The COTR was able to accomplish this scheme without detection by Air Force officials because he took advantage of his broad authority and the lack of adequate supervision. Continuing Internal Control Weaknesses in Air Force Vendor Payment Processes

Now, Mr. Chairman, I would like to turn our attention to the current control environment at the locations where these incidents occurred. Our work shows that similar internal control and system weaknesses continue to leave the Air Force vulnerable to fraudulent or improper vendor payments. For example, as of mid-June 1998, over 1,800 DFAS and Air Force employees had a level of access to the vendor payment system that allowed them to enter contract information, including the contract number, delivery orders, modifications, and obligations, as well as invoice and receiving report information and remittance addresses. In addition, the automated vendor payment system is vulnerable to penetration by unauthorized users due to weaknesses in computer security, including inadequate password controls. Finally, controls over remittance addresses remain a weakness. Specifically, DFAS lacks procedures to ensure that the date that invoices were received for payment and the date that goods and services were received were properly documented. These are critical dates for ensuring proper vendor payments and compliance with the Prompt Payment Act, which requires that payments made after the due date include interest. Until DFAS and the Air Force complete the actions to address control weaknesses in vendor payment systems and processes and maintain accountability over goods and services received, Air Force funds will continue to be vulnerable to fraudulent and improper payments.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the current status of internal controls over the process for Air Force vendor payments, focusing on two recent cases of payment fraud.

What GAO Found

GAO noted that: (1) the two cases of Air Force vendor payment fraud resulted from a weak internal control environment; (2) the lack of segregation of duties and other control weaknesses created an environment where employees were given broad authority and the capability, without compensating controls, to perform functions that should have been performed by separate individuals under proper supervision; (3) similar internal control weaknesses continue to leave Air Force funds vulnerable to fraudulent and improper vendor payments; (4) for example, as of mid-June 1998, over 1,800 Defense Finance and Accounting Service (DFAS) and Air Force employees had a level of access to the vendor payment system that allowed them to enter contract information, including the contract number, delivery orders, modifications, and obligations, as well as invoice and receiving report information and remittance addresses; (5) no one individual should control all key aspects of a transaction or event without appropriate compensating controls; (6) this level of access allows these employees to submit all the information necessary to create fraudulent or improper payments; (7) in addition, the automated vendor payment system is vulnerable to penetration by unauthorized users due to weaknesses in computer security, including inadequate password controls; (8) further, DFAS lacked procedures to ensure that the date that invoices were received for payment and the date that goods and services were received were properly documented; (9) these are critical dates for ensuring proper vendor payments and compliance with the Prompt Payment Act, which requires that payments made after the due date include interest; and (10) until DFAS and the Air Force complete the actions to address control weaknesses in vendor payment systems and processes and maintain accountability over goods and services received, Air Force funds will continue to be vulnerable to fraudulent and improper vendor payments.