What a government credit card audit actually examines
A government credit card audit is a formal review of how federal, state, or local agencies use corporate credit cards issued to employees. Auditors examine transaction records, receipts, and cardholder policies to verify that spending follows the law, agency rules, and the terms of the card agreement. The audit does not determine whether individual purchases were wise — it determines whether they were allowed.
The Department of Defense, General Services Administration, and Office of Inspector General conduct audits at the federal level. State auditors and local finance departments run similar reviews for their agencies. An audit typically covers a sample of transactions over a set period, often one to three years, rather than every single purchase.
Audits produce public reports that name spending patterns, missing receipts, policy violations, and the dollar amounts involved. These reports are often available through the agency's website, the state auditor's office, or federal databases like USAspending.gov. The goal is transparency: taxpayers and elected officials can see how public money moved through the system.
Key Takeaways
- Government credit card audits review whether spending followed law and agency policy, not whether purchases were the best use of money.
- Auditors look for missing receipts, personal expenses mixed with business expenses, and violations of card limits or approval chains.
- Audit reports are public documents available through agency websites, state auditor offices, or federal spending databases.
- Common violations include purchases without proper documentation, spending above cardholder limits, and failure to reconcile statements monthly.
- Agencies must respond to audit findings and often implement new controls, training, or policy changes to prevent repeat violations.
What auditors actually look for in the transaction records
Auditors start with the card statement itself: the date, merchant, amount, and category code for each transaction. They then match each transaction to a receipt or invoice to confirm the purchase actually happened and the amount is correct. Missing receipts are a common finding — federal policy requires receipts for most purchases, and their absence is flagged as a control weakness even if the transaction itself was legitimate.
Next, auditors check whether the purchase fits the cardholder's job and the agency's mission. A state transportation department buying office supplies is routine; a state transportation department buying airline tickets to Hawaii for a conference that was held in Ohio is not. Auditors also verify that the cardholder had authority to make the purchase — some cards have limits, and some purchase categories require pre-approval from a supervisor.
Personal expenses are a major audit focus. Meals, lodging, and entertainment must meet specific rules: they must be for official business, not personal use, and often must stay under per-diem limits set by the General Services Administration or the agency itself. A meal during a work trip is allowed; a meal for the cardholder's family is not. Auditors look for patterns — multiple small purchases at the same merchant on the same day, or recurring charges that suggest a personal subscription rather than a one-time business expense.
How missing documentation and policy violations show up in audit reports
When an auditor cannot find a receipt or cannot verify that a purchase followed policy, the transaction becomes a "questioned cost." This does not mean the money was stolen or the purchase was fraudulent — it means the auditor cannot confirm it was allowed. The report lists the questioned cost, the reason it was questioned, and the dollar amount. If the agency later provides the missing receipt or proof of approval, the cost may be cleared; if not, it stays in the report as a control weakness.
Policy violations appear as separate findings. Common ones include cardholders who did not reconcile their statements each month, supervisors who did not review transactions promptly, and purchases that exceeded the cardholder's single-transaction limit. Some agencies require pre-approval for purchases over a certain amount; if a cardholder bought something for $5,000 without that approval, the audit flags it even if the purchase itself was legitimate and the receipt was present.
Auditors also look for segregation of duties — the principle that one person should not both approve and execute a transaction. If a cardholder approved their own purchases without a supervisor review, or if a card administrator issued cards without a manager's sign-off, the audit notes this as a systemic control gap rather than a single transaction problem.
Where to find published audit reports and what the numbers mean
Federal agency audits are posted on USAspending.gov, which aggregates spending data from all federal agencies. You can search by agency name and filter by transaction type. The Office of Inspector General for each major agency (Defense, Veterans Affairs, Health and Human Services, and others) publishes separate audit reports on their own websites, often in a section labeled "Audits" or "Reports."
State-level audits are usually available through the state auditor's office website. Search for your state plus "auditor" and look for a reports section. Local government audits may be posted by the city or county finance department, or by a state auditor if the state conducts local audits. Some are also filed with the state legislature and available through the legislative library.
When you read an audit report, the dollar amounts matter but require context. A report might say "questioned costs totaled $47,000" — this does not mean $47,000 was stolen. It means the auditor could not verify $47,000 in transactions against receipts or policy. Some of that money may be recovered once documentation is provided. The report should also state how many transactions were tested (often a sample of 50 to 100 out of thousands) so you can understand the scope of the review.
Why agencies respond to audit findings with new controls and training
After an audit is published, the agency must respond. Federal agencies submit a corrective action plan to the Office of Inspector General or the auditing body. This plan describes what went wrong, why it happened, and what the agency will do to prevent it in the future. Common responses include mandatory training for all cardholders, new approval workflows, stricter receipt requirements, or changes to the card program itself (such as lowering limits or restricting certain merchant categories).
Agencies often implement system changes: requiring electronic receipts, automating the reconciliation process, or adding a second approval step for purchases above a threshold. Some agencies suspend card programs temporarily while they retrain staff. Others hire additional finance staff to review transactions more closely.
The corrective action plan is also public. You can see what the agency committed to do and, in follow-up audits, whether they actually did it. If the same violation appears in the next audit, it signals that the agency's response did not work or was not enforced.
Common violations that appear across multiple agencies
Certain violations repeat across government. Missing receipts are nearly universal — agencies struggle to enforce the requirement that cardholders keep documentation. Personal expenses mixed with business expenses also appear frequently, often because the line between them is unclear to cardholders or because supervisors do not review statements carefully enough.
Failure to reconcile monthly is another pattern. Cardholders are supposed to match their card statement to their agency's accounting system each month, but many do not do this until an audit forces them to. This delay makes it harder to catch errors or fraud early. Audits also regularly find purchases that exceed cardholder limits or that were made without required pre-approval, suggesting that the approval process itself is not working or is not being followed.
Travel and meal expenses are a frequent audit focus because the rules are complex and the opportunities for error are high. Per-diem rates vary by location and by agency, and cardholders often do not know the correct rate for a given trip. Auditors also find entertainment expenses that do not meet the "business purpose" test — meals or events that were not clearly tied to official business.
How audit findings affect future card policies and cardholder behavior
Audit reports influence policy in two ways: directly, through the corrective action plan, and indirectly, through public pressure. When a major audit finds widespread violations, elected officials and the media often demand action. This pressure can lead to stricter rules, higher training requirements, or even suspension of the card program for certain employee groups.
Cardholders also change behavior when they know audits are coming. Some agencies see a drop in questioned costs in the year after an audit is published, suggesting that cardholders become more careful about documentation and approval. However, this effect often fades over time if the agency does not maintain the training and oversight.
Audits also inform how agencies design new card programs. If an audit finds that a particular merchant category (such as online retail) has high violation rates, the agency may restrict that category or require additional approval. If audits show that certain job titles (such as field staff) have more violations, the agency may provide targeted training to those groups.
Frequently Asked Questions
What is the difference between a questioned cost and a disallowed cost?
A questioned cost is a transaction the auditor cannot verify against receipts or policy — the documentation is missing or unclear. A disallowed cost is a transaction the auditor has determined violated policy or law. Questioned costs may become disallowed if the agency cannot later provide proof they were allowed. Disallowed costs must be repaid or the agency must appeal the finding.
Can I see which specific employee made a questioned purchase?
Audit reports typically do not name individual cardholders. They report findings by agency, department, or card program. However, if you submit a Freedom of Information Act request, you may be able to obtain more detailed transaction records, though agencies often redact employee names to protect privacy.
What happens if an agency ignores an audit finding?
The auditing body (usually an Office of Inspector General) can escalate the issue to the agency head, the legislature, or law enforcement. Repeated failure to address audit findings can result in restrictions on the card program, loss of funding, or criminal investigation if fraud is suspected. Auditors also track whether corrective actions were actually implemented in follow-up audits.
Are government credit card audits the same at the federal, state, and local level?
The basic process is similar — auditors review transactions, check for receipts, and verify compliance with policy. However, the rules, limits, and approval processes vary by level and by agency. Federal agencies follow GSA rules; states and localities set their own policies. Audit frequency and scope also vary — some agencies are audited annually, others every few years.
How often do audits find fraud versus honest mistakes?
Most audit findings are honest mistakes or control gaps, not fraud. Missing receipts, unclear business purpose, and failure to follow approval steps are common but usually unintentional. Audits are designed to catch these gaps and prevent them. Actual fraud — intentional misuse of a card for personal gain — is less common but does occur and is typically referred to law enforcement.