HomeMy WebLinkAbout02/22/2008 - Report: P-Card Audit Report - City Council - Audit Committee
Performance Audit of
The City’s Purchasing Card Program
February, 22 2008
City Internal Auditor’s Office
City of College Station
File#: 02.07
February 22, 2008
Honorable Mayor and Members of the City Council:
The Purchasing Card Audit was conducted in accordance with the fiscal year 2008 audit
plan. In addition, the Association of Certified Fraud Examiners estimates that over 50
percent of the reported cases of occupational frauds in the U.S. are related to the
procurement process. Because approximately 96 percent of all city purchases are
transactions less than $3,000, and a majority of these transactions are made on city
purchasing cards; it was determined that a thorough examination of purchasing card
policies, procedures, processes and practices was warranted.
Background: Over the last six years the City of College Station has used purchasing cards
as an alternative to the city’s existing purchasing processes. In most cases, the purchasing
card has replaced field purchase orders, some reimbursement requests, and other
associated paperwork. An effectively administered purchasing card program offers the
following benefits: (1) reduces invoicing, ordering, and processing costs; (2) enables faster
delivery of goods and services; (3) decreases the need for petty cash; (4) provides staff
with better purchasing flexibility, but with built and variable control mechanisms; (5)
reduces stock holding costs because goods are purchased when needed; and (6) offers
automated reporting tools, which can provide (a) management information on purchases,
(b) cost effective systems to monitor purchasing activity, and (c) audit trail functionality.
Scope and Methodology: For most audit tests, I reviewed transactions from October 2005
to October 2007, which comprised approximately 35,000 transactions for $5,000,000. For
some tests, however, data was not available during this period and I used fiscal year 2007
data or transactions between December 2005 and November 2007. One scope limitation
was caused by the city’s purchasing card vendor, JP Morgan Chase. JP Morgan Chase
maintains the purchasing card management system database. Every month, JP Morgan
Chase purges this database of city purchasing card data over two years old.
TY ELLIOTT
City Internal Auditor
telliott@cstx.gov
CITY INTERNAL AUDITOR’S OFFICE
1101 TEXAS AVENUE
COLLEGE STATION, TEXAS 77842
TEL: (979) 764-6269
FAX: (979) 764-6377
AUDIT COMMITTEE
Mayor Pro Tem Ron Gay, Chair
Councilmember Lynn McIlhaney
Councilmember James Massey
Audit Objectives: The three main objectives of the Purchasing Card Audit are as follows:
1. Are the city’s processes and procedures in alignment with purchasing card best
practices for a “best in class” government purchasing card program?
2. Are purchasing card users in compliance with city purchasing card policies and
procedures?
3. Are the city’s purchasing card internal controls effective?
Audit Results: Based on the results of several audit tests, the risk that employees are using
purchasing cards for their sole benefit is low. In addition, the city’s processes and
procedures were found to be in general alignment with purchasing card best practices.
Most card users are complying with purchasing card policies and procedures. Overall, the
city’s purchasing card internal controls are effective.
Audit Recommendations: The purchasing card program needs a few slight improvements,
encompassed in the ten audit recommendations contained at the end of the audit report.
Implementing these recommendations would strengthen internal controls to further prevent
any inappropriate card use and help ensure the future success of the purchasing card
program. Written responses from the City Manger and Chief Financial Officer are appended
to the report.
Ty Elliott
City Internal Auditor
Purchasing Card Audit
Table of Contents
Introduction................................................................................................................. 1
Purchasing Card Background ................................................................................ 1
Audit Objectives .................................................................................................... 3
Scope and Methodology ........................................................................................ 3
Findings and Analysis.................................................................................................... 5
The City is in General Alignment with P-Card Best Practices .............................. 5
City Management Supports Strong Internal Controls ...................................... 5
Adequate Resources are Committed to the Program ....................................... 6
The City could be More Selective in Issuing Purchasing Cards ........................ 6
Spending Limits should be Commensurate with Needs.................................... 7
Oversight Officials are Typically Appropriately Assigned ................................. 8
The Duties of Some Employees should be Better Segregated.......................... 9
Purchasing Card Training is Mandatory ...........................................................10
The City Takes Advantage of Preventative Controls........................................11
There is a Multi-Faceted, Strategic Approach to Monitoring...........................11
Consequences of Card Misuse is Clearly Communicated.................................12
Use of the Card Solely for Personal Benefit is Not Tolerated ..........................12
Most Card Users are Complying with City Policies..............................................13
Cards are Typically Assigned to Only One Employee .......................................14
The Risk that Unauthorized Persons Use City Cards is Low ............................14
There are no Capital Equipment or Cash Advance Purchases .........................14
The Purchasing Card System Identified all Split Transactions........................15
The Risk that Personal Misuse is Material is Low ............................................15
Improvement could be Made in Timely Account Reconciliation .....................16
A Few Cardholders are not Keeping Cards in a Secure Place ..........................16
The Financial Risk from Incorrect Sales Tax Charges is Low ..........................17
Some Purchases Lacked Adequate Support Documentation...........................17
Purchasing Card Internal Controls are Generally Effective ................................17
The Cardholder Application Process is Adequate.............................................18
The Allowable Number of Purchases Control is Not Activated .......................18
The Card Effectively Prevents Purchases Exceeding $3,000 ..........................19
The Card Blocks Designated Merchant Categories..........................................19
Change Processes for Spending Limits are Adequate .....................................19
Some Transactions are not Being Adequately Approved ................................19
The City’s Process for Canceling Cards is Adequate........................................20
Recommendations....................................................................................................... 21
Appendices
Appendix 1 City Manager’s Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Appendix 2 Chief Financial Officer’s Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Purchasing Card Audit 1
Introduction
The City Internal Auditor conducted this performance audit of the
city’s purchasing card program pursuant to Article III Section 30 of
the College Station City Charter, which outlines the City Internal
Auditor’s primary duties.
A performance audit is an objective, systematic examination of
evidence to assess independently the performance of an organization,
program, activity, or function. The purpose of a performance audit is
to provide information to improve public accountability and facilitate
decision-making. Performance audits encompass a wide variety of
objectives, including those related to assessing program effectiveness
and results; economy and efficiency; internal control; compliance with
legal or other requirements; and objectives related to providing
prospective analyses, guidance, or summary information.
A performance audit of the city’s purchasing processes was included
in the fiscal year 2008 audit plan based on the results of a citywide
risk assessment conducted in October 2007. On October 25, 2007,
the City Council approved the City Internal Auditor’s audit plan.
The Association of Certified Fraud Examiners estimates that over 50
percent of the reported cases of occupational frauds in the U.S. are
related to the procurement process. Additional risks of fraud, waste,
or abuse exist for purchases under $3,000 because the city
delegates purchasing authority to the ordering department.
Because approximately 96 percent of all city purchases are
transactions less than $3,000, and a majority of these transactions
are made on city purchasing cards; it was determined that a thorough
examination of purchasing card policies, procedures, processes and
practices was warranted.
Purchasing Card Background
Purchasing cards are enhanced credit cards used by city employees.
They are similar to a MasterCard or Visa card, but contain more
information that can be used to control purchases such as dollar
limits, number of transactions within a given period or for an
2 Purchasing Card Audit
individual or group, or restrictions based on merchant categories.
Card users are not responsible for paying the bill for their own
purchases. Instead, the city gets one bill a month that includes the
spending of all cards. The city then pays that bill in one lump
payment, usually around $210,000 per month. Purchasing cards
facilitate point-of demand procurement. In other words, the
purchasing authority is delegated to the ordering department enabling
the authorized cardholder to place an order directly with the supplier.
Over the last six years the City of College Station has used purchasing
cards as an alternative to the city’s existing purchasing processes. In
most cases, the purchasing card has replaced field purchase orders,
some reimbursement requests, and other associated paperwork. An
effectively administered purchasing card program offers the following
benefits:
1. reduces invoicing, ordering, and processing costs;
2. enables faster delivery of goods and services;
3. decreases the need for petty cash;
4. provides staff with better purchasing flexibility (e.g. online
ordering), but with built and variable control mechanisms;
5. reduces stock holding costs because goods are purchased
when needed; and
6. offers automated reporting tools, which can provide (a)
management information on purchases, (b) cost effective
systems to monitor purchasing activity, and (c) audit trail
functionality.
There are risks, however, associated with purchasing cards. The
general consensus in acquisition and inspector general communities is
that use of purchasing cards can lead to an increase in fraud and
abuse if proper controls are not implemented and enforced. Lack of
internal controls is by far the most frequently cited factor contributing
to waste, fraud or abuse in purchasing card programs.
Purchasing Card Audit 3
Audit Objectives
This audit addresses purchasing card policies, procedures, processes
and practices. This report answers the following questions:
• Are the city’s purchasing card processes and procedures in
alignment with purchasing card best practices for a “best in class”
government purchasing card program?
• Are card users in compliance with city purchasing card policies
and procedures?
• Are the city’s purchasing card internal controls effective?
Scope and Methodology
This audit was conducted in accordance with government auditing
standards, which are promulgated by the Comptroller General of the
United States. Audit fieldwork was conducted from November 2007
through February 2008.
For most audit tests, transactions from October 2005 to October 2007
were examined. These transactions comprised approximately 35,000
purchases for $5,000,000. For some tests, however, data was not
available during this period. Therefore, fiscal year 2007 data or
transactions between December 2005 and November 2007 were used
to meet some audit sub-objectives. One scope limitation was caused
by the city’s purchasing card vendor, JP Morgan Chase. JP Morgan
Chase maintains the purchasing card management system database.
Every month, JP Morgan Chase purges this database of city
purchasing card data over two years old.
The audit methods included:
• Reviewing the work of auditors in other jurisdictions and
researching professional literature to identify best practices for
administering purchasing card programs.
• Interviewing staff responsible for performing purchasing card
oversight functions.
4 Purchasing Card Audit
• Conducting data analysis using specialized auditing software to
test for purchasing card misuse and system control failings.
• Reviewing purchasing card support documentation, program
coordinator’s procedural manual, the purchasing card policies and
procedures manual, cardholders’ approval/access hierarchy, and
select cardholders’ performance evaluations.
• Observing mandatory cardholder training and the monitoring
functions performed by purchasing card oversight officials.
Purchasing Card Audit 5
Findings and Analysis
The City is in General Alignment with P-Card Best Practices
Successful purchasing card programs typically exhibit the following
characteristics: (1) strong management support of controls, (2)
adequate resources are committed to achieve success, (3) cards are
selectively issued, (4) spending limits are established that are
commensurate with needs, (5) appropriate oversight officials are
identified and their responsibilities are clearly delineated, (6) major
job functions are segregated, (7) training is mandatory, (8) card
administrators take advantage of preventive controls to minimize risk
exposure, (9) monitoring activities are strategically implemented at
various levels throughout the organization, and (10) consequences of
improper behavior is clearly communicated and swift action is taken
when inappropriate use is discovered.
City Management Supports Strong Internal Controls
City management is setting and maintaining the organization’s ethical
tone, providing guidance for proper behavior, and removing
temptations for unethical behavior. However, there is room for
improvement in the area of providing discipline when appropriate.
The ethical tone of the city is effectively communicated. The
city has a comprehensive purchasing card policies and procedures
manual that effectively describes the proper use of the card and the
consequences for improper use. The purchasing card manual is
communicated and distributed to all cardholders during mandatory
purchasing card training. In addition, the city’s ethical standards are
documented in the city’s Stewardship Enhancement Plan, which was
revised and approved by the City Council on March 8, 2007. The
Stewardship Enhancement Plan adequately communicates the city’s
plan for creating a culture of honesty and high ethics, and specifically
addresses the following: setting the city’s ethical tone at the top of
the organization, creating a positive workplace environment, hiring
and promoting appropriate employees, training, and disciplining
employees when appropriate.
6 Purchasing Card Audit
Some department’s performance evaluations do not address
compliance with city policy. The proper use of the purchasing
card should be incorporated as a factor in employees’ performance
evaluations. All but three city department heads said they either
directly or indirectly incorporate the proper use of the card as a factor
in employees’ performance evaluations. However, eight of the city’s
fifteen departments do not have a section on their performance
evaluations that cover compliance with city policies and procedures.
No departments’ evaluations specifically addressed proper use of
purchasing cards—although the Parks and Recreation Department has
a section of their evaluations that deals with compliance with city
purchasing policies. The other department that best demonstrated
alignment with this best practice was the Police Department. The
Police Department evaluates how their employees (1) demonstrate a
working knowledge of policies and procedures, (2) are able to
recognize and apply the intent of the policy, and (3) exhibit
knowledge of duties, policies, procedures, responsibilities, and work
standards related to the job.
Adequate Resources are Committed to the Program
Based on observations of critical oversight duties performed by
Department of Finance personnel, Finance has sufficient staff to
continue to effectively administer the purchasing card program. In
addition, departments are generally devoting sufficient human
resources to effectively perform oversight functions. A best practice
“rule of thumb” is to have approximately ten cardholders per
approving official. Only nine percent of approving officials were
identified that approve purchasing card transactions for more than ten
cardholders, and only one approving official was identified that
approved transactions for more than twenty cardholders.
The City could be More Selective in Issuing Purchasing Cards
The city has an effective approval process established through which
applicants must be reviewed and approved prior to being issued a
purchasing card. However, the number and distribution of
cardholders across city departments is not in conjunction with the
evolving needs and expenditures of the departments.
The city has an effective card issuance process. The city has
an effective approval process established through which applicants
must be reviewed and approved prior to being issued a purchasing
Purchasing Card Audit 7
card. City employees are issued a card after (1) Finance receives a
completed application form signed by both the employee and the
employee’s supervisor, (2) the employee completes mandatory
purchasing card training, and (3) the cardholder signs an agreement
form, signifying they understand and will adhere to all city purchasing
card policies and procedures.
Cards are issued to employees who are not using them. City
departments are requesting purchasing cards for employees that may
not need the card. Approximately 60 percent of the city’s workforce
is issued a purchasing card. There were 26 employees issued cards
prior to the start of fiscal year 2007 that did not make any purchases
during the fiscal year. An additional 38 employees made less than six
transactions for total amounts less than $200 during the fiscal year.
After examining the number and distribution of cardholders across
city departments in conjunction with their evolving needs and
expenditures, the following departments are the most in need of
examining the purchasing card needs of their employees: Police, Fire,
Public Works, Waste Water, Water, Electric, Parks and Recreation,
and the Municipal Court Division of the Department of Finance.
Spending Limits should be Commensurate with Needs
Controls could be strengthened if the city established spending limits
commensurate with needs of cardholders. Both monthly and single
transaction limits were found to be much higher than a large number
of cardholder needs. Establishing different spending limits for each
individual employee would not be administratively cost effective.
However, grouping similar categories of staff together and assigning
these groups of employees pre-established limits that are lower than
the maximum limits would be feasible.
The single transaction limit is higher than a large number of
cardholder needs. From October 2005 to October 2007, there were
approximately 35,000 transactions for $5,000,000 made on city
purchasing cards. Over 97 percent of these transactions were for
items less than $1,000. In addition, 12.6 percent of active
cardholders had a single transaction limit under $3,000; while, 8.4
percent of cardholders made transactions for amounts exceeding
$2,400 and only 3.3 percent had multiple transactions for amounts
exceeding $2,400.
8 Purchasing Card Audit
The monthly spending limit is higher than a large number of
cardholder needs. From October 2005 to October 2007, there were
658 cardholders who made transactions on city purchasing cards.
During this period, there were only 18 employees whose total
transactions for a month exceeded $8,000. There were 40
cardholders who spent more than $5,000 within a month on their city
purchasing card, and only 22 cardholders spent more than $5,000
within a month multiple times during the period reviewed. As of
November 2007, there were only 23 active cards with credit limits
under $10,000.
Oversight Officials are Typically Appropriately Assigned
The city appropriately identifies and assigns employees to be
oversight officials of the purchasing card program. Employees who
approve purchasing card transaction were found to be knowledgeable
in the appropriate use of the card, and the procurement needs of the
organization. In addition, most purchasing card approvers were
found to be sufficiently independent and/or of a sufficient rank to
question the cardholder when additional information is needed about
specific transactions. On the other hand, approving officials were not
always held accountable for performing adequate timely reviews as
part of their job performance.
Overall, appropriate approvers are assigned. Approving officials
are required to attend mandatory training where they are instructed
on the appropriate use of the card. In addition, approving officials
are typically designated based on supervisory hierarchy. Typically,
employees’ supervisors are most knowledgeable to determine
whether purchases made by their employees are aligned with the
purchasing needs of the organization.
Most card approvers are sufficiently independent to question
inappropriate transactions. Active cardholders were examined to
see if they had a higher rank/position than the employees who
approved their purchasing card transactions. In addition, key
department personnel were interviewed and purchasing card
processes were observed to assess the ability of approving officials to
question the cardholder when additional information is needed about
specific transactions. Less than nine percent of approving officials are
not sufficiently independent and/or of sufficient rank to question the
cardholder when additional information is needed about specific
transactions.
Purchasing Card Audit 9
Approving officials who frequently do not perform adequate
timely reviews are not held accountable as part of their job
performance. The city’s policy states that “each Friday, the
previous week’s transactions must be edited, reviewed, and approved
and all invoices/receipts attached to the transaction report must be
forwarded to Accounting.” From December 2005 through November
2007, twelve cardholders were identified that frequently had a
material amount of unapproved purchasing card transactions. The
performance evaluations of these cardholders and their supervisors’
performance evaluations were examined. Based on this examination
of performance evaluations, approving officials do not appear to be
held accountable for performing adequate timely reviews as part of
their job performance in these instances. In addition, eight of the
city’s fifteen departments do not have a section on their performance
evaluations that cover compliance with city policies and procedures.
The Duties of Some Employees should be Better Segregated
The same employee should not perform more than one of the
following job functions: authorization, execution, custody, and
recording. An employee who possesses two or more of these
functions has inadequate segregation of duties. Such a situation can
provide employees with the opportunity to commit fraud.
The responsibilities of some cardholders, approving officials,
and program coordinators overlap. Program coordinators have
the highest level of access to the city’s purchasing card systems in
order to setup new cardholders, maintain the city’s purchasing
records, and assign access and monitoring controls to approving
officials. Five city employees were identified as program coordinators.
All five of these employees are also cardholders. In addition, two of
these employees are approving officials to other cardholders. Two
program coordinators are approving officials to other program
coordinators.
A few cardholders approve their supervisors’ purchases.
All current cardholders (as of November 8, 2007) were examined and
less than seven percent of approving officials approve purchasing
card transactions for their supervisors.
No cardholders are approving officials for their own card.
According to Department of Finance personnel, the purchasing card
system prevents cardholders from approving their own transactions.
10 Purchasing Card Audit
All current cardholders (as of November 8, 2007) were examined, and
no cardholder was identified that approves purchasing card
transactions for their own card.
Purchasing Card Training is Mandatory
Cardholders are trained on the applicable procurement regulations,
appropriation issues, and reconciliation of monthly purchasing card
statements. In addition, approving officials are trained on appropriate
review of cardholder purchases and reconciliations, and appropriate
use of oversight tools available to them. Verification of understanding
of purchasing card training is required prior to a cardholder being
issued the card and cardholders are provided with information at the
conclusion of training to remind them about appropriate use of the
card.
Cardholders are required to attend training. Cardholders are
required to attend training on the appropriate use of the purchasing
card prior to being issued a card. Based on observations of this
training, cardholders receive adequate instruction on the applicable
procurement regulations and appropriation issues. However, there
could have been more thorough training regarding the proper
reconciliation of monthly purchasing card statements.
Approving officials are required to attend training. Approving
officials are trained on appropriate review of cardholder purchases
and reconciliations, and appropriate use of oversight tools available to
them. In addition, approving officials are provided with the following
during mandatory cardholder training (1) the purchasing card policies
and procedures manual and (2) training materials instructing them on
how to use the city’s purchasing card system in order to perform their
required oversight duties.
Cardholders must verify that they understand the city’s
policies. Based on observations of mandatory cardholder training
and review of the city’s purchasing card policies and procedures
manual, employees are required to verify understanding of purchasing
card training prior to being issued a card by signing a cardholder
agreement form. In addition, cardholders are provided with a copy of
the purchasing card policies and procedures manual during
mandatory training to provide them with a reminder about the
appropriate use of the card.
Purchasing Card Audit 11
The City Takes Advantage of Preventative Controls
The city’s purchasing cards preemptively block purchases from vendor
categories not reasonably related to city purchasing needs. In
addition, the purchasing card management system contains an alert
system that monitors the database for pre-established conditions
which may indicate potential abuse by cardholders. However, the
purchasing card management system has additional control features
the city could utilize. For example, the cards could block additional
vendor categories or transactions could be instantaneously approved
or declined based on the number of transactions allowed per day or
per month.
The card blocks purchases from non-business related vendor
categories. There are six vendor categories the city’s purchasing
card preemptively blocks, and these categories were determined to be
not reasonably related to city purchasing needs. In comparison,
however, there are 282 vendor categories. There are 75 vendor
categories that the Federal Government’s purchasing card program
states “may be subject to further investigation” if a purchase is made
from a vendor in the category.
The card contains an alert system for split transactions. The
city purchasing card policy states that the card is not to be used for
multiple, sequential purchases of less than $3,000 from a single
vendor for similar purchases adding up to more than $3,000. The
purchasing card management system contains an alert system that
monitors the database for instances when employees split
transactions to avoid the $3,000 purchasing threshold. The
Department of Finance receives these alerts and notifies departments
when an employee from their department has violated this city policy.
There is a Multi-Faceted, Strategic Approach to Monitoring
Overall, the city has established a multi-faceted, strategic approach to
monitoring and oversight. However, there are additional automated
reporting tools available through the purchasing card system that
could be utilized by program coordinators in the Department of
Finance and approving officials throughout city.
Automated reporting tools are being used at various levels
throughout the city. Automated reporting tools are being
strategically used by program coordinators in the Department of
12 Purchasing Card Audit
Finance to monitor purchasing card use. In addition, Fire, Police, and
Utilities employ purchasing card administrators who centrally conduct
adequate oversight of cardholders within their respective
organizations through the use of automated statements and tools. All
approving officials throughout the city receive training instructing
them on how to use the city’s purchasing card system to perform
transaction reconciliation and approval.
Additional automated reporting tools could be utilized.
Program coordinators in the Department of Finance are aware of all
the reporting tools that are available to them, but are not using some
of these tools. Other oversight officials at the department level are
trained on how to use transaction related reporting and monitoring
tools. However, other automated reporting tools available through
the purchasing card system include: spending analysis reporting,
merchant information reporting, and travel and expense reporting.
There are also several administrative tools available to program
coordinators that are currently not being used such as the declined
transaction report or the transaction audit report.
Consequences of Card Misuse is Clearly Communicated
The city has a comprehensive purchasing card policies and
procedures manual that effectively describes the proper use of the
card and the consequences for improper use. The purchasing card
manual is communicated and distributed to all cardholders during
mandatory purchasing card training. During this training,
consequences for both personal and administrative misuse of the
purchasing card are clearly communicated. Cardholders are also
required to sign an agreement form to signify that they understand
the city’s purchasing card policy and the consequences for not
complying with the policy.
Use of the Card Solely for Personal Benefit is Not Tolerated
If purchasing cards are used to intentionally make purchases for the
sole benefit of the employee, the city takes swift action to discipline,
terminate employment and/or indict the employee for theft of city
funds. However, approving officials and cardholders are not
consistently held accountable across city departments for
administrative misuse of the card, which could include: lack of proper
and timely reconciliations, non submittal of receipts or other support
documentation, or inadequate timely review and approval of
Purchasing Card Audit 13
cardholder transactions. There was also an instance where action
was not taken when a Parks and Recreation employee intentionally
split a transaction to avoid the $3,000 purchasing threshold. The
Department of Finance caught this violation of purchasing card policy
and notified the employee’s supervisor. This employee received a
fully successful rating for compliance with purchasing procedures in
the year this violation occurred. Another Parks and Recreation
employee lost his purchasing card four times in under a year and
received an exceeding expectations rating for compliance with
purchasing procedures during the period he lost the cards.
Most Card Users are Complying with City Policies
The city’s purchasing card policies and procedures were examined
and determined to be reasonable. Therefore, several audit tests were
conducted to test cardholders’ compliance with these policies and
procedures. These audit tests were designed to answer the following
questions:
1. Is each purchasing card issued to only one employee?
2. Are purchasing cards assigned, transferred, or loaned to any
unauthorized person; or used by suspended or terminated
employees?
3. Are purchasing cards used for any of the following purchases:
(1) alcoholic beverages, (2) capital equipment, or (3) cash
advances/travelers checks?
4. Are purchasing cards used for multiple, sequential purchases
of less than $3,000 from a single vendor for similar purchases
adding up to more than $3,000?
5. Are purchasing cards used to make purchases for the sole
benefit of the employee?
6. Are individual cardholder accounts properly and timely
reconciled?
7. Are purchasing cards signed and kept in a secure place?
8. Do cardholders inform the vendor of the city’s tax
identification number to take advantage of the city’s tax-
exempt status?
9. Is adequate documentation maintained to support the
legitimate business purpose of all transactions made with the
purchasing card?
14 Purchasing Card Audit
Cards are Typically Assigned to Only One Employee
City policy states that purchasing cards are to be assigned to only one
employee. There are, however, a few exceptions to this rule.
There is a risk that employees who transfer from one
department to another can receive multiple cards. One
wastewater employee was identified as having two active purchasing
card accounts. In December 2007, the City Internal Auditor notified
the Department of Finance of this instance and one of the employee’s
accounts was immediately cancelled. The employee originally
received a card when he was hired as a public works employee.
When he transferred to the Utilities Department he received an
additional card upon the request of his new supervisor.
The processes for accounting for unassigned purchasing
cards are adequate. The Police and Fire departments have
unassigned purchasing cards that are issued to employees for training
and travel purposes. As of December 2007, there are eleven
unassigned police or fire purchasing cards. The processes for
administering these unassigned cards were examined, and internal
controls over the use of these cards were determined to be effective.
The Risk that Unauthorized Persons Use City Cards is Low
The Department of Finance has an effective process of assigning
cards to only authorized employees. In addition, Finance reviews
purchasing card transactions and support documentation to detect if
any cards have been transferred or loaned to any unauthorized
person. The city also has a sufficient process to ensure that
purchasing cards are not used by terminated employees. To reach
this audit conclusion, purchasing card monitoring activities performed
by purchasing card program coordinators in the Department of
Finance were observed, and the program coordinator’s procedure
manual was reviewed.
There are no Capital Equipment or Cash Advance Purchases
Cardholders are not making purchases on their cards for capital
equipment or cash advances/travelers checks. However, support
documentation is inadequate to determine if alcoholic beverage
purchases are made on purchasing cards.
Cardholders are not making capital equipment or cash
advance/travelers checks purchases on city cards. A purchase
Purchasing Card Audit 15
is classified as capital equipment when the item purchased exceeds
$5,000 and has a useful life of three or more years. Approximately
35,000 transactions for $5,000,000 from October 2005 to October
2007 were reviewed. During this period, there were no transactions
made with purchasing cards that meet the criteria for capital
equipment. In addition, there were no purchases made during this
period for cash advances or travelers checks.
No alcohol purchases were found, but a definitive
determination could not be made because of inadequate
documentation. A judgment sample of 30 restaurant transactions
was examined. No evidence of alcoholic beverage purchases was
found. However, over half of the transactions reviewed did not have
adequate documentation to determine if alcoholic beverages were
purchased on city purchasing cards.
The Purchasing Card System Identified all Split Transactions
The purchasing card management system monitors the database for
instances when cardholders make multiple purchases on the same
date with the same vendor that add up to over $3,000. When these
types of transactions occur, the system sends an automated alert to
program coordinators in the Department of Finance, and they notify
cardholders’ supervisors of the violation of city policy. There is a risk,
however, that cardholders could circumvent this system by asking
vendors to split transactions on different dates. Therefore,
approximately 35,000 transactions for $5,000,000 from October 2005
to October 2007 were reviewed to identify all instances when
employees split transactions to avoid the $3,000 purchasing
threshold. This review verified that the purchasing card management
system identified all cardholders who split transactions.
The Risk that Personal Misuse is Material is Low
Although there may be a small number of purchasing card
transactions made by city employees for non-business related
purposes, the risk that the amount of inappropriate transactions is
material is low. Audit tests were designed to identify all purchasing
card transactions during the most recent two year period that met the
following criteria: (1) purchases from vendor categories the Federal
Government’s purchasing card program restricts, and/or (2)
purchases that were unapproved by cardholders’ supervisors, and/or
(3) purchases made when cardholders took some type of leave. The
16 Purchasing Card Audit
audit tests included approximately $5,000,000 in transactions. Based
on these tests, 258 transactions for $51,000 were identified as the
highest risk of purchases made for the sole benefit of the employee.
Support documentation maintained in the Department of Finance for
these 258 transactions was thoroughly examined, and 184 of these
transactions were verified as legitimate business use purchases.
Adequate documentation was not submitted to Finance to make a
determination for the remaining 74 transactions. However, the
amount of these 74 transactions made up less than 0.2 percent of the
total transaction amount during the period reviewed.
Improvement could be Made in Timely Account Reconciliation
Although there may be some cardholders that are not properly and
timely reconciling their individual accounts, the Department of
Finance has procedures in place to encourage compliance with this
policy. In addition, evidence was found that cardholders are
reconciling their accounts. For example, documented instances of
cardholders disputing purchasing card charges were found. Also,
approximately 98 percent of receipts are being submitted to Finance.
However, a greater percentage of receipts (approximately 6.5
percent) are not submitted in a timely fashion. During mandatory
purchasing card training, cardholders are not specifically instructed on
how they should be reconciling their purchasing card transactions.
Cardholder training could be improved to ensure better compliance
with this policy.
A Few Cardholders are not Keeping Cards in a Secure Place
A small percentage of cardholders are not keeping purchasing cards
in a secure location. Cardholders are required to attend training
where they are instructed to sign and keep cards in a secure place.
In addition, police and fire unassigned purchasing cards were
observed to be signed and kept in a secure location. The Utilities
Department centrally secures purchasing cards of employees who
infrequently use the card. These utilities employees’ cards were all
signed and kept in a secure place. On the other hand, during the six
year period the purchasing card program has been in place,
approximately ten percent of employees issued a card have lost them
at least once. Approximately two percent of current cardholders have
lost purchasing cards multiple times.
Purchasing Card Audit 17
The Financial Risk from Incorrect Sales Tax Charges is Low
Although there is a small number of purchasing card transactions
where cardholders do not inform the vendor of the city’s tax
identification number to take advantage of the city’s tax exempt
status, the risk that the amount is material is low. A judgment
sample of 252 transactions for $50,000 was taken from a population
of approximately $5,000,000 in transactions over a two year period.
The purchasing card support documentation for these 252
transactions maintained by the Department of Finance was examined.
Sales tax charges were incorrectly applied in 17 out of the 252
transactions (6.75 percent). The city would have saved
approximately $300 if sales tax was not charged in these 17
instances. Cardholders are sufficiently instructed during mandatory
cardholder training on appropriate procedures in order to not be
incorrectly charged for sales tax.
Some Purchases Lacked Adequate Support Documentation
In fiscal year 2007, approximately 98 percent of purchasing card
transactions had invoices, receipts, or other support documentation
that was submitted to the Department of Finance. The Department
of Finance also has specific policies and procedures in place to
encourage cardholders to maintain adequate documentation to
support the legitimate business purpose of all transactions made with
the purchasing card. However, not all cardholders are submitting the
required documentation to Finance. From October 2005 to October
2007, there were approximately 35,000 purchasing card transactions.
During this period, a judgment sample of 209 transactions was taken
and support documentation maintained by Finance for these
transactions was examined. Of the 209 transactions reviewed, 108
did not have itemized receipts. During fiscal year 2007, there were
also 111 transactions for approximately $9,500 where a required
travel form or taxable/nontaxable form was not submitted to Finance.
Purchasing Card Internal Controls are Generally Effective
The city’s internal controls over purchasing cards were examined and
audit tests were conducted to determine the effectiveness of these
controls. These audit tests were designed to answer the following
questions:
18 Purchasing Card Audit
1. Does the Department of Finance have record of all cardholder
application forms and are these forms signed by both the
cardholder and the cardholder’s supervisor?
2. Are all transactions approved or declined instantaneously
based on the number of transactions allowed per day or per
month?
3. Are all transactions approved or declined instantaneously
based on the single purchase limit not to exceed $3,000?
4. Are all transactions declined instantaneously based on the
following unapproved merchant categories: wire
transfer/money orders; furriers & fur shops; jewelry stores,
watches, clocks, & silverware stores; dating & escort services;
watch, clock & jewelry repair; or lottery tickets, casino gaming
chips, off-track betting and wagers?
5. Are there any employees who had monthly spending limits
that exceed $10,000? If so, does Finance have documentation
of department directors’ written authorizations to change a
cardholder’s credit limit?
6. Are all transactions being edited, reviewed, and approved?
7. Does the Department of Finance have (1) a process for
identifying lost or stolen purchasing cards and promptly
canceling the card and (2) a record of all cancelled purchasing
card documentation?
The Cardholder Application Process is Adequate
All current cardholders’ application forms and agreement forms were
reviewed to ensure that the forms were complete and signed by both
cardholders and the cardholders’ supervisors. Out of the 530
cardholders, only six exceptions were found: four cardholder
agreement forms were missing, one application form was missing,
and one application form was not signed by a cardholder’s supervisor.
Therefore, approximately 99 percent of cardholder application and
agreement forms were complete and signed by cardholders and their
supervisors.
The Allowable Number of Purchases Control is Not Activated
The city’s purchasing card policy and procedures manual states that
all transactions are approved or declined instantaneously based on a
specified number of transactions allowed per day and a specified
number of transactions allowed per month. However, the purchasing
card management system currently does not control transactions
based on this criteria. The Department of Finance should either
Purchasing Card Audit 19
implement this control or remove the statement from the policies and
procedures manual.
The Card Effectively Prevents Purchases Exceeding $3,000
According to the city purchasing card policy, transactions are
approved or declined instantaneously base on the single purchase
limit not to exceed $3,000. Audit tests were conducted to identify
any transaction made from October 2005 to October 2007
(approximately 35,000 transactions) that exceeded $3,000. No single
transaction within the period exceeded $3,000.
The Card Blocks Designated Merchant Categories
From October 2005 to October 2007, there were approximately
35,000 transactions for $5,000,000 made on city purchasing cards.
Audit tests were designed to identify purchases made during this
period to vendors from the following merchant categories: (1) wire
transfer/money orders; (2) furriers and fur shops; (3) jewelry stores,
watches, clocks, and silverware stores; (4) dating and escort services;
(5) watch, clock and jewelry repair; or (6) lottery tickets, casino
gaming chips, off-track betting and wagers. No purchasing card
transactions were identified that were made in any of these
categories.
Change Processes for Spending Limits are Adequate
As of December 2007, there are no current cardholders who have
monthly spending limits that exceed $10,000. However, there have
been instances where cardholders’ monthly credit limits were
temporarily increased based on need and the approval of their
department directors. Documentation of department directors’
written authorizations to change a cardholder’s credit limit was
reviewed and determined to be sufficient evidence to conclude that
Finance has an adequate process to ensure credit limits are not
inappropriately changed.
Some Transactions are not Being Adequately Approved
The official record of approval is contained in the city’s purchasing
card management system (i.e. PaymentNet). The city’s policy
requires cardholders to review their transactions and cardholders’
supervisors to approve these transactions and record their reviews
and approvals respectively in the PaymentNet system. Adherence to
this policy requirement is an effective internal control for the following
reasons: (1) supervisory approval is the best preventative control
against purchasing card misuse because supervisors are the most
20 Purchasing Card Audit
knowledgeable in the purchasing needs of the organization, (2) the
system’s security control allows only authorized approving officials to
approve cardholder transactions, and (3) centralized data
management systems allows for efficient and reliable monitoring of
cardholder transactions, which enables program coordinators to
quickly identify the cardholder accounts that are not being timely
reviewed and approved.
Between December 1, 2005 and November 30, 2007 there were
approximately 36,000 purchasing card transactions for $5,200,000.
During this period, there were 2,110 unapproved transactions for
approximately $342,000. There were eleven out of eighteen city
departments whose amount of unapproved purchasing card
transactions exceeded five percent of their total transaction amount—
and three departments whose amount of unapproved transactions
exceeded 28 percent.
The City’s Process for Canceling Cards is Adequate
Cardholders are notifying the Department of Finance when their cards
are lost or stolen and the Department of Finance is promptly
canceling these cards. New cards are issued to employees provided
that (1) the employee has the approval of their supervisor and (2) the
employee submits a signed cardholder agreement form to the
Department of Finance. The Department of Finance also has record
of all cancelled purchasing card documentation through PaymentNet’s
Cardholder Status Report.
Purchasing Card Audit 21
Recommendations
The purchasing card program needs a few slight improvements,
encompassed in the following audit recommendations. Implementing
these recommendations would strengthen internal controls to further
prevent any inappropriate card use and help ensure the future
success of the purchasing card program.
1. The City Manager should issue a directive that every city
performance evaluation has a section dealing with compliance
with city policy. In addition, employees who conduct performance
evaluations should be instructed to (1) incorporate the proper use
of the card as a factor in the evaluation and (2) hold approving
officials accountable for performing adequate timely reviews as
part of the evaluation.
2. Purchasing card spending limits should be established that are
commensurate with the needs of the cardholder. The City
Manager should direct departments to adjust their cardholders’
monthly and single transaction limits based on an evaluation of
cardholders’ needs. One way this could be accomplished is to use
the automated reporting tools available in the PaymentNet system
to perform a spending analysis. The spending analysis may reveal
that cardholders’ of similar position have comparable spending
needs that require no more than a certain purchasing card
threshold.
3. The City Manager should direct department directors to evaluate
whether or not all the employees who are issued a card, within
their respective departments, need a purchasing card to better
perform their essential job duties.
4. The Chief Financial Officer should work with department directors
to ensure that (1) there are no cardholders who are approving
officials for their supervisors and (2) all approving officials are
sufficiently independent and of a sufficient rank to question the
cardholder when additional information is needed about specific
transactions.
5. The Chief Financial Officers should correct situations where the
responsibilities of cardholders, approving officials, and program
coordinators overlap.
22 Purchasing Card Audit
6. The purchasing card currently preemptively blocks purchases from
six vendor categories not reasonably related to city purchasing
needs. The Chief Financial Officer should consider additional
vendor categories the purchasing card could block in order to
further take advantage of preventive controls and minimize the
city’s risk exposure.
7. The Chief Financial Officer should implement procedures for
purchasing card coordinators to prevent multiple purchasing cards
from being issued to an employee who transfers from one
department to another. For example, prior to issuing a card, the
program coordinator could query the PaymentNet system for a
card applicant to see if the employee has already been issued a
card.
8. Because transactions are not approved or declined
instantaneously based on the number of transactions allowed per
day or per month, the Chief Financial Officer should remove this
statement from the purchasing card policies and procedures
manual.
9. The Chief Financial Officer should improve mandatory purchasing
card training in the following ways: (1) instruct cardholders on
how they should be properly and timely reconciling their
purchasing card accounts, (2) stress the importance of keeping
purchasing cards signed and in a secure place, (3) present
examples of the proper types of documentation necessary to
support the legitimate business purpose of purchasing card
transactions, and (4) explain the rationale for the necessity of
timely review and approval of transactions.
10. The Chief Financial Officer should consider using additional
automated monitoring tools available, such as the declined
transaction report or the transaction audit report. The Chief
Financial Officer should also consider instructing approving
officials to use additional automated tools at various levels
throughout the city.
Purchasing Card Audit 23
APPENDIX 1
AUDIT RESPONSE – CITY MANAGER’S OFFICE
To: Ty Elliot, Internal Auditor
From: Glenn Brown, City Manager
Date: February 22, 2008
Subject: Responses to Draft Audit Report – Purchasing Card Policies
Following are the recommendations accompanied by management’s response:
1. The City Manager should issue a directive that every city performance evaluation has a section dealing
with compliance with city policy. In addition, employees who conduct performance evaluations
should be instructed to (1) incorporate the proper use of the card as a factor in the evaluation and (2)
hold approving officials accountable for performing adequate timely reviews as part of the evaluation.
Management Response: The City Manager concurs with this recommendation. Employees should
already understand that being in compliance with City policy is required of employment. But to ensure this
is happening, staff will be directed to include compliance with city policies as a part of annual employee
evaluations.
2. Purchasing card spending limits should be established that are commensurate with the needs of the
cardholder. The City Manager should direct departments to adjust their cardholders’ monthly and
single transaction limits based on an evaluation of cardholders’ needs. One way this could be
accomplished is to use the automated reporting tools available in the PaymentNet system to perform a
spending analysis. The spending analysis may reveal that cardholders’ of similar position have
comparable spending needs that require no more than a certain purchasing card threshold.
Management Response: The City Manager concurs with this recommendation, and would like to review
the spending analysis to be performed. If different spending limits were used, the goal would be to group
similar categories of staff together. It would not be feasible for each employee to have a different limit.
3. The City Manager should direct department directors to evaluate whether or not all the employees who
are issued a card, within their respective departments, need a purchasing card to better perform their
essential job duties.
Management Response: The City Manager concurs with this recommendation. Please provide a list of
employee purchasing card usage which will be provided to department directors to determine if employees
need a purchasing card to perform essential job duties.
24 Purchasing Card Audit
Purchasing Card Audit 25
APPENDIX 2
AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES
the heart of the Research Valley
To: Ty Elliott, City Internal Auditor
Through: Glenn Brown, City Manager
From: Jeff Kersten, Chief Financial Officer
Date: February 21, 2008
Subject: Purchasing Card Audit Report - Fiscal Services Response
Attached is the Fiscal Services Department response to the Purchasing Card Audit Report. Each of
the seven recommendations addressed to the Chief Financial Officer includes a response on how the
recommendation will be addressed.
Please let me know if any additional information is needed.
cc: Cheryl Turney, Assistant Director Fiscal Services
Janet Dudding, Assistant Director Fiscal Services
PO Box 9960
1101 Texas Avenue
College Station, TX 77842
www.cstx.gov
26 Purchasing Card Audit
APPENDIX 2 (continued)
AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES
Procurement Card Internal Audit
Internal Audit Recommendations and Fiscal Services Response:
Responses to Recommendations 1-3 are being prepared by the City Manager.
4. Recommendation: The Chief Financial Officer should work with department directors to
ensure that (1) there are no cardholders who are approving officials for their supervisors and
(2) all approving officials are sufficiently independent and of a sufficient rank to question the
cardholder when additional information is needed about specific transactions.
Response: Management concurs and will establish internal controls that ensure that (1)
there are no cardholders who are approving officials for their supervisors and (2) all
approving officials are sufficiently independent and of a sufficient rank to question
transactions.
5. Recommendation: The Chief Financial Officer should correct situations where the
responsibilities of cardholders, approving officials, and program coordinators overlap.
Response: Management concurs, and will review and establish internal controls that
prevent a program administrator (coordinator) from also approving subordinate program
administrator transactions. A program administrator is restricted from approving their own
transactions. Management will review current internal controls and consider revisions to
address the recommendation.
6. Recommendation: The purchasing card currently preemptively blocks purchases from six
vendor categories not reasonably related to city purchasing needs. The Chief Financial
Officer should consider additional vendor categories the purchasing card could block in order
to further take advantage of preventive controls and minimize the city’s risk exposure.
Response: Management concurs and will investigate other Merchant Category Code
restrictions that could be put on all cards in order to further take advantage of preventative
controls and minimize the City's risk exposure. Management will consider whether restricting
certain cards use solely for travel and training would help restrict the number of general
procurement cards outstanding.
7. Recommendation: The Chief Financial Officer should implement procedures for purchasing
card coordinators to prevent multiple purchasing cards from being issued to an employee
who transfers from one department to another. For example, prior to issuing a card, the
program coordinator could query the PaymentNet system for a card applicant to see if the
employee has already been issued a card.
PO Box 9960
1101 Texas Avenue
College Station, TX 77842
www.cstx.gov
Purchasing Card Audit 27
APPENDIX 2 (continued)
AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES
Response: Management concurs. Issuing administrators will confirm there are no duplicate
entries/cardholder prior to issuing a new card beginning immediately.
8. Recommendation: Because transactions are not approved or declined instantaneously
based on the number of transactions allowed per day or per month, the Chief Financial
Officer should remove this statement from the purchasing card policies and procedures
manual.
Response: Management concurs that the policy should be revised. The procurement policy
will be reviewed to determine what changes, if any, should be made to ensure appropriate
controls are in place regarding purchasing card transactions. Any revised policy will then be
communicated to the organization and implemented.
9. Recommendation: The Chief Financial Officer should improve mandatory purchasing card
training in the following ways: (1) instruct cardholders on how they should be properly and
timely reconciling their purchasing card accounts, (2) stress the importance of keeping
purchasing cards signed and in a secure place, (3) present examples of the proper types of
documentation necessary to support the legitimate business purpose of purchasing card
transactions, and (4) explain the rationale for the necessity of timely review and approval of
transactions.
Response: Management concurs and will develop and implement enhanced purchasing
card training for card holders covering all aspects of the purchasing card program including
reconciliation and documentation, and ramifications of non compliance with established
policy. These ramifications could include canceling individual cards for non-compliance,
and/or securing personal repayment of purchases not in full compliance with policy.
10. Recommendation: The Chief Financial Officer should consider using additional automated
monitoring tools available such as the declined transaction report or the transaction audit
report. The Chief Financial Officer should also consider instructing approving officials to use
additional automated tools at various levels throughout the city.
Response: Management concurs and will enhance staff training on the automated oversight
tools available.
PO Box 9960
1101 Texas Avenue
College Station, TX 77842
www.cstx.gov