Conduct Effective Oversight of Your GSA SmartPay2 Program

1. Conduct Effective Oversight of Your GSA SmartPay2 Program Joline McDonald Elizabeth Skolnik Office of Charge Card Management (OCCM) 12th Annual GSA SmartPay Training Conference August 10 – 12, 2010

2. Value to the Customer • Understand the difference between waste, fraud and misuse/abuse • Improve ability to identify potential misuse by cardholders • Understand consequences of waste, fraud and misuse/abuse • Learn and share general charge card management best practices • Learn about relevant legislation and regulations • Find out about general resources • Review waste, fraud and misuse/abuse sample scenarios

3. Agenda • GSA SmartPay Program Overview • GAO Report on Governmentwide Purchase Cards (GAO-08-333) • Understanding and Preventing Waste, Fraud, and Misuse/Abuse • Roles and Responsibilities • General Charge Card Management Best Practices • Resources and Contacts • Questions • Sample Scenarios

4. GSA SmartPay2 Program Overview DID YOU KNOW… $943 was spent using Federal charge cards every second in FY09 • The GSA SmartPay program, enables over 350 Federal agencies/organizations to obtain charge card products and services through master contracts thatGSA established with three banks: Citibank, JP Morgan Chase, and U.S. Bank • Agencies/organizations issued task orders against these master contracts to obtain charge card products and services • Agencies/organizations pay no direct fees to use the program • Period of performance for existing contracts is through 2018

5. Preventing Waste, Fraud and Misuse/Abuse

6. GAO Report on Government Purchase Cards • In March 2008, GAO released a report that analyzed purchase card transactions government-wide related to the GSA SmartPay1 program to: • Determine if internal control weaknesses existed in the government purchase card program • Identify examples of fraudulent, improper, and abusive activity What GAO Found: • Internal control weaknesses in agency/organization purchase card programs exposed the federal government to fraud, waste, abuse, and loss of assets Source: GAO-08-333

7. GAO Report on Government Purchase Cards • Case studies that the GAO examined included: Source: GAO analysis of bank data and supporting documentation.

8. GAO Recommendations GSA and Dept. of Treasury work with Agencies/Organizations to: • Improve internal controls over the government purchase card program • Provide guidance on how cardholders can document independent receipts and acceptance of items obtained with a purchase card • Remind cardholders to obtain prior approval or subsequent review of purchase activity for purchase transactions that are under the micro purchase threshold • Strengthen monitoring and oversight of purchase cards Source: GAO-08-333

9. GAO Recommendations (cont’d) GSA and Dept. of Treasury work with Agencies/Organizations to: • Remind travelers who receive government-paid-for-meals at conferences or other events, they must reduce the per diem claimed on their travel vouchers by the specific amount that GSA allocates for the provided meal • Provide agencies/organizations guidance regarding what should be considered sensitive and pilferable property (e.g. computers, palm pilots, digital cameras, fax machines, can be easily converted to personal use) • Cancel convenience check privileges of cardholders who improperly use these checks Source: GAO-08-333

10. Fraud vs. Misuse • Fraud: A person or entity other than the cardholder makes transactions using the cardholder’s account • Misuse: Cardholder uses his/her own card for transactions not permitted per policy • In the case of government charge cards, intentional use of the government charge card for other than official government transactions constitutes misuse, and may involve fraud • The cardholder is liable for all transactions classified as misuse DID YOU KNOW… Misuse by employees impacts the performance of agency/organization program and rebate earnings potential

11. Fraud • Fraud involves use of the card or cardholder data by an unauthorized person • High-risk situations for fraud include: • Card was never received • Card was lost • Card was stolen • Altered or counterfeit cards

12. Phishing: Example of Fraud • Have you ever received an email similar to this? Gone Phishing? With fraud on the rise, it is imperative that A/OPCs and cardholders learn to recognize criminal methods in order to protect their GSA SmartPay charge cards.

13. Examples of Misuse • Personal use or unauthorized purchases • Use for or by someone other than the cardholder • Purchases from an unauthorized merchant • Purchases which are not authorized by the agency • Purchases for which there is no funding • Purchases for personal consumption • Purchases which do not comply with Federal Acquisition Regulation (FAR) and/or other applicable procurement statues and regulations

14. Possible Indicators of Fraud and Misuse • Merchant Category Code (MCC) appears to be outside the cardholder’s general area of responsibility • Account has been closed due to fraud and a new card has been reissued • Cardholder frequently disputes transactions • Cardholder has had multiple authorizations declined • Cardholder makes transactions on non-work days • Cardholder consistently hits his/her monthly limit • Merchant address appears to be a home address Cues to misuse and abuse can be determined by asking “Who”, “What”, “Where”, “When”, “Why” and “How Much”

15. Possible Indicators of Fraud and Misuse (cont’d) • Cardholder has several transactions with the same merchant within a short period of time (e.g., 48 hours), and the transactions total more than $3,000 (micro-purchase threshold) • Cardholder is unable to provide proof of purchases such as receipts • Cardholder has multiple transactions of even dollar limits (e.g., $20, $100) • Cardholder repeatedly does business with the same merchants (minimal rotation of sources)

16. Consequences of Fraud and Misuse • Employing agency/organization of a cardholder who misuses the card or who participates in fraud may cancel the GSA SmartPay charge card and take disciplinary action against the employee, as appropriate • In case of card misuse, employee will be held personally liable to the government for the amount of any unauthorized (non-government transaction) • Additional consequences include: • Reprimand • Counseling • Cancellation of card • Notation in employee performance evaluation • Suspension or termination of employment • Criminal prosecution DID YOU KNOW… Many agencies/ organizations have their own policies for consequences related to fraud and misuse.

17. Program Oversight - Roles & Responsibilities

18. Addressing Misuse/Abuse and Fraud What happens if fraud has already taken place? • Agency/Organization Program Coordinators are responsible for reporting any suspected or actual fraud to your contracting bank or agency’s Inspector General • If fraud is suspected of a cardholder, merchant, or other third party, A/OPCs may file a complaint with the agency/organization Inspector General • Many agencies/organizations provide a fraud hotline number for reporting misuse/abuse and fraud • Contact your GSA SmartPay2 contracting bank to see what tools and resources they provide for eliminating fraud and misuse

19. Roles & Responsibilities of A/OPCs A/OPC responsibilities, as they relate to fraud and misuse include: • Promote appropriate use of GSA SmartPay charge card by cardholders • Establish internal policies and procedures • Take appropriate action regarding charge card waste, fraud or abuse • Provide cardholders with “Helpful Hints” for Card Use brochure • Ensure cardholders receive appropriate training and take refresher training at a minimum once every three years, or more frequently (as required by your agency/organization) • Monitor account activity and managing delinquencies

20. Roles & Responsibilities of Cardholders Cardholder responsibilities, as they relate to fraud and misuse include: • Use the charge card appropriately, in accordance with agency/organization policy, laws, and governmental regulations • Understand preventative measures to avoid fraud and misuse • Keep up-to-date with required program and agency/organization specific training, including refresher training • Review and understand “Cardholder Dos and Don’ts” available on the GSA SmartPay website • Reference our new Fraud Brochure, available on the GSASmartPay website and at our Welcome Center

21. Establish Internal Policies A/OPCs should establish clear policiesfor their agency/ organization to prevent cardholder misuse by outlining: • Timeframes for cancelling inactive cards and cards for exiting/retiring employees • Controls on cards – credit, single purchase limit, Merchant Category Codes (MCCs), etc. • Cash advances and convenience check limits • Eligible Cardholders • Who should have authority to make changes to accounts

22. Establish Internal Procedures A/OPCs should establish clear procedures to prevent misuse by explicitly outlining the following: • How to obtain, change, and close an account • Policy and refresher trainings for cardholders and users • Reconciliation process • Audit process and frequency • Required standard and ad hoc reports which can be used to monitor fraud, misuse/abuse

23. Risk Management Controls A/OPCs should establish risk management controls to prevent misuse: • Set reasonable credit limits • Restrict use through MCC Blocks • Limit Cash Access • Use reporting tools to monitor card usage • Manage delinquencies • Implement proper training for cardholders • Maintain training certificates in a database or personnel records

24. ATM Safety ATMs offer a great deal of convenience, but here are some tips you might share with your cardholders: • Be careful when using a freestanding ATM machine, especially those that are poorly lit or in a hidden area • Have your card ready as you approach the ATM • Ensure that nobody can see you entering your personal identification number (PIN) • Take your ATM receipts or transaction records to keep your account information confidential • Do not use ATMs that appear unusual, or offer options that you are not familiar with

25. Charge Card Management Oversight

26. Leading Practices • Engage management at the highest levels • Review credit limits and lower as appropriate • Issue cards based on need, versus title • Perform an annual review of all issued cards to determine if each cardholder meets the criteria for continued participation in the federal government charge card program • Incorporate process to enable an alternate point of contact to receive and accept material • Utilize your GSA SmartPay2 contracting bank’s resources • Create a newsletter to reinforce agency/organization charge card policies and procedures

27. Leading Practices (cont’d) • Provide the GSA SmartPay card-sized booklet, “Helpful Hints for Purchase Card Use” and “Helpful Hints for Travel Card Use” with each cardholder application • Publish frequently asked questions (FAQs) related to the charge card on your agency’s/organization’s website • Eliminate manually performing data analysis by developing ad hoc reports that can be generated as needed • Perform an annual review of all issued cards to determine if each cardholder meets the criteria for continued participation in the federal government purchase charge card program

28. Leading Practices: Payment Reconciliation • Benefits of Payment Reconciliation: • Avoid hidden delinquencies • Frequent reconciliation leads to smooth program close-out • Avoid out of balance conditions between agencies/organizations and issuers • Reconcile frequently, at least once a month • Reconcile interface files/mappers to statements/invoices • Confirm payment and generate invoice status reports • Review payment reconciliations to ensure agency and bank records agree • Monitor the status of disputed transactions More information on this topic will be provided during the “GSA SmartPay Charge Card Reconciliation” See program for more information. Presentation will be available on our website following the conference.

29. Leading Practices: Reporting GSA SmartPay2 contractor banks are required to issue a set of reports to A/OPCs (determined by the agency/organization) that cover topics such as transactions, payments, disputes, delinquencies • Monitor reports regularly • Use reports proactively, not reactively • Understand and familiarize yourself with all available reports • Develop ad hoc reports • Benefits of Reports: • Allow A/OPCs to oversee their GSA SmartPay charge card program’s overall financial condition • Monitor for potential fraud/waste/abuse • Provide invoice, payment, and refund data • Supply necessary data to fulfill OMB requirements A full listing of agency reports can be found in section C.3.3.1 of the GSA SmartPay2 Master Contract

30. Leading Practices: Training • Provide a comprehensive face-to-face cardholder training as orientation for new cardholders • Discuss agency/organization policy • Ensure cardholders and A/OPCs fulfill the required refresher training requirements at a minimum every three years, or more frequently per agency/organization policy • Ensure that training is easily accessible • Engage in bank-provided training

31. Resources & Contacts

32. Training Resources • GSA SmartPay Online Training: • GSA SmartPay Travel Cardholder and A/OPC Training • GSA SmartPay Purchase Cardholder and A/OPC Training • Requested on-site training with banks • Training Sessions at the Annual GSA SmartPay Conference • Publications and materials are available on-line and may be ordered via the Centralized Mailing List Service (CMLS) website. (Can be ordered onsite at our Welcome Center)

33. Other relevant GSA SmartPay Courses: • GSA SmartPay2 Purchase Card Basics • GSA SmartPay2 Travel Card Basics • GSA SmartPay2 Fleet Card Basics • GSA SmartPay2 Master Contract Basics • GSA SmartPay Program Update • GSA SmartPay in More than One Flavor: Innovative Products & Services • Basic Charge Card Payment Reconciliation • Navigating the GSA SmartPay Website

34. Questions Please provide your feedback and thoughts about the current and future program at: www.gsa.gov/gsasmartpay under “GSA SmartPay Program Feedback Form” Contact Us Joline McDonald, joline.mcdonald@gsa.gov Elizabeth Skolnik, elizabeth.skolnik@gsa.gov GSA SmartPay Program Support  Phone: (703) 605-2808  E-mail: gsa_smartpay@gsa.gov www.gsa.gov/gsasmartpay

35. Thank you!

36. APPENDIX - Sample Scenarios

37. What’s wrong with this scenario? Case #1 • A cardholder conspired with a local business owner to make purchases not authorized by the cardholder’s agency. The merchant circumvented the authorization process to allow the cardholder to make purchases for his personal consumption. The cardholder approved the transactions.

38. What’s wrong with this scenario? Case #2 • A business owner approached a cardholder and offered to provide kickbacks to the cardholder if the cardholder made supply purchases from his business. The cardholder was authorized to make purchases of these supplies and the supplies were delivered. The company provided false receipts for the supplies. The cardholder repeatedly made transactions with this company. The company paid cardholder a percentage of sales.

39. What’s wrong with this scenario? Case #3 • A cardholder obtained goods and services for personal use. The ship to address was the employee’s home. A third party did not confirm receipt of the materials. The cardholder advised the merchant to split transactions to ensure they would not exceed the cardholder’s single-purchase limit.