National Science Foundation • Office of Inspector General
4201 Wilson Boulevard, Suite I-1135, Arlington, Virginia 22230
MEMORANDUM
DATE: January 27, 2014
TO: Dr. Cora B. Marrett
Deputy Director
National Science Foundation
FROM: Dr. Brett M. Baker
Assistant Inspector General for Audit
SUBJECT: Audit of NSF’s Purchase Card Program, Report No. 14-2-006
Attached is the final report on the subject audit. The report contains one finding on the
need to strengthen NSF’s oversight of the purchase card program with three
recommendations.
In accordance with Office of Management and Budget Circular A-50, Audit Followup,
please provide a written corrective action plan within 60 days to address the report
recommendations. This corrective action plan should detail specific actions and milestone
dates.
We appreciate the courtesies and assistance provided by so many NSF staff during the
review. If you have any questions, please contact Marie Maguire, Director of
Performance Audits, at (703) 292-5009.
Attachment
cc: Allison Lerner Steven Strength
G. P. Peterson Susan Carnohan
Michael Van Woert Marie Maguire
Cliff Gabriel Wendell Reid
Martha Rubenstein Emily Franko
Jeffrey Lupis Karen Scott
Greg Steigerwald
Audit of the National Science Foundation’s
Purchase Card Program
National Science Foundation
Office of Inspector General
January 27, 2014
OIG 14-2-006
TM#13-P-1-002
Introduction
The National Science Foundation (NSF) participates in the General Services
Administration’s (GSA) government-wide purchase card program, SmartPay. The
purchase card program provides Federal agencies with a flexible and efficient means to
quickly make authorized low dollar value and high volume purchases of general
supplies or services. JPMorgan Chase bank (JPMorgan Chase) provides the credit
cards and banking services to NSF under GSA’s SmartPay program.
The Government Charge Card Abuse Prevention Act of 2012 (the Charge Card Act),
Public Law 112-194, enacted in October 2012, requires all executive branch agencies to
establish and maintain specific safeguards and internal controls for the management of
purchase cards. In addition, the Charge Card Act also establishes additional reporting
and audit requirements relating to the agency purchase cards. On September 6, 2013,
the Office of Management and Budget (OMB) issued Memorandum M-13-21, which
provided further guidance to implement the Charge Card Act.
The Division of Acquisition and Cooperative Support (DACS) within NSF’s Office of
Budget, Finance & Award Management is primarily responsible for administering the
purchase card program. At NSF, the primary participants in the program are the:
(1) Agency Program Coordinator (APC) in DACS who has responsibility for both
overall administrative functions relating to the program and general oversight of
all purchase cardholders;
(2) purchase cardholders appointed to use the purchase card within their NSF
organizational unit; and
(3) approving officials who pre-approve the purchase card use of their assigned
cardholder(s), monitor account activity, and review cardholders’ monthly account
statement.
From April 1, 2010 through March 31, 2013, 233 NSF employees used purchase cards
to make approximately 34,300 transactions totaling almost $17 million. DACS reported
that as of February 1, 2013, 272 purchase cards were assigned to 186 employees and
there were 96 approving officials.
The last OIG audit of NSF’s purchase card program, performed in 2002 1, found irregular
transactions, including potential split purchases, payment of sales taxes, and the
purchase of prohibited items such as travel.
1
Purchase Card Program Controls Need Strengthening, Audit Report No. 02-2-014, issued September
30, 2002.
1
Results of Audit
NSF’s controls to prevent and detect unauthorized purchases and its oversight of the
purchase card program need strengthening. The control to cancel accounts when
cardholders leave NSF was generally working. However, controls over preapprovals of
transactions and reviews of purchase card statements were not always followed. Also,
agency-wide monitoring of the program and reviews of JPMorgan Chase reports
showing agency activity were not often performed. As a result, there was a risk that
inappropriate or fraudulent transactions could occur and not be detected. We did
identify some inappropriate purchases and referred three cardholders’ activity to our
Office of Investigations (OI) for investigation of possible fraud. As a result of one of
these investigations, a cardholder pleaded guilty in December 2013 to stealing more
than $94,000 by using his purchase card to buy electronics, music, and movies for
himself and his family.
NSF recently made improvements in its oversight of the purchase card program,
including updated guidance for the purchase card program in July 2013 and a new
online training course in August 2013. During fiscal year 2013, NSF management
committed more resources to assist the APC to perform targeted reviews of purchase
card activity. DACS began using a contractor to test a sample of transactions. As most
of these improvements occurred after our period under audit, we did not evaluate their
effectiveness. However, a sustained commitment by management to strong oversight is
needed to ensure purchase card holders comply with Federal regulations and agency
policies, and to prevent and detect misuse of the purchase cards.
Oversight of NSF’s Purchase Card Program Needs
Strengthening
NSF’s internal controls to ensure that cardholders properly use purchase cards and
comply with Federal regulations as well as NSF policies and procedures need to be
strengthened and enforced. From our targeted, risk-based sample 2 of 508 transactions,
totaling $314,443 3 for 43 cardholders 4, we found the following control weaknesses.
Some purchases were not pre-approved.
There was no evidence of preapproval for 151 transactions totaling $76,877. These
unapproved purchases were made by 30 of the 43 cardholders tested. These 30
cardholders had between 1 and 21 unapproved transactions. Per both of NSF’s
2
See Appendix B: Objectives, Scope and Methodology for details on how we selected which transactions
to test. Because we targeted our testing to the riskiest transactions, the sample is not representative of
the approximately 34,300 transactions in our population and the results should not be projected to the
universe.
3
This amount is the net of transactions tested, reflecting both charges and credits (refunds, adjustments,
etc.). All totals discussed in this report reflect net amounts.
4
Includes 10 cardholders who no longer work for NSF.
2
policies in effect during our audit period - the VISA Purchase Card Program
Handbook and Training Manual and the VISA U.S. Government Purchase Card
Guidance for Approving Officials, dated February 2004 - the approving official is
responsible for ensuring that transactions were authorized in advance of being made
by the cardholder.
Cardholders did not consistently maintain receipts or invoices for transactions, as
required.
Of the 43 cardholders tested, NSF could not provide support for 72 transactions
totaling $46,206 for 21 cardholders. For two former employees, NSF could not
locate documentation for any of their purchases. Both NSF policy and National
Archives and Records Administration regulations require that cardholders retain
records pertaining to purchase card transactions for 3 years after final payment to
the vendor.
There was no evidence of approving officials’ review of some purchase card bank
statements.
Of the 508 transactions we tested, there was no evidence that the approving official
reviewed the bank statements for 191 transactions totaling $124,747. Furthermore,
32 transactions totaling $27,163 were not reviewed within 60 days of the billing date.
These 223 transactions were made by 37 5 of the 43 cardholders tested. For one
cardholder we tested, some bank statements were in unopened envelopes. Per
NSF’s policies, the approving official should approve the cardholder’s monthly
statement to ensure that the statement and supporting documentation are complete,
accurate, and reflect only authorized purchases made in accordance with the
Federal Acquisition Regulation. These policies also require approving officials to
review monthly transactions for patterns that indicate purchases are being split to
avoid the micro-purchase limit. The approving official’s review should also ensure
that sales taxes are not paid in accordance with GSA regulations and NSF policy.
The approving official is required to sign and date the cardholder’s monthly
statement. However, NSF’s policies did not prescribe when these reviews must
occur. Given that cardholders have 60 days to dispute transactions with JPMorgan
Chase, it is reasonable for the approving officials’ review to take place within this
time period.
5
Some of these 37 cardholders had both transactions with no approving official review of the related bank
statement(s) and late approving official review.
3
Bank activity reports and Merchant Category Codes were not reviewed.
JPMorgan Chase provides the APC various exception reports on purchase card
activity, such as reports of lost or stolen cards, declined or blocked transactions, and
reports containing detailed information on items purchased from certain vendors.
NSF did not regularly obtain and review most of these reports. GSA SmartPay
program recommends that the APC use bank electronic reports to monitor and track
purchases to identify potential misuse and fraud. NSF’s 2004 policy states that
reviews and assessments of monthly administrative reports on the program is an
APC responsibility. Also, OMB Circular No. A-123, Appendix B Revised, dated
January 15, 2009, requires card managers to review account activity reports to
identify questionable or suspicious transactions.
Merchant Category Codes (MCC) identify the vendor’s business category, such as
computer software stores, telecommunications services, restaurants, book stores,
etc. At the APC’s request, JPMorgan Chase can block transactions with merchants
with specified MCC codes. Although MCC codes periodically change, before
February 2013 NSF had not reviewed its allowable and blocked codes since 2008.
We requested a list of blocked and allowable MCC codes and identified some codes;
such as babysitting, massage parlors, dating and escort services, and veterinary
services; that should have been blocked but were not. It is important to note that we
did not identify any NSF purchases to any of these codes. The APC then reviewed
the list provided to us and directed JPMorgan Chase to immediately block these and
other questionable MCC codes. NSF can reduce its risk of improper purchases by
periodically reviewing MCC codes and blocking purchases from vendors with codes
that do not relate to NSF’s business needs.
4
Some electronic equipment purchased using the purchase card, such as iPads and
cameras, did not have inventory barcodes to be included in NSF’s inventory system.
NSF’s purchase card policy requires cardholders to report accountable property
purchases to the Division of Administrative Services (DAS) to arrange for
assignment of barcode stickers and to have the items logged into the NSF inventory
system. NSF’s 2004 policy also requires the approving official to verify that the
accountable property has been inventoried. Furthermore, NSF’s policy on property
management for accountable property, issued by DAS, requires items with
acquisition values under $2,500 considered to be sensitive or highly pilferable, such
as desktops and laptops, to be inventoried.
We identified four causes that allowed these internal control weaknesses to occur.
First, NSF had not committed sufficient resources to monitor and oversee the purchase
card program. The APC, who is responsible for overseeing NSF’s purchase card
activity, also had other competing time-sensitive job responsibilities, such as serving as
Contracting Officer for several contract awards. Second, in the majority of cases,
cardholders and approving officials received informal training from the APC once, when
they were initially assigned cardholder and approving official responsibilities. This
training was not provided annually despite being required by NSF’s VISA Purchase
Card Program Handbook and Training Manual. In August 2013, NSF developed new
automated training for both cardholders and approving officials. NSF required that this
new training be completed by December 2013. This change should improve
cardholders’ and approving officials’ awareness of their responsibilities under the
program.
Third, some cardholders stated that they were not aware that sensitive or highly
portable property, such as professional cameras and high-end audiovisual equipment,
should be barcoded because NSF’s policy only required computers (laptops and
desktops) and Personal Digital Assistants (PDAs), including Blackberry cell phones, to
be barcoded. NSF’s prior purchase card policy does not require barcoding of other
sensitive or pilferable property, such as cameras and high-end audiovisual items.
NSF’s new 2013 Purchase Card Program Handbook and Policy Manual does state that
the cardholder should inventory equipment with acquisition values under $2,500
considered to be sensitive or highly pilferable, and this Manual lists laptops, desktops,
and PDA’s. The DAS policy, Procedures for Property Management for accountable
property, only lists desktops and laptops as examples of accountable property with
acquisition values under $2,500. However, another DAS guidance document, the
Property Custodian Operational Handbook, which details property management roles
and responsibilities, also includes iPads, iPhones, video cameras, and high-end
audiovisual equipment on its list of sensitive and highly portable equipment to be
barcoded.
Finally, some approving officials did not always ensure that departing cardholders
submitted their purchase card records before they left the agency despite the 3-year
record retention policy.
5
As of result of the conditions we identified, there was a risk that inappropriate or
fraudulent transactions could occur and not be detected. We identified the following
inappropriate purchases:
• 17 transactions totaling $32,503 made by 6 cardholders were split
purchases.
• 17 instances totaling $1,113 in which the purchase card was
inappropriately used to pay for transportation to airports for two officials
who were on temporary duty travel. SmartPay provides a separate travel
card program to be used for travel and travel-related purchases.
• 10 of the 43 cardholders tested paid $821 of sales taxes for 20
transactions tested.
• Two instances in which cardholders did not fully resolve disputes of items
that NSF did not purchase. In one case, the cardholder failed to fully
resolve potential overcharges of $11,594 for computers that the
cardholder did not purchase.
• Some electronic items purchased, such as music players and speakers,
appear to be of questionable business use or necessity.
Furthermore, we referred purchase card transactions for three cardholders to OI for
investigation of possible fraud. We did not test any transactions for two of these
cardholders, so their transactions are not included in our results. As a result of one of
these investigations, one cardholder, whose purchases are not included in our results,
pleaded guilty on December 5, 2013 to fraudulently purchasing more than $94,000 of
electronics, music, and movies for himself and his family. For another cardholder, OI
determined that the purchase investigated was not inappropriate. The remaining
investigation is ongoing.
During our audit, NSF made improvements in its oversight of the purchase card
program, including issuing updated guidance in July 2013 and requiring cardholders
and approving officials to annually complete a new online training course. NSF
management obtained a contractor to assist the APC to perform targeted reviews of
purchase card activity. These improvements occurred after our period under audit and
therefore, we did not evaluate their effectiveness. However, a sustained commitment
by management to strong oversight is needed to ensure purchase cardholders comply
with Federal regulations and agency policies, and to prevent and detect misuse of the
purchase cards.
Recommendations
1. The NSF Director should take appropriate actions to monitor and oversee the
purchase card program. Such actions should include:
• Continuous monitoring of purchase card transactions, using available
JPMorgan Chase reports to identify transactions for additional review.
6
• Ensuring approving officials are reviewing cardholders’ transactions from
preapproval to bank statement reconciliation.
• Reviewing MCC codes on a periodic basis to determine if additional codes
should be blocked.
• Ensuring compliance with record retention policies for purchase card
activity.
• Ensuring accountable property, including sensitive and highly portable
items, has been inventoried.
2. DACS should:
• Coordinate with DAS to revise the NSF policy, Procedures for Property
Management for accountable property to include additional examples of
sensitive and highly portable items to be barcoded, and
• Update the Purchase Card Program Handbook and Policy Manual and
training materials to be consistent with the revisions to the DAS policy.
3. The APC should ensure that cardholders and approving officials meet the new
annual training requirement.
Summary of Agency Response and OIG Comments
NSF concurs with the conclusions and recommendations. We have included NSF's
response to this report in its entirety as Appendix A.
OIG Contact and Staff Acknowledgements
Marie Maguire – Director of Performance Audits
(703) 292-5009 or mmaguire@nsf.gov
In addition to Ms. Maguire, Wendell Reid and Emily Franko made key contributions to
this report.
7
Appendix A: Agency Response
8
9
Appendix B: Objective, Scope and Methodology
The objectives of this performance audit were to determine the adequacy of NSF’s
controls over purchase cards and to identify possible improper charges. Our scope was
purchase card controls and activity from April 1, 2010 through March 31, 2013.
To complete our objectives, we reviewed NSF and federal criteria to understand the
rules governing the purchase card program; interviewed the APC, several cardholders,
and several approving officials to gain an understanding of their procedures to oversee
the program, and make and approve purchase card transactions; utilized data obtained
from JPMorgan Chase; and tested a risk-based sample of purchase card transactions
occurring during our scope period.
To develop this risk-based sample, we developed 19 risk-based transaction tests at
both the transaction level and cardholder level to identify anomalies in purchase card
data that could indicate fraud or abuse. Examples of risk factors at the transaction level
included:
• purchases made on a weekend or holiday,
• charges to merchant names or Merchant Category Codes that we suspected
may not be business-related,
• suspect charges identified from the JPMorgan Chase report containing detailed
information on items purchased from certain vendors,
• purchases in which only one NSF card holder did business with a particular
merchant,
• purchases made through third party payers (such as Paypal), and
• possible split purchases (multiple purchases by a cardholder to the same vendor
over a 2-3 day period that exceeded the $3,000 micro-purchase limit).
Examples of risk factors at the cardholder level included: cardholders for whom the
approving official’s span of control6 exceeded four purchase cards, and cardholders who
had declined charges and/or lost/stolen card(s) during the audit scope period.
We assigned risk scores for each of the 19 attributes tested and calculated the total risk
score for all 34,300 purchase transactions made between April 1, 2010 and March 31,
2013. Based on our review of the risk scores and number of cardholders with high risk
transactions, we tested 145 transactions with a total risk score above a certain level
made by 26 cardholders. In addition to the highest risk transactions for these 26
cardholders, we manually reviewed and judgmentally selected 225 additional
transactions that appeared unusual. Therefore, we tested a total of 370 transactions for
these 26 cardholders.
6
The span of control is how many purchase card accounts an approving official is responsible for
overseeing. Auditors considered purchase cardholders whose approving officials had a span of control
exceeding four purchase card accounts as the riskiest.
10
We also manually reviewed and judgmentally selected 102 other transactions for 15
additional card holders whose transactions did not score the minimum total level but
appeared to be unusual. For example, we decided to test a cardholder with several taxi
purchases in the hundreds of dollars, and a cardholder who was the sole purchaser for
a vendor with a specific merchant category. We also tested 36 of the transactions of
two OIG cardholders, the results of which are included in this report. Therefore, we
tested a cumulative total of 508 transactions, totaling $314,443, made by 43
cardholders.
When testing transactions, we interviewed cardholders and some approving officials
about the training received, physical security of purchase cards, and explanations for
both declined transactions and lost or stolen cards.
Additionally, we performed testing to determine if purchase cardholder accounts were
canceled on a timely basis when cardholders left the agency.
We met with OIG Office of Investigations (OI) throughout our audit to discuss our
methodology and findings. Prior to testing transactions, we shared with OI the results of
our risk factor scores. OI identified two cardholders to examine for possible fraudulent
transactions. The purchases for these two cardholders are not included in our results.
During our testing, we referred another cardholder to OI for possible investigation.
During the course of this audit, we relied on information and data received from
JPMorgan Chase in electronic format that had been entered into a computer system or
that resulted from computer processing. We tested the reliability of JPMorgan Chase’s
computer-processed data by matching transaction dates, transaction amounts, and
vendor names against original source documents. We relied on NSF’s data to test a
limited number of transactions for one cardholder. We performed limited testing of the
reliability of this NSF data by corroborating some results with NSF officials independent
of the computer system. Based on our assessment, we concluded the computer-
processed data was sufficiently reliable to use in meeting the audit’s objectives.
We reviewed NSF’s compliance with applicable provisions of pertinent laws and
guidance, including the:
• GSA’s SmartPay guidance,
• Federal Acquisition Regulation,
• Office of Management and Budget Circular No. A-123, Appendix B Revised,
dated January 15, 2009,
• National Archives and Records Administration’s record retention regulations,
• Treasury Financial Manual, and
• NSF’s VISA Purchase Card Program Handbook and Training Manual and the
VISA U.S. Government Purchase Card Guidance for Approving Officials,
dated February 2004.
11
We identified several instances of noncompliance with these laws and regulations, as
discussed in our audit finding.
Through interviewing NSF staff and reviewing documentation, we also obtained an
understanding of the management controls over the purchase card program. We
identified several internal control deficiencies which we discuss in our finding and
potential instances of fraud, illegal acts, violations, or abuse, which we referred to our
Office of Investigations.
We conducted this performance audit between January 2013 and December 2013 in
accordance with generally accepted government auditing standards. Those standards
require that we plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our finding and conclusions based on our audit
objectives. We believe that the evidence obtained provides a reasonable basis for our
finding and conclusions based on our audit objectives.
We held an exit conference with NSF management on December 12, 2013.
12
Audit of NSF's Purchase Card Program
Published by the National Science Foundation, Office of Inspector General on 2014-01-27.
Below is a raw (and likely hideous) rendition of the original report. (PDF)