As discussed in the next section of this report on tests of key  controls, 52 of the 152 transactions in our Lackland AFB sample were for  Wilford Hall purchase card activity, and required supporting  documentation was not available for 23 of these 52 transactions. Some Approving Officials’ Span of Control over Purchase Card Accounts Exceeds DOD Guidelines

In response to concerns about approving official span of control raised  during our initial Navy purchase card work, the Director of DOD’s  Purchase Card Joint Program Management Office issued a memorandum  on July 5, 2001, that called for no more than five to seven cardholders per  approving official. For  example, of the five key control activities we tested, we found that all four  Air Force locations had significant control breakdowns in at least three of  them. Based on our statistical testing, we estimated that the failure  rate for independent documentation of receipt and acceptance—receiving  of goods and services by someone other than the cardholder—ranged from  53 percent to 68 percent at the four Air Force locations we tested. In these instances,  cardholders and approving officials were unable to tell us the types of  items purchased or the purpose of the transactions. Our analysis of documentation  related to the potentially fraudulent transactions that were not disputed  disclosed the following facts. Split purchases in which the cardholder circumvents the micropurchase  limit or other transaction limits. In response to our DOD audits, the Congress has recently enacted  amendments in section 1007(a) of DOD’s fiscal year 2003 authorization act  that address requirements for (1) periodic reviews to be performed to  determine whether each purchase card holder has a need for the purchase  card, (2) periodic inspector general audits to identify potentially  fraudulent, improper, and abusive uses of purchase cards,    (3) appropriate  training for cardholders and oversight officials, and (4) specific policies  regarding the number of purchase cards issued by various organizations,  authorized credit limits, and categories of employees eligible to be issued  purchase cards. However, the problems we  identified with missing receipts, lack of cardholder reconciliations and  approving official review, and failure to follow requirements in laws,  regulations, and DOD and Air Force policies and procedures resulted in  control environment weaknesses that leave the Air Force vulnerable to  fraud and improper use of the purchase card, as well as abuse and wasteful  spending. Recommendations for Executive Action

To strengthen the overall control environment and improve internal control  over the Air Force purchase card program, we recommend that the  following actions be taken. Alternative Air Force actions relate to our recommendations that the  Deputy Assistant Secretary for Contracting (1) review organizational use of  the purchase card and revoke purchase cards issued to organizations that  do not have authority to participate in the governmentwide purchase card  program and (2) establish appropriate, consistent Air Force-wide policy as  a guide for taking disciplinary actions with respect to cardholders and  approving officials who make or approve fraudulent, improper, or abusive  purchase card transactions. We used a case study  approach to evaluate the local purchase card program, and our work  consisted of three major segments—(1) an assessment of the overall  control environment, including the adequacy of the Air Force’s policies and  procedures, (2) an evaluation of the effectiveness of key internal control  activities, and (3) a determination of whether evidence existed of  potentially fraudulent, improper, and abusive or questionable transactions. Finally, we assessed management actions taken in fiscal year 2002 to  improve purchase card controls. Approving official review  is a recognized control activity at all levels of the purchase card program,  and the approving official review process has been described as the first  line of defense against misuse of the card.
Why GAO Did This Study

In July 2001 and March 2002, GAO testified on significant breakdowns in internal controls over purchase card transactions at two Navy sites that resulted in fraud, waste, and abuse. As a result, the Congress asked GAO to audit purchase card controls at DOD. This report focuses on Air Force purchase card controls and addresses whether the overall management control environment and key internal controls were effective in preventing potentially fraudulent, improper, and abusive purchase card transactions.

What GAO Found

Weaknesses in the overall control environment and breakdowns in key controls relied on to manage the purchase card program leave the Air Force vulnerable to fraud, waste, and abuse. Major contributors to the weak control environment included excessive numbers of purchase cards, with about one purchase card for every seven employees, approving official span of control that far exceeded DOD guidelines, and credit limits that were 12 to 20 times higher than actual spending. Of the five key control activities tested, the Air Force had significant control breakdowns in at least three of them (1) receiving of goods and services by someone other than the card holder, (2) cardholder reconciliation, and (3) approving official review of the cardholder's reconciled statements. The highest failure rates--69 to 87 percent--at the four locations tested related to approving official review--viewed by DOD as the first line of defense against misuse of the purchase card. The control breakdowns resulted in purchases that were potentially fraudulent, improper, and abusive or questionable. GAO also identified potentially fraudulent transactions for which supporting documentation was not available to show the quantity and type of items purchased. Air Force officials could not recall the purpose of these transactions. In addition, GAO identified (1) improper transactions related to weaknesses in controls relied on to prevent splitting purchases into multiple transactions to circumvent micropurchase and cardholder transaction limits and (2) the failure to use mandated sources of supply. Finally, GAO found that cardholders who abused or improperly used the purchase card were not subject to strong disciplinary action or consequences. The Air Force has taken a number of steps to improve control over the purchase card program. For example, it implemented automated controls during fiscal year 2002 to help monitor approving official span of control, credit limits, and cardholder reconciliation and approving official review of monthly statements. If effectively implemented, these controls should help strengthen the overall Air Force purchase card control environment as well as controls over statement reconciliation and approval.