No one individual should control all key aspects of a transaction or event without appropriate compensating controls. For the two fraud cases, the primary internal control weakness was the lack of segregation of duties. In each case, the individuals committing the fraud had authority or capability to perform functions that should have been segregated. The Staff Sergeant, who was Chief of Material in the Accounting Branch, had broad access to the automated vendor payment system, which allowed him to enter contract information, including contract numbers, delivery orders, modifications, and obligations as well as invoice and receiving report information and remittance addresses. Inadequate Access Controls Leave Payment System Vulnerable to Unauthorized Use

The lack of segregation of duties with respect to the level of access to the vendor payment system held by the Staff Sergeant that allowed him to embezzle funds remains widespread. Payments made after the required payment date must include interest. The practice of creating invoices for contractors provides an opportunity for DFAS and Air Force employees to create false invoices. Unable to Determine Whether Goods and Services Were Received Due to Inadequate Contract Management

We were also unable to determine whether the Air Force received the goods and services paid for under the two contracts because, in addition to missing records, a number of improper and questionable procedures were followed for receipt and control of equipment and services paid for under the contracts. Conclusions

Internal control weaknesses that contributed to past fraud in the Air Force’s vendor payment process continue. Moreover, the Air Force’s vendor payment system is vulnerable to unauthorized users due to weaknesses in operating computer system and local network security. To help ensure that vendor payments are proper and that they comply with Prompt Payment Act time frames, we recommend that the DFAS Director ensure that (1) the date that invoices are received and the date that goods and services are received are properly documented and (2) invoices are tracked from receipt through disbursement of funds. Objectives, Scope, and Methodology

In accordance with your request, our objectives were to (1) identify internal control weaknesses that contributed to Bolling AFB, Castle AFB, and the DFAS Dayton fraud, (2) provide our observations on whether the same or similar internal control weaknesses at the locations covered by our review continue to leave the Air Force vulnerable to fraud, and (3) to the extent possible, reconstruct the history of the two contracts associated with the Bolling AFB fraud to determine whether the government received the goods and services paid for under the contracts.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed two specific cases of fraud involving Air Force vendor payments, focusing on: (1) internal control weaknesses that contributed to the two fraud cases; (2) observations on whether the same or similar internal control weaknesses continue to leave the Air Force vulnerable to fraud or improper payments; and (3) reconstructing the history of the two contracts associated with the Bolling Air Force Base (AFB) fraud to determine whether the government received the goods and services paid for under the contracts.

What GAO Found

GAO noted that: (1) the two cases of fraud resulted from a weak internal control environment; (2) the lack of segregation of duties and other control weaknesses created an environment where employees were given broad authority and the capability, without compensating controls, to perform functions that should have been performed by separate individuals under proper supervision; (3) similar internal control weaknesses continue to leave Air Force funds vulnerable to fraudulent or improper vendor payments; (4) for example, as of mid-June 1998, over 1,800 Defense Finance and Accounting Service (DFAS) and Air Force employees had a level of access to the vendor payment system that allowed them to enter contract information, including the contract number, delivery orders, modifications, and obligations, as well as invoice and receiving report information and remittance addresses; (5) no one individual should control all key aspects of a transaction or event without appropriate compensating controls; (6) this level of access allows these employees to submit all the information necessary to create fraudulent and improper payments; (7) in addition, the automated vendor payment system is vulnerable to penetration by unauthorized users due to weaknesses in computer security, including inadequate password controls; (8) further, DFAS lacked procedures to ensure that the date that invoices were received for payment and the date that goods and services were received were properly documented; (9) these are critical dates for ensuring proper vendor payments and compliance with the Prompt Payment Act, which requires that payments made after the due date include interest; (10) missing records, another indicator of a weak internal control environment, prevented GAO from reconstructing the complete history of the two Air Force contracts associated with the Bolling AFB fraud; and (11) GAO was also unable to determine whether the Air Force received the goods and services paid for under these contracts because, in addition to missing records, a number of improper procedures were followed for receipt and control of equipment and services paid for under the contracts.