US. Department of Energy ‘Western Area Power Administration HQ Procurement Office & Internal Audit and Compliance Office Western AREA POWER ADMINISTRATION Control Weaknesses in Western Area Power tration’s Purchase Card Program February 2016United States Government Department of Energy MEMORANDUM, Western Area Power Administration DATE: February 4, 2016 REPLY TO ATINOF: —A7100, George A. Kelley, Director of Procurement A8500, Lisa Hansen, Supervisory Auditor, Governance and Poli lhl Seur— SUBJECT: — Capping Report on Internal Control Weaknesses in Western Area Power Administration’s Purchase Card Program TO: 47000, Anthony Montoya, Executive Vice President and Chief Operating Officer This capping report summatizes the results of the Offices of Procurement and Internal Audit and Compliance’s (IA&C) review of Western Avea Power Administration’s (Western) compliance with established policies, procedures, and standards related to its Government Purchase Card (GPC) Program. Between December 2014 and October 2015, we issued five sepatate reports on the GPC Progtam ~ one report for each of Westemn’s four regional locations (Desert Southwest, Uppet Great Plains, Rocky Mountain, and Sierra Nevada) and a report for the Headquarters Office (HQ). For these five reviews, we data mined over 86,800 transactions totaling more than $37.3 million and exainined just over 12,000 (14%) of those transactions totaling around $7.2 million (19%). Of the transactions reviewed, we identified ‘more than 11,600 (13%) transactions totaling approximately $6.8 million (18%) that required farther review by regional and headquatters? officials. While we found some areas that appear to be compliant, the majority of the GPC Program areas tested were non-compliant with established policies and procedures, lacked necessary internal controls, and failed to meet minimum GPC requirements, Specifically, based on our review of over 12,000 GPC transactions, we found weaknesses in the control environment that contributed to potentially fraudulent or improper transactions, These weaknesses included: - Completed annual management reviews were ineffective; = Inadequate oversight and monitoring at various levels; and - _ Ineffective and in some cases non-existent internal control activities. Our previously issued GPC reports discuss in detail the findings relating to Westen’s compliance with GPC policies and procedutes with regard to the tested transactions, The purpose of this report is to summarize the findings from our prior reports and include recommendations that we believe will have Western-wide applications to improve its GPC program. Management comments are included in their entirety in Appendix III.BACKGROUND Breakdowns in the internal controls over purchase card programs have been the subject of Congressional and media scrutiny for several years. For example, in October 2014, the Chairman of the Oversight and Government Reform Subcommittee on Government Operations requested that the U.S. Government Accountability Office conduct an investigation into potential waste, fraud, mismanagement, and abuse in the use of federally issued purchase cards, with a focus on transactions involving small purchases. These small purchases, known as micro purchases, are not to exceed $3,000 per transaction, but in aggregate can easily surpass several million dollars over the course of a year, Western's ‘management supports and encourages the use of a well-controlled and executed GPC Program and stresses the importance of having adequate internal controls to protect Western from fraud, waste, and abuse. Responsibility for the GPC program was delegated by the Head of the Contracting Activity (HCA) to the previous Directors of Procurement (Director), who fuither delegated this responsibility to the Administrative Officer in each region. The Administrative Officers remained responsible for the program until the current Director reported for duty in January 2014 and was subsequently delegated program responsibility by the HCA on March 17, 2014, and he has chosen not to re-delegate his authority. Western consists of'a Headquarters (HQ) and four regional offices located throughout its 15- state service area, to include Desert Southwest (DSW), Upper Great Plains (UGP), Rocky ‘Mountain (RM), and Sierra Nevada (SN). For the purpose of our purchase card review, the Colorado River Storage Project Management Cenier’s transactions were reviewed in conjunction with the RM review. As of July 2014, Western had a total of 1,439 employees and 476 Government Purchase Card cardholders (GPC-CH). ‘Western's Employees and Active GPC-CH at its Five Locations —— #ot | Active % GPC-CHi to Office Locations! ranptoyees | GPC-CH # Employees Headquarters 278 30 10.8% Desert Southwest 216 6 301% Upper Great Plains 363 177 48.8% Sierra Nevada 183 56 30.6% Rocky Mountain 399 148 37.1% Total 1,439 476 Due to concerns raised in DSW regarding the possibility of the questionable use of purchase cards for up-ftting (accessorizing) of Government owned and/or leased vehicles, the Director initiated a review of these questionable transactions, Based on the results of that review, confirming the misuse of the purchase card, the Director requested that the Office of [A&C participate in a joint review of DSW’s entire purchase card program. Subsequently, a decision ‘was made to review the purchase card program Westem-wide. Therefore, over the past 14 months, the purchase card review teams conducted similar reviews of the GPC Program atWestem’s other locations in the following order: HQ, RM, UGP, and SN. The focus of the audits was on those transactions that appear to be higher risk based on attributes such as the merchant name, dollar amount, trends in purchase dates, and description of the transaction. RESULTS OF REVIEW Based on the transactions we reviewed, we found weaknesses in Western’s control environment that contributed to breakdowns in key control activities and potentially fraudulent and improper purchase card transactions, Ineffective oversight of the GPC Program by the HQ Procurement Policy team and regional Administrative Officers contributed to these weaknesses. Specifically, we identified ineffective monitoring or oversight activities for assessing program results, evaluating internal controls, and identifying the extent of potentially fraudulent, improper, and abusive or questionable purchases. In general, effective oversight activities would include regular management reviews and evaluations of how well the purchase card program is operating, as well as any associated internal control activities. The control weaknesses and supporting exatnples of potentially fraudulent or improper transactions are summarized later in this report: ‘tis important to note that during the completion of the GPC audits, Western’s management took immediate action, The following are measures taken by HQ and the regions: 1, On August 21, 2014, the HCA notified Western’s Managers that several instances of improper use of Government purchase cards had been identified, which included possible unlawful activity, unauthorized and questionable purchases, inability to account for certain property, and splitting of purchases to circumvent transaction limits. The HCA further stressed the seriousness of these issues and emphasized how crucial it was that the purchase card users and approving officials fulfill their obligations and scrutinize every purchase to ensure proper use. 2. ‘The regions have: a. addressed the need to reduce the total number of GPC cards, and provided additional training to regional staff. 3, The Procurement Director has: a, issued Western’s Government Purchase Card Policy and Operating Procedures; . reduced the available monthly credit exposure Western-wide by $1.5 million (from $4 million to $2.5.million); ©. reviewed and adjusted single purchase and cycle limits; 4. required documented business case justifications Western-wide for all new requests to open a GPC account as well as any changes to existing accounts; ¢. reduced infrequently used GPC cards, to include, evaluating the monthly available credit limits to determine if they should be reduced; £ re-evaluated the unblocked MCs with Westem’s stakeholders and re-blocked all these codes in accordance with DOE’s policies and procedures; 8. initiated 90 day reviews of new cardholder account activity to ensure adherence to GPC procedures; andhh, developed supplemental training to present to the regions in addition to the mandatory biennial GPC training to further reinforce the importance of effective controls and adherence to laws, regulations, and policies and procedures. While these are steps in the right direction, further actions are needed to strengthen the controls over Western’s GPC Program. The purchase card is a valuable tool for Western to streamline the process to meet its purchasing needs. However, implementing a program. without effective controls or adequate management oversight can lead to potentially fraudulent, improper, and abusive or questionable transactions to go undetected. The problems we identified, of the transactions reviewed, with missing supporting documentation, insufficient Procurement Office reviews, and failures to follow laws, regulations, policies and procedures, and standards for internal controls, leave Western vulnerable to potential fraud, waste, and abuse, ec: M. Gabriel, A0000, Lakewood, CO L. Kimberling, A8000, Lakewood, CO R. Harris, B0000, Billings, MT R. Moulton, G0000, Phoenix, AZ B. Warren, 10000, Loveland, CO L, Jeka, 0000, Salt Lake City, UT S. Paluru, NO000, Folsom CATABLE OF CONTENTS Results of Review... 2 1 Appendices 1. Objective, Scope, and Methodology... : .. 16 Il, Definitions ... IIT, Management’s Response.Internal Control Weaknesses in Western’s Government Purchase Card Program Weaknesses in Overall Control Environment We found weaknesses in Western’s control environment at each of its four regional locations and its headquarters office, and breakdowns in key control activities that resulted in potentially fraudulent and improper purchase card transactions. Ineffective oversight of the GPC Program contributed to these weaknesses. In general, effective oversight activities would include regular management reviews and evaluations of how well the purchase card program is operating, including other associated internal control activities. However, we identified inadequate monitoring and oversight activities by the Administrative Officers directed at assessing program results, evaluating intemal controls, or identifying the extent of potentially improper purchases. In addition, the HQ Procurement Office did not provide adequate oversight and management of the Government Purchase Card (GPC) program, ‘The Government Accountability Office’s (GAO) Standards for Internal Control in the Federal Government states that “Management and employees should establish and maintain an environment throughout the organization that sets a positive and supportive attitude toward internal control and conscientious management. A positive control environment is the foundation for all other standards, It provides discipline and structure as well as the climate which influences the quality of internal control.” <>” In addition, according to GAO"s Internal Control Stanidards: Internal Control Management and Evaluation Toot agency internal contol monitoring assesses the quality of performance over time. It does this by putting procedures in place to monitor internal control on an on- ‘going basis as a part of the process of carrying out its regular activities. It includes ensuring that managers and supervisors know their responsibilities for internal control and the need to make internal control monitoring part of their regular operating processes. Ongoing ‘monitoring occurs during normal operations and includes regular management and supervisory activities, comparisons, reconciliations, and other actions people take in performing their duties. Lastly, GAO's Standards for Internal Control in the Federal Government’ states that “transactions and other significant events should be authorized and executed only by persons acting within the scope of their authority. This is the principal means of assuring that only valid transactions to exchange, transfer, use, or commit resources and other events are initiated or entered into.” Ineffective Annual Management Reviews ‘The Department of Energy’s (DOE) Purchase Card Policy and Operating Procedures’ (Procedures) state that the “HCA should ensure annual reviews of cardholder records are conducted and documented to determine the extent of adherence to prescribed procedures, GAO's Standards for Internal Control inthe Federal Government, GAO/AIMD-00-21.3.1, November 1999 ® GAO's Internal Contra! Standards: Internal Control Management and Evaluation Tool, GAO-01-1008G, August 2001 ® GAO's Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1, November 1999 * Department of Energy Purchase Card Policy and Operating Procedures, CHAPTER 13.1, August 2012 1Internal Control Weaknesses in Western’s Government Purchase Card Program guidelines, policies, regulations, and good management practices, and to identify any needs for improvement, guidance and/or training.” These reviews should include an assessment of the appropriateness of transaction dollar limits as well as confirmation of the need for the account based upon usage. The review should also include selecting a sampling of cardholder records within each of the approving officials’ accounts and completing a designated checklist for each individual record reviewed in the sample selected. While annual reviews were performed, based on the number of questionable and/or improper and lack of documentation we identified, it was evident that some reviews were tly performed, nor were they adequately reviewed/documented by the HQ Policy ‘Team, otherwise these items would likely have been identified and appropriate action taken prior to our reviews. The Director of Procurement took corrective measures to address the weaknesses identified in completing the annual management reviews by substituting robust reviews of the GPC Program Westen-wide that included data mining and analysis of transactions, review of available supporting documentation and approvals, assessment of cardholder spending limits and credit exposure to Western. Inadequate Daily Oversight and Monitoring Our testing revealed limited, and in some cases no documented evidence of approving officials’ reconciliation of documentation supporting cardholders" transactions to their statements. Financial Management Regulation, volume 10, chapter 10, section 1203, states that (1) cardholders are to reconcile each statement against supporting documentation and sign the statement, and (2) approving officials are to reconcile the cardholders’ statement and sign the consolidated monthly bill. Further; DOE’s Procedures state that the approving official must review, approve, and sign the monthly account statement. The approving official’s signature represents, among other things; hat (1) all purchases were authorized, (2) the cardholder did not make repetitive purchases for the same item from one merchant, (3) purchases were not split, (4) documentation for the purchase transaction was completed, and (5) documentation and invoice dates match purchase dates, ‘The violations we identified of non-compliance with laws, regulations, and policies and procedures demonstrated that the approving officials did not perform their monitoring responsibilities as required. Approving Official Review We noted a trend during our review where the approving official certified the billing statement for payment but had not examined the transactions or the supporting documentation to determine whether the transactions were correct and for a valid Government purpose, Such activities could allow potentially fraudulent, improper, abusive, and questionable purchases to go undetected, Examples of these transactions are summarized later in this report. ‘The approving officials” reviews are a recognized control activity at all levels of the purchase card program. DOE’s policy and guidance requires approving officials to review and certify each cardholder’s monthly transactions. Without documentation of such reviews, neither theInternal Control Weaknesses in Western’s Government Purchase Card Program Procurement Office as program oversight, nor the program coordinators, ot other ‘management officials could determine whether the approving officials were carrying out their review responsibilities as required. Controls over the Issuance and Assessment of Ongoing Need for Cards Carefully controlling the issuance of cards and continually re-assessing the need and {justification for outstanding cards are important issues in managing the Government's risk in the purchase card program. However, we found that there was no review that systematically considered Western’s mission needs based on the volume of active purchase cards. For example, we identified over 100 infrequently used cards from our sampled transactions with a total credit exposure over $1,500,000. We defined infrequently used cards as those cardholders with GPC activity that trended at a level lower than the general volume of GPC activity according to region or HQ location. During the course of our reviews, we noticed that Western officials closed some of the infrequently used purchase cards we identified; however, these cards were generally closed due to retirements or transfers, rather than based on an analysis of Western's credit exposure, As noted in the following section, Cardholder Spending Limits, some cardholders had higher ‘than normal purchase limits for emergency purposes. Infrequéntly used cards and limits that are higher than justified by the cardholder's authorized and expected usage unnecessarily increases the Government's exposure to potentially fraudulent, improper, and abusive purchases. Limiting credit available to cardholders is a key factor in managing the purchase card program and in minimizing the Government's financial risk. The Director of Procurement (Director) has taken corrective action Western-wide to reduce infrequently used GPC cards, to include, evaluating the monthly available credit limits to determine if they should be reduced. Cardholder Spending Limits For cach Western location, the individual supervisors requested the single purchase and total credit limits for each cardholder. In the past, these purchase limits were not controlled or determined by the Regional Administrative Officer as program coordinator, or assessed/reviewed by the HQ procurement policy manager or program coordinator. For example, in one region, all but two cardholders had single purchase limits set at $3,000. One cardholder's limit was $2,500 and the other was set at $100,000. The cardholder with the higher dollar amount was a procurement official who had a higher than normal limit for emergency purposes. We found that individual transaction limits were generally set at the micro-purchase threshold ($3,000) Westem-wide; however we did not see evidence that these purchase limits were set based on an analysis of individual cardholder’s needs or past spending patterns.Internal Control Weaknesses in Western's Government Purchase Card Program The table below quantifies Western’s purchase card expenditure limits for reviewed cardholder accounts, urdholders’ Purchase Ottice | # of Active | # of Cardholders | # of Cardholders | # of Cardholders Locations | Cardholders | with Purchase | with $3,000 | with Purchase i _Reviewed_| Limits <$3,000 | Purchase Limits | Limits > $3,000 Headquarters 26 2 24 0 Desert 6 5 38 2 Southwest Upper Great 168 76 90 2 Plains 7 Sierra 50 7 2 1 | Nevada a Rocky 133 H 131 1 Mountain Total 4a om 345) 6 The Director has taken corrective action to review and adjust all single purchase and eycle limits when necessary, He is also requiring documented. business case justifications Western- wide for all new requests to open a GPC account as well as any changes to existing accounts. Procurement of Services Using the GPC We identified several transactions where purchase cards or convenience checks were used to procure services that were in violation of the Service Contract Act (SCA). According to the SCA, the GPC should not be used to obtain services greater than $2,500 in a single year, However, we found that purchase cards were used to procure services for amounts greater than the annual SCA dollar threshold: For example: * Inone region, several monthly charges were made for garbage collection services from January 2012 through May 2014. Specifically, the region charged $6,299.92 in calendar year (CY) 2012, $5,265.82 in CY 2013, and $3,420.53 from January through May of 2014; for a total of $14,986.27; and * In another region, one cardholder exceeded the SCA annual limit with purchases for pest control services. Specifically, for CY 2012, CY 2013 and through July 2014, purchases totaled $9,102.33, $6,637.96, and $4,737.95 respectively. In aggregate, the amount paid by purchase card to this vendor (for the period reviewed) was $20,478.24, ‘These services were purchased without consideration of terms and conditions, necessary licenses, etc., creating significant risk for Western. Services charged on the GPC that routinely exceeded the maximum dollar threshold included payments for management, consulting, public relations, and many other commonly used services, Payments to these vendors demonstrated clear violations of the GPC program requirements, 4Internal Control Weaknesses in Western’s Government Purchase Card Program Proper Procurement Vehicles Were Not Used for Certain Procurements Of the 12,000 transactions reviewed, we could not find documented evidence that the priority of sources requirements was met or considered. For example, purchases of office supplies, boots, Nomex gear, printer toner, computer equipment, electronics, and other items that are readily available through General Services Administration (GSA) were purchased on the open market, often times at substantially greater cost, All GPC purchases must be performed in accordance with the Federal Acquisition Regulation (FAR) Part 8, Required Sources of Supplies and Services, Part 12, Acquisition of Commercial Items, Part 13, Simplified Acquisition Procedures, and others as applicable. During our review of all five Western locations, we did not find support documenting that cardholders considered market research prior to making purchases, which contributed to possible overpayments for readily available items, In addition, we found that supplies, clothing, furniture, and other items were purchased at commercial sources that were available from mandatory sources such as the AbilityOne Program and UNICOR. Key Internal Control Activities Were Not Effectively Implemented The review results of the selected transactions demonstrated that key internal control activities over Western’s purchase card program were either ineffective or not in place, Poor internal controls created a weak control environment that permitted potentially fraudulent and improper transactions to occur. Control activities occur at all levels and functions of an agency, They include a wide range of diverse activities such as approvals, authorizations, verifications, reconciliations, performance reviews, and the production of records and documentation, We found that the followiiig control activities were either not effective or were not in place: (1) obtaining and retaining invoices and documentation supporting purchase card transactions, (2) purchases made to blocked merchant category codes (MCC) as mandated by DOE, (3) training on.the purchase card program at the region level, and (4) accountability over property proctired with the purchase card. Obtaining and Retaining Invoices and Supporting Documentation For the transactions reviewed, GPC-CHs and approving officials did not maintain proper documentation to support purchases. For example, in our requests for supporting documentation for selected transactions at each of Western’s locations, personnel were unable to locate or could not provide satisfactory evidence to support transactions for approximately 270 cardholders. According to DOE procedures, cardholders are required to reconcile the statement of account with their purchase card log and convenience check log (if applicable) and maintain copies of charge/eredit slips, customer receipts, and other required documentation, Documentation of the following is also required: (1) consideration of prices obtained from a single source that are found to be fair and reasonable, ifthe purchase is made without securing competitive quotations, (2) evidence that the purchases are distributed among qualified suppliers by rotating recurring procurements among merchants, and (3) justification for verbal and mail order (internet) purchases of supplies or services (competition, fair price, delivery, etc.). In all cases, there needs to be a complete audit file, but we found that this did not exist, In fact, there was no indication of quality, detailedInternal Control Weaknesses in Western’s Government Purchase Card Program reviews by the approving officials, regional Administrative Officers, or the HQ Procurement Policy team, In addition, we identified multiple purchases made from single vendors with no documentation to support whether prices were fair and reasonable and/or the rationale for not distributing purchases among qualified suppliers. In summary, very few of the transactions wwe reviewed were properly documented and supported. In addition, no explanations were provided to support purchases in instances when documentation was missing, Further, according to DOE’s Procedures, cardholders must maintain a purchase card log. At a minimum, the log should contain the date on which the item or service was ordered, the merchant's name, the dollar amount of the transaction, a description of the item or service ordered, and an indication of whether the item was received. Our review indicated that the majority of these logs are not being maintained in accordance with the guidance. GAO’s Internal Control Standards state that “Ail transactions and other significant events need to be clearly documented, and the documentation should be readily available for examination, All documentation and records should be properly matiaged and maintained.” Without supporting sales receipts or invoices, itis not possible to ascertain the quantity and type of items purchased or whether those items were for a valid Government requirement or of a personal nature, Purchases Made to Mandated Blocked MCC-Codes Western cardholders made transactions to imultiple MCs that DOE had designated to be blocked. Specifically, 337 transactions totaling $164,191.62 were made using the purchase card to merchants with these MCs. The MCC descriptions included motoreycle shops, automotive body repair and paint shops, car washes, and towing services. DOE’s Procedures state that “should a cardholder need to make a valid purchase from a merchant in one of these category codes, the Organizational Program Coordinator (OPC) will need to clear the purchase with the JPM Chasé Bank, If recurring transactions need to be made from blocked MCCs the OPC shall submit a request, with justification, to the agency point of contact for approval.”Internal Control Weaknesses in Western’s Government Purchase Card Program ‘The table below details the number of transactions and amounts charged to MCC codes that were designated to be blocked and example merchants from those specific MCC codes. ‘Transactions to Potentially Blocked MCCs MCC MCG Hof Code | Description enone Mecehante § Charged | yansactions 5571 | Motorcycle Cycle Gear, Craig Power $102,591.27 152 Shops and Sports, Champion Cycle, [_ Dealers Adrenaline Powersports 7531 | Automotive Guiting Edge Auto Glass, 342,014.46 82 Body Repair | Collins Auto Renewal, AAA Shops Window Tint 7535. | Automotive Beaver Stripes, Hightower $1,063.09 8 Paint Shops Supply #2, Auto Body Specialties, Beller Equip 7542, | Car Washes The Car Wash, Cowboy Auto | $4,862.81 8 Spa, Hamilton Touchless, Kwik and Kleen Carwash 7549 | Towing Services | Interstate Towing, Hartz E&F | $13,659.99 27 ‘Towing, MW Towing, California Towin; Total | $164,191.62 337, In November 2014, the Director obtained a list of unblocked MCC codes for Western, Upon review, all of the previously referenced MCC codes had been requested by Western, at some point, to be unblocked by DOE’s Agency Program Coordinator, However, the Director was ‘unable to locate the required written justification documenting that the HQ Level IV OPC or regional Administrative Officer requested that the DOE HQ Agency Program Coordinator approve the use of these codes, or any documentation to indicate the reasoning for the MCCs to be unblocked at all. Upon request, DOE provided evidence of a request by Western (in 2008) as a seemingly temporary solution to address issues with Westemn’s Fleet Cards, although, there was no documentation of any follow-up once the Fleet Card issues were resolved. Since the completion of our audits, the Director re-evaluated the unblocked MCCs with Western’s stakeholders and re-blocked all these codes in accordance with DOE’s policies and procedures. Lack of Training at the Regional Level Neither the regional Administrative Officers nor the HQ Procurement Policy team provided any regional or Western specific training, local procedures or processes, or supplemented the minimum required training to ensure assigned cardholders understood program requirements. In addition, minimal oversight of cardholder transactions and approving officials’ records significantly contributed to deficiencies within this area of responsibility. To address this issue, the Director is developing supplemental training to present to the regions in addition to the mandatory biennial GPC training to further reinforce the importance of effective controls AInternal Control Weaknesses in Western's Government Purchase Card Program and adherence to laws, regulations, and policies and procedures. In the interim, GPC training has been added to regional craft training sessions that has been conducted by both HQ program coordinators and regional coordinators. According to GAO’s Internal Control Standards: Internal Control Management and Evaluation Tool’, to effectively manage the workforce to achieve results the agency should consider ensuring that “Employees are provided orientation, training, and tools to perform their duties and responsibilities.” Lack of Property Accountability ‘We were unable to confirm the existence of documentation or locate evidence that personal property purchased and receipted by the cardholder was reported to the property management, office for proper accountability and control, DOE’s procedures state that “personal property purchased and receipted by the cardholders is to be reported to the property management office, in writing,” that includes the cardholders name, office, telephone number, building and room number; nomenclature, model and serial numbers of the property, original acquisition cost, delivery or acceptance date, receipt verification (Witness name, office, telephone number, building and room number). Also, personal property appears to have been purchased for and provided to contractor personnel without authority or accountability In addition, each card purchase is required to be manually or electronically documented, which includes evidence of transaction completion and receipt of property. Property receipts are required to be submitted along with the monthly statement of account to the approving official, and the original is to be maintained by each cardholder for record keeping purposes. However, cardholders and approving officials did not ensure accountable, sensitive, and other property was properly accounted for and recorded. We concluded that a very high percentage of the files reviewed did not meet minimum documentation requirements regarding personal property or othier general program requirements. Control Weaknesses Contributed to Potentially Fraudulent or Improper Transactions GAO has found numerous instances of fraud, waste, and abuse related to the purchase card program at dozens of agencies across the Government. Internal control weaknesses in ‘Westemn’s purchase card program directly increase the risk of fraudulent, improper, and abusive transactions, For example, we identified several purchase card transactions Westemn- wide that were either potentially fraudulent or improper. The following describes some of these examples, Potentially Fraudulent Purchases We identified several purchases of items that could have been for personal use at each of Western’s five locations, which are considered potentially fraudulent according to GAO's definition, However, because of the lack of supporting documentation in the cardholders’ * GAO's Internal Control Standard: Internal Control! Management and Evaluation Tool, GAO-01-1008G, August 2001Internal Control Weaknesses in Western’s Government Purchase Card Program files, we were unable to determine the justification for the purchases or conclude whether they were for Government use. GAO defines fraudulent purchases as the “Use of the government purchase card to acquire goods or services that are unauthorized and intended for personal use or gain.” Transactions we questioned were to merchants such as, Amazon, Cabela's, Walgreens, Bass Pro Shops, Target, and others. The table below provides examples of the potentially fraudulent transactions we identified Western-wide and the charges within various merchant categories, Purchases for Potentially Fraudulent Transactions MCC Description ‘Example Merchants $ Charged Amazon.com, Amazon Marketplace eens Payments, Barnes & Noble $271,533.41 | or Dick’s Clothing and Sporting, Apu end Accessory, | Bede, Gea Up and Get Out There, $92,135.64 | Clothing Rental ne a ans Walgreens, Rocky Mountain Sunsoréen $4,994.18 Grocery Stores, Supermarkets Target, Walmart, Safeway $89,358.76 Recreational & Utility | Affordable Trailers, Al’s Trailer Sales, Trailers Lance's Triple T Trailers See Shoe Stores, Hoffman Bools, Red Wing Shoes, Boot Commercial Footwear_| Bam, Wayne’s Boot Shop SL B20 08 ‘Specialty Retail Stores | The Glove Wagon, Murdoch’s Ranch =Mise. & Home Supply, Linton’s Big R eee x Bass Pro Shop, Cabela’s Retail, Jax Sporting Goods Stores Ouldoar Gear, Spacismanta Warehouse eee Total $1,830,324.97 Improper Purchases and Transactions Our data mining identified numerous examples of potentially improper transactions. GAO defines improper purchases as “Government purchase card transactions that are intended for ‘government use but are not permitted by law, regulation, or organization policy.” We identified transactions from our review of the sampled transactions that were improper; including split purchases and purchases from improper sources. Examples we found included (1) split purchases made to circumvent the cardholders’ single-purchase limits or to avoid the need to obtain competition on purchases over the $3,000 micro-purchase limit; (2) improper sources when cardholders did not buy from a mandatory procurement source, or document reasoning for not purchasing from these sources; (3) improper use of convenience checks; and (4) purchases that were prohibited or otherwise not authorized by federal law, regulation, or Government/agency policy. Our review documented purchases by and for contractor personnel that were prohibited, We also identified instances of contractor personnel performing inherently Government functions such as determining what items and 9Internal Control Weaknesses in Western's Government Purchase Card Program from which vendors purchases were made, The following paragraphs provide further details on the potentially improper purchases and transactions we found Western-wide, Split Purchases A split purchase is the practice of dividing a purchase into two or more smaller transactions to keep each transaction under a cardholder's single purchase limit, or other established credit limits, Based on our data mining, we identified transactions totaling over $2.7M that potentially could have been split purchases. However, because supporting documentation was not always maintained and available for review, we could not confirm the total number of actual split purchases. Therefore, Western regional and HQ offices will perform a more detailed review to determine the substance of these transactions. ‘The Federal Acquisition Regulation (FAR) and DOB’s purchase card procedures prohibit these practices. Once items exceed the $3,000 threshold, they are to be purchased in accordance with simplified acquisition procedures, which are more stringent than those for micro-purchases. During our review, we identified examples where cardholders potentially split transactions to a single merchant as well as multiple cardholders splitting transactions to the same merchant. Order of Precedence Another type of improper purchase occurs when cariholders do not buy from a mandatory procurement source ot consider the priorities for use of mandatory sources required by FAR Part 8, If not a mandatory source, agencies are encouraged to consider satisfying requirements from or through non-mandatory sources such as Federal Supply Schedules or Government-wide acquisition contracts... While procurement sourcing was not the primary focus of our work, we noted that cardholders frequently did not purchase from or through non-mandatory sources. For example, we noted numerous purchases of office supplies, personal items, and electronics from local vendors when these or substantially similar products were available from-either mandatory or non-mandatory sources such as the General Services Administration or one of its contractors’ catalogs or Web sites, oftentimes at considerable savings. In addition, supplies, clothing, furniture, and other items were being purchased at commercial sources that were available from mandatory sources such as the AbilityOne Program and UNICOR, There was no documentation uncovered that indicated these sources were considered to determine if their products or services could meet, Westem’s needs. Adequacy of program management and control of key supplies and services could not be determined due to lack of supporting documentation. Improper Use of Convenience Checks Our analysis of convenience check use for the scope of the reviews identified purchase cardholders with convenience check authority that had issued 3,251 convenience checks totaling $2,341,534.43. The corresponding convenience check fees incurred for these transactions totaled $35,392.72, or 1.5 percent of the face value of each check processed. According to DOE’s procedures, “convenience checks are a payment and/or procurement tool intended only for use with merchants that do not accept purchase cards and for other 10Internal Control Weaknesses in Western's Government Purchase Card Program authorized purposes where charge cards are not accepted. ..and should be used as a payment method of last resort.” In addition, because there is a 1.5 percent fee, cost-benefit, considerations are required when using convenience checks. We identified improper use of convenience checks related to payments for amounts over $2,500 for services and to vendors who accepted purchase card payments. For example, at one region, we identified 15 separate convenience checks in excess of the $2,500 limit for services. ‘The dollar amounts of the checks ranged from just over $2,500 to $3,000 each. In addition, convenience checks are not authorized for use in construction projects that exceed $2,000 per requirement, Although there appeared to be examples of this in the transactions we reviewed, it was difficult to determine if the services identified would be classified as construction or “other” services since there was no MCC code attached to these convenience check transactions and there was minimal or no supporting documentation. For example, in one region, four checks were addressed to a construction-type company for more ‘than $7,400 in total; however, due to the lack of supporting documentation, we could not make a clear determination as to the nature of these transactions. Further, according to DOB’s guidance, cardholders must maintain a Convenience Check Log that includes the check number, merchant name, business address, merchant tax identification number or social security number, the description of the purchase, the dollar amount of the purchase, the dollar amount of the check fee, and the total cost. Our review of the logs corresponding to the sampled transactions demonstrated that they were not being maintained in accordance with the guidance. Prohibited Purchases We also found instances where DOE purchase cards were used to up-fit and/or accessorize GSA vehicles, Examples of up-fitting include adding radios, mud flaps, suspension upgrades, bumpers, different wheels and tires, and high jacks for lifted trucks. The justification given for adding extra equipment was to enhance GSA vehicles so that they could better perform duties necessary to carry out Western’s mission. uwInternal Control Weaknesses in Western's Government Purchase Card Program The table below details the dollar amount by vendor we identified during our reviews. ~Total Number and Amount of Potential Up-fitting Transactions Number of Dollar Amount of Veneer ‘Transactions ‘Transactions XTC Motorsports 70 $160,669.28 Bullhide 4X4 ea 8 $57,819.77 Drake Equipment of AZ | 2 ~ $53,270.11 Winch Ready 8 $14,518.40 Custom Wheel Service i $13,259.08 Rhino Linings 16 $12,047.25 Street Image 2B $10,346.63 Fly-N-Hi 1 $8,300.00 Pickup Specialties 4 $6,780.00 Totally Trucks i $5,536.84 “4 Wheel Parts 4 $2,651.00 Custom Auto zE $2,299.00 Chimney Canyon 4X4 3 $1,785.00 Total 254 $349,282.36 Using the DOE purchase card to purchas¢ stipplies or services for GSA fleet vehicles is prohibited by DOE policy. In addition, the Code of Federal Regulations requires GSA approval for the modification of a GSA fleet vehicle, for which we found no evidence of compliance. We identified several vendors, primarily those listed in the table above, known to perform potential up-fitting, . Some examples of items installed were: lift kits, off road shocks, custom wheels and tires, custom bumpers, cargo glides, winches, step bars, new radios, GPS units, and tool boxes. CONCLUSION ‘The purchase card is a valuable tool for Wester to streamline the process to meet its purchasing needs. However, implementing a program without effective controls or adequate ‘management oversight can lead to potentially fraudulent, improper, and abusive or questionable transactions to go undetected. The problems we identified, in the sample transactions reviewed, with missing supporting documentation, insufficient official reviews, and failures to follow laws, regulations, policies and procedures, and internal control standards, leaves Western vulnerable to fraud, waste, and abuse. Several of the transactions highlighted within this report are examples of misuse of the purchase card. In addition, Western’s supervisors did not always demonstrate the commitment to enforce established controls, 12Internal Control Weaknesses in Western's Government Purchase Card Program ‘We support the use of a purchase card program with effective controls and recognize that strengthening the control environment will require detailed and continued attention and commitment by all partics involved. We have provided recommendations to address the weaknesses identified in this report and to improve Western’s management and administration of its GPC Program. RECOMMENDATIONS To address the weaknesses identified in this report, we recommend that the Chief Operating Officer direct Western's Director of Procurement to: 1, Bstablish a GPC Organizational Program Coordinator position whose primary responsibility is management and oversight of the GPC Program, 2. Design standardized purchase card and convenience check log templates to track and record transactions that will be implemented Western-wide. 3, Establish mandatory, Western-wide training (along with an annual refresher) that will include information on the penalties for misuse of the GPC and/or non-compliance with program requirements for all cardholders and approving officials. 4, Design and implement procedures to ensure: a, compliance with DOE's requirement to review all new cardholder files within 3 ‘months of activation; b. HQ and the regions are conducting robust annual GPC program reviews as required and that HQ Procurement officials verify the accuracy and completeness of the reviews, and the validity of the findings. This will also include the identification of the HQ individual responsible for overseeing the annual execution of this effort; and, c. written documentation is completed and maintained as evidence that personal property purchased and receipted by the cardholder was reported to the property ‘management office for accountability and control. 5, Implement a procedure to evaluate a sample of GPC transactions from the HQ and rogional offices periodically throughout the fiscal year to proactively identify and remedy weaknesses. The evaluation should include obtaining and reviewing evidence to ensure that: a. cardholders ~ 1) reconciled each statement against supporting documentation; 2), maintained a purchase card log or convenience check log, if applicable, and reconciled it to the statement; 3) maintained a file that includes: a) copies of charge/eredit slips, customer receipts and other required documentation; b) documented evidence of price fair and reasonableness; 13Internal Control Weaknesses in Western's Government Purchase Card Program ©) purchases were made from mandatory sources or documented reasoning supporting an alternative; 4) evidence of distributed purchases among qualified suppliers by rotating recurring procurement among merchants; and, ©) have sufficient documentation for verbal and mail ordered items (intemet) and purchases of supplies or services (competition, fair price, deliver, etc.) 4) signed their credit card statement; and, $) followed all applicable regulations, directives, orders, ete b. approving officials reviewed, approved, and signed monthly account statements indicating certification of each cardholders monthly transactions. ¢. purchase card transactions were accurate and for a valid government purchase; 4._no blocked merchant category codes were requested to be unblocked without approval; €, there were no violations of the Service Contract Act; £ purchases were made in accordance with FAR’s Required Sources of Supplies and Services; and, purchases were made in accordance with FAR’s Acquisition of Commercial Items, 6. Review the number of cardholders with acéess to convenience checks to determine if a consolidation of check usage can be put in place with fewer cardholders. The outcome of the review should be doctumented and the volume of cardholders with access to convenience checks should be reduced if found practical 7, Formalize and complete the efforts to: a, reduce infrequently used GPC cards across Western to minimi: which can be facilitated by the use of inactive account alert; b, evaluate the monthly available GPC credit limits Western-wide to determine if they should be reduced; and, ensure that a business case analysis is conducted for all new requests to open a GPC account as well as any changes to existing accounts. edit exposure We recommend that the Chief Operating Officer direct Western’s regional and other identified HQ officials to complete the reviews initiated on all questionable transactions identified during the individual HQ and regional GPC audits and prepare a summary report deiailing the results of the review These reports are due to the Director of Procurement by February 1, 2016, MANAGEMENT AND AUDITOR COMMENTS, Western's response to our draft audit report is included in its entirety in Appendix TIL. Western agrees with the report’s recommendations, and has already implemented, or is currently working towards implementing all of our recommendations, We consider 4