Purchase Card Programs - How Effective are Your Internal Controls

We finished last week by discussing the House Committee on Veterans' Affairs hearing on waste, fraud, and abuse in the Veteran Administration's (VA) purchase card program. Although the hearing was limited to problems in the VA, issues with purchase card programs is widespread among Government contractors and can significantly affect contractors' ability to ensure the propriety of costs charged to Government contracts. By studying the Government's purchase card problems, the methods used by its oversight arms to ferret out fraud, waste, and abuse, and the internal controls established to reduce the risk of fraud in the program, we might be able to offer up best practices for contractors.

The Government Charge Card Abuse Prevention Act of 2012 (Charge Card Act or CCA) requires agencies to establish and maintain safeguards and internal controls for purchase cards. Under the CCA, Inspectors General must conduct periodic risk assessments of agency purchase card programs to analyze the risks of illegal, improper, or erroneous purchases. Inspectors General then use these risk assessments to determine the necessary scope, frequency, and number of audits or reviews of these programs. Long time readers of this blog and those involved in internal audits will recognize the "risk assessment" is the second of the five elements of internal controls.

At the Hearing, the VA's Assistant Inspector General for Audits and Evaluations described their risk assessment as follows:

For the fiscal year (FY) 2015 risk assessment, we performed data mining on credit card transactions using a set of defined criteria designed to identify transactions or patters of activity that appear to represent potential fraud, waste, or abuse. Our risk assessment examined

• Cardholders with a high volume of transactions
• Multiple transactions made on the same day with the same vendor, amount and purchase card
• Credit card purchases that exceeded established purchase card limits
• Recurring transactions made with the same vendor
• Transactions occurring on holidays, weekends, in the last two months of the fiscal year, and during unusual times of the day
• Transactions made by a facility that were more than double the nationwide average number of transactions and costs per purchase card.

This would seem like a likely starting point for contractors to assess their risks and vulnerabilities in purchase card programs. There doesn't seem to be anything in this listing that would test or point to the use of cards to make "personal" purchases so that might be an additional risk factor that contractors consider.

Continuing on with the testimony, the Assistant IG  noted that from the above risk assessment, the organization identified seven high risk areas that included:

• Cardholder transactions that exceed authorized purchase limits including unauthorized commitments.
• Inadequate financial controls prohibiting duplicative and split payments
• An excessive number of cardholders making purchases with inadequate justifications
• An unmanageable span of control resulting from an unbalanced ratio or cardholders to approving officials.
• Inadequate recording or reporting of financial information.
• Insufficient oversight of year-end spending
• Inadequate review of purchases by approving officials.

Based on the risk assessments, the IG plans to conduct audits and reviews to identify control weaknesses, strengthen program control, and address inefficiencies in VA’s Purchase Card Program. Its recent work has identified significant control weaknesses that did not prevent transactions involving unauthorized commitments, improper payments, split purchases, and purchases that lacked appropriate supporting documentation.  

So evidently, the controls that are in place to prevent unauthorized commitments, improper payments, split purchases, and purchases that lacked supporting documentation were not working. Now its up to the auditors and management to improve its system of internal controls to prevent that from happening in the future.

Problems with Purchase Card Programs

Yesterday, the House Committee on Veterans' Affairs held a hearing on waste, fraud, and abuse in the VA's (Veterans Administration) purchase card program (i.e. credit cards issued to VA employees). This hearing focused on the program's weak internal controls which have caused serious violations of procurement laws and, according to the Committee Chairman, has resulted in an astounding $5 billion a year in improper and unauthorized procurement expenditures for at least the past five years.

Although this hearing focused on credit cards issued to VA employees, contractors face the same kinds of problems in their own P-Card (purchase card) programs. The deficiencies identified by the Inspector General's (IG) office of the VA have been found at Government contractors, especially at some of the big DOE (Department of Energy) M&O (Management and Operations) contractors. While the magnitude of the problem is not as significant as the VA, it remains a management concern at most contractors who have implemented purchase card programs.

The litany of identified deficiencies are classic textbook internal control weaknesses frequently found in purchase card programs. These include:

1. Exceeding authorized purchase limits individually or aggregately
2. An excessive number of purchase cardholders with inadequate justification
3. An unmanageable span of control (ratio of cardholders to approving officials is high)
4. Inadequate financial controls prohibiting duplicative or split payments
5. Inadequate recording or reporting of financial information
6. Insufficient oversight of year-end spending, and
7. Inadequate review of purchases by reviewing officials.

In the context of the VA, the Committee Chairman made the following observation:

Violations of procurement laws are not mere technicalities. It is not just a matter of paying a little more for needed supplies and services as some apologists for VA have asserted. Among other things, purchase card abuse invites cronyism and the directing of business to favored vendors, including those who may employ former VA officials. Moreover, buying biologic and medical supplies without contracts imperils patient safety. Without contracts, FDA certifications are not a legal requirement nor are the Buy American Act or Trade Agreement Act provisions. 

In the context of contractors, the inappropriate use of purchase cards can result in purchases that bypass contractors' purchasing department and its associated internal controls, policies, procedures, and practices. Thus, there is an increased likelihood of paying too much for needed materials and supplies.

Next, we will look as some of the recommendations made by the IG to tighten up the purchase card program. Perhaps some of these recommendations can be applied to contractor purchase card programs.

Audit Finds $134 Million in Unsupported Subcontract Costs

A recent audit report underscores the importance for contractors to adequately support incurred costs.

The Special Inspector general for Afghanistan Reconstruction (SIGAR) recently issued an audit report on costs incurred by a contractor providing highly specialized counterinsurgency intelligence exerts to mentor and train Afghan National Security Forces, to provide for hiring bilingual cultural advisers, and developing Afghanistan-specific instruction in counterinsurgency operations to strengthen Afghanistan's capacity to combat terrorist and insurgent networks.

The audit identified two material weaknesses, one significant deficiency, and three instances of noncompliance with the terms and conditions of the contract. Specifically, the contractor did  not retain sufficient supporting documentation for a subcontractor's costs. As a result, the auditors were unable to determine whether the subcontract costs were incurred, allocable, and complied with the appropriate cost principles.

Additionally, the contractor did not compile  with federal procurement policies in that it did not provide support for a competitive procurement process for three subcontracts totaling almost $5 million. As a result, the contractor was unable to demonstrate that these costs were reasonable. Finally, the contractor improperly billed the U.S. government for fixed fees beyond the amount authorized by the contract. Although the contractor ultimately refunded the excess fees, the Government lost $36 thousand in interest.

As a result of all of these deficiencies, the auditor found that $134 million was not supported with adequate documentation. The contractor disagreed with the audit findings of course and the auditors, in turn, disagreed with the contractor's disagreement. Because there is an impasse, the auditor decided to do more work to determine the allowability of and recover, as appropriate, $134 million in unsupported costs.

This thing has turned into a real mess which could have been avoided had the contractor simply done a better job in documenting its costs.

Other Direct Costs (ODCs)

Everyone is familiar with labor and material costs that can be identified specifically to a contract and therefore charged direct to that contract. Subcontracts are another cost category that is identifiable and charged direct to contracts. In addition to the big three (labor, materials, and subcontracts) there are other types of expenses which, under certain circumstances, may be charge direct to a specific job or contract. Typically these are lumped together and referred to as ODCs or Other Direct Costs.

Examples of ODCs include

• special tooling and test equipment, dies, jigs, and fixtures
• plant rearrangement
• packaging and packing
• consultant's fees
• outbound freight
• expediting
• royalties
• travel

ODCs can be charged direct to contracts, allocated on some representative basis, or charged partially direct and partially by allocation.

When it comes to auditing ODCs, contract auditors are always wary of inconsistent charging practices between fixed price and cost-type contracts. Cost type contracts are "riskier" than fixed price contracts because contractors might be tempted to charge ODCs direct on cost-type contracts because they would be fully reimbursable while charging ODCs indirect on fixed price contracts so as to allow their cost type contracts to share in the absorption of ODCs.

Auditors are also cautious to determine whether costs charged to ODCs might also have continuing use on other contracts or on successor contracts and therefore should be capitalized rather than expensed. Plant rearrangement costs to configure a facility for a particular contract might fall in this category.

Contractors should generally charge everything direct that can be identified direct to a contract. In the case of ODCs where charging practices could go either way, contractors should establish firm practices, document them, and consistently follow them. That will help avoid potential audit issues.

Don't Assume That Your Email was Duly Received by the Addressee

Here's a case involving the SBA's Office of Hearings and Appeals (OHA) but it has relevance beyond that particular venue. It involves a size protest to the contracting officer and subsequent appeal to OHA.

A size appeal must be filed at OHA within fifteen days of receipt of the size determination. An appellant received the size determination on February 3, 2015 but the appeal petition was not received by OHA until April 9, 2015 and therefore "plainly untimely". Under the relevant regulations, OHA has no discretion to extend or waive the deadline for filing an appeal.

The appellant maintained that it attempted to transmit its appeal by e-mail on February 18, 2015, which would have met the 15 day deadline. It produced an acknowledgement from its e-mail system entitled "Certificate of service." It also contained the phrase "Delivery to these recipients or groups is complete, but no delivery notification was sent by the destination server". There was a problem however in that OHA never received the appeal (or so it maintains).

By regulation, a document must be received at OHA in order to be considered filed. The regulations are clear that an appeal petition is not filed until it is actually received at OHA. SBA regulations provide that although e-mail is a permissible method of delivery, the sender is responsible for ensuring a successful, virus-free transmission, and the sender is encouraged to contact OHA by telephone to verify receipt. Accordingly, having chosen to submit its appeal by e-mail, the appellant was responsible for ensuring that the email successfully reached OHA. The appellant could not reasonably rely solely upon the acknowledgement from its e-mail system, particularly given that the appellant received no response, over a period of several weeks, from OHA.

It is critical to followup e-mail transmissions of important documents with a phone call or some other form of positive assurance, especially on time-critical matters. Do not assume that your and the Government's email systems are infallible.

Incurred and Claimed Does Not Prove Reasonableness

BAE Systems San Francisco Ship Repair was awarded a task order under a multiple-award, task order contract (MATOC) for programmed maintenance of a Logistics Support Vessel. During performance, BAE discovered significant differences between the drawings for potable water and drain piping systems and those that actually existed on the vessel. BAE filed a equitable adjustment claim for $904 thousand.

Eventually, DCAA (Defense Contract Audit Agency) was requested to audit the claim. In its report, DCAA reported that BAE had submitted adequate data to support its claim and considered the claim to be acceptable as a basis for negotiation of a fair and reasonable settlement. Of the $904 thousand claimed, DCAA took exception to a very insignificant $566 - almost not worth reporting upon.

The contracting officer evidently did not like the DCAA audit report because she dismissed it entirely and rendered a decision that BAE was entitled to recover only $351 thousand. She wrote:

Defense Contract Audit Agency (DCAA) ... did not question the amounts of your proposed claim. All DCAA did, unfortunately, was verify the addition of the claim without verifying any of the underlying facts. DCAA did not have any of the oroginal time cards or any other information beyond the summary you provided. DCAA took no exception to the proposed material costs. DCAA specifically did not examine entitlement, but only looked at quantum. DCAA had no knowledge of the actual facts and did not look beyond the information offered by BAE.

BAE appealed the contracting officer's final decision to the ASBCA (Armed Services Board of Contract Appeals. As the case progressed, BAE, at one point, moved for a summary judgment, asking whether its claim be based on its actual, recorded costs of performing additional work as confirmed by Government auditors, or should the amount be based on an estimate by Government personnel. BAE stated that its proposed costs are actual costs and DCAA confirmed them by tracing to books and records. The Government should not be heard to impeach or contradict its own auditors.

The ASBCA denied BAE's request for summary judgment. The ASBCA did not agree that BAE's costs were automatically allowable simply because those costs were recorded in the books and records and because DCAA had reconciled those costs to the books and records. It further stated that the contractor has the burden of proof, unaided by a presumption of reasonableness, to establish that the costs it incurred were reasonable. Therefore, BAE's claim does not meet the requirement, imposed by law, that it had met its initial burden of establishing that the costs it claimed are reasonable.