges at vendors that had the departed cardholders’ account numbers on file. FAA identified and closed three of the open accounts but was unaware of and did not close the remaining two accounts until we brought them to its attention, including one that was closed 6 months after the cardholder left the agency. • Multiple accounts. We also found that APCs were not monitoring for increased risk of improper purchases by cardholders with multiple purchase cards. During our data mining, we identified 176 cardholders who were issued from two to eight purchase cards each. According to FAA, multiple cards were issued so that the originating office could 33 Our finding only relates to 11 of 12 APCs because the scope of our review excluded the Alaskan Region. Page 24 GAO-03-405 FAA Purchase Cards separately track expenditures against different funding allocations. However, because every transaction requires an accounting classification code to indicate the appropriation and fund that the purchase is to be charged against, there is no need for separate purchase cards to do this. In addition, the issuance of multiple cards to the same cardholder places an additional administrative burden on APCs, cardholders, and approving officials in carrying out their respective responsibilities, and increases FAA’s risk of improper purchases. As a result of our audit, APCs have begun to review and cancel the excess purchase cards issued to these cardholders and have stopped issuing multiple cards to individual cardholders. FAA officials informed us that a national purchase card program coordinator and a national organization reporting coordinator were appointed to oversee the program beginning January 6, 2003. Proper oversight at this level will be critical for ensuring that identified program weaknesses are addressed nationally and program improvements are implemented consistently. Noncompliance with The lack of adequate internal controls was evident in identified violations of FAA acquisition requirements that we classified as improper purchases. Policies and These included (1) purchases that were split into two or more transactions Procedures Resulted in to circumvent single purchase limits, (2) purchases that exceeded other limits established by FAA, (3) purchases from other than required vendors Some Improper without the appropriate waivers, (4) unauthorized purchase actions Purchases whereby someone other than the cardholder made the purchase, and (5) withdrawals or payments to cardholders through cash advances or convenience checks. Table 1 shows the number of exceptions we identified for each category, as described further below. Page 25 GAO-03-405 FAA Purchase Cards Table 1: Transactions Not in Compliance with Purchasing Requirements Number of Dollar amount of Policy violation of purchasing transactions not transactions not in requirement in compliance compliance Transactions associated with purchases that were split into two or more segments to avoid established single purchase limits 997 $5,111,147 Purchases that exceeded limits established by FAA 30 214,666 Purchases that were not made from required vendors 20 35,903 Unauthorized purchase actions, that is, purchases by someone other than the cardholder 12 75,646 Withdrawals or payments through cash advances or convenience checks 4 2,462 Total 1,063 $5,439,824 Source: GAO. Note: GAO’s analysis of FAA purchase card transactions and related documentation. While the total amount of improper purchases we identified is relatively small compared to the over $150 million in annual purchase card and convenience check transactions, it demonstrates vulnerabilities from weak controls that could easily be exploited to a greater extent. The above policy violations are discussed in more detail below. • Split purchases. During our data mining and detailed tests of transactions, we found 997 split purchase transactions34—purchases that had been split into more than one transaction to stay within established single purchase limit—totaling $5.1 million. For example, a cardholder with a single purchase limit of $5,000 purchased a printer and accessories totaling $8,391. The cardholder had the vendor make three separate charges to the purchase card, on the same day, to avoid 34 Using data mining, we identified instances where one cardholder made multiple purchases from the same vendor on the same day that, in total, exceeded the cardholder’s established single purchase limit. We then followed up with the APCs and cardholders and, based on the documentation and responses provided, determined whether split purchases had been made. Page 26 GAO-03-405 FAA Purchase Cards exceeding the single purchase limit. Another cardholder informed us that she was directed by her supervisor to issue multiple convenience checks to pay a vendor in order to work around the $2,500 convenience check limit, despite the fact the cardholder advised her supervisor that this was contrary to procurement policy. After the split purchases were discovered, the cardholder stated that the incident was investigated, she was counseled, and her account was subsequently closed in January 2002. However, no disciplinary action was taken against the supervisor. We noted that cardholders and approving officials generally were not disciplined when these types of policy violations occurred. We identified another 201 transactions totaling over $543,000 that we considered potential split purchase transactions, but could not confirm this because cardholders did not provide adequate documentation to enable us to fully assess the transactions. The purpose of the single purchase limit is to require that purchases above established limits be subject to additional controls to ensure that they are properly reviewed and approved before the agency obligates funds. By allowing these limits to be circumvented, FAA has less control over the obligation and expenditure of its resources. Page 27 GAO-03-405 FAA Purchase Cards • Purchases that exceeded limits established by FAA policy. We found that several purchases exceeded FAA’s established purchase card thresholds for the procurement of services and the dollar limit for purchases made with convenience checks. When cardholders circumvent these management controls, FAA has no assurance that purchases comply with certain labor laws35 and that cardholders are making contractual commitments on behalf of FAA within the limits of their delegated purchasing authority. FAA’s operating procedures prohibit the use of the purchase card and convenience checks when procuring certain nonconstruction services of $2,500 or more, such as janitorial, grounds, and guard services,36 or when procuring certain services, such as temporary help and consulting services, regardless of the amount.37 During our detailed tests of transactions, we identified four transactions totaling $16,460 for nonconstruction services costing $2,500 or more. We also identified seven transactions totaling $111,648 for consulting services even though FAA prohibits using the purchase card for these types of purchases. For example, a cardholder procured consulting services for engineering, technical analysis, and program management support activities from the same vendor over a 3-month period totaling $67,000 because management had directed that these services continue while a new contract was awarded. 35 FAA must comply with the Service Contract Act of 1965, as amended; the applicable provisions of the Fair Labor Standards Act of 1938, as amended; and related Secretary of Labor regulations and instructions. These laws and regulations govern various labor standards for construction and nonconstruction services. 36 FAA exempts the following types of services from this requirement: maintenance, calibration, or repair of automated data processing equipment, scientific equipment and medical apparatus, and office or business machines. 37 FAA prohibits the use of the purchase card or convenience checks for certain types of services, including advisory and assistance services. It defines advisory and assistance services as “those services that are provided by nongovernmental sources that support or improve agency policy development, decision-making, management, and administration, or support or improve the operation of management systems. Advisory and assistance services provide outside points of view from individuals with special skills or knowledge from industry, universities or research foundations. Examples include studies, analyses, and evaluations, management and professional support including consultants, experts and advisors.” Page 28 GAO-03-405 FAA Purchase Cards FAA’s operating procedures also prohibit the use of the purchase card or convenience check when procuring construction services valued at $2,000 or more. FAA defines these services as the construction, alteration, or repair of buildings, structures, or other real property.38 During our detailed tests of transactions, we identified eight transactions totaling $35,735 that exceeded the $2,000 limit for purchasing construction services with the purchase card. These included a $5,224 purchase for the repair of wiring and replacement of lighting at an FAA cafeteria and two purchases totaling $12,684 from the same vendor on two different occasions for electrical work at an FAA facility. Our data mining also identified 11 transactions totaling $50,823 where cardholders exceeded the $2,500 convenience check limit.39 The most serious violation was the use of a convenience check to pay for equipment modifications totaling $18,690. FAA indicated it had previously identified this purchase as a violation of policy, notified the cardholder’s approving official, and taken steps to ensure the cardholder was reminded of convenience check policies and procedures. However, we noted that no disciplinary action was taken against the approving official who was responsible for ensuring that the purchase was made in accordance with policies and procedures. 38 FAA specifies that this definition includes but is not limited to improvements of all types, such as painting, fencing, and carpet installation at air traffic control facilities, communication towers, radar facilities, and office facilities. 39 Unlike purchase card transactions, there is no authorization process at the point of sale for convenience checks. However, agencies may elect to have a dollar limit imprinted on the check, as FAA has done. Page 29 GAO-03-405 FAA Purchase Cards • Purchases were not made from required vendors. Cardholders made numerous purchases from other than required vendors without obtaining appropriate waivers to indicate that they were authorized to buy elsewhere.40 During our testing of the 333 transactions in the statistical sample, we identified 36 purchases that were required to be purchased from a mandatory source. Of the 36, 20 transactions were not purchased from the mandatory vendors and did not have the required waiver from Federal Prison Industries, Inc. (UNICOR) or any documentation that would support that a Javits-Wagner-O’Day (JWOD) Act supplier did not offer the items or that the items were currently unavailable. Based on the results of our review of these transactions, we estimate that $9 million41 of the related sample population of purchase card and convenience check transactions lacked the required waivers or other supporting documentation. For example, a cardholder purchased 24 office chairs totaling $15,246 from a commercial vendor without obtaining a waiver indicating that UNICOR could not meet the purchase request. In another example, a cardholder purchased a leather binder, refills, and other accessories totaling $196 from Franklin Covey, a high-end office supply store, instead of purchasing similar products from a JWOD supplier. The cardholder provided an explanation that the purchase was for business use, but provided no documentation why similar products were not procured from a JWOD supplier. During our data mining, we noted that FAA made 2,903 purchases totaling $492,643 from Franklin Covey in fiscal year 2001. While we did not review all of these individual purchases, based on our detailed testing of similar transactions, it is likely many of them should have been procured from a mandatory source, if at all. In response to our questions about such purchases, FAA’s Director of Acquisitions responded to us in a 40 FAA policy requires that purchasers acquire certain products and services from designated mandatory sources, including JWOD Act suppliers and UNICOR. FAA purchasers are permitted to purchase from other sources only after a mandatory source provides a waiver indicating that it cannot provide the requested items. Although FAA’s procurement guidance requires that waivers be obtained from both JWOD and UNICOR, we found that JWOD suppliers generally do not issue waivers. According to the Director of Customer Service for the JWOD program, it is not normal practice to issue a waiver for items that are not currently available or items that it does not stock. Waivers are rarely issued, and if a waiver were granted to an agency, it would most likely be in the form of an E-mail. As a result, we accepted any documentation that would support that a JWOD supplier did not offer the items or that the items were currently unavailable. 41 We are 95 percent confident that the total dollar value of transactions that lacked the required waivers or other supporting documentation was between $8 million and $10 million. Page 30 GAO-03-405 FAA Purchase Cards November 21, 2002, memorandum that FAA is reviewing the need to establish guidelines on what can be purchased from this vendor. • Unauthorized purchase actions made with the purchase card. During our detailed tests of transactions, we found several unauthorized transactions where noncardholders made purchases using cardholders’ accounts, increasing the risk that the card may be used to make improper purchases. FAA’s operating guidance requires that the named cardholder on the purchase card be the only one to use the card to make purchases. Allowing someone other than the cardholder to use the card is considered an unauthorized purchase action that is subject to disciplinary action. However, we found that FAA did not always comply with this requirement. Specifically, we identified 12 unauthorized purchases totaling $75,646 where someone other than the cardholder made the purchase. Seven of these unauthorized purchases, totaling $70,000, related to one cardholder’s account. According to the cardholder, her supervisor had requested her purchase card account number so that others in the office could make purchases, which included various computer and office equipment, including 20 PDAs. Because the total order exceeded the cardholder’s single purchase limit, the vendor split the order into seven different purchase transactions, which is also a violation of policy. When her monthly billing statement came, the cardholder stated that she was unable to account for some of the transactions because the purchasers did not provide her with all of the related receipts for the items purchased. Furthermore, the cardholder informed us that an additional 14 transactions totaling $79,445 that were not in the sample but were listed on her monthly billing statement were also unauthorized purchase actions made by others in her office. Because of these unauthorized uses and the related frustrations associated with attempting to reconcile her monthly billing statements, the cardholder informed us that per her request, the APC closed her account on October 27, 2002. We identified another unauthorized transaction when a cardholder was unable to provide any supporting documentation for the item in the sample, stating she had not made the purchase. The cardholder stated that she transferred from the unit that issued her the card in July 1999, but was asked to leave the active credit card with the assistant manager so that the office could continue to use it to make purchases. Because the cardholder left the issuing unit in July 1999, all purchases made to Page 31 GAO-03-405 FAA Purchase Cards her account during fiscal year 2001, our period of review, were unauthorized purchase actions. As a result, we identified an additional 28 unauthorized purchase transactions totaling $3,595 that were charged to the cardholder’s account from October 2000 through January 2001. The APC eventually closed the cardholder’s account on January 28, 2002, approximately 2 ½ years after the cardholder had left. • Cash advances and cash payments made to cardholders. FAA’s operating guidance prohibits the use of the purchase card for cash advances and prohibits cardholders from issuing convenience checks payable to themselves. However, during our data mining we identified three cash advance transactions and one transaction where the cardholder wrote a convenience check payable to herself. For example, one cardholder used the government purchase card to obtain a $100 cash advance to pay a vendor for lawn services rendered at an FAA facility. The approval form for this transaction showed that the key authorizers and reviewers of this transaction—including the funds certification officer and the approving official—had approved the cash advance even though it was a violation of policy. In another example, a cardholder wrote a convenience check payable to herself totaling $214, in violation of policy. She purchased an item at a warehouse club that did not accept the brand of the government purchase card. Because the cardholder did not have authorization to use a convenience check at the time of purchase, she made the purchase with her personal credit card and subsequently requested and received authorization from her supervisor to be reimbursed by writing a convenience check payable to herself, even though this was a violation of policy. As described above, our review of FAA’s purchase card activities identified numerous policy violations that resulted in improper purchases. However, we generally found that disciplinary action was not taken against the cardholders or approving officials when these policy violations occurred. Enforcement of disciplinary action procedures helps prevent or deter future policy violations from occurring and assists in holding cardholders and approving officials accountable for carrying out their responsibilities when using, reviewing, and approving purchase card transactions. Page 32 GAO-03-405 FAA Purchase Cards Poor Controls Resulted The inadequacies and ineffectiveness of internal controls were also evident in the number of transactions identified that we classified as wasteful— in Some Wasteful and that is, were excessive in cost compared to other available alternatives Questionable and/or were for questionable government needs. Our reviews of transactions in both the statistical and nonstatistical samples identified Purchases transactions that we considered wasteful. In addition, FAA cardholders frequently did not document their determination that the purchase represented the “best value” to the government, which FAA purchasing policy defines as the solution that is most advantageous to FAA based on an evaluation of price and other factors. We also identified other transactions that we classified as questionable because there was insufficient documentation to determine what was purchased or because the charges were made to a third party billing company that did not identify the actual vendor. Lacking this documentation or identity, neither we nor other reviewers of the transactions could verify the reasonableness and appropriateness of the purchases. Table 2 indicates the number of transactions and dollar amounts in both the statistical and nonstatistical samples that we determined to be excessive in cost relative to similar products on the market, for questionable government needs, or for which we were unable to determine the reasonableness of the item due to missing invoices or because the charges were paid to third party on-line billing services. While not significant to the overall purchase card program, these transactions are indicative of what can occur when the use of the cards is not properly controlled. Because we tested only a small portion of the transactions that appeared to have a higher risk of fraud, waste, or abuse, there may be other improper, wasteful, and questionable purchases in the remaining untested transactions. Page 33 GAO-03-405 FAA Purchase Cards Table 2: Transactions Identified as Wasteful or Questionable Number of Dollar amount of Transaction category transactionsa transactions Wasteful transactions: Excessive cost 46 $140,131 Questionable government need 10 3,312 Both excessive cost and questionable government need 58 79,159 Total 114 $222,602 Questionable transactions: Missing invoice 149 401,347 Third party on-line billing 13 6,009 Total 162 $407,356 Source: GAO. Note: GAO’s analysis of statistical and nonstatistical transactions selected for fiscal year 2001. a Of the 114 transactions identified as wasteful, 9 came from the statistical sample and 105 came from the nonstatistical sample results. Of the 162 transactions identified as questionable, 18 came from the statistical sample and 144 came from the nonstatistical sample. Wasteful Purchases We identified 114 purchases totaling $222,602 that we determined to be wasteful because they were excessive in cost relative to available alternatives, were of questionable government need, or both. We considered them excessive in cost when compared to available alternatives that would meet the same basic needs or questionable as government expenditures because they appeared to be items that were a matter of personal preference or personal convenience, were not reasonably required as part of the usual and necessary equipment for the work the employees were engaged in, and/or did not appear to be for the principal benefit of the government. Specifically, we identified 46 purchases totaling $140,131 that we considered excessive in cost, 10 purchases totaling $3,312 for which we questioned the government need, and an additional 58 purchases totaling $79,159 that we considered both excessive in cost and for questionable government need. Such purchases included purchases of store gift cards for later use; hotel and resort charges, including room rentals and food costs for internal management meetings; award, retirement, and farewell gifts; Internet services for individual FAA employees; and purchases of PDAs and accessories. These examples are described below. Page 34 GAO-03-405 FAA Purchase Cards • Store gift cards. We noted several purchases of store gift cards for which we question the government need. Purchases of gift cards are particularly risky because they are the equivalent of cash. Unlike purchases made with a purchase card, which appear on a monthly billing statement to be approved by an approving official and supported by receipts, purchases made with a gift card have no such subsequent audit trail. Consequently, if the gift cards are lost, stolen, or misused, there is no means for determining how they were spent. In addition, gift cards used after the end of the fiscal year in which they are purchased violate the “bona fide” needs rule under 31 U.S.C. 1502(a) (2000).42 For example, one cardholder purchased 10 $100 Home Depot store gift cards, totaling $1,000, that the cardholder stated were to be used to purchase tile and mini blinds for installation in the day care facility after the close of the fiscal year. However, the cardholder was only able to provide one receipt dated 3 months after the close of the fiscal year, which showed that 3 of the gift cards were used to purchase items totaling $203.49. In addition to violating the bona fide needs rule, we identified several problems with this purchase. One, the $96.51 balance due from that purchase—government funds—was refunded in cash to the person using the gift cards, which we confirmed with the vendor. However, because the purchase was made with gift cards, which do not identify the purchaser, we could not determine who received the cash back nor what happened to it. Two, among the items purchased were two pairs of cowhide gloves, which were not part of the intended purpose the cardholder stated.43 Three, because the purchase was made with gift cards rather than the government purchase card, the state sales tax was charged and paid even though the federal government was exempt from state sales tax. In addition to these problems, the cardholder could not show how the remaining 7 gift cards were used, whether they were spent for government purposes, when they were used, or even who used them. Another cardholder spent $775 on Wal- Mart gift cards, but similarly was unable to provide any documentation on how the cards were ultimately spent. 42 Simply stated, the bona fide needs rule stands for the proposition that a fixed period appropriation may not be used to purchase a future-year need after the expiration of the appropriation’s period of availability for incurring obligations. 43 The bulk of the purchase was for a line item on the receipt that only showed a customer agreement number. We attempted to verify what was purchased with the vendor, but due to the age of the receipt, we were unable to obtain the detailed information by the time of our report. Page 35 GAO-03-405 FAA Purchase Cards In another example, one cardholder told us she was given verbal approval to spend a certain amount on an awards ceremony. When the award ceremony expenses totaled less than the allocated amount, the cardholder purchased a grocery store gift card for the remaining $179, which was later used to buy postage stamps for Christmas cards to send to other FAA facilities, and food and utensils for a Christmas luncheon and a retirement gathering, all of which are unallowable government expenditures. When we asked FAA for its policy on the purchase of gift cards, the Director of Acquisitions responded to us in a November 21, 2002, memorandum that FAA’s present policy is that gift cards will not be purchased for later use because such purchases are a violation of the fiscal law statute regarding bona fide need. However, unless cardholders and approving officials are aware of this policy and management adequately monitors compliance, such expenditures are likely to continue. • Conference room rentals and related food charges.44 We identified several purchases for the rental of hotel and resort facilities used for internal FAA meetings, conferences, and training. For example, FAA paid $2,660 for a conference room and audiovisual rentals at the Tropicana Resort and Casino in Las Vegas, with no explanation as to the reason why this location was chosen to hold an internal FAA management meeting. After we reported similar findings in our report on FAA’s Alaskan Region, the Chief Financial Officer issued a June 4, 2002, memorandum that established new spending restrictions, one of which now requires that internal FAA conferences and off-site meetings be held in federal facilities. However, this memorandum was issued after the period of our review. We also identified transactions for conference room rentals that included significant food and beverage costs, which we considered excessive and for which we questioned the government need. For example, in one case FAA spent $12,866 for food at a Hyatt Hotel for a conference, and $18,050 for food at another conference. We also noted a wasteful purchase representing a cancellation fee charge totaling $5,398 that resulted because the cardholder did not cancel FAA’s reservation for a conference room rental in time to avoid the fee. 44 Due to a lack of documentation and explanation for these transactions, we were unable to determine whether any of these charges were also improper purchases. Page 36 GAO-03-405 FAA Purchase Cards • Award, retirement, and farewell gifts. We noted several purchases for award, retirement, and farewell gifts. Although FAA policy gives managers a wide berth in determining the nature and extent of awards, we identified six purchases for award gifts for which they were unable to provide the purposes for which the recipients were being recognized. For example, we identified three purchases of Waterford crystal costing from $110 to $220 each. For these purchases, FAA could not provide the award letters or justification for the awards. Consequently, it could provide no evidence that these purchases were truly awards. We also identified two purchases for award events for which FAA was unable to provide the basis for the awards. These included a purchase of $225 for the rental of bowling lanes and shoes for 27 employees with no justification as to why the individuals were receiving the award, and $459 for 100 movie passes for “employee appreciation day” with no list of awardees or basis for the award. We also identified eleven purchases that FAA cardholders characterized as either retirement gifts or farewell gifts. However, they were unable to demonstrate that the gifts were authorized under applicable agency authority. The retirement gifts included two Waterford crystal gifts, a glass clock, and an inscribed globe, which ranged in cost from $101 to $209 each. The farewell gifts included a $329 engraved desk statue for a manager transferring to another unit within FAA. • Internet services. During our data mining, we identified 472 purchases totaling $16,894 for individual subscriptions to various Internet service providers, such as America Online, CompuServe, and EarthLink.45 We inquired with FAA regarding these types of purchases. In his November 21, 2002, response to us, the Director of Acquisitions indicated that these were unnecessary, stating that FAA provides Internet access for employees through eight authorized Internet access points and that employees should obtain the necessary services from one of these access points. The Director stated that FAA would work with the cardholders and FAA’s information resource management contact points and staff offices to ensure that employees do not inappropriately obtain individual subscriptions to Internet service providers. 45 Only 7 of these transactions were selected in the nonstatistical or statistical samples and were thus included in the totals shown in table 2. The remainder was identified by conducting a query on the database for Internet service providers such as those listed. Page 37 GAO-03-405 FAA Purchase Cards • PDAs and accessories. During our detailed testing, we identified 25 purchase transactions for 123 PDAs and/or PDA accessories totaling $66,684. For example, one of these transactions included a purchase of 30 PDAs and accessories totaling $13,189. However, no documentation was available to show how the office determined that these 30 PDAs were necessary to fulfill a valid government need, rather than for the personal preference of employees. We also noted a wide range in cost for the PDAs purchased. Specifically, the statistical and nonstatistical samples contained transactions for PDAs that ranged in cost from $100 to $558. Cardholders did not provide justification as to why the more expensive PDAs were needed, nor why there was a valid government need for these items. In addition, FAA incurred other costs to support the PDAs, such as those for PDA keyboards, carrying cases, and PDA Internet services. For example, in one instance we identified a purchase of six leather PDA accessories from the Coach store totaling $717. In addition to being excessive in cost, we question whether such items are necessary government expenses. In a June 4, 2002, memorandum prepared in response to our report on FAA’s Alaskan Region, FAA established new spending restrictions that included prohibiting the use of federal funds to purchase PDAs except where the affected associate or assistant administrator personally decides that it is vital to a person or organization successfully achieving their mission in an effective and efficient manner. We also identified numerous other individual purchases that we considered wasteful or, in some cases, abusive. Such purchases included a $299 Bose headset, which the cardholder indicated was used by her director and other senior managers during long flights; $206 for key chains and crystal hearts for training participants; and a $65 picture frame for a cardholder’s use in her office. In another example, a cardholder purchased a $3,707 Sony Vaio laptop computer because an assistant division manager saw it while on travel and asked the cardholder to buy it for him, despite the fact that other, less costly laptop computers were widely available. For example, during the same month another cardholder in the same region purchased 22 lower- end Sony Vaios for $1,330 each; a midrange Sony Vaio in the sample cost $1,700. According to the first cardholder, the model the assistant division manager wanted was new on the market and thus was only available directly from the manufacturer at that time. Page 38 GAO-03-405 FAA Purchase Cards Part of the problem with these purchases is that cardholders often did not document their determination that the specific purchase represented the best value to the government. FAA policy requires purchasers to determine that prices are fair, reasonable, and provide the best value46 to FAA. Its policy states that the determination that price is fair and reasonable should be documented and the extent of the documentation depends on the complexity and dollar value of the procurement action. We examined transactions in the statistical sample to determine whether there was any evidence that cardholders considered best value in making their purchase decisions, such as any evidence that at the time of purchase the cardholder considered prices from other vendors, services provided by the vendor, quality of product versus alternatives, prior experience with a vendor, or useful life of a product. We identified 213 purchases to which the determination of best value applied.47 Of these, 152 purchases did not have any documentation demonstrating that cardholders considered best value before making their purchases. Based on the results of our review of transactions, we estimate that $74 million48 of the sampled population of purchase card and convenience check transactions lacked documentation of the best value determination. While FAA has issued some new policies to prohibit or better control certain types of expenditures, the types of wasteful purchases we identified can only be prevented through proper employee training, adequate segregation of duties, and thorough management review and enforcement. Until FAA provides adequate management oversight of its purchase card program, including more thorough, systematic monitoring of expenditures with appropriate disciplinary action when warranted, the types of wasteful and abusive purchases we identified, as well as those that may not have appeared in the sample, are likely to continue. 46 FAA policy defines best value as a term used during the procurement source selection to describe the solution that is most advantageous to FAA, based on the evaluation of price and other factors specified by FAA. 47 Not all purchases in our 333-item selection were subject to the determination of best value. For example, purchases from required sources and purchases made through a single source selection process are not subject to the determination of best value requirement. 48 We are 95 percent confident that the total dollar value of transactions that lacked documentation of the best value determination was between $65 million and $84 million. Page 39 GAO-03-405 FAA Purchase Cards Questionable Purchases As discussed earlier in this report, we identified numerous transactions that were missing adequate supporting documentation to identify what was purchased and the amount. Specifically, 18 of the 333 transactions in the statistical sample49 and 131 of the 1,874 transactions in the nonstatistical sample lacked an invoice, credit card slip, or other sales documentation. Lacking key purchase documentation, neither approving officials nor we could determine or support what was actually purchased, how many items were purchased, the cost of the items purchased, and whether there was a legitimate government need for such items. However, based on the vendor names and explanations provided by the cardholders, we believe at least some of these items may have been determined to be improper or wasteful had the documentation been provided or available. For example, in one transaction that was missing an invoice, the cardholder stated that the purchase was for a $499 Bose Wave radio/CD player that was needed to monitor the news and weather. Table 3 illustrates some of the other transactions in the sample for which cardholders were unable to provide an invoice or other documentation to support what was purchased. Table 3: Examples of Transactions Where Invoice Documentation Was Missing Vendor Transaction amount Ashford.com (a jewelry Web site) $ 78 Bed, Bath, and Beyond 63 BestBuy.com 2,440 BJ’s Wholesale Club 251 Home Depot 1,042 Harbourtowne Resort 5,100 L.L. Bean Mail Order 90 Service Merchandise 216 Treasure Isle Food 1,755 Wal-Mart 332 Source: GAO. Note: GAO’s analysis of nonstatistical transactions selected for fiscal year 2001. 49 We estimate that $8 million of the total fiscal year 2001 purchase card and convenience check transactions lacked key supporting documentation. We are 95 percent confident that the total dollar value of transactions that lacked key supporting documentation was between $3 million and $13 million. Page 40 GAO-03-405 FAA Purchase Cards In addition, during our data mining, we identified 50 transactions totaling $13,450 that involved the use of third party on-line payment services to pay for cardholder purchases. We selected 30 of these transactions totaling $7,802 for further review. When using these types of services, the cardholder charges the amount of the transaction to the third party payment company. The payment company then forwards the funds to the vendor, generally because the vendor does not accept credit cards for payment. There is no additional expense to the government for using these third party payment companies. However, because the name of the third party payment company appears on the cardholder’s billing statement and not the name of the actual vendor that provided the goods or services purchased, there is no certainty that the purchase was for a bona fide government need and use. For example, one of the purchases included a transaction totaling $470 that the cardholder stated was for payment of software design services. Although the cardholder provided an invoice for the amount, there is no way to verify that the invoice belonged to the actual transaction because the merchant name on the cardholder’s billing statement was the name of the third party payment company, not the name of the vendor that purportedly supplied the software design services. In addition, the invoice date and the transaction date on the cardholder’s monthly billing statement did not match. As a result, we could not verify that the invoice supported the transaction. Furthermore, of the 30 transactions reviewed, 17 transactions involving four different third party payment companies were for purchases the cardholders claimed they did not make.50 Except for 2 transactions totaling $180, we noted that Bank of America subsequently credited the cardholders’ accounts because it determined that the charges were fraudulent in nature. This type of fraudulent activity demonstrates the risk that purchases made using third party payment companies may not be for valid government needs. We asked FAA for its policy on using third party payment companies. In its November 21, 2002, response to us, FAA indicated that it plans to issue guidance in the near future to emphasize that when the cardholder knows a purchase will be processed by a third party payment company, the cardholder must immediately make the approving official aware of the 50 For the remaining 13 transactions, we were unable to determine whether the purchase was for a bona fide government need or use. Therefore, we included these transactions in table 2 of this report. Page 41 GAO-03-405 FAA Purchase Cards transaction and provide supporting documentation once the purchase is received. However, this does not resolve the difficulty of ensuring that the supporting documentation is in fact associated with the transaction, given that the merchant name on the invoice and the name on the billing statement will not match. Poor Controls In reviewing purchases of computers and other portable assets bought with purchase cards, we found that FAA lacked adequate controls over such Contributed to Wasted purchases to ensure that they were properly recorded and accounted for. or Missing Assets Assets bought with purchase cards were not required to go through a central receiving point to help ensure that items were recorded in FAA’s property system before they were distributed to users. As a result, we identified 262 asset-related transactions totaling $4.1 million that contained one or more property items that had not been recorded in FAA’s property management system. In testing a selection of unrecorded items, we identified 238 items totaling $287,766 for which FAA could not account. Of these, 202 items were missing; FAA reported that the other 36 items had been transferred to other FAA locations or had been returned for repair and replacement, although FAA could not provide any documentation to support these claims. In addition to the items we found missing, the property management division at one FAA location identified during its physical inventory counts over 800 items totaling almost $2 million that were lost or stolen in fiscal years 2001 and 2002. Given the systemic weaknesses we identified in FAA’s property controls, the actual amount of missing or stolen equipment agencywide could be much higher. FAA’s cardholders buy a significant amount of computers and computer- related equipment with purchase cards. For example, in fiscal year 2001 FAA purchased at least $26.4 million in computers and computer-related equipment at vendors that primarily sell such items, such as Dell, Micron, and Gateway.51 Our Standards for Internal Control in the Federal Government requires agencies to establish physical control to secure and safeguard vulnerable assets. FAA policy requires that accountable property, items that meet specific FAA criteria and dollar thresholds, be recorded in FAA’s Personal Property In-use Management System (PPIMS) to establish accountability for these items. However, FAA did not require 51 Because FAA also purchased computers and related equipment from vendors that sold computers and noncomputer-related items, we could not determine the total amount of such equipment FAA purchased. Page 42 GAO-03-405 FAA Purchase Cards purchases of such property to go through a central receiving point where they could be adequately safeguarded until they were bar coded and recorded in PPIMS. Instead, purchase cardholders who bought sensitive items such as computers often took physical delivery of these items at the time of purchase or had them delivered directly to them. Consequently, FAA generally relied on the cardholders to determine whether assets met the requirements for tracking in PPIMS and to forward the appropriate information to property custodians for input. However, during our transaction review, we noted that cardholders did not appear to be knowledgeable of the different asset classifications that required input into PPIMS. For example, in selecting the statistical and nonstatistical sample transactions, we asked cardholders to provide documentation showing the item had been entered into PPIMS for all purchases of accountable property. Several cardholders responded “not applicable” to this request, even though the items they purchased met FAA’s criteria for tracking in PPIMS. Consequently, we identified 262 asset-related transactions totaling $4.1 million where one or more property items had not been recorded in FAA’s property management system. Specifically, from the statistical sample, 39 asset-related transactions totaling $737,951 had not been recorded in PPIMS even though the property items had been purchased at least 1 year earlier.52 Based on the sample results, we estimated that $17 million53 of the sampled population were unrecorded in PPIMS. From the nonstatistical sample, 223 asset-related transactions totaling $3.4 million had one or more items that had not been entered into PPIMS.54 When an asset is not recorded in the property management system, there is no systematic means of identifying where it is located or when it is moved, transferred, or disposed of and no record of its existence when physical inventories are performed. Thus, unrecorded assets can be easily lost or stolen without detection. 52 We identified 92 asset-related transactions in the statistical sample. Of the 92, 39 had not been recorded in PPIMS. 53 We are 95 percent confident that the total dollar value of transactions that were unrecorded in PPIMS was between $14 million and $19 million. 54 We identified 355 asset-related transactions in the nonstatistical sample. Of the 355, 223 (63 percent) had not been recorded in PPIMS. Page 43 GAO-03-405 FAA Purchase Cards Given the high risk of theft or loss, we conducted an unannounced inventory to test FAA’s ability to account for its assets. We selected 81 purchases of assets totaling over $1.3 million made during fiscal year 2001 by four FAA locations. The 81 transactions were for the purchase of 692 items consisting primarily of computer-related equipment, such as personal computers, laptops, and printers, as well as certain sensitive items, such as PDAs, that are easily pilfered. All of the transactions selected contained 1 or more items that had not been recorded in PPIMS. Of the 692 items we attempted to observe, we found that FAA could not locate 238 items (34 percent) totaling $287,766 at the time of our observation. Although FAA reported that 36 of these missing items had been transferred to other FAA locations or had been returned for repair and replacement, contrary to policy FAA could not provide any documentation to support these claims. In addition to the items we found missing, we noted that at one FAA location the property management division identified 405 items totaling over $900,000 that were lost or stolen in fiscal year 2001 and another 437 items totaling over $1 million that were lost or stolen in fiscal year 2002. These lost or stolen items were primarily identified through physical inventory counts performed during those years. During our follow-up with that location’s property management division, we noted that employees and FAA units responsible for safeguarding the assets were not held accountable when items were identified as lost or stolen. This lack of disciplinary action when items were lost or stolen, combined with poor recordkeeping within those FAA units, created an environment where there was little accountability for government assets. Because lost or stolen items that were not recorded in PPIMS might never be identified as missing, the actual number of missing or stolen items at this and other FAA locations may be much higher. During our site visits and unannounced physical inventories, we also observed instances where computers were not stored in a separate and secured storage room, and as a result, employees had unlimited access to these assets. For example, during an unannounced physical inventory at one location, we observed that an unsecured common office area was being used to store computer equipment. Without enhanced physical security, FAA will continue to be at risk for further computer equipment losses. We also noted instances in which cardholders purchased varying brands of computer equipment in small quantities from different vendors at various times of the year with no documented coordination with FAA’s information Page 44 GAO-03-405 FAA Purchase Cards technology or acquisitions unit. For example, the statistical and nonstatistical samples contained 47 transactions for 108 computers or laptops totaling over $400,000 where cardholders purchased fewer than 5 computers or laptops in a single transaction. By not coordinating such purchases, FAA could not take advantage of quantity discounts that it might have otherwise received had it combined, negotiated, and purchased similar items in large quantity with a single vendor. In addition, the wide variety of equipment purchased makes it more difficult for the information technology unit to provide user and network support and equipment maintenance. In an official response to us on November 21, 2002, FAA stated that it is developing standard policy guidance that will require equipment items over $500 to be centrally purchased to take advantage of economies of scale and to facilitate equipment standardization. However, it also needs to ensure that the purchases are needed to avoid wasted purchases. For example, one cardholder purchased 30 personal computers costing over $36,000 in November 2000. Although this particular transaction had been coordinated through the information technology unit prior to purchase, we physically observed that as of July 2002 all but 1 of these computers were still unused, sitting in their unopened boxes in a warehouse. Given how quickly computer technology advances, those computers will likely never be used by the agency. Had there been adequate central oversight, FAA could have prevented this purchase or directed the items to a unit that needed them. We noted 10 subsequent transactions for the purchase of a total of 134 personal computers made by cardholders in the same center as the cardholder that purchased the 29 unused computers. Conclusions Although weaknesses with FAA’s purchase card program were reported as far back as 1997, FAA has not corrected the identified problems. Consequently, improper and questionable purchases continued to occur, and numerous items purchased were lost or stolen because appropriate accountability had not been established. FAA has taken the first step towards addressing some of these issues by establishing new positions and responsibilities for overseeing its purchase card program at the national level, and issuing new policies to address some of the weaknesses identified. However, correcting the problems we identified will require a thorough evaluation and strengthening of current policies and procedures, a strong commitment at all levels of the agency to carrying them out, and appropriate oversight to continually assess the effectiveness of its controls. Page 45 GAO-03-405 FAA Purchase Cards Until this occurs, FAA will continue to be exposed to fraud, waste, abuse, and lost assets in connection with its purchase card program. Recommendations for We recommend that the Administrator of FAA take the following actions to strengthen internal controls and compliance in its purchase card program, Executive Action decrease wasteful purchases, and improve the accountability of assets in order to reduce FAA’s vulnerability to improper and wasteful purchases. Internal Controls With regard to improving FAA’s internal controls over purchasing, we recommend that FAA do the following. • Establish policies and procedures that segregate duties for all phases of the purchasing process when using the purchase card. No individual should be able to take all the steps needed to request, purchase, pick up, and receive goods and services purchased. Such policies should also require that responsibilities of the cardholders, approving officials, funds certification officers, property custodians, and APCs be performed by different people to ensure that management controls are not circumvented. • Develop detailed procedures that specify the type and extent of approving official review that is expected. Such procedures might include a checklist for approving officials to use in their monthly reviews of cardholders’ transactions. At a minimum, these procedures should describe the types of supporting documentation that the approving official should ensure that the cardholder has provided, such as the invoice and/or credit card receipt, certification of funds availability, documentation of best value, applicable waivers, PPIMS input forms, and written dispute forms for any disputed charges; the purchasing requirements that the approving official should review for compliance with policies and procedures, such as reviewing for split purchases, cash advances, and compliance with purchase card and convenience check spending limits and limits for construction and nonconstruction services; and a requirement that as evidence of review, the approving official sign the cardholder’s monthly billing statement. • Establish policies and procedures to limit the number of cardholders assigned to any one approving official consistent with GSA guidelines. Page 46 GAO-03-405 FAA Purchase Cards • Follow up on transactions we identified that were missing invoice documentation to determine what was purchased and whether the items were for legitimate government needs, and take appropriate disciplinary actions as warranted. • Reiterate records retention policy for purchase card transaction files. • Establish procedures to be performed by the approving official or issuing office when a cardholder leaves that office to ensure that his or her purchase files are retained in accordance with policy. • Require refresher training for all cardholders and approving officials. Such training should cover the areas discussed in this report, such as proper segregation of duties, purchasing policies and procedures, approving official responsibilities for reviewing and approving individual purchases, and reporting potential purchase card fraud and abuse. • Establish a systematic process that each APC can use to track and monitor training for cardholders and approving officials to help ensure that they receive (1) training before being granted purchase cards or approval authority and (2) timely, periodic refresher training. • Require initial and periodic refresher training for APCs, the national purchase card coordinator, and the national organization reporting coordinator that will assist them in carrying out their purchase card program management and oversight responsibilities. This should include developing a training curriculum specific to FAA purchase card policies and procedures. • Develop a national purchase card program monitoring and oversight system that includes assigning specific responsibility for following up on the effectiveness of actions to address prior audit or management review findings, overseeing local APC activities to ensure that local policies and procedures are adequate and consistent FAA-wide, and developing and using analytical tools to evaluate overall program results. • Develop operating guidance to assist APCs in performing their monitoring responsibilities. At a minimum, the guidance should Page 47 GAO-03-405 FAA Purchase Cards • provide detailed procedures for conducting annual reviews of cardholder and approving official activities, including the population to use when selecting the sample, the internal controls that should be assessed to ensure that they are operating as intended, and data analysis techniques and tools to use in analyzing bank electronic data, and • specify the monthly EAGLS and other reports that should be monitored for potential fraud, waste, and abuse. • Establish procedures to monitor and ensure purchase cards are canceled when cardholders leave FAA, are reassigned, or no longer have valid needs for the cards. • Identify cardholders with multiple purchase cards and cancel additional cards. • Establish policies and procedures that prohibit the future issuance of multiple cards to cardholders. • Establish procedures to periodically assess whether each cardholder continues to have a valid need for a purchase card and the appropriateness of the individual’s spending limits. This should include verifying that current APCs and their alternates are not purchase cardholders. Compliance with With regard to improving and enforcing compliance with purchasing Purchasing Requirements requirements at FAA, we recommend the following. • Revoke or suspend purchasing authority of cardholders who are found to be frequently or flagrantly noncompliant with policies and procedures, such as cardholders making split purchases, cash advances, or purchases exceeding established dollar thresholds. • Exercise appropriate disciplinary action against supervisors or approving officials who direct or approve purchase transactions that are noncompliant with policies and procedures. • Clarify FAA policy regarding the type of documentation required of cardholders, in lieu of a waiver, when not using a JWOD supplier, since JWOD suppliers do not issue standard waivers. Page 48 GAO-03-405 FAA Purchase Cards Wasteful and Questionable With regard to purchases that may be at an excessive cost or for Purchases questionable government need, we recommend that FAA do the following. • Establish agency policies covering the allowability, justifications, and approvals required for purchasing items that should be controlled or restricted such as store gift cards and food. • Clarify AMS policy and operating guidance regarding documentation requirements for the best value determination, including types of acceptable documentation. • Establish policies and procedures to better limit and control the use of third party on-line payment companies as a payment mechanism. This might include requiring documented advance approval from the approving official to help ensure that the item is needed and that the on- line payment company is the only viable method of payment, as well as a subsequent verification to help ensure that the item or service purportedly purchased was in fact received. Recording and Safeguarding With regard to improving FAA’s controls over the purchasing, recording, of Assets and safeguarding of assets, we recommend the following. • Require centralized receiving and acceptance of accountable assets and sensitive property items purchased. • Establish required time frames for completing and submitting property input forms, and for recording accountable assets in the property management system. • Follow up on property items that FAA officials were unable to locate at the time of our unannounced inventory to determine whether the items were subsequently located and entered into FAA’s property management system or whether the items were in fact lost or stolen, and take appropriate disciplinary actions as warranted. • Establish procedures to ensure that appropriate disciplinary action is taken against cardholders, approving officials, and/or property custodians as applicable who are unable to account for purchased assets under their responsibility in order to improve accountability for these assets. Page 49 GAO-03-405 FAA Purchase Cards • Improve physical security over the storage of computer-related equipment, such as placing these items in locked storage until they can be entered into the property management system and assigned to users. • Require purchases of certain assets, such as computer equipment, to be coordinated centrally to take advantage of economies of scale, standardize types of equipment purchased, and to better ensure bona fide government need for each purchase. Agency Comments and We received written comments from DOT on a draft of this report, which are reprinted in appendix I. DOT expressed its commitment to the Our Evaluation principles of the program and said that FAA has taken or plans to take a number of actions to ensure that the issues identified in our report are effectively addressed and appropriately enforced. For example, FAA established a (1) National Purchase Card Coordinator position to provide centralized program monitoring and (2) National Organization Reporting Coordinator position to enhance operating guidance and assist agency program coordinators in improving guidance for monitoring the purchase card program. In addition, FAA has revised its operating guidance to assist in strengthening controls over the purchase card program. Examples include clarifying segregation of duties requirements, specifying the type and extent of the approving official review, and developing standard policy guidance requiring that high cost or high quantity items be centrally purchased to take advantage of economies of scale. Implementation of these and other recommendations in our report should greatly reduce FAA’s vulnerability to improper, wasteful, and questionable purchases and missing assets. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 10 days after its date. At that time, we will send copies of this report to the Ranking Democratic Member, House Committee on Transportation and Infrastructure; the Secretary of Transportation; and the FAA Administrator. Copies will also be made available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you have any questions about this report, please contact me at (202) 512- 9508 or email@example.com; Doreen Eng, Assistant Director, at Page 50 GAO-03-405 FAA Purchase Cards (206) 287-4858 or firstname.lastname@example.org; or Steven Haughton, Assistant Director, at (202) 512-5999 or email@example.com. Major contributors to this report are acknowledged in appendix II. Sincerely yours, Linda M. Calbom Director, Financial Management and Assurance Page 51 GAO-03-405 FAA Purchase Cards Appendix I Comments from the Department of Appendx ies Transportation Append x Ii Page 52 GAO-03-405 FAA Purchase Cards Appendix I Comments from the Department of Transportation Page 53 GAO-03-405 FAA Purchase Cards Appendix II Staff Acknowledgments Appendx Ii Acknowledgments Staff members who made key contributions to this report include Brooks Bare, Beverly Burke, Sharon Byrd, Anh Dang, Christine Fant, Angela Fernandez, Richard Kusman, Carla Lewis, and Russell Rowe. (190043) Page 54 GAO-03-405 FAA Purchase Cards GAO’s Mission The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- GAO Reports and text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents Testimony using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to GAO Mailing Lists” under “Order GAO Products” heading. Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C. 20548 To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 512-6061 To Report Fraud, Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm Waste, and Abuse in E-mail: firstname.lastname@example.org Federal Programs Automated answering system: (800) 424-5454 or (202) 512-7470 Public Affairs Jeff Nelligan, Managing Director, NelliganJ@gao.gov (202) 512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C. 20548 United States Presorted Standard General Accounting Office Postage & Fees Paid Washington, D.C. 20548-0001 GAO Permit No. GI00 Official Business Penalty for Private Use $300 Address Service Requested
FAA Purchase Cards: Weak Controls Resulted in Instances of Improper and Wasteful Purchases and Missing Assets
Published by the Government Accountability Office on 2003-03-21.
Below is a raw (and likely hideous) rendition of the original report. (PDF)