Review of the National Institutes of Health Internal Controls Over Purchase Card Activities

EXECUTIVE SUMMARY:

This report provides the results of the Office of Inspector General's review of internal controls over, and use of purchase cards by the National Institutes of Health (NIH).

The objective of the review was to determine whether NIH has designed and implemented adequate internal controls over its purchase card activities.

Generally, NIH has designed and implemented adequate management controls over the use of purchase cards. The General Services Administration (GSA) provided general guidance to agencies for using purchase cards. We found NIH to be in compliance with the GSA guidance. Our findings agreed with those of Enterprise Integration Services, an NIH contractor, which issued a June 1996 report concluding that NIH was in compliance with all applicable GSA guidance.

However, NIH may not be in compliance with General Accounting Office (GAO) internal control standard relating to separation of duties. Individual cardholders were authorized to both order and sign for receipt of goods and services. Internal control standards issued by GAO specify that key duties, such as authorizing, approving, and recording transactions; and issuing and receiving assets should be separated among individuals. The NIH officials identified several compensating controls that they believe adequately make up for the apparent lack of separation of key duties and responsibilities; however, they told us that they did not formally assess the risks in this area.

In addition, NIH cardholders did not always comply with NIH policy and procedures relating to payment of sales taxes. Six of the 25 cardholders whose transactions we reviewed improperly paid State sales tax on eight transactions in June and July 1996. The NIH officials advised us that they would obtain refunds from the vendors in the eight cases and take additional actions to prevent sales taxes from being paid in the future.

Our review also showed that sensitive property procurements, such as computer equipment and cameras were not always entered in property management records as required by NIH. We were advised by NIH officials that this was due to a computer programming error which was corrected after we called it to NIH's attention.

We are recommending that NIH:

1. fully evaluate the effectiveness of controls over the card purchase program which compensate for the lack of separation of duties;
   
   
2. ensure that cardholders pay no more State sales taxes on card purchases;
   
   
3. revise the property module designed for card purchases so all object classes designated for sensitive and accountable property trigger electronic alerts to the property management officials to place decals on such property and enter them into the property management system; and
   
   
4. review all card purchases and identify all sensitive equipment items that should have been entered into the property management system and enter them.

The NIH generally concurred with our recommendations.

The National Performance Review (NPR) Report issued by the Vice President in 1993 recommended that agencies promote the use of purchase cards to realize savings of administrative costs associated with making small purchases. Based on February 1997 card purchase volume, we estimated that NIH's annual card purchase volume to be about $17.4 million. The NIH officials advised us that they are planning to increase the annual card purchases to about $100 million. We believe that this goal is reasonable. Further, we believe that NIH can increase card purchases to about $152 million annually if they make card purchases the preferred means of making small purchases of up to $2,500, as requested by the Deputy Assistant Secretary for Grants and Acquisition Management (DASGAM). We believe that at such a volume NIH can save about $4 million in administrative costs annually.

---