Internal Controls Are Sufficient But
Administration Can Be Improved
The components have established policy and issued guidance to their employees on the use of the VISA card. The JMD manual, Department of Justice VISA Credit Card Program for Simplified Acquisitions, provides guidance to cardholders in the Department's OBDs. Most of the components have used the JMD manual as a guide to develop guidance for their cardholders. The OJP and the OIG use the JMD Manual.
The GSA established the VISA card program to include internal controls that prevent and detect misuse. The components have included additional program controls to ensure the VISA cards are used appropriately and that funds are available.
GSA's Program Controls
The GSA program has inherent controls, which are intended to prevent and detect misuse. Before VISA cards can be issued, GSA requires that the components designate the following controls:
· Purchase Limits - Each prospective cardholder is given a single purchase limit, which is based on the spending authority given to the cardholder, and a monthly purchase limit, which is based on the cardholder's office budget. Both limits are checked by RMBCS as part of the required merchant authorization for each transaction. If a cardholder's transaction exceeds the established purchase limits, RMBCS declines the transaction.
· Merchant Activity Codes - Each prospective cardholder is assigned a merchant activity code, by which components can restrict purchases from merchants who provide goods and services not authorized. The JMD guidance recommends that employees who make a wide range of purchases should have an unrestricted merchant activity code.
· Key Personnel - Key personnel, such as approving officials, finance and dispute officials, and agency program coordinators, must be designated. The approving official has oversight responsibility to ensure that all VISA card transactions are necessary for official government business and in accordance with procurement regulations.
The OIG Random Sample - All of the 592 cardholder accounts in our sample had single and monthly purchase limits. However, we found that for 22 of the 592 cardholders RMBCS was maintaining higher single purchase limits than authorized by the components. In effect, these cardholders could potentially spend more money than authorized. We believe the components need to ensure that RMBCS has the most current, accurate purchase limits so that the cardholders cannot spend more than what they are authorized.
Components' Program Controls
Each component administers its own VISA card program and has developed internal procedures specific to its needs. We reviewed each component's VISA purchase card procedures and found the following controls:
Agency Program Coordinators - Each component has a designated agency program coordinator who has overall responsibility for the VISA card program. Some of the components have also designated program coordinators in field and program offices and institutions to help manage the program.
Approving Officials - The approving official, typically, the cardholder's supervisor, should be someone who has control of available funds or, at least, knowledge of available funds. According to RMBCS, the number of cardholders assigned to any one approving official should be kept sufficiently small to ensure that appropriate oversight can be provided. Officials in the Office of the Chief Acquisition Officer suggested that no more than ten cardholders should be assigned to one approving official. The DEA restricts to three the number of cardholders assigned to one approving official and the USMS restrict this number to 12. The BOP recommends no more than 12 cardholders, and FPI recommends no more than 7 cardholders, be assigned to any one approving official. We found the following among the remaining components, which have not imposed specific restrictions on, or recommended a number, of cardholders assigned to one approving official:
· INS had 71 cardholders assigned to one approving official.
· Among the OBDs, the Antitrust Division assigned 51 cardholders to one approving official and the Executive Office for United States Trustees assigned 29 cardholders to one approving official.
In these instances, the cardholders' supervisors reviewed the monthly statements of account before the approving officials signed them. In one office we found that neither the designated approving official nor the supervisor was collocated with the cardholder. Cardholders in this situation may be responsible for both purchasing and receiving supplies. If collocation by the cardholders' supervisors or approving officials is not possible, we believe that, at a minimum, personnel other than the cardholders should be responsible for acknowledging receipt of purchased items.
Preapprovals Required - Most of the components require their cardholders to obtain approval before each VISA card purchase and an additional preapproval if the purchase involves ADP equipment or accountable property, which must be added to the components' property inventories. The BOP and FPI require preapproval by the approving official. This requirement is also true for cardholders in the OBDs, unless written office policies state otherwise. In the remaining components, we found the following requirements for preapproval:
· In the USMS, the requirement for preapproval of all purchases is left to the discretion of the approving official.
· The INS guidance does not specifically address required preapprovals by the approving official; however, the INS National Coordinator for the VISA program told us approving officials must preapprove purchases. The INS cardholders must also get preapprovals from logistics offices before they can use their VISA cards to ensure that mandatory sources are checked.10
· The DEA and FBI guidance does not specifically address preapproval by approving officials but requires the cardholders to complete internal requisition forms before they can use their VISA cards. Based on our review of cardholder documentation, we determined that the internal form is signed by an official, typically, the special agent in charge of the office, who is not necessarily the approving official.
Before authorizing RMBCS to issue VISA cards, components provide training to prospective cardholders. Following training, prospective cardholders are issued written delegations of authority to make VISA purchases.
· Training - Length and type of training, such as video or classroom, are determined by the component. Cardholders told us training varied from one-half to two days.
· Written Delegations of Authority - Components provide cardholders with written authority to use their VISA cards. Most often, this authority is for purchases at, or below, the micropurchase threshold of $2,500. However, cardholders who have had additional training in contracting procedures (most often procurement personnel) may use the VISA card for amounts authorized by their delegated authority.
The OIG Random Sample - Based on the OIG random sample we found that 584 of the 592 cardholders who provided us documentation had been issued written delegations of authority to use the VISA card. There were five cardholders in the OBDs and three cardholders in the FBI who did not have current delegations of authority. We also found that 50 of the 102 INS cardholders were issued written delegations of authority during July 1996, following our request for cardholder documentation. The INS National Coordinator at Headquarters told us that, due to an administrative error, delegations of authority had been prepared, but not signed or given to employees who had been issued VISA cards in 1995. Therefore, officially, these cardholders did not have the authority to make purchases between 1995 and 1996.
All of the components' procedures instruct Department cardholders to use the VISA cards to make purchases for the government in accordance with procurement regulations. The Federal Acquisition Regulations (FAR) require cardholders to (1) check mandatory sources before purchasing on the open market, (2) distribute purchases among various suppliers to ensure fair and equitable treatment, and (3) ensure the government is not charged state or local taxes in jurisdictions where the federal government is exempt. If charged inappropriately, cardholders are responsible for disputing taxes charged directly with the vendor. In addition, the FAR prohibits cardholders from separating one purchase into two or more purchases (called splitting purchases) to avoid exceeding authorized purchase limits.
The OIG Random Sample - Based on our sample, we believe that, overall, cardholders understand and follow procurement regulations when they use their VISA cards. We found a minimal number of cardholders who appeared to use one vendor exclusively, but the cardholders explained that they have limited sources within the immediate area from which to obtain needed goods. We found five instances in which it appeared that cardholders split their purchases to avoid single purchase limits. Based on the cardholders' explanations or documentation, we believe that the cardholders did not split their purchases.
We found 24 transactions in which cardholders paid state or local taxes amounting to $265.64 that should not have been charged to the VISA cards. In 15 of the 24 transactions, the taxes were not recovered from the vendors. An INS cardholder, who had not recovered the taxes, told us he had been instructed by his supervisor not to recover any taxes paid in error if the amount was under $10. Another cardholder in the OBDs told us he was too busy to call the vendor and recover the taxes paid in error.
Based on our random sample, we believe that the cardholders use their VISA cards appropriately. The components' guidance is sufficient to administer their VISA card programs and the VISA program internal controls can prevent and detect misuse if the components implement them effectively. We suggest that components ensure that the number of cardholders assigned to one approving official is small enough to provide sufficient oversight. The potential for misuse would be lessened even further if components provided direct oversight of cardholders' VISA purchases. If practicable, the approving official or the cardholder's supervisor should be collocated with the cardholder. If this is not possible, we suggest that someone other than the cardholder be accountable for receipt of the items purchased by the cardholder.
We suggest that INS eliminate its requirement to have logistics offices preapprove cardholders' purchases. Cardholders are responsible for making purchases in accordance with procurement regulations and can have disciplinary action taken against them if they do not.
10 Procurement regulations require that cardholders consider a hierarchy of sources, such as excess inventories and workshops for the blind and other severely handicapped, before buying on the open market.