HUD Purchase Cards

Poor Internal Controls Resulted in Improper and Questionable Purchases Gao ID: GAO-03-489 April 11, 2003

Due to the Department of Housing and Urban Development's (HUD) increasing use of purchase cards and the inherent risk associated with their use, Congress asked GAO to audit the purchase card program concentrating on assessing internal controls and determining whether purchases being made are a valid use of government funds.

Significant internal control weaknesses in HUD's approximately $10.6 million purchase card program resulted in improper, potentially improper, and questionable purchases in fiscal year 2001. Because of these internal control weaknesses, there was often inadequate documentation supporting many purchases GAO reviewed, and as a result, GAO was unable to determine whether these purchases were a valid use of government funds. GAO also found that HUD's remedial action plan for its purchase card program does not adequately address all the control weaknesses we identified. These weaknesses created an environment in which improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases GAO identified. GAO found improper and potentially improper purchases totaling about $1 million where HUD employees either split or appeared to have split purchases into multiple transactions to circumvent cardholder limits. GAO also found that HUD employees lacked adequate supporting documentation for about $1.3 million in questionable purchases including those from vendors not expected to engage in commerce with HUD, purchases made on holidays and weekends, and $74,500 in portable assets such as computer equipment and digital cameras. In these instances, it was not possible to determine what was purchased, for whom, and why. The problems GAO identified with HUD's purchase card program leave the agency vulnerable to wasteful, fraudulent, or otherwise improper purchases. Unless HUD makes specific improvements to its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan, the department remains susceptible to fraud, waste, and abuse.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.

Director: Team: Phone:

GAO-03-489, HUD Purchase Cards: Poor Internal Controls Resulted in Improper and Questionable Purchases This is the accessible text file for GAO report number GAO-03-489 entitled 'HUD Purchase Cards: Poor Internal Controls Resulted in Improper and Questionable Purchases' which was released on April 11, 2003. This text file was formatted by the U.S. General Accounting Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products‘ accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. Report to the Secretary of Housing and Urban Development: April 2003: HUD Purchase Cards: Poor Internal Controls Resulted in Improper and Questionable Purchases: GAO-03-489: GAO Highlights: Highlights of GAO-03-489, a report to the Secretary of Housing and Urban Development Why GAO Did This Study: Due to HUD‘s increasing use of purchase cards and the inherent risk associated with their use, Congress asked GAO to audit the purchase card program concentrating on assessing internal controls and determining whether purchases being made are a valid use of government funds. What GAO Found: Significant internal control weaknesses in HUD‘s approximately $10.6 million purchase card program resulted in improper, potentially improper, and questionable purchases in fiscal year 2001. Because of these internal control weaknesses, there was often inadequate documentation supporting many purchases GAO reviewed, and as a result, GAO was unable to determine whether these purchases were a valid use of government funds. GAO also found that HUD‘s remedial action plan for its purchase card program does not adequately address all the control weaknesses we identified. These weaknesses created an environment in which improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases GAO identified. GAO found improper and potentially improper purchases totaling about $1 million where HUD employees either split or appeared to have split purchases into multiple transactions to circumvent cardholder limits. GAO also found that HUD employees lacked adequate supporting documentation for about $1.3 million in questionable purchases including those from vendors not expected to engage in commerce with HUD, purchases made on holidays and weekends, and $74,500 in portable assets such as computer equipment and digital cameras. In these instances, it was not possible to determine what was purchased, for whom, and why. Some examples of these inadequately supported purchases are shown in the table below. The problems GAO identified with HUD‘s purchase card program leave the agency vulnerable to wasteful, fraudulent, or otherwise improper purchases. Unless HUD makes specific improvements to its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan, the department remains susceptible to fraud, waste, and abuse. What GAO Recommends: GAO is making several recommendations to strengthen internal controls including: * developing and implementing a robust review and approval function to include requiring and performing a detailed review of relevant supporting documentation for each purchase, * establishing specific requirements for documentation and records to support each purchase, and * developing and implementing a formal monitoring process to assess the effectiveness of the enhanced review and approval process. HUD said that while it had made some improvements, it agreed that it still needed to strengthen its purchase card controls. HUD‘s response listed actions to address five of the seven recommendations. GAO believes that HUD needs to address the remaining two recommendations as well. www.gao.gov/cgi-bin/getrpt?GAO-03-489. To view the full report, including the scope and methodology, click on the link above. For more information, contact Linda Calbom at 202-512-8341 or by E-mail at calboml@gao.gov. [End of section] Letter: Results in Brief: Background: Scope and Methodology: HUD‘s Internal Controls over Purchase Cards Did Not Provide Assurance That Improper Purchases Would Be Prevented or Detected: Control Weaknesses Contributed to Improper, Potentially Improper, and Questionable Purchase Card Transactions: HUD‘s Remedial Action Plan to Correct Purchase Card Program Deficiencies Lacked Specificity: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendixes: Appendix I: Comments from the Department of Housing and Urban Development: Appendix II: GAO Contacts and Staff Acknowledgements: : Letter April 11, 2003: The Honorable Mel Martinez Secretary of Housing and Urban Development: Dear Mr. Secretary: The use of purchase cards at the Department of Housing and Urban Development (HUD) has been steadily increasing over the last several years. During fiscal year 2001, purchase cards were used to make over 24,000 purchases totaling more than $10 million compared to over 14,000 transactions totaling more than $7.6 million in fiscal year 1997. Purchase cards are available to federal agencies under a General Services Administration (GSA) SmartPay Master Contract and may be used to make purchases with minimal paperwork. GSA administers the master contract and also provides purchase card program guidance for government agencies on its GSA Web site. Individual agencies are required to administer their own purchase card programs and set the parameters for use by authorizing employees, establishing dollar limits, and monitoring usage. The benefits of using purchase cards versus traditional contracting and payment processes are lower transaction processing costs and less ’red tape“ for both the government and the vendor community. While we support the use of a well-controlled purchase card program to streamline the government‘s acquisition processes, it is important that agencies have adequate internal controls in place to protect the government from fraud, waste, and abuse. Given HUD‘s increasing use of purchase cards and the inherent risk in their use, we were asked to assess HUD‘s purchase card activities.[Footnote 1] Specifically, we were asked to determine if (1) HUD‘s existing controls over the purchase card program provide reasonable assurance that improper payments will not occur or will be detected in the normal course of business and (2) payments for purchase card transactions are properly supported as a valid use of government funds. During the course of our work, the Office of Management and Budget (OMB) issued a memorandum requiring all agencies to develop a remedial action plan to manage the risk associated with purchase card usage. Because of this memorandum‘s relevance, we expanded our work to include determining whether HUD‘s remedial action plan effectively addressed its internal control weaknesses. Results in Brief: Significant internal control weaknesses in HUD‘s purchase card program made the agency vulnerable to and in some cases resulted in improper, potentially improper, and questionable purchases. During our review, which covered fiscal year 2001, we found that a preapproval process, required by HUD to help ensure the appropriateness of each purchase, was virtually nonexistent. Of the total $1.8 million purchase card transactions selected in the statistical sample,[Footnote 2] $1.4 million lacked adequate supporting documentation for the approving official to determine the validity of the purchase. Nevertheless, these purchases were approved for payment. Based on the results of the sample, we estimate that $4.8 million[Footnote 3] of the total sampled population of purchases ($10.6 million) lacked adequate supporting documentation. Additionally, HUD was not performing the required periodic reviews of purchase card transactions to assess compliance with its policies and procedures, thus preventing adequate monitoring of the purchase card program. These weaknesses, combined with the inherent risk of fraud and abuse associated with purchase cards, created an environment in which improper purchases could be made with little risk of detection. These control weaknesses likely contributed to the approximately $2.3 million in improper, potentially improper, and questionable purchases we identified during our review. For example, we identified improper split purchases and potential split purchases totaling over $1 million. Split purchases occur when multiple charges are made to the same vendor for one purchase in order to circumvent single purchase limits. We also identified questionable purchases, such as those made on holidays or weekends, and purchases made with vendors not routinely expected to engage in commerce with HUD. To determine whether these purchases were a valid use of government funds, we requested supporting documentation. HUD was unable to provide adequate supporting documentation for 1,478 transactions totaling about $1.3 million or 43 percent of the transactions we requested and 72 percent of the total dollars requested. These unsupported transactions included $27,000 to various department stores, $8,900 to music and audio stores, and $9,700 to restaurants. Because HUD was unable to provide adequate documentation for these purchases, we consider them to be a questionable use of government funds and therefore potentially improper. HUD‘s remedial action plan for its purchase card program does not effectively address its internal control weaknesses. Although HUD recognizes the need to improve its internal controls, its plan lacks specific commitment of time and resources to implement the proposed actions. Management‘s commitment to improving internal control is necessary to reduce HUD‘s vulnerability to future improper payments. Unless HUD‘s management makes specific improvements to its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan, HUD will continue to be susceptible to misuse of government funds. We are making recommendations in each of these areas. In commenting on a draft of this report, HUD agreed that further improvements are needed to strengthen the department‘s purchase card controls and cited actions it is taking or plans to take to address five of our seven recommendations. Regarding the remaining two recommendations, we continue to believe that HUD needs to revise its remedial action plan to include the steps necessary to fully implement the proposed changes to strengthen internal controls. Also, HUD needs to follow up on the inadequately supported purchases identified during our audit. Background: HUD‘s purchase card program is part of the governmentwide commercial credit card program established to simplify federal agency acquisition processes by providing a low-cost, efficient vehicle for obtaining goods and services from vendors. According to Federal Acquisition Regulation (FAR) Part 13.201(b), government purchase cards should be used for micropurchases, which are purchases up to $2,500.[Footnote 4] The Department of the Treasury also requires agencies to establish approved uses and limitations on the types of purchases and spending limits. GSA administers the master contract and HUD‘s purchase card policy was derived from the GSA governmentwide credit card program and tailored by HUD to meet its specific needs. During the period of our review--October 2000 through September 2001--HUD was operating under a policy dated October 1995. HUD is currently updating its purchase card policy. HUD‘s purchase card policy states that purchase cards are intended to procure general-purpose office supplies and other support needs. The policy requires each approving official to develop a preapproval process to ensure that all purchase card transactions are authorized and in accordance with departmental and other federal regulations. The approving official signifies that a cardholder‘s purchases are appropriate by reviewing and signing monthly statements. As required by the Department of the Treasury, HUD‘s purchase card policy established approved uses and limitations on the types of purchases and dollar amounts in its purchase card policy. This policy also includes a detailed list of items that cardholders are prohibited from buying with their government purchase cards. For example, purchase or rental of nonexpendable property (generally defined as property of a durable nature with a life expectancy of at least 1 year), meals, drinks, entertainment or lodging, and construction costs exceeding $2,000 are generally prohibited.[Footnote 5] Fiscal year 2001 single purchase limits for individual cardholders, which are required to be established by the approving officials and approved by the departmental directors, ranged from $100 to $80,000, and their monthly limits ranged from $100 to $300,000. HUD was in the process of reevaluating and where applicable, lowering these limits. Bank One currently services the purchase card program at HUD. Internal control is a major part of managing an organization and is key to ensuring proper use of government resources. As mandated by 31 U.S.C. 3512, commonly known as the Federal Managers‘ Financial Integrity Act of 1982, the Comptroller General issues standards for internal control in the federal government.[Footnote 6] These standards provide the overall framework for establishing and maintaining internal control and for identifying and addressing major performance and management challenges and areas at greatest risk of fraud, waste, abuse, and mismanagement. According to these standards, internal control comprises the plans, methods, and procedures used to meet missions, goals, and objectives. Control activities are the policies, procedures, techniques, and mechanisms that enforce management‘s directives and help ensure that actions are taken to address risks. Control activities are an integral part of an entity‘s planning, implementation, review, and accountability for stewardship of government resources and achieving effective results. They include a wide range of diverse activities. Some examples of control activities include controls over information processing, physical control over vulnerable assets, segregation of duties, proper execution of transactions and events, and access restrictions to and accountability for resources and records. Scope and Methodology: To determine whether HUD‘s existing controls over the purchase card program provided assurance that improper purchases would be detected or prevented in the normal course of business, we interviewed HUD staff and performed walk-throughs of the process. We reviewed HUD‘s policies and procedures and prior GAO reports as well as reports by HUD‘s Office of Inspector General (OIG) and independent auditors on this topic. To test the effectiveness of internal controls, we selected a stratified random sample of 222 purchase card transactions made during fiscal year 2001 totaling over $1.8 million from a population of purchase card transactions totaling $10.6 million. To identify potential improper purchases we requested and obtained fiscal year 2001 transaction data from Bank One and used data mining techniques[Footnote 7] and other computer analyses to identify unusual transactions and payment patterns in HUD‘s fiscal year 2001 purchase card transaction data that may be indicative of improper purchases. In order to determine if fiscal year 2001 purchases were adequately supported and for a valid government use, we requested and analyzed supporting documentation for those transactions that we identified as potentially improper and questionable. While we identified some improper, potentially improper, and questionable purchases, our work was not designed to determine the full extent of improper purchases. We requested comments from the Secretary of Housing and Urban Development. We conducted our work from November 2001 through November 2002 in accordance with generally accepted government auditing standards, and we performed our investigative work in accordance with standards prescribed by the President‘s Council on Integrity and Efficiency. HUD‘s Internal Controls over Purchase Cards Did Not Provide Assurance That Improper Purchases Would Be Prevented or Detected: HUD staff did not comply with key elements of its purchase card policies that would have helped minimize the risk of improper purchases, including (1) obtaining preapproval for purchases, (2) retaining adequate supporting documentation, (3) conducting supervisory review of all purchases, and (4) periodically reviewing purchase card transactions to ensure compliance with key aspects of the department‘s policy. This created an environment where improper purchases could be made with little risk of detection and likely contributed to the $2.3 million in improper, potentially improper, and questionable purchases we identified through our data mining efforts. GAO‘s Standards for Internal Control in the Federal Government[Footnote 8] states that transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into. To address these internal control standards, HUD‘s purchase card policy contains fundamental controls designed to minimize the agency‘s exposure to improper purchases. HUD‘s policy requires each approving official to establish a preapproval process for each cardholder to ensure that all purchases are appropriate and for official government use. Further, HUD‘s policy states that the approving official is required to review, certify, and monitor all cardholder purchases to ensure that they have the necessary approvals before purchases are made. Additionally, HUD‘s purchase card policy requires that approving officials review each purchase along with the applicable supporting documentation in order to certify that the purchases were appropriate and a valid use of government funds. Based on our review of HUD‘s purchase card process, we found that most approving officials had not established a preapproval process to ensure the appropriateness of purchases before they are made. Only the Information Technology Office routinely obtained authorization prior to purchasing items with the purchase card. The approving official‘s review of each purchase card transaction is one of the most important controls to ensure that all purchases are a valid use of government funds. We found that this critical control was seriously compromised because of inadequate supervisory review of supporting documentation by approving officials. To test the effectiveness of this key internal control, we selected and tested a stratified random sample of 222 purchase card transactions made during fiscal year 2001. Of the total $1.8 million purchase card transactions selected in the statistical sample,[Footnote 9] $1.4 million lacked adequate supporting documentation for the approving official to determine the validity of the purchase. Based on the results of this sample, we estimate that $4,753,253[Footnote 10] of the total sampled population of purchases ($10,590,461) made during fiscal year 2001 lacked adequate supporting documentation. Our Standards for Internal Control in the Federal Government states that internal control activities help ensure that management‘s directives are carried out. One such activity is the appropriate documentation of transactions. Internal control and all transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination. All documentation should be properly managed and maintained. We determined that some of HUD‘s records supporting the purchase card program were not properly managed or maintained. For instance, HUD could not provide a complete and accurate list of all approving officials. When we attempted to contact cardholders and their respective approving officials to request supporting documentation using the list the agency provided, at least 28 approving officials provided written notification that cardholders assigned to them according to HUD records were not their responsibility. According to HUD officials, the purchase card program administrator is not routinely informed of changes in approving officials and often does not have the time to update the list regularly. Because HUD does not know who should be approving purchases, there is an increased risk of collusion as well as a general lack of accountability for ensuring the proper use of government funds. Another control activity that was available but not being used by HUD is blocking Merchant Category Codes (MCC). Blocking categories of merchants allows agencies to prohibit certain types of transactions that are clearly not business related, such as purchases from jewelry stores or entertainment establishments. During our review, we found that HUD was not blocking any MCCs. These blocks are available as part of HUD‘s purchase card task order, under the GSA SmartPay Master Contract with Bank One. Because HUD did not take advantage of this control, there were no restrictions on the types of purchases employees could make during fiscal year 2001--the period of our audit. As a result of our audit work, on March 6, 2002, HUD began using selected MCC blocks. Our Standards for Internal Control in the Federal Government states that internal control should generally be designed to assure that ongoing monitoring occurs in the course of normal operations. Internal control monitoring should assess the quality of performance over time and ensure that findings of audits and other reviews are promptly resolved. Program and operational managers should monitor the effectiveness of control activities as part of their regular duties. HUD‘s purchase card policy requires the department to perform annual program reviews and report the results, including findings and recommendations, to the purchase card program administrator. However, HUD officials could locate only one such report. This November 2001 report, prepared by a consultant, identified problems that were similar to the findings previously reported by the OIG in February 1999.[Footnote 11] Both reports documented problems with weak internal controls and insufficient supporting documentation. The consultant‘s report also noted that HUD was not performing the periodic program reviews required by its policies and that employees were making improper split purchases. HUD management agreed with the findings in the OIG report and developed and implemented an action plan to address the identified weaknesses. According to HUD OIG staff, its recommendations were implemented and have been closed since September 30, 2000. However, based on our findings, corrective actions taken at that time were not effective. The results of our control testing indicate that HUD‘s lack of internal control over the purchase card process allows continued vulnerability to wasteful, fraudulent, or otherwise improper purchases by employees using government purchase cards. Control Weaknesses Contributed to Improper, Potentially Improper, and Questionable Purchase Card Transactions: Poor internal controls created an environment where improper purchases could be made with little risk of detection. We define improper purchases as those purchases that include errors, such as duplicate charges and miscalculations; charges for services not rendered; multiple charges to the same vendor for a single purchase to circumvent existing single purchase limits--known as split purchases; and purchases resulting from fraud and abuse. We define questionable purchases as those that, while authorized, were for items purchased for a questionable government need as well as transactions for which HUD could not provide adequate supporting documentation to enable us to determine whether the purchases were valid. We identified 88 transactions totaling about $112,000 that were improper split purchases. For example, one cardholder purchased nine personal digital assistants and the related accessories from a single vendor on the same day in two separate transactions just 5 minutes apart. Because the total purchase price of $3,788 exceeded the cardholder‘s single purchase limit of $2,500, the purchase was split into two transactions of $2,388 and $1,400, respectively. These improper split purchases violate provisions of the Federal Acquisition Regulation and HUD‘s own purchase card policy, which prohibits splitting purchases into more than one transaction to circumvent single purchase limits. We received documentation from some cardholders confirming that they split their purchases because they exceeded their single purchase limits, while one cardholder claimed the vendor independently split the purchases. We identified an additional 465 purchases totaling over $913,000 where HUD employees made multiple purchases from a vendor on the same day. Specifically, cardholders made multiple purchases totaling over $2,500 on the same day from the same vendor. Although we were unable to determine definitively whether these purchases were improper, based on the available supporting documentation, these transactions share similar characteristics with the 88 split purchases, and therefore we consider these transactions to be potentially improper. We also found 2,507 transactions, totaling about $1.3 million, with vendors that would not routinely be expected to engage in commerce with HUD. In order to determine whether these questionable purchases were a valid use of government funds, we requested supporting documentation for each purchase. HUD was able to provide us with adequate supporting documentation for 1,324 transactions totaling about $412,000. The department was unable, however, to provide adequate support for the remaining 1,183 transactions (47 percent of total transactions requested) totaling about $869,000 (67 percent of total dollars requested). Additionally, we found 940 transactions, totaling about $554,000, where the purchases were made either on a weekend or holiday. We requested supporting documentation for each of these transactions. HUD was able to provide us with adequate support for 645 transactions totaling about $189,000. HUD was unable to provide adequate support for the remaining 295 transactions (31 percent of total transactions requested) totaling over $364,000 (66 percent of total dollars requested). In these instances, we were unable to determine what was purchased, for whom, and why. Some examples of the questionable vendor transactions for which we did not receive adequate support included over $27,000 to various department stores such as Best Buy, Circuit City, Dillard‘s, JCPenney, Lord & Taylor, Macy‘s, and Sears; over $8,900 to several music and audio stores including Sound Craft Systems, J&R‘s Music Store, Guitar Source, and Clean Cuts Music; and over $9,700 to various restaurants such as Legal Sea Food, Levis Restaurant, The Cheesecake Factory, and TGI Fridays. Additional examples of questionable or potentially improper purchases we found include $25,400 of ’no show“ hotel charges for HUD employees who did not attend scheduled training and $21,400 of purchases from vendors who appear to have been out of business prior to the purchase. Because HUD was unable to provide adequate documentation for these purchases, we consider them to be a questionable use of government funds and therefore potentially improper purchases. We also have concerns about HUD‘s accountability for computer and related computer equipment bought with purchase cards because of the large volume of transactions for which it did not have appropriate documentation. For example, our testing revealed that HUD employees used their purchase cards to buy portable assets, such as computer equipment and digital cameras, totaling over $74,500 for which they have provided either no support or inadequate support. In HUD‘s August 28, 2002, purchase card remedial action plan, discussed in more detail in the next section, HUD acknowledged that items bought with purchase cards were not being consistently entered in the department‘s asset management system. As a result, portable assets became vulnerable to loss or theft. In our follow-up work, we plan to determine whether these items are included in HUD‘s asset management system and are being appropriately safeguarded. HUD‘s Remedial Action Plan to Correct Purchase Card Program Deficiencies Lacked Specificity: OMB‘s April 18, 2002 memorandum, M-02-05, requires all agencies to develop remedial action plans to manage the risk associated with purchase card usage. Agencies were required to submit their plans to the Office of Federal Procurement Policy no later than June 1, 2002. HUD‘s remedial action plan was submitted to OMB on May 31, 2002. Our review of HUD‘s remedial purchase card action plan found that it did not address all the weaknesses we identified. Although HUD‘s plan includes steps for resolving and preventing a number of potential problem areas, including the need for (1) adequate monitoring, (2) more frequent internal audits, (3) accountability and penalties for misuse of cards, (4) updating the agency handbook, (5) spending limits in line with purchasing requirements, (6) adequate program records, including proper approving officials, and (7) entering property purchased with purchase cards in the inventory system, the plan falls short in other key areas. For example, the plan did not include requirements for (1) a robust review and approval function for purchase card transactions, focusing on identifying split purchases and other inappropriate transactions, (2) a process to periodically assess the effectiveness of the review and approval process, and (3) specific documentation and records to support the purchase card transactions. In addition, the remedial plan lacked specifics as to how and when HUD would implement it. On August 16, 2002, OMB returned HUD‘s remedial action plan and asked that a timeline be incorporated. HUD submitted a new plan to OMB on August 28, 2002. While the revised remedial action plan includes a broad timeline for completion of each objective, we found that it still does not adequately address key control weaknesses we identified, in part because it lacks specific steps necessary to fully address identified problem areas. In addition, the revised remedial action plan does not require the program administration staff to begin designing a monitoring plan to assess HUD‘s compliance with key aspects of its purchase card policy until the second quarter of fiscal year 2003 and does not give an estimated date for when this key internal control will be implemented. Additionally, the revised plan does not specifically identify who is responsible for developing or implementing any of the proposed improvements. Conclusions: The problems we identified with HUD‘s purchase card program leave the agency vulnerable to wasteful, fraudulent, or otherwise improper purchases. The remedial action plan prepared by HUD is an important first step toward addressing the control weaknesses we identified. At the same time, much still remains to be done to effectively control the inherent risk in HUD‘s purchase card program. HUD management will have to effectively follow through on its implementation plan and expand the plan to improve its review and approval process, requirements for documentation and record retention, monitoring process, and remedial action plan or HUD will continue to be susceptible to misuse of government funds. Recommendations for Executive Action: To strengthen its internal control over the purchase card program and reduce HUD‘s vulnerability to improper purchases, we recommend that the Secretary direct the Assistant Secretary for the Office of Administration to take the following actions: * implement the preapproval requirement in the existing purchase card policy; * develop and implement a robust review and approval function for purchase card transactions, focusing on identifying split purchases and other inappropriate transactions, and on performing a detailed review of relevant supporting documentation for each purchase; * update the list of approving officials and their designated cardholders quarterly to ensure accuracy and completeness; * establish specific requirements for documentation and records to support all purchase card purchases; * develop and implement a formal monitoring process to periodically assess the effectiveness of the enhanced review and approval process; * revise the remedial action plan for purchase cards to include the specific steps necessary to fully implement the above five recommendations; and: * follow up on the purchases we identified for which cardholders did not provide adequate supporting documentation to determine the validity and the propriety of the purchases. Agency Comments and Our Evaluation: In written comments on a draft of this report, which are reprinted in appendix I, HUD agreed that further improvements are needed to strengthen the department‘s purchase card controls. Although HUD did not specifically agree or disagree with our individual recommendations, the actions being taken or planned by the agency address five of our seven recommendations. For example, in response to our recommendation to implement the preapproval requirement in the existing purchase card program, HUD stated that it has always had an effective preapproval process in its field offices through the Automated Client Response System (ACRS). While we agree that this system is available for use, during our review of supporting documentation, we found no evidence that cardholders were utilizing this system. To improve its preapproval process at its headquarters, HUD stated that it has implemented the mandatory use of HUD Form 10.4, Requisition for Supplies, Equipment, Forms, Publications, and Procurement Services. In addition, to enhance its review and approval function, HUD said it had provided mandatory training in January 2003 to approving officials on the procedures for reviewing and approving cardholder statements. HUD also said that it was working with Bank One to provide training to cardholders and approving officials on the use of the automated purchase card system and the monitoring tools available through Bank One. HUD also stated that as of January 2003, a review of the approving officials will be performed and the Agency Program Coordinator will make the necessary changes quarterly to ensure the list is accurate and complete. To ensure proper supporting documentation is maintained for all purchases, HUD also noted that it provided training to cardholders and approving officials starting in January 2003. Additionally, HUD stated that in October 2002, a staff person was assigned to begin performing planned internal reviews and random spot reviews of purchase card transactions with reports to be issued on an interim basis as the reviews are completed to ensure that proper management and internal controls are maintained over the authorization of purchases and use of the purchase card. These actions will be helpful in strengthening the purchase card controls at HUD. HUD did not state what, if any, action it planned to take regarding the two remaining recommendations. Regarding our recommendation to revise its remedial action plan, HUD stated that the plan adequately met the requirements set forth by OMB. While the plan may address the elements required by OMB, we do not believe it lays out an adequate approach for resolving identified control weaknesses. As discussed in the report, the plan lacks the specific steps necessary to fully implement the proposed changes to strengthen internal controls. Concerning follow-up on inadequately supported purchases we identified, HUD stated that it had provided documentation when asked and would provide more if necessary. On July 8, 2002, we provided HUD with a compact disk containing all transactions for which we received either no support or inadequate support during our fieldwork and allowed an additional 3 weeks for the agency to provide the supporting documentation. We have not received any additional supporting documentation since then. It is our view that HUD has a fiduciary duty to follow up on the inadequately supported purchases, which total about $2.1 million and represent 57 percent of the total purchase transactions we tested, to ensure their propriety. HUD offered several additional technical comments, which have been incorporated into this report as appropriate. This report contains recommendations to you. The head of a federal agency is required by 31 U.S.C. 720 to submit a written statement on actions taken on these recommendations to the Senate Committee on Governmental Affairs and the House Committee on Government Reform and Oversight within 60 days of the date of this report. You must also send a written statement to the House and Senate Committees on Appropriations with the agency‘s first request for appropriations more than 60 days after the date of this report. : We are sending copies of this report to the Chairmen and Ranking Minority Members of the Senate Committee on Governmental Affairs and the House Committee on Government Reform, the Director of Office of Management and Budget; and other interested parties. We also will make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. Should you or your staff have any questions on matters discussed in this report, please contact me at (202) 512-8341 or by E-mail at calboml@gao.gov. Sincerely yours, Signed by: Linda Calbom Director, Financial Management and Assurance: [End of section] Appendixes : Appendix I: Comments from the Department of Housing and Urban Development: U. S. Department of Housing and Urban Development Washington, D.C. 20410-3000: OFFICE OF THE ASSISTANT SECRETARY FOR ADMINISTRATION: MAR 28 2003: Ms. Linda Calbom: Director, Financial Management and Assurance U.S. General Accounting Office: Washington, DC 20548: Dear Ms. Calbom: Thank you for the opportunity to provide comments on the draft report entitled ’Department of Housing and Urban Development: Poor Internal Controls Over Purchase Card Program Resulted in Improper and Questionable Purchases“ (GAO-03-489). We reviewed the report and agree that, while the Department made some program improvements, there is still a need to strengthen our purchase card controls. This response lists the actions that have been taken and are planned to improve HUD‘s Purchase Card Program. Additional comments on several statements in the report are also included. Recommendation: Implement the pre-approval requirement in the existing purchase card policy. Response: HUD has always had an effective pre-approval process in our field offices. The Automated Client Response System (ACRS) is used by field staff for purchase card transactions. Receipt of the ACRS request by the approving official officially initiates a purchase transaction. The request must contain an adequate description of the item or service requested including the quantity needed, the prices, and proper funds reservation. Additionally, the (ACRS) requisition must be properly approved by the appropriate officials prior to any purchase. To improve the pre-approval process in Headquarters, the Department implemented the mandatory use of HUD Form 10.4, Requisition for Supplies, Equipment, Forms, Publications and Procurement Services. This form documents the item or service requested for purchase, the quantity, and total cost. In January 2003, during our annual mandatory purchase card training, all cardholders were instructed to complete HUD Form 10.4 and obtain proper approval from their budget office and the approving official prior to any purchase card transaction. Failure to follow these procedures would result in adverse actions. Recommendation: Develop and implement a robust review and approval function for purchase card transactions, focusing on identifying split purchases and other inappropriate transactions, as well as performing a detailed review of relevant supporting documentation for each purchase. Response: In January 2003, during our annual mandatory purchase card training, approving officials were instructed again on the procedures for reviewing each cardholder‘s statement. Approving officials were directed to verify: (1) the appropriateness of each item purchased; (2) that HUD received the purchased items; and (3) that the transactions were supported by the appropriate documentation. They were also instructed to review the purchase logs maintained by cardholders on a daily basis. Our review and approval function will also be enhanced by the Department‘s increasing use of automated monitoring tools. Use of the servicing bank‘s automated system will greatly enhance the monitoring effort. For example, cardholders will be able to review and run reports on their transactions enabling them to quickly detect errors and initiate the dispute process. Approving officials will be able to manage and monitor more efficiently because they will have the ability to review the cardholders‘ statement in real time versus 30 days after the purchase. This will enable them to check for split purchases and any other prohibited or questionable transactions. Further, using the automated purchase card system provides for daily monitoring of purchase transactions by Program Administration Staff, which can ensure that infrequent instances of long-term cardholder abuse do not occur. This is a coordinated effort with the servicing bank to provide training to cardholders and approving officials on the use of the automated purchase card system. Implementation of this process is being phased in over a period of two years. It began in November 2002 with the training of the Field Program Coordinators. Training is scheduled throughout Fiscal Years (FYs) 2003 and 2004 with completion in FY 2004. In October 2002, HUD assigned a staff person to perform planned internal reviews as well as conduct random spot reviews. Use of the automated monitoring allows for weekly, sometimes daily, checks for split purchases, adequate rotation of vendors, prohibited purchases, and any other questionable purchases. Recommendation: Update the list of approving officials and their designated cardholders quarterly to ensure accuracy and completeness. Response: In January 2003, a list of our current approving officials, cardholders, and respective spending limits was distributed to each Assistant Secretary within the Department. Each was asked to review the list for accuracy and submit corrections back to the Agency Program Coordinator. This task will be performed quarterly. Recommendation: Establish specific requirements for documentation and records to support all purchase card purchases. Response: As of January 2003, all Headquarters cardholders were required to complete HUD Form 10.4, which documents the items or services requested for purchase, the quantity and estimated cost. Each cardholder is required to get approval from their Budget Office for the availability of funds and the approving official prior to any purchase card transaction. As previously stated, approving officials are required to review the purchase logs maintained by cardholders. In order to ensure consistency throughout the Department, we provided both approving officials and cardholders with an example of a standardized purchase log. We also gave very detailed instructions on the fields of information for the purchase logs and the types of supporting documentation, in addition to invoices and receipts, which should be kept on file for each transaction. Failure to comply with this process would result in adverse actions. Recommendation: Develop and implement a formal monitoring process to periodically assess the effectiveness of the enhanced review and approval process. Response: As previously stated, in October 2002 the Department assigned a staff person to perform planned internal reviews as well as random spot reviews. This function will ensure that proper management and internal controls are maintained over the authorization and use of the purchase card transactions. Reports will be issued on an interim basis as reviews are completed. Recommendation: Revise the remedial action plan for purchase cards to include the specific steps necessary to fully implement the above five recommendations. Response: Our remedial plan has been revised to meet the guidelines set forth by the Office of Management and Budget (OMB). The plan was resubmitted to and approved by OMB. Recommendation: Follow up on the purchases we identified for which cardholders did not provide adequate supporting documentation to determine the validity and propriety of the purchases. Response: During the audit, cardholders provided documentation to support purchase card transactions when requested. If any additional information is needed, we will ensure it is provided. Listed below are additional actions that have been taken or are planned to further enhance and strengthen controls over the purchase card program. * Validation of Need for Purchase Card. The Department is performing periodic reviews to verify that the need for the card is still valid, the spending limits are appropriate for the purchasing need and the delegations of authority for single purchase limits above $2,500 are current. The Department performed the first review in November 2002. These reviews are scheduled to occur annually. * Improve Program Guidance and Communication. The Department plans to create a handbook supplement that will summarize the cardholder and approving official duties and responsibilities and clearly define each level of accountability. The supplement will contain a comprehensive list of the penalties for various types of misuse, abuse, and fraud associated with the purchase card. It will also contain the do‘s and don‘ts of the purchase and approval process. The supplement will have to be certified that it has been read and understood by the cardholder and approving official. This task is scheduled to begin in the third quarter FY 2003. * Travel and Purchase Charge Card Awareness Day. On March 26, 2003, the Office of Administration partnered with the Office of the Chief Financial Officer to host a Travel and Purchase Charge Card Awareness Day. HUD officials who participated in the event included our Secretary, Chief Financial Officer, and myself. The purpose of this event was to remind and educate HUD employees on the dos‘ and don‘ts of using purchase and travel cards. During this event, cardholders were provided with: (1) purchase card procedures; (2) purchase card do‘s and don‘ts; and, (3) the purchase card dispute process. Representatives were also present from HUD‘s Office of the Chief Procurement Officer, the Office of Budget and Administrative Support, and the servicing bank to answer questions and to provide information to cardholders. This event shows the level of commitment that the Department has undertaken in making the Purchase Charge Card Program a top priority in our daily work. The Awareness Day agenda along with the packets that were passed out to cardholders are provided as attachments. Although the Department still faces some challenges in this area, the work described above demonstrates that we are in the process of taking specific actions designed to enhance and improve our purchase card program. Thank you once again for the opportunity to comment on the draft report. If you have any questions concerning this response, please contact Glennel M. Cooper, Director, Office of Budget and Administrative Support, at (202) 708-1583. Sincerely, Vickers B. Meadows: Assistant Secretary for Administration: Signed by Vickers B. Meadows: Enclosure: [End of section] Appendix II: GAO Contacts and Staff Acknowledgments: GAO Contacts: Dan Blair, (202) 512-9401: Acknowledgments: In addition to the contact named above, Sharon Byrd, Lisa Crye, Sharon Loftin, and Julie Matta made key contributions to this report. (190083): FOOTNOTES [1] This work was done as part of a broader body of work on which we testified last fall. [U.S. General Accounting Office, Strategies to Address Improper Payments at HUD, Education, and Other Federal Agencies, GAO-03-167T (Washington, D.C.: Oct. 3, 2002.)] We are currently assessing the effectiveness of internal controls over other disbursement processes at HUD and will report on the results of that work at a later date. [2] We randomly sampled 222 transactions from a total of 23,688 transactions. [3] We are 95 percent confident that the estimate is between $4,074,446 and $5,432,059. This estimate exceeds the tolerable amount in error of $1,059,046 (10 percent of the population total of $10,590,461). [4] Certain construction purchases are limited to $2,000. [5] Under certain circumstances, some offices within HUD are permitted to purchase some of the prohibited items in the policy. [6] U.S. General Accounting Office, Internal Control: Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). [7] Data mining for improper payments involves using computer aided auditing techniques to highlight hidden patterns and relationships in data that help identify unusual transactions, which may be improper payments. [8] GAO/AIMD-00-21.3.1. [9] We randomly sampled 222 transactions from a total of 23,688 transactions. [10] We are 95 percent confident that the estimate is between $4,074,446 and $5,432,059. This estimate exceeds the tolerable amount in error of $1,059,046 (10 percent of the population total of $10,590,461). [11] Department of Housing and Urban Development Office of Inspector General, Commercial Credit Card Program, 99-DP-166-0001 (Washington, D.C.: Feb. 1, 1999). GAO‘s Mission: The General Accounting Office, the investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO‘s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO‘s Web site ( www.gao.gov ) contains abstracts and full-text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as ’Today‘s Reports,“ on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select ’Subscribe to daily E-mail alert for newly released products“ under the GAO Reports heading. Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. General Accounting Office 441 G Street NW, Room LM Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov Automated answering system: (800) 424-5454 or (202) 512-7470: Public Affairs: Jeff Nelligan, managing director, NelliganJ@gao.gov (202) 512-4800 U.S. General Accounting Office, 441 G Street NW, Room 7149 Washington, D.C. 20548: