Effective Oversight of Your GSA SmartPay® 2 Program (Intermediate)

1. Effective Oversight of Your GSA SmartPay® 2 Program (Intermediate) Phillip Myers Elizabeth Skolnik GSA Training Conference & Expo May 4-6, 2010

2. Value to the Customer • Understand the difference between fraud, waste, and misuse • Improve ability to identify potential misuse by cardholders • Understand consequences of waste, fraud and abuse • Learn and share general charge card management best practices • Learn about relevant legislation and regulations

3. Agenda • GSA SmartPay® Program Overview • GAO Report on Governmentwide Purchase Cards (GAO-08-333) • Understanding and Preventing Waste, Fraud, and Abuse • Roles and Responsibilities • General Charge Card Management Best Practices • Resources and Contacts

4. GSA SmartPay® Program Overview • The GSA SmartPay® program enables over 350 Federal agencies, organizations, and Native American tribal governments to obtain charge card products and services through Master Contracts thatGSA has currently established with three banks: Citibank, JP Morgan Chase, and U.S. Bank • The GSA SmartPay® program provides charge cards to federal employees to make official government purchases and use of the cards should be in accordance with agency/organization-specific policy • There are many benefits to using GSA SmartPay® charge cards, and with these benefits come certain responsibilities for cardholders and A/OPCs DID YOU KNOW… $941 was charged on the GSA SmartPay® charge card every second in FY 09

5. Preventing Waste, Fraud and Abuse

6. GAO Report on Government Purchase Cards • In March 2008, GAO released a report that analyzed purchase card transactions government-wide related to the GSA SmartPay® 1 program to: • Determine if internal control weaknesses existed in the government purchase card program • Identify examples of fraudulent, improper, and abusive activity What GAO Found: • Internal control weaknesses in agency/organization purchase card programs exposed the federal government to fraud, waste, abuse, and loss of assets Source: GAO-08-333

7. GAO Recommendations GSA and Dept of Treasury work with Agencies/Organizations to: • Improve internal controls over the government purchase card program • Provide guidance on how cardholders can document independent receipts and acceptance of items obtained with a purchase card • Remind cardholders to obtain prior approval or subsequent review of purchase activity for purchase transactions that are under the micro purchase threshold • Strengthen monitoring and oversight of purchase cards Source: GAO-08-333

8. GAO Recommendations (cont’d) GSA and Dept of Treasury work with Agencies/Organizations to: • Remind travelers who receive government-paid-for-meals at conferences or other events, they must reduce the per diem claimed on their travel vouchers by the specific amount that GSA allocates for the provided meal • Provide agencies/organizations guidance regarding what should be considered sensitive and pilferable property (e.g. computers, palm pilots, digital cameras, fax machines, can be easily converted to personal use) • Cancel convenience check privileges of cardholders who improperly use these checks Source: GAO-08-333

9. Fraud vs. Misuse • Fraud: A person or entity other than the cardholder makes transactions using the cardholder’s account • Misuse: Cardholder uses his/her own card for transactions not permitted per policy • In the case of government charge cards, intentional use of the government charge card for other than official government transactions constitutes misuse, and may involve fraud • The cardholder is liable for all transactions classified as misuse DID YOU KNOW… Misuse by employees impacts the performance of agency/organization program and rebate earnings potential

10. Examples of Fraud and Misuse • Personal use or unauthorized purchases • Use for or by someone other than the cardholder • Purchases from an unauthorized merchant • Purchases which are not authorized by the agency • Purchases for which there is no funding • Purchases for personal consumption • Purchases which do not comply with Federal Acquisition Regulation (FAR) and/or other applicable procurement statues and regulations

11. Non-Cardholder Fraud • Non-cardholder fraud involves use of the card or cardholder data by an unauthorized person • High-risk situations for non-cardholder fraud include: • Card was never received • Card was lost • Card was stolen • Altered or counterfeit cards

12. Phishing: Example of Non-cardholder Fraud • Have you ever received an email similar to this? Gone Phishing? With fraud on the rise, it is imperative that A/OPCs and cardholders learn to recognize criminal methods in order to protect their GSA SmartPay® charge cards.

13. Possible Indicators of Fraud and Misuse • Merchant Category Code (MCC) appears to be outside the cardholder’s general area of responsibility • Account has been closed due to fraud and a new card has been reissued • Cardholder frequently disputes transactions • Cardholder has had multiple authorizations declined • Cardholder makes transactions on non-work days • Cardholder consistently hits his/her monthly limit • Merchant address appears to be a home address Cues to misuse and abuse can be determined by asking “Who”, “What”, “Where”, “When”, “Why” and “How Much”

14. Possible Indicators of Fraud and Misuse (cont’d) • Cardholder has several transactions with the same merchant within a short period of time (e.g., 48 hours), and the transactions total more than $3,000 (micro-purchase threshold) • Cardholder is unable to provide proof of purchases such as receipts • Cardholder has multiple transactions of even dollar limits (e.g., $20, $100) • Cardholder repeatedly does business with the same merchants (minimal rotation of sources)

15. Consequences of Fraud and Misuse • Employing agency/organization of a cardholder who misuses the card or who participates in fraud may cancel the GSA SmartPay® charge card and take disciplinary action against the employee, as appropriate • In case of card misuse, employee will be held personally liable to the government for the amount of any unauthorized (non-government transaction) • Additional consequences include: • Reprimand • Counseling • Cancellation of card • Notation in employee performance evaluation • Suspension or termination of employment • Criminal prosecution DID YOU KNOW… Many agencies/ organizations have their own policies for consequences related to fraud and misuse.

16. Program Oversight - Roles & Responsibilities

17. Addressing Misuse/Abuse and Fraud What happens if fraud has already taking place? • Program Coordinators* are responsible for reporting any suspected or actual fraud to your contracting bank or agency’s Inspector General • If fraud is suspected of a cardholder, merchant, or other third party, A/OPCs may file a complaint with the agency/organization Inspector General • Many agencies/organizations provide a fraud hotline number for reporting misuse/abuse and fraud • Contact your GSA SmartPay® 2 contracting bank to see what tools and resources they provide for eliminating fraud and misuse *Note: Program Coordinators include: Agency/Organization Program Coordinators (A/OPCs, Fleet Managers, etc.)

18. Roles & Responsibilities of A/OPCs A/OPC responsibilities, as they relate to fraud and misuse include: • Promote appropriate use of GSA Smart Pay® Charge Card by cardholders • Establish internal policies and procedures • Take appropriate action regarding charge card waste, fraud or abuse • Provide cardholders with “Helpful Hints” for Card Use brochure • Ensure cardholders receive appropriate training and take refresher training at a minimum once every three years, or more frequently (as required by your agency/organization) • Monitor account activity and managing delinquencies

19. Roles & Responsibilities of Cardholders Cardholder responsibilities, as they relate to fraud and misuse include: • Use the charge card appropriately, in accordance with agency/organization policy, laws, and governmental regulations • Understand preventative measures to avoid fraud and misuse • Understand GSA SmartPay® Charge Card liabilities • Keep up-to-date with required program and agency/organization specific training, including refresher training • Review and understand “Cardholder Dos and Don’ts” available on the GSA SmartPay® website

20. Establish Internal Policies • A/OPCs should establish clear policiesfor their agency/ organization to prevent cardholder misuse by outlining: • Timeframes for cancelling inactive cards and cards for exiting/retiring employees • Controls on cards – credit, single purchase limit, Merchant Category Codes (MCCs), etc. • Cash advances and convenience check limits • Eligibly Cardholders • Who should have authority to make changes to accounts • Cardholders should be aware of agency/organization policies

21. Establish Internal Procedures • A/OPCs should establish clear procedures to prevent misuse by explicitly outlining the following: • How to cancel GSA SmartPay® charge cards • How to determine if unauthorized users have access to cards • How to obtain, change, and close an account • Policy and refresher trainings for cardholders and users • Reconciliation process • Audit process and frequency • Authorization controls • Cardholders should be aware of agency/organization procedures

22. Risk Management Controls A/OPCs should establish risk management controls to prevent misuse: • Set reasonable credit limits • Restrict use through MCC Blocks • Limit Cash Access • Use reporting tools to monitor card usage • Manage delinquency • Implement proper training for cardholders • Maintain training certificates in a database or personnel records

23. Charge Card Management Oversight

24. Leading Practices • Engage management at the highest levels • Review credit limits and lower as appropriate • Issue cards based on need, versus title • Perform an annual review of all issued cards to determine if each cardholder meets the criteria for continued participation in the federal government purchase charge card program • Incorporate process to enable an alternate point of contact to receive and accept material • Utilize your GSA SmartPay® 2 contracting bank’s resources • Create a newsletter to reinforce agency/organization charge card policies and procedures

25. Lead Practices (cont’d) • Provide the GSA SmartPay® card-sized booklet, “Helpful Hints for Purchase Card Use”, with each cardholder application • Publish frequently asked questions (FAQs) related to the purchase card on your agency’s/organization’s website • Eliminate manually performing data analysis by developing ad hoc reports that can be generated as needed • Perform an annual review of all issued cards to determine if each cardholder meets the criteria for continued participation in the federal government purchase charge card program

26. Leading Practices: Payment Reconciliation • Benefits of Payment Reconciliation: • Avoid hidden delinquencies • Frequent reconciliation leads to smooth program close-out • Avoid out of balance conditions between agencies/organizations and issuers • Reconcile frequently, at least once a month • Reconcile interface files/mappers to statements/invoices • Confirm payment and generate invoice status reports • Review payment reconciliations to ensure agency and bank records agree • Monitor the status of disputed transactions Contact your GSA SmartPay® 2 contracting bank to learn about the tools they provide you with to assist in the payment reconciliation process

27. Leading Practices: Reporting GSA SmartPay® 2 contractor banks are required to issue a set or reports to A/OPCs (determined by the agency/organization) that cover topics such as transactions, payments, disputes, delinquencies • Monitor reports regularly • Use reports proactively, not reactively • Understand and familiarize yourself with all available reports • Develop ad hoc reports • Benefits of Reports: • Allow A/OPCs to oversee their GSA SmartPay® charge card program’s overall financial condition • Monitor for potential fraud/waste/abuse • Provide invoice, payment, and refund data • Supply necessary data to fulfill OMB requirements A full listing of agency reports can be found in section C.3.3.1 of the GSA SmartPay® 2 Master Contract

28. Leading Practices: Training • Provide a comprehensive face-to-face cardholder training as orientation for new cardholders • Discuss agency/organization policy • Ensure cardholders and A/OPCs fulfill the required refresher training requirements at a minimum every three years, or more frequently per agency/organization policy • Ensure that training is easily accessible • Engage in bank-provided training • Attend GSA SmartPay® Annual Training Conference

29. Leading Practices: State/Local Tax Exemption • Merchants are required to recognize the tax exempt status of official Federal Government purchase, travel, fleet, and integrated charge card transactions • Some merchants do not exempt state or local taxes on purchases • Each state has different policies and procedures around the tax exemption of purchases made with GSA SmartPay® cards • The GSA SmartPay® website provides information on each state’s requirements; often cardholders will need to print a “tax exemption” certificate to provide the merchant • Visit the GSA SmartPay® website and click on “tax information” to view updated state information for GSA SmartPay® 2 • Tax exemption and recovery plans and processes are an important part of managing your charge card program

30. Resources & Contacts

31. Training Resources • Other GSA SmartPay® Courses offered at Expo: • Navigating the New GSA SmartPay® Website (Basic) • GSA SmartPay® Program Update (Advanced) • Your GSA SmartPay® 2 – The Basics of Travel, Purchase, Fleet & Integrated Charge Cards (Basic) • GSA SmartPay® Online Training: • GSA SmartPay® Travel Cardholder and A/OPC Training • GSA SmartPay® Purchase Cardholder and A/OPC Training • GSA SmartPay® Fleet Cardholder and A/OPC Training – coming soon • On-site training with banks • Training Sessions at GSA SmartPay® Conference • Materials Available online, and hard copies may be ordered via the GSA SmartPay® website

32. Questions Please provide your feedback and thoughts about the current and future program at: www.gsa.gov/gsasmartpay under “GSA SmartPay® Program Feedback Form” Contact Us Phillip Myers, phillip.myers@gsa.gov Elizabeth Skolnik, elizabeth.skolnik@gsa.gov GSA SmartPay® Program Support  Phone: (703) 605-2808  E-mail: gsa_smartpay@gsa.gov www.gsa.gov/gsasmartpay

33. Thank you!