Travel Cards: Control Weaknesses Leave Navy Vulnerable to Fraud and Abuse

The Navy, in conjunction with DOD, has taken actions that substantively address 24 of the 25 recommendations in this report. Consequently, we consider this overall recommendation closed as implemented.

Effective in 2005, DOD issued an amendment to their FMR that provided that, when requested by the applicant, and as directed by the commander or supervisor, DOD's credit card contractor is to issue a restricted travel card to requestors with low or no credit score. The Navy also adopted operating instructions consistent with this DOD guidance.

In response, the Navy eBusiness Operations Office, which is responsible for managing the Navy travel card program, developed comprehensive Navy-wide computer-based initial training for cardholders. The Navy eBusiness Operations Office also issued policies requiring that travel cardholders be provided with training on travel card policy and procedures and cardholder responsibilities at the time of submission of an application for a travel card. The policy also requires that the cardholder's Agency Program Coordinator maintain documentation of successful completion of this training. Further, the Navy eBusiness Operations Office also developed refresher cardholder training, available through video teleconferencing, and available several times a month. This course is also part of the mandatory training for travel cardholders.

On July 19, 2002, the Office of the Under Secretary of Defense Comptroller directed the services to close all government travel credit card accounts that have expired or have not had activity for the 12 months before end of April 2002. In September 2002, the Navy eBusiness Operations Office issued its own directive informing Navy commands that all Navy travel card accounts that meet the criteria in the Comptroller memorandum informing Navy commands that Navy cards meeting the criteria will be closed beginning with the September 17, 2002 cycle. Similarly, the Marine Corps issued its own order on closing accounts of infrequent travelers on September 27, 2002.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, issued policy directing applicable major commands to immediately deactivate travel cards for all personnel not scheduled for official travel. These cards are to be activated 10 days before travel is to begin and deactivated immediately upon the conclusion of official travel.

Navy developed comprehensive Navy-wide computer-based initial training for cardholders. Navy also issued policies requiring that travel cardholders be provided with training on travel card policy and procedures and cardholder responsibilities at the time of submission of an application for a travel card. The policy requires that the cardholder's Agency Program Coordinator maintain documentation of successful completion of this training. Further, Navy also made cardholder refresher available through video teleconferencing several times a month. This course is also part of the mandatory training for travel cardholders.

DOD FMR adds appointment considerations to APC responsibilities. Commanders and supervisors should consider the volume of workload associated with the APC responsibilities in determining how many personnel may be needed to fulfill the associated workload. Other factors, such as the frequency of travel and historic delinquency rate of the organization should be taken into account. Individuals appointed as APCs should have the analytic and computer skills and access necessary to utilize the reports provided on the card provider's electronic system. The APCs must be able to have access to the ability to relate sensitive information to the chain of command for determination of appropriate action. Commanders and supervisors should consider assignment of APC duties to civilian personnel where practical in order to avoid the loss of knowledge of program responsibilities in high turnover military positions.

The Department of the Navy eBusiness Operations Office responsible for managing the travel card program issued revised policies and procedures in September 2003 for the travel charge card. The new policy, which has the force and effect of Navy regulations, contains guidelines for the assignment of unit APCs. The new policies and procedures instruct commanders and commanding officers to give consideration to the number of cardholder accounts and the frequency and length of official travel when determining if the APC should be assigned as a full time duty.

DOD FMR requires that individuals appointed as APCs have the analytic and computer skills and access necessary to utilize the reports provided on the card provider's electronic system, and that the APCs must be able to have access to and the ability to relate sensitive information to the chain of command for determination of appropriate action. Navy's program oversight requires the APC to use reports available through the custom reporting tool within the bank system to proactively monitor the program. NAVSUP 4200.99 requires that APCs receive initial training as well as refresher training every two years. Also, level III APCs, or their alternate, are required to attend APC conferences. Navy APCs monitor the travel card program for delinquency, credit limit review, and program compliance.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, announced policy changes to strengthen controls over Navy travel card management. The new policy directed APCs to review the Bank of America's Returned Check Charges Exception Report to identify cardholders who have written NSF checks and report those cases to the individuals' commands for further actions.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, responded to our recommendation by directing Navy commands to investigate and, if warranted, take appropriate disciplinary actions against cardholders who wrote three or more non-sufficient fund checks to Bank of America.

OPNAVINST 4650.16, 2 March 2004, establishes policy and procedures for effective management and oversight of the Navy's travel card program. Under this guidance, APCs are responsible for reviewing standard reports in EAGLS specifically designed to help identify travel card misuse or abuse.

OPNAVINST 4650.16, dated 2 March 2004, establishes requirements for APCS to obtain and document all cases of abuse and delinquency as well as any disciplinary actions taken to include Non-Judicial Punishment and collection activity. Also, APCs are required to retain the records for 36 months.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, issued new policy directing the APCs to retain records of fraudulent and abusive use of the travel cards. Further, Navy's OPNAVNST 4650.16, dated 2 March 2004, provides that APCs are to retain such records for 36 months.

OPNAVINST 4650.16, 2 March 2004, establishes policy and responsibility for effective management and oversight of the Navy's travel card program. The instructions place responsibility for discipline of personnel that abuse the travel card program on commanders, commanding officers, and officers in charge. DOD also issued sample guidelines for disciplinary actions. Furthermore, Navy established policy providing guidance on appropriate disciplinary actions for travelers with abusive activity related to the travel card. Navy's internal controls over the travel account, in conjunction with the DOD guidelines, substantially responds to GAO's recommendation.

OPNAVINST 4650.16, 2 March 2004, establishes policy and procedures for effective management and oversight of the Navy's travel card program. APCs are to brief commanding officers at least quarterly on the status of the program using a designated reporting format. Some of the items the APC are to report on include, delinquent cardholder accounts and actions taken to resolve the delinquency, numbers of restricted cards, number and value of delinquent accounts, and number of cards canceled as a result of non-payment or abuse--including the number of personnel on a reduced payment plan and the number on salary offset. The instructions place responsibility for discipline of personnel that abuse the travel card program, to include administrative actions related to any security concerns, on commanders, commanding officers, and officers in charge. Navy's instructions are consistent with DOD's 2005 amendment to the FMR. These actions substantially complete and are consistent with the intent of GAO's recommendation.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, responded to our recommendation by issuing new policies directing Navy commands to perform periodic review of active travel card accounts and listings of current employees, to identify open accounts assigned to separated or retired employees, and to take actions to ensure that accounts of separated cardholders are deactivated or closed in a timely manner.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, directed Navy commands to perform periodic reviews to ensure that accounts of separated cardholders are deactivated or closed in a timely manner.

In February 2003, the Assistant Secretary of the Navy, Financial Management and Comptroller, directed Navy commands to perform periodic reviews to ensure that accounts of separated cardholders are deactivated or closed in a timely manner.

Bank of America security officials reviewed employee access and deactivated access for 655 employees that they determined should not have had any level of access. Further, Bank of America has since initiated periodic reviews to ensure that it maintains appropriate levels of employee access.

On October 1, 2005, the DOD Comptroller issued the Department of Defense Government Charge Card Guidebook for Establishing and Managing Purchase, Travel, and Fuel Card Programs. The Charge Card Guidebook establishes business rules for each program which address many of the weaknesses identified in our audits. For example, the Guidebook mandates direct involvement of senior military leaders and civilian managers and requires them to ensure that effective management controls, including proper separation of duties among personnel, are in place, order investigations when appropriate, and follow up on investigation results. The Guidebook states that management controls should effectively identify, correct, and address fraud, waste, and abuse and it describes key steps in investigations of suspicious activity and provides examples of credit card misuse. In addition, the Guidebook requires periodic audits and risk assessments to identify sources of fraud, waste, and abuse.

Puget Sound Naval Shipyards implemented procedures requiring for the commercial travel office to review the accuracy of draft shipyard personnel travel vouchers before they are submitted for payment. Further, new procedures require the Personnel Support Detachment in Bremerton to verify vouchers are completed properly, authorized, and validated. The Navy IG office verified in July 2007 that these procedures were in place and operating.

The Navy's Puget Sound Naval Shipyard implemented procedures for the commercial travel office to conduct periodic reviews of shipyard travel voucher data the travel voucher/claims system. Specifically, the shipyard established and implemented procedures for sampling travel voucher data in the travel voucher system for accuracy. In July 2007, the inspector general verified that the shipyard had procedures in place to conduct periodic reviews of the accuracy of travel voucher data in the travel voucher system.

In response to this recommendation, DOD incorporated the recommendations in GAO reports on travel and purchase cards in the Department of Defense Charge Card Task Force Status Report signed December 18, 2002, referred to within DOD as Management Initiative Decision (MID) 904. MID 904 also provided a mechanism for addressing recommendations in the Navy travel card report, which was issued after MID 904 was released. Specifically, MID 904 transitioned responsibility for implementation and management of the Task Force recommendations from the OUSD(C) Performance and Management Excellence Directorate to the appropriate organizations. DOD established a Senior Steering Group charged with ensuring successful implementation of MID 904 and created Integrated Product Teams (IPT) to create solutions based upon Senior Steering Group strategic direction. GAO staff participation in Air Force purchase card conferences in January and February 2003 and the DOD IPT strategic planning conference on March 21, 2003, confirmed that DOD charge card corrective actions were planned or underway to address all GAO report recommendations, including recommendations in the Navy travel card report. Further, DOD has focused senior management attention on developing appropriate solutions to identified problems, establishing implementation schedules that incorporate actions on GAO audit recommendations, and monitoring corrective actions.