Appendix II: Objectives, Scope, and Methodology
We performed a forensic audit of executive agencies’ purchase card activity for the 15 months ending September 30, 2006. Specifically, we (1) determined the effectiveness of internal controls intended to minimize fraudulent, improper, and abusive transactions by testing two internal control attributes related to transactions taken from two statistical samples and (2) identified specific examples of potentially fraudulent, improper, and abusive transactions through data mining and investigations.
Statistical Sample of Internal Control Procedures
We obtained the databases containing agency purchase and other government charge card transactions for the 12-month period ending June 30, 2006, from Bank of America, Citibank, JP Morgan Chase, Mellon Bank, and U.S. Bank. The databases contained purchase, travel, and fleet card transactions. Using information provided by the banks, we queried the databases to identify transactions specifically related to purchase cards. We performed other procedures—including reconciliation to purchase card data that the General Services Administration (GSA) published—to confirm that the data were sufficiently reliable for the purposes of our report.
Our statistical sampling work covered purchase card activity at executive agencies. We define executive agencies as federal agencies that are required to follow the Federal Acquisition Regulation (FAR), including executive departments, independent establishments, and wholly owned federal government corporations as defined by the United States Code.1 We excluded transactions from the legislative and judicial branches, entities under treaty with the United States, and federal agencies with specific authority over their own purchase card programs.2
To assess compliance with key internal controls, we extracted and tested two statistical (probability) samples of 96 transactions each. The first sample consisted of transactions exceeding $50 taken from a population of over 16 million purchase card transactions totaling almost $14 billion. We also selected a second sample from the population of over 600,000
15 U.S.C. §§ 101, 104 and 31 U.S.C § 9101 identify agencies required to follow the FAR.
2Because of limitations in the data, we were unable to remove all transactions related to entities outside the scope of our audit from the sample populations. If any transaction that should have been excluded were selected as part of either sample, we replaced them.
GAO-08-333 Governmentwide Purchase Cards