Sandia National Laboratories
Further Improvements Needed to Strengthen Controls Over the Purchase Card Program
Gao ID: GAO-04-989R August 5, 2004
The Sandia National Laboratories (Sandia) operate in Albuquerque, New Mexico and Livermore, California. Sandia is a government-owned, contractor-operated national laboratory of the Department of Energy's (DOE) National Nuclear Security Administration (NNSA). During the fall of 2002, the Federal Bureau of Investigation began investigating two Los Alamos National Laboratory employees for alleged misuse of lab credit cards. Other allegations of theft and misuse of government funds at Los Alamos soon followed. In light of the problems identified at Los Alamos, Congress asked us to review selected procurement and property management practices at two DOE and two NNSA contractor labs, including Sandia. This report summarizes the information provided during our June 14, 2004 briefing to Congressional staff on these issues as they relate to Sandia. Specifically, we reviewed Sandia's purchase card program and property management practices to determine whether (1) internal controls over the lab's purchase card (Pcard) program provided reasonable assurance that improper purchases would not occur or would be detected in the normal course of business, (2) purchase card expenditures made under the contract properly complied with lab policies and other applicable requirements and were reasonable in nature and amount and thus were allowable costs payable to the contractor under the contract, and (3) property controls over selected asset acquisitions provided reasonable assurance that accountable assets would be properly recorded and tracked. Our review covered selected transactions that occurred during fiscal year 2002 and the first half of fiscal year 2003, which were the most current data available when we requested the data for our review.
Internal control weaknesses in Sandia's Pcard program increased the lab's risk of improper purchases. These control weaknesses primarily related to the review and approval processes, which are key controls in the Pcard program. Specifically, cardholders who were managers were allowed to approve their own purchases. Of the nonstatistical selection of 141 transactions obtained through data mining, 15 purchases (11 percent) were made by such cardholders and thus did not have any independent review and approval. In addition, approving officials did not review cardholders' monthly statements in a timely manner for 14 of 49 (29 percent) transactions tested. We also found 7 of the 141 nonstatistically selected transactions lacked an invoice, credit card slip, or other sales documentation. We further found that Sandia required purchases of restricted items to be preapproved, but did not require documentation of such approvals for the majority of our review period. Thirty-one of the 36 (86 percent) restricted item purchases we reviewed totaling $92,857 did not have any documented preapproval. Consequently, neither we nor the lab could determine whether this control was being effectively implemented. These control weaknesses likely contributed to the approximately $479,645 in improper, wasteful, and questionable purchases we identified during our review. This demonstrates vulnerabilities from weak controls that could be exploited to a greater extent. Specifically, we found 10 improper split purchases, which circumvented single purchase limits, consisting of 24 transactions totaling $372,321. Eleven purchases totaling $3,606 we determined to be wasteful because they were excessive in cost compared to other alternatives and/or of questionable need. Another 15 transactions totaling $103,718 we considered questionable because they were missing key documentation that would enable us or the lab to determine what was purchased and whether the purchases were proper and reasonable. Because we only tested a small portion of the transactions we identified that appeared to have a higher risk of fraud, waste, or abuse, there may be other improper, wasteful, and questionable purchases in the remaining untested transactions. Sandia also did not ensure that acquired property and equipment were tracked properly and in a timely manner. Of 43 assets in our nonstatistical selection of Pcard transactions, 21 (49 percent) totaling $39,113 were not recorded in Sandia's property management system at the time we provided the lab with the list of assets selected. We performed a physical observation of 88 assets, which included selected assets identified from the nonstatistical selection of 141 Pcard transactions as well as assets selected from the property database because they were still assigned to separated employees or there were multiple assets with the same serial number. All 88 were either found or--in the case of 12 assets--the lab indicated that the items had been disposed of or written off. However, because they only record the bar-code number and not the asset's serial number on the disposal form or the write-off report, we could not verify that the 12 assets had actually been disposed of or written off. Furthermore, our physical observation revealed several inaccuracies in the property database. The lab has made a number of recent policy and procedural changes that, if properly implemented, should help improve internal controls over its Pcard purchases. However, additional improvements are needed to further reduce the risk of improper and wasteful purchases.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director:
Team:
Phone:
GAO-04-989R, Sandia National Laboratories: Further Improvements Needed to Strengthen Controls Over the Purchase Card Program
This is the accessible text file for GAO report number GAO-04-989R
entitled 'Sandia National Laboratories: Further Improvements Needed to
Strengthen Controls Over the Purchase Card Program' which was released
on September 07, 2004.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
August 6, 2004:
Congressional Requesters:
Subject: Sandia National Laboratories: Further Improvements Needed to
Strengthen Controls Over the Purchase Card Program:
The Sandia National Laboratories (Sandia) operate in Albuquerque, New
Mexico and Livermore, California. Sandia is a government-owned,
contractor-operated national laboratory of the Department of Energy's
(DOE) National Nuclear Security Administration (NNSA).[Footnote 1] The
Lockheed Martin Corporation manages the lab under a cost-reimbursable
contract with NNSA. Lockheed Martin is paid a management fee to operate
the lab and is reimbursed for all allowable costs charged to the
contract.
During the fall of 2002, the Federal Bureau of Investigation began
investigating two Los Alamos National Laboratory employees for alleged
misuse of lab credit cards. Other allegations of theft and misuse of
government funds at Los Alamos soon followed. In light of the problems
identified at Los Alamos, you asked us to review selected procurement
and property management practices at two DOE and two NNSA contractor
labs, including Sandia.[Footnote 2]
This report summarizes the information provided during our June 14,
2004 briefing to your staff on these issues as they relate to Sandia.
The enclosed briefing slides highlight the results of our work and the
information provided.[Footnote 3] Specifically, we reviewed Sandia's
purchase card program and property management practices to determine
whether (1) internal controls over the lab's purchase card (Pcard)
program provided reasonable assurance that improper purchases would not
occur or would be detected in the normal course of business, (2)
purchase card expenditures made under the contract properly complied
with lab policies and other applicable requirements and were reasonable
in nature and amount and thus were allowable costs payable to the
contractor under the contract, and (3) property controls over selected
asset acquisitions provided reasonable assurance that accountable
assets would be properly recorded and tracked.[Footnote 4] Our review
covered selected transactions that occurred during fiscal year 2002 and the
first half of fiscal year 2003 (October 1, 2001, through March 31,
2003), which were the most current data available when we requested the
data for our review. This report also includes 10 recommendations for
action--9 related to actions needed to be taken by Sandia and 1 related
to action needed to be taken by the NNSA contracting officer for
Sandia.
Results in Brief:
Internal control weaknesses in Sandia's Pcard program increased the
lab's risk of improper purchases. These control weaknesses primarily
related to the review and approval processes, which are key controls in
the Pcard program. Specifically, during the majority of our review
period, cardholders who were managers were allowed to approve their own
purchases. Of the nonstatistical selection of 141 transactions obtained
through data mining[Footnote 5] for fiscal years 2002 and the first
half of fiscal year 2003, 15 purchases (11 percent) were made by such
cardholders and thus did not have any independent review and approval.
In addition, approving officials did not review cardholders' monthly
statements in a timely manner for 14 of 49 (29 percent) transactions
tested.[Footnote 6] For example, one purchase of a digital camera
wasn't approved until 16 months after purchase. We also found 7 of the
141 nonstatistically selected transactions lacked an invoice, credit
card slip, or other sales documentation. This may partly be due to the
fact that lab policy did not require monthly approvers to verify
purchases listed in the cardholder statements against supporting
documents. We further found that Sandia required purchases of
restricted items to be preapproved, but did not require documentation
of such approvals for the majority of our review period. Thirty-one of
the 36 (86 percent) restricted item purchases we reviewed totaling
$92,857 did not have any documented preapproval. Consequently, neither
we nor the lab could determine whether this control was being
effectively implemented.
These control weaknesses likely contributed to the approximately
$479,645 in improper, wasteful, and questionable purchases we
identified during our review. While relatively small compared to the
approximately $102 million in purchase card activity that occurred
during the review period, it demonstrates vulnerabilities from weak
controls that could be exploited to a greater extent. Specifically, we
found 10 improper split purchases--that is, groups of two or more
similar transactions that were split to circumvent single purchase
limits--consisting of 24 transactions totaling $372,321. Eleven
purchases totaling $3,606 we determined to be wasteful because they
were excessive in cost compared to other alternatives and/or of
questionable need, such as four laser pointers costing $228 each, when
other laser pointers were available for $90-$120 each. Another 15
transactions totaling $103,718 we considered questionable because they
were missing key documentation that would enable us or the lab to
determine what was purchased and whether the purchases were proper and
reasonable. Because we only tested a small portion of the transactions
we identified that appeared to have a higher risk of fraud, waste, or
abuse, there may be other improper, wasteful, and questionable
purchases in the remaining untested transactions.
Sandia also did not ensure that acquired property and equipment were
tracked properly and in a timely manner. Of 43 assets in our
nonstatistical selection of Pcard transactions, 21 (49 percent)
totaling $39,113 were not recorded in Sandia's property management
system at the time we provided the lab with the list of assets
selected. We performed a physical observation of 88 assets, which
included selected assets identified from the nonstatistical selection
of 141 Pcard transactions as well as assets selected from the property
database because they were still assigned to separated employees or
there were multiple assets with the same serial number. All 88 were
either found or--in the case of 12 assets--the lab indicated that the
items had been disposed of or written off. However, because they only
record the bar-code number and not the asset's serial number on the
disposal form or the write-off report, we could not verify that the 12
assets had actually been disposed of or written off. Furthermore, our
physical observation revealed several inaccuracies in the property
database, including data discrepancies, incorrect location
information, and inaccurate property custodians listed.
The lab has made a number of recent policy and procedural changes that,
if properly implemented, should help improve internal controls over its
Pcard purchases. However, additional improvements are needed to further
reduce the risk of improper and wasteful purchases.
Recommendations for Executive Action:
In order to address the issues identified in our review, we recommend
that the Administrator of NNSA direct the Sandia National Laboratories'
Director to take the following nine actions.
* To strengthen internal controls over the purchase card program and
reduce the lab's exposure to improper, wasteful, and questionable
purchases:
* Cancel purchase card accounts for cardholders who perform oversight
functions for the purchase card program to help ensure appropriate
independence and separation of duties between these functions.
* Require approving officials to attend initial and periodic refresher
training on Pcard policies and procedures to help ensure their
knowledge of purchasing requirements remains current.
* Emphasize during training for cardholders and approving officials the
laboratory's policies on (1) timely cardholder reconciliation and
supervisory review of transactions, (2) split purchases, (3)
transaction documentation requirements, (4) preapproval requirements
for restricted items, (5) prohibited purchases, and (6) considering
best value in making and approving purchases. Training should also
include reminding these staff of the criteria for accountable assets
and the requirements to notify property management to ensure
accountable assets purchased are identified, bar-coded, and entered
into the property management system.
* Require approving officials to verify purchases on cardholders'
monthly statements to the detailed sales receipts, invoices or other
independent support showing the description, quantity, and price of
individual items for all purchases made to help ensure that purchases
are adequately documented and are proper purchases before approving.
This should include verifying that there is documented approval for all
purchases of restricted items.
* Implement tools, such as data mining, for use by Pcard program staff
in reviewing cardholder purchases for improper purchases. These tools
should be used to systematically monitor for potential split purchases,
unusual vendors, restricted items without approval, and other
potentially improper or wasteful purchases.
* Consider modifying the Pcard system so that purchases that are not
reconciled timely by the cardholder are charged to a temporary suspense
account rather than to each cardholder's default project and task
codes.
* To help improve Sandia's controls over the purchasing, recording, and
safeguarding of assets, we recommend the following.
* Require that key information such as the property custodian,
location, serial number, and item description are verified against the
information entered into the property database during physical
inventory counts.
* Develop a report to enable property management staff to review recent
Pcard purchases for accountable assets that require recording in the
property management system.
* Require that serial numbers for items being disposed or written off
be listed on the disposal forms or inventory write-off reports.
We also recommend that the Administrator of NNSA direct the NNSA
contracting officer for the lab to review the improper, wasteful, and
questionable items we identified to determine whether any of these
purchases should be repaid to NNSA.
Agency Comments:
We obtained comments on a draft of this briefing from NNSA headquarters
officials. They generally agreed with the findings and recommendations,
and indicated that the lab has made a number of improvements to their
controls in light of the problems identified at Los Alamos.
We also obtained comments from NNSA's Sandia Site Office, who disagreed
with the recommendation to require approving officials to verify
purchases listed on cardholders' statements against detailed sales
receipts or invoices, indicating that to do so would be labor intensive
and cost prohibitive. They suggested periodic reviews of statistical
samples and data mining instead. While we endorse periodic reviews of
sample transactions and data mining as part of an overall system of
internal control, they are not a substitute for adequate supervisory
review. The approving official's review of transactions is one of the
most critical controls for helping to ensure that purchases are
necessary and proper. Without reviewing independent, detailed support
for the individual items purchased, a reviewer cannot ensure that the
actual items purchased were reasonable and proper, thus increasing the
risk of improper purchases.
Lab officials indicated that their efforts over the past 18 months have
resulted in many process and internal control changes, and further
changes are being considered. For example, Sandia management is
considering making training for approving officials mandatory and is
looking into the purchase of data mining software. In addition, the
Pcard manager informed us that the account of the staff member
responsible for monitoring Pcard activities was cancelled on June 8,
2004.
The lab also provided technical and clarifying comments, which we
incorporated as appropriate.
Scope and Methodology:
To determine if Sandia's internal controls over its Pcard program
provided reasonable assurance that improper purchases would not occur
or would be detected in the normal course of business, we reviewed
Sandia's contract with NNSA and applicable provisions of the DOE
Acquisition Regulation (DEAR) and the Federal Acquisition Regulation
(FAR), performed walkthroughs of key processes, interviewed Sandia and
NNSA management and staff, and compared the results to the lab's
policies and GAO's Standards for Internal Control in the Federal
Government.[Footnote 7] These standards provide the overall framework
for establishing and maintaining internal control and for identifying
and addressing major performance and management challenges and areas at
greatest risk of fraud, waste, abuse, and mismanagement and are based
on internal control guidance for the private sector.[Footnote 8]
To determine whether Pcard expenditures complied with lab policies and
other applicable requirements and were reasonable in nature and amount,
we performed data mining on fiscal year 2002 and the first half of
fiscal year 2003 Pcard transactions to identify indicators of potential
noncompliance with policies and procedures and to identify purchases
that appeared to be from unusual vendors, purchases made on weekends,
during the holidays, or at fiscal year-end, and purchases of attractive
assets. Based on the results, we (1) identified 50 potential split
purchases and tested all of them to determine whether they were in fact
split purchases and (2) tested a nonstatistical selection of 141
transactions for evidence of supervisory review and approval, adequacy
of supporting documentation, and reasonableness of the purchases.
To determine if property controls over selected asset acquisitions
provided reasonable assurance that accountable assets would be properly
recorded and tracked, we performed walkthroughs to observe property
controls, reviewed property management policies and procedures, tested
accountable property items selected in the nonstatistical selection to
determine whether these assets had been entered into the lab's property
system prior to our review, performed data mining on the property
database to identify possible database errors or inaccuracies such as
property assigned to terminated employees and multiple property items
with the same serial number, and performed a physical observation of
selected assets to determine whether they could be properly accounted
for.
We requested oral comments on a draft of the enclosed briefing slides
from the Administrator of NNSA or his designee and have included any
comments as appropriate in the letter and enclosed slides. While we
identified some improper, wasteful, and questionable purchases, our
work was not designed to determine the full extent of such purchases.
We conducted our work on all four labs from March 2003 through May 2004
in accordance with generally accepted government auditing standards.
Unless you publicly announce its contents earlier, we plan no further
distribution of this report until 30 days after its date. At that time,
we will send copies of this report to the Ranking Minority Member,
House Committee on Energy and Commerce; the Secretary of Energy; the
Administrator of NNSA; and the Sandia National Laboratories Director.
Copies will also be made available to others upon request. In addition,
the report will be available at no charge on our home page at http://
www.gao.gov. If you have any questions about this report, please
contact me at (202) 512-9508 or Doreen Eng, Assistant Director, at
(206) 287-4858. You may also reach us by e-mail at calboml@gao.gov or
engd@gao.gov. Additional contributors to this assignment were Stephanie
Chen, David Elder, Barbara House, Kelly Lehr, Gail Luna, and Lien To.
Signed by:
Linda M. Calbom:
Director, Financial Management and Assurance:
Enclosure:
List of Requesters:
The Honorable Sherwood Boehlert, Chairman:
The Honorable Bart Gordon, Ranking Minority Member:
Committee on Science:
House of Representatives:
The Honorable Joe Barton, Chairman:
Committee on Energy and Commerce:
House of Representatives:
The Honorable Jerry Costello:
The Honorable James Greenwood:
The Honorable W.J. "Billy" Tauzin:
House of Representatives:
Enclosure:
[See PDF for images]
[End of slide presentation]
FOOTNOTES
[1] The National Nuclear Security Administration (NNSA) was created in
fiscal year 2000 as a separately organized agency within DOE. As part
of its national security mission, NNSA has responsibility for the
institutional stewardship of three national security laboratories.
[2] The four labs we reviewed were DOE's Lawrence Berkeley National
Laboratory and Pacific Northwest National Laboratory, and NNSA's
Lawrence Livermore National Laboratory and Sandia National
Laboratories.
[3] Separate briefings were provided for each of the labs reviewed,
which we also summarized in separate letters.
[4] Throughout this document, references to purchases and transactions
refer to those made by the contractor employees of the lab that are
charged to the NNSA contract. Although the lab's purchase cards are
issued by the contractor, purchases charged to the NNSA contract are
ultimately reimbursed and thus paid for by the federal government.
Similarly, property purchased that is charged to NNSA becomes
government property.
[5] Data mining applies a search process to a data set, analyzing for
trends, relationships, and interesting associations. For instance, it
can be used to efficiently query transaction data for characteristics
that may indicate potentially improper activity.
[6] We were unable to test the timeliness of supervisory approval for
the remaining 92 transactions selected. According to Sandia officials,
during a computer conversion all of the approval dates were changed to
December 23, 2002. Thus, we could only perform this test on
transactions that occurred after the conversion.
[7] U.S. General Accounting Office, Standards for Internal Control in
the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November
1999).
[8] Internal Control--Integrated Framework, Committee of Sponsoring
Organizations of the Treadway Commission (COSO).
