Loading...
02/22/2008 - Report: P-Card Audit Report - City Council - Audit Committee Performance Audit of The City’s Purchasing Card Program February, 22 2008 City Internal Auditor’s Office City of College Station File#: 02.07 February 22, 2008 Honorable Mayor and Members of the City Council: The Purchasing Card Audit was conducted in accordance with the fiscal year 2008 audit plan. In addition, the Association of Certified Fraud Examiners estimates that over 50 percent of the reported cases of occupational frauds in the U.S. are related to the procurement process. Because approximately 96 percent of all city purchases are transactions less than $3,000, and a majority of these transactions are made on city purchasing cards; it was determined that a thorough examination of purchasing card policies, procedures, processes and practices was warranted. Background: Over the last six years the City of College Station has used purchasing cards as an alternative to the city’s existing purchasing processes. In most cases, the purchasing card has replaced field purchase orders, some reimbursement requests, and other associated paperwork. An effectively administered purchasing card program offers the following benefits: (1) reduces invoicing, ordering, and processing costs; (2) enables faster delivery of goods and services; (3) decreases the need for petty cash; (4) provides staff with better purchasing flexibility, but with built and variable control mechanisms; (5) reduces stock holding costs because goods are purchased when needed; and (6) offers automated reporting tools, which can provide (a) management information on purchases, (b) cost effective systems to monitor purchasing activity, and (c) audit trail functionality. Scope and Methodology: For most audit tests, I reviewed transactions from October 2005 to October 2007, which comprised approximately 35,000 transactions for $5,000,000. For some tests, however, data was not available during this period and I used fiscal year 2007 data or transactions between December 2005 and November 2007. One scope limitation was caused by the city’s purchasing card vendor, JP Morgan Chase. JP Morgan Chase maintains the purchasing card management system database. Every month, JP Morgan Chase purges this database of city purchasing card data over two years old. TY ELLIOTT City Internal Auditor telliott@cstx.gov CITY INTERNAL AUDITOR’S OFFICE 1101 TEXAS AVENUE COLLEGE STATION, TEXAS 77842 TEL: (979) 764-6269 FAX: (979) 764-6377 AUDIT COMMITTEE Mayor Pro Tem Ron Gay, Chair Councilmember Lynn McIlhaney Councilmember James Massey Audit Objectives: The three main objectives of the Purchasing Card Audit are as follows: 1. Are the city’s processes and procedures in alignment with purchasing card best practices for a “best in class” government purchasing card program? 2. Are purchasing card users in compliance with city purchasing card policies and procedures? 3. Are the city’s purchasing card internal controls effective? Audit Results: Based on the results of several audit tests, the risk that employees are using purchasing cards for their sole benefit is low. In addition, the city’s processes and procedures were found to be in general alignment with purchasing card best practices. Most card users are complying with purchasing card policies and procedures. Overall, the city’s purchasing card internal controls are effective. Audit Recommendations: The purchasing card program needs a few slight improvements, encompassed in the ten audit recommendations contained at the end of the audit report. Implementing these recommendations would strengthen internal controls to further prevent any inappropriate card use and help ensure the future success of the purchasing card program. Written responses from the City Manger and Chief Financial Officer are appended to the report. Ty Elliott City Internal Auditor Purchasing Card Audit Table of Contents Introduction................................................................................................................. 1 Purchasing Card Background ................................................................................ 1 Audit Objectives .................................................................................................... 3 Scope and Methodology ........................................................................................ 3 Findings and Analysis.................................................................................................... 5 The City is in General Alignment with P-Card Best Practices .............................. 5 City Management Supports Strong Internal Controls ...................................... 5 Adequate Resources are Committed to the Program ....................................... 6 The City could be More Selective in Issuing Purchasing Cards ........................ 6 Spending Limits should be Commensurate with Needs.................................... 7 Oversight Officials are Typically Appropriately Assigned ................................. 8 The Duties of Some Employees should be Better Segregated.......................... 9 Purchasing Card Training is Mandatory ...........................................................10 The City Takes Advantage of Preventative Controls........................................11 There is a Multi-Faceted, Strategic Approach to Monitoring...........................11 Consequences of Card Misuse is Clearly Communicated.................................12 Use of the Card Solely for Personal Benefit is Not Tolerated ..........................12 Most Card Users are Complying with City Policies..............................................13 Cards are Typically Assigned to Only One Employee .......................................14 The Risk that Unauthorized Persons Use City Cards is Low ............................14 There are no Capital Equipment or Cash Advance Purchases .........................14 The Purchasing Card System Identified all Split Transactions........................15 The Risk that Personal Misuse is Material is Low ............................................15 Improvement could be Made in Timely Account Reconciliation .....................16 A Few Cardholders are not Keeping Cards in a Secure Place ..........................16 The Financial Risk from Incorrect Sales Tax Charges is Low ..........................17 Some Purchases Lacked Adequate Support Documentation...........................17 Purchasing Card Internal Controls are Generally Effective ................................17 The Cardholder Application Process is Adequate.............................................18 The Allowable Number of Purchases Control is Not Activated .......................18 The Card Effectively Prevents Purchases Exceeding $3,000 ..........................19 The Card Blocks Designated Merchant Categories..........................................19 Change Processes for Spending Limits are Adequate .....................................19 Some Transactions are not Being Adequately Approved ................................19 The City’s Process for Canceling Cards is Adequate........................................20 Recommendations....................................................................................................... 21 Appendices Appendix 1 City Manager’s Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Appendix 2 Chief Financial Officer’s Response . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Purchasing Card Audit 1 Introduction The City Internal Auditor conducted this performance audit of the city’s purchasing card program pursuant to Article III Section 30 of the College Station City Charter, which outlines the City Internal Auditor’s primary duties. A performance audit is an objective, systematic examination of evidence to assess independently the performance of an organization, program, activity, or function. The purpose of a performance audit is to provide information to improve public accountability and facilitate decision-making. Performance audits encompass a wide variety of objectives, including those related to assessing program effectiveness and results; economy and efficiency; internal control; compliance with legal or other requirements; and objectives related to providing prospective analyses, guidance, or summary information. A performance audit of the city’s purchasing processes was included in the fiscal year 2008 audit plan based on the results of a citywide risk assessment conducted in October 2007. On October 25, 2007, the City Council approved the City Internal Auditor’s audit plan. The Association of Certified Fraud Examiners estimates that over 50 percent of the reported cases of occupational frauds in the U.S. are related to the procurement process. Additional risks of fraud, waste, or abuse exist for purchases under $3,000 because the city delegates purchasing authority to the ordering department. Because approximately 96 percent of all city purchases are transactions less than $3,000, and a majority of these transactions are made on city purchasing cards; it was determined that a thorough examination of purchasing card policies, procedures, processes and practices was warranted. Purchasing Card Background Purchasing cards are enhanced credit cards used by city employees. They are similar to a MasterCard or Visa card, but contain more information that can be used to control purchases such as dollar limits, number of transactions within a given period or for an 2 Purchasing Card Audit individual or group, or restrictions based on merchant categories. Card users are not responsible for paying the bill for their own purchases. Instead, the city gets one bill a month that includes the spending of all cards. The city then pays that bill in one lump payment, usually around $210,000 per month. Purchasing cards facilitate point-of demand procurement. In other words, the purchasing authority is delegated to the ordering department enabling the authorized cardholder to place an order directly with the supplier. Over the last six years the City of College Station has used purchasing cards as an alternative to the city’s existing purchasing processes. In most cases, the purchasing card has replaced field purchase orders, some reimbursement requests, and other associated paperwork. An effectively administered purchasing card program offers the following benefits: 1. reduces invoicing, ordering, and processing costs; 2. enables faster delivery of goods and services; 3. decreases the need for petty cash; 4. provides staff with better purchasing flexibility (e.g. online ordering), but with built and variable control mechanisms; 5. reduces stock holding costs because goods are purchased when needed; and 6. offers automated reporting tools, which can provide (a) management information on purchases, (b) cost effective systems to monitor purchasing activity, and (c) audit trail functionality. There are risks, however, associated with purchasing cards. The general consensus in acquisition and inspector general communities is that use of purchasing cards can lead to an increase in fraud and abuse if proper controls are not implemented and enforced. Lack of internal controls is by far the most frequently cited factor contributing to waste, fraud or abuse in purchasing card programs. Purchasing Card Audit 3 Audit Objectives This audit addresses purchasing card policies, procedures, processes and practices. This report answers the following questions: • Are the city’s purchasing card processes and procedures in alignment with purchasing card best practices for a “best in class” government purchasing card program? • Are card users in compliance with city purchasing card policies and procedures? • Are the city’s purchasing card internal controls effective? Scope and Methodology This audit was conducted in accordance with government auditing standards, which are promulgated by the Comptroller General of the United States. Audit fieldwork was conducted from November 2007 through February 2008. For most audit tests, transactions from October 2005 to October 2007 were examined. These transactions comprised approximately 35,000 purchases for $5,000,000. For some tests, however, data was not available during this period. Therefore, fiscal year 2007 data or transactions between December 2005 and November 2007 were used to meet some audit sub-objectives. One scope limitation was caused by the city’s purchasing card vendor, JP Morgan Chase. JP Morgan Chase maintains the purchasing card management system database. Every month, JP Morgan Chase purges this database of city purchasing card data over two years old. The audit methods included: • Reviewing the work of auditors in other jurisdictions and researching professional literature to identify best practices for administering purchasing card programs. • Interviewing staff responsible for performing purchasing card oversight functions. 4 Purchasing Card Audit • Conducting data analysis using specialized auditing software to test for purchasing card misuse and system control failings. • Reviewing purchasing card support documentation, program coordinator’s procedural manual, the purchasing card policies and procedures manual, cardholders’ approval/access hierarchy, and select cardholders’ performance evaluations. • Observing mandatory cardholder training and the monitoring functions performed by purchasing card oversight officials. Purchasing Card Audit 5 Findings and Analysis The City is in General Alignment with P-Card Best Practices Successful purchasing card programs typically exhibit the following characteristics: (1) strong management support of controls, (2) adequate resources are committed to achieve success, (3) cards are selectively issued, (4) spending limits are established that are commensurate with needs, (5) appropriate oversight officials are identified and their responsibilities are clearly delineated, (6) major job functions are segregated, (7) training is mandatory, (8) card administrators take advantage of preventive controls to minimize risk exposure, (9) monitoring activities are strategically implemented at various levels throughout the organization, and (10) consequences of improper behavior is clearly communicated and swift action is taken when inappropriate use is discovered. City Management Supports Strong Internal Controls City management is setting and maintaining the organization’s ethical tone, providing guidance for proper behavior, and removing temptations for unethical behavior. However, there is room for improvement in the area of providing discipline when appropriate. The ethical tone of the city is effectively communicated. The city has a comprehensive purchasing card policies and procedures manual that effectively describes the proper use of the card and the consequences for improper use. The purchasing card manual is communicated and distributed to all cardholders during mandatory purchasing card training. In addition, the city’s ethical standards are documented in the city’s Stewardship Enhancement Plan, which was revised and approved by the City Council on March 8, 2007. The Stewardship Enhancement Plan adequately communicates the city’s plan for creating a culture of honesty and high ethics, and specifically addresses the following: setting the city’s ethical tone at the top of the organization, creating a positive workplace environment, hiring and promoting appropriate employees, training, and disciplining employees when appropriate. 6 Purchasing Card Audit Some department’s performance evaluations do not address compliance with city policy. The proper use of the purchasing card should be incorporated as a factor in employees’ performance evaluations. All but three city department heads said they either directly or indirectly incorporate the proper use of the card as a factor in employees’ performance evaluations. However, eight of the city’s fifteen departments do not have a section on their performance evaluations that cover compliance with city policies and procedures. No departments’ evaluations specifically addressed proper use of purchasing cards—although the Parks and Recreation Department has a section of their evaluations that deals with compliance with city purchasing policies. The other department that best demonstrated alignment with this best practice was the Police Department. The Police Department evaluates how their employees (1) demonstrate a working knowledge of policies and procedures, (2) are able to recognize and apply the intent of the policy, and (3) exhibit knowledge of duties, policies, procedures, responsibilities, and work standards related to the job. Adequate Resources are Committed to the Program Based on observations of critical oversight duties performed by Department of Finance personnel, Finance has sufficient staff to continue to effectively administer the purchasing card program. In addition, departments are generally devoting sufficient human resources to effectively perform oversight functions. A best practice “rule of thumb” is to have approximately ten cardholders per approving official. Only nine percent of approving officials were identified that approve purchasing card transactions for more than ten cardholders, and only one approving official was identified that approved transactions for more than twenty cardholders. The City could be More Selective in Issuing Purchasing Cards The city has an effective approval process established through which applicants must be reviewed and approved prior to being issued a purchasing card. However, the number and distribution of cardholders across city departments is not in conjunction with the evolving needs and expenditures of the departments. The city has an effective card issuance process. The city has an effective approval process established through which applicants must be reviewed and approved prior to being issued a purchasing Purchasing Card Audit 7 card. City employees are issued a card after (1) Finance receives a completed application form signed by both the employee and the employee’s supervisor, (2) the employee completes mandatory purchasing card training, and (3) the cardholder signs an agreement form, signifying they understand and will adhere to all city purchasing card policies and procedures. Cards are issued to employees who are not using them. City departments are requesting purchasing cards for employees that may not need the card. Approximately 60 percent of the city’s workforce is issued a purchasing card. There were 26 employees issued cards prior to the start of fiscal year 2007 that did not make any purchases during the fiscal year. An additional 38 employees made less than six transactions for total amounts less than $200 during the fiscal year. After examining the number and distribution of cardholders across city departments in conjunction with their evolving needs and expenditures, the following departments are the most in need of examining the purchasing card needs of their employees: Police, Fire, Public Works, Waste Water, Water, Electric, Parks and Recreation, and the Municipal Court Division of the Department of Finance. Spending Limits should be Commensurate with Needs Controls could be strengthened if the city established spending limits commensurate with needs of cardholders. Both monthly and single transaction limits were found to be much higher than a large number of cardholder needs. Establishing different spending limits for each individual employee would not be administratively cost effective. However, grouping similar categories of staff together and assigning these groups of employees pre-established limits that are lower than the maximum limits would be feasible. The single transaction limit is higher than a large number of cardholder needs. From October 2005 to October 2007, there were approximately 35,000 transactions for $5,000,000 made on city purchasing cards. Over 97 percent of these transactions were for items less than $1,000. In addition, 12.6 percent of active cardholders had a single transaction limit under $3,000; while, 8.4 percent of cardholders made transactions for amounts exceeding $2,400 and only 3.3 percent had multiple transactions for amounts exceeding $2,400. 8 Purchasing Card Audit The monthly spending limit is higher than a large number of cardholder needs. From October 2005 to October 2007, there were 658 cardholders who made transactions on city purchasing cards. During this period, there were only 18 employees whose total transactions for a month exceeded $8,000. There were 40 cardholders who spent more than $5,000 within a month on their city purchasing card, and only 22 cardholders spent more than $5,000 within a month multiple times during the period reviewed. As of November 2007, there were only 23 active cards with credit limits under $10,000. Oversight Officials are Typically Appropriately Assigned The city appropriately identifies and assigns employees to be oversight officials of the purchasing card program. Employees who approve purchasing card transaction were found to be knowledgeable in the appropriate use of the card, and the procurement needs of the organization. In addition, most purchasing card approvers were found to be sufficiently independent and/or of a sufficient rank to question the cardholder when additional information is needed about specific transactions. On the other hand, approving officials were not always held accountable for performing adequate timely reviews as part of their job performance. Overall, appropriate approvers are assigned. Approving officials are required to attend mandatory training where they are instructed on the appropriate use of the card. In addition, approving officials are typically designated based on supervisory hierarchy. Typically, employees’ supervisors are most knowledgeable to determine whether purchases made by their employees are aligned with the purchasing needs of the organization. Most card approvers are sufficiently independent to question inappropriate transactions. Active cardholders were examined to see if they had a higher rank/position than the employees who approved their purchasing card transactions. In addition, key department personnel were interviewed and purchasing card processes were observed to assess the ability of approving officials to question the cardholder when additional information is needed about specific transactions. Less than nine percent of approving officials are not sufficiently independent and/or of sufficient rank to question the cardholder when additional information is needed about specific transactions. Purchasing Card Audit 9 Approving officials who frequently do not perform adequate timely reviews are not held accountable as part of their job performance. The city’s policy states that “each Friday, the previous week’s transactions must be edited, reviewed, and approved and all invoices/receipts attached to the transaction report must be forwarded to Accounting.” From December 2005 through November 2007, twelve cardholders were identified that frequently had a material amount of unapproved purchasing card transactions. The performance evaluations of these cardholders and their supervisors’ performance evaluations were examined. Based on this examination of performance evaluations, approving officials do not appear to be held accountable for performing adequate timely reviews as part of their job performance in these instances. In addition, eight of the city’s fifteen departments do not have a section on their performance evaluations that cover compliance with city policies and procedures. The Duties of Some Employees should be Better Segregated The same employee should not perform more than one of the following job functions: authorization, execution, custody, and recording. An employee who possesses two or more of these functions has inadequate segregation of duties. Such a situation can provide employees with the opportunity to commit fraud. The responsibilities of some cardholders, approving officials, and program coordinators overlap. Program coordinators have the highest level of access to the city’s purchasing card systems in order to setup new cardholders, maintain the city’s purchasing records, and assign access and monitoring controls to approving officials. Five city employees were identified as program coordinators. All five of these employees are also cardholders. In addition, two of these employees are approving officials to other cardholders. Two program coordinators are approving officials to other program coordinators. A few cardholders approve their supervisors’ purchases. All current cardholders (as of November 8, 2007) were examined and less than seven percent of approving officials approve purchasing card transactions for their supervisors. No cardholders are approving officials for their own card. According to Department of Finance personnel, the purchasing card system prevents cardholders from approving their own transactions. 10 Purchasing Card Audit All current cardholders (as of November 8, 2007) were examined, and no cardholder was identified that approves purchasing card transactions for their own card. Purchasing Card Training is Mandatory Cardholders are trained on the applicable procurement regulations, appropriation issues, and reconciliation of monthly purchasing card statements. In addition, approving officials are trained on appropriate review of cardholder purchases and reconciliations, and appropriate use of oversight tools available to them. Verification of understanding of purchasing card training is required prior to a cardholder being issued the card and cardholders are provided with information at the conclusion of training to remind them about appropriate use of the card. Cardholders are required to attend training. Cardholders are required to attend training on the appropriate use of the purchasing card prior to being issued a card. Based on observations of this training, cardholders receive adequate instruction on the applicable procurement regulations and appropriation issues. However, there could have been more thorough training regarding the proper reconciliation of monthly purchasing card statements. Approving officials are required to attend training. Approving officials are trained on appropriate review of cardholder purchases and reconciliations, and appropriate use of oversight tools available to them. In addition, approving officials are provided with the following during mandatory cardholder training (1) the purchasing card policies and procedures manual and (2) training materials instructing them on how to use the city’s purchasing card system in order to perform their required oversight duties. Cardholders must verify that they understand the city’s policies. Based on observations of mandatory cardholder training and review of the city’s purchasing card policies and procedures manual, employees are required to verify understanding of purchasing card training prior to being issued a card by signing a cardholder agreement form. In addition, cardholders are provided with a copy of the purchasing card policies and procedures manual during mandatory training to provide them with a reminder about the appropriate use of the card. Purchasing Card Audit 11 The City Takes Advantage of Preventative Controls The city’s purchasing cards preemptively block purchases from vendor categories not reasonably related to city purchasing needs. In addition, the purchasing card management system contains an alert system that monitors the database for pre-established conditions which may indicate potential abuse by cardholders. However, the purchasing card management system has additional control features the city could utilize. For example, the cards could block additional vendor categories or transactions could be instantaneously approved or declined based on the number of transactions allowed per day or per month. The card blocks purchases from non-business related vendor categories. There are six vendor categories the city’s purchasing card preemptively blocks, and these categories were determined to be not reasonably related to city purchasing needs. In comparison, however, there are 282 vendor categories. There are 75 vendor categories that the Federal Government’s purchasing card program states “may be subject to further investigation” if a purchase is made from a vendor in the category. The card contains an alert system for split transactions. The city purchasing card policy states that the card is not to be used for multiple, sequential purchases of less than $3,000 from a single vendor for similar purchases adding up to more than $3,000. The purchasing card management system contains an alert system that monitors the database for instances when employees split transactions to avoid the $3,000 purchasing threshold. The Department of Finance receives these alerts and notifies departments when an employee from their department has violated this city policy. There is a Multi-Faceted, Strategic Approach to Monitoring Overall, the city has established a multi-faceted, strategic approach to monitoring and oversight. However, there are additional automated reporting tools available through the purchasing card system that could be utilized by program coordinators in the Department of Finance and approving officials throughout city. Automated reporting tools are being used at various levels throughout the city. Automated reporting tools are being strategically used by program coordinators in the Department of 12 Purchasing Card Audit Finance to monitor purchasing card use. In addition, Fire, Police, and Utilities employ purchasing card administrators who centrally conduct adequate oversight of cardholders within their respective organizations through the use of automated statements and tools. All approving officials throughout the city receive training instructing them on how to use the city’s purchasing card system to perform transaction reconciliation and approval. Additional automated reporting tools could be utilized. Program coordinators in the Department of Finance are aware of all the reporting tools that are available to them, but are not using some of these tools. Other oversight officials at the department level are trained on how to use transaction related reporting and monitoring tools. However, other automated reporting tools available through the purchasing card system include: spending analysis reporting, merchant information reporting, and travel and expense reporting. There are also several administrative tools available to program coordinators that are currently not being used such as the declined transaction report or the transaction audit report. Consequences of Card Misuse is Clearly Communicated The city has a comprehensive purchasing card policies and procedures manual that effectively describes the proper use of the card and the consequences for improper use. The purchasing card manual is communicated and distributed to all cardholders during mandatory purchasing card training. During this training, consequences for both personal and administrative misuse of the purchasing card are clearly communicated. Cardholders are also required to sign an agreement form to signify that they understand the city’s purchasing card policy and the consequences for not complying with the policy. Use of the Card Solely for Personal Benefit is Not Tolerated If purchasing cards are used to intentionally make purchases for the sole benefit of the employee, the city takes swift action to discipline, terminate employment and/or indict the employee for theft of city funds. However, approving officials and cardholders are not consistently held accountable across city departments for administrative misuse of the card, which could include: lack of proper and timely reconciliations, non submittal of receipts or other support documentation, or inadequate timely review and approval of Purchasing Card Audit 13 cardholder transactions. There was also an instance where action was not taken when a Parks and Recreation employee intentionally split a transaction to avoid the $3,000 purchasing threshold. The Department of Finance caught this violation of purchasing card policy and notified the employee’s supervisor. This employee received a fully successful rating for compliance with purchasing procedures in the year this violation occurred. Another Parks and Recreation employee lost his purchasing card four times in under a year and received an exceeding expectations rating for compliance with purchasing procedures during the period he lost the cards. Most Card Users are Complying with City Policies The city’s purchasing card policies and procedures were examined and determined to be reasonable. Therefore, several audit tests were conducted to test cardholders’ compliance with these policies and procedures. These audit tests were designed to answer the following questions: 1. Is each purchasing card issued to only one employee? 2. Are purchasing cards assigned, transferred, or loaned to any unauthorized person; or used by suspended or terminated employees? 3. Are purchasing cards used for any of the following purchases: (1) alcoholic beverages, (2) capital equipment, or (3) cash advances/travelers checks? 4. Are purchasing cards used for multiple, sequential purchases of less than $3,000 from a single vendor for similar purchases adding up to more than $3,000? 5. Are purchasing cards used to make purchases for the sole benefit of the employee? 6. Are individual cardholder accounts properly and timely reconciled? 7. Are purchasing cards signed and kept in a secure place? 8. Do cardholders inform the vendor of the city’s tax identification number to take advantage of the city’s tax- exempt status? 9. Is adequate documentation maintained to support the legitimate business purpose of all transactions made with the purchasing card? 14 Purchasing Card Audit Cards are Typically Assigned to Only One Employee City policy states that purchasing cards are to be assigned to only one employee. There are, however, a few exceptions to this rule. There is a risk that employees who transfer from one department to another can receive multiple cards. One wastewater employee was identified as having two active purchasing card accounts. In December 2007, the City Internal Auditor notified the Department of Finance of this instance and one of the employee’s accounts was immediately cancelled. The employee originally received a card when he was hired as a public works employee. When he transferred to the Utilities Department he received an additional card upon the request of his new supervisor. The processes for accounting for unassigned purchasing cards are adequate. The Police and Fire departments have unassigned purchasing cards that are issued to employees for training and travel purposes. As of December 2007, there are eleven unassigned police or fire purchasing cards. The processes for administering these unassigned cards were examined, and internal controls over the use of these cards were determined to be effective. The Risk that Unauthorized Persons Use City Cards is Low The Department of Finance has an effective process of assigning cards to only authorized employees. In addition, Finance reviews purchasing card transactions and support documentation to detect if any cards have been transferred or loaned to any unauthorized person. The city also has a sufficient process to ensure that purchasing cards are not used by terminated employees. To reach this audit conclusion, purchasing card monitoring activities performed by purchasing card program coordinators in the Department of Finance were observed, and the program coordinator’s procedure manual was reviewed. There are no Capital Equipment or Cash Advance Purchases Cardholders are not making purchases on their cards for capital equipment or cash advances/travelers checks. However, support documentation is inadequate to determine if alcoholic beverage purchases are made on purchasing cards. Cardholders are not making capital equipment or cash advance/travelers checks purchases on city cards. A purchase Purchasing Card Audit 15 is classified as capital equipment when the item purchased exceeds $5,000 and has a useful life of three or more years. Approximately 35,000 transactions for $5,000,000 from October 2005 to October 2007 were reviewed. During this period, there were no transactions made with purchasing cards that meet the criteria for capital equipment. In addition, there were no purchases made during this period for cash advances or travelers checks. No alcohol purchases were found, but a definitive determination could not be made because of inadequate documentation. A judgment sample of 30 restaurant transactions was examined. No evidence of alcoholic beverage purchases was found. However, over half of the transactions reviewed did not have adequate documentation to determine if alcoholic beverages were purchased on city purchasing cards. The Purchasing Card System Identified all Split Transactions The purchasing card management system monitors the database for instances when cardholders make multiple purchases on the same date with the same vendor that add up to over $3,000. When these types of transactions occur, the system sends an automated alert to program coordinators in the Department of Finance, and they notify cardholders’ supervisors of the violation of city policy. There is a risk, however, that cardholders could circumvent this system by asking vendors to split transactions on different dates. Therefore, approximately 35,000 transactions for $5,000,000 from October 2005 to October 2007 were reviewed to identify all instances when employees split transactions to avoid the $3,000 purchasing threshold. This review verified that the purchasing card management system identified all cardholders who split transactions. The Risk that Personal Misuse is Material is Low Although there may be a small number of purchasing card transactions made by city employees for non-business related purposes, the risk that the amount of inappropriate transactions is material is low. Audit tests were designed to identify all purchasing card transactions during the most recent two year period that met the following criteria: (1) purchases from vendor categories the Federal Government’s purchasing card program restricts, and/or (2) purchases that were unapproved by cardholders’ supervisors, and/or (3) purchases made when cardholders took some type of leave. The 16 Purchasing Card Audit audit tests included approximately $5,000,000 in transactions. Based on these tests, 258 transactions for $51,000 were identified as the highest risk of purchases made for the sole benefit of the employee. Support documentation maintained in the Department of Finance for these 258 transactions was thoroughly examined, and 184 of these transactions were verified as legitimate business use purchases. Adequate documentation was not submitted to Finance to make a determination for the remaining 74 transactions. However, the amount of these 74 transactions made up less than 0.2 percent of the total transaction amount during the period reviewed. Improvement could be Made in Timely Account Reconciliation Although there may be some cardholders that are not properly and timely reconciling their individual accounts, the Department of Finance has procedures in place to encourage compliance with this policy. In addition, evidence was found that cardholders are reconciling their accounts. For example, documented instances of cardholders disputing purchasing card charges were found. Also, approximately 98 percent of receipts are being submitted to Finance. However, a greater percentage of receipts (approximately 6.5 percent) are not submitted in a timely fashion. During mandatory purchasing card training, cardholders are not specifically instructed on how they should be reconciling their purchasing card transactions. Cardholder training could be improved to ensure better compliance with this policy. A Few Cardholders are not Keeping Cards in a Secure Place A small percentage of cardholders are not keeping purchasing cards in a secure location. Cardholders are required to attend training where they are instructed to sign and keep cards in a secure place. In addition, police and fire unassigned purchasing cards were observed to be signed and kept in a secure location. The Utilities Department centrally secures purchasing cards of employees who infrequently use the card. These utilities employees’ cards were all signed and kept in a secure place. On the other hand, during the six year period the purchasing card program has been in place, approximately ten percent of employees issued a card have lost them at least once. Approximately two percent of current cardholders have lost purchasing cards multiple times. Purchasing Card Audit 17 The Financial Risk from Incorrect Sales Tax Charges is Low Although there is a small number of purchasing card transactions where cardholders do not inform the vendor of the city’s tax identification number to take advantage of the city’s tax exempt status, the risk that the amount is material is low. A judgment sample of 252 transactions for $50,000 was taken from a population of approximately $5,000,000 in transactions over a two year period. The purchasing card support documentation for these 252 transactions maintained by the Department of Finance was examined. Sales tax charges were incorrectly applied in 17 out of the 252 transactions (6.75 percent). The city would have saved approximately $300 if sales tax was not charged in these 17 instances. Cardholders are sufficiently instructed during mandatory cardholder training on appropriate procedures in order to not be incorrectly charged for sales tax. Some Purchases Lacked Adequate Support Documentation In fiscal year 2007, approximately 98 percent of purchasing card transactions had invoices, receipts, or other support documentation that was submitted to the Department of Finance. The Department of Finance also has specific policies and procedures in place to encourage cardholders to maintain adequate documentation to support the legitimate business purpose of all transactions made with the purchasing card. However, not all cardholders are submitting the required documentation to Finance. From October 2005 to October 2007, there were approximately 35,000 purchasing card transactions. During this period, a judgment sample of 209 transactions was taken and support documentation maintained by Finance for these transactions was examined. Of the 209 transactions reviewed, 108 did not have itemized receipts. During fiscal year 2007, there were also 111 transactions for approximately $9,500 where a required travel form or taxable/nontaxable form was not submitted to Finance. Purchasing Card Internal Controls are Generally Effective The city’s internal controls over purchasing cards were examined and audit tests were conducted to determine the effectiveness of these controls. These audit tests were designed to answer the following questions: 18 Purchasing Card Audit 1. Does the Department of Finance have record of all cardholder application forms and are these forms signed by both the cardholder and the cardholder’s supervisor? 2. Are all transactions approved or declined instantaneously based on the number of transactions allowed per day or per month? 3. Are all transactions approved or declined instantaneously based on the single purchase limit not to exceed $3,000? 4. Are all transactions declined instantaneously based on the following unapproved merchant categories: wire transfer/money orders; furriers & fur shops; jewelry stores, watches, clocks, & silverware stores; dating & escort services; watch, clock & jewelry repair; or lottery tickets, casino gaming chips, off-track betting and wagers? 5. Are there any employees who had monthly spending limits that exceed $10,000? If so, does Finance have documentation of department directors’ written authorizations to change a cardholder’s credit limit? 6. Are all transactions being edited, reviewed, and approved? 7. Does the Department of Finance have (1) a process for identifying lost or stolen purchasing cards and promptly canceling the card and (2) a record of all cancelled purchasing card documentation? The Cardholder Application Process is Adequate All current cardholders’ application forms and agreement forms were reviewed to ensure that the forms were complete and signed by both cardholders and the cardholders’ supervisors. Out of the 530 cardholders, only six exceptions were found: four cardholder agreement forms were missing, one application form was missing, and one application form was not signed by a cardholder’s supervisor. Therefore, approximately 99 percent of cardholder application and agreement forms were complete and signed by cardholders and their supervisors. The Allowable Number of Purchases Control is Not Activated The city’s purchasing card policy and procedures manual states that all transactions are approved or declined instantaneously based on a specified number of transactions allowed per day and a specified number of transactions allowed per month. However, the purchasing card management system currently does not control transactions based on this criteria. The Department of Finance should either Purchasing Card Audit 19 implement this control or remove the statement from the policies and procedures manual. The Card Effectively Prevents Purchases Exceeding $3,000 According to the city purchasing card policy, transactions are approved or declined instantaneously base on the single purchase limit not to exceed $3,000. Audit tests were conducted to identify any transaction made from October 2005 to October 2007 (approximately 35,000 transactions) that exceeded $3,000. No single transaction within the period exceeded $3,000. The Card Blocks Designated Merchant Categories From October 2005 to October 2007, there were approximately 35,000 transactions for $5,000,000 made on city purchasing cards. Audit tests were designed to identify purchases made during this period to vendors from the following merchant categories: (1) wire transfer/money orders; (2) furriers and fur shops; (3) jewelry stores, watches, clocks, and silverware stores; (4) dating and escort services; (5) watch, clock and jewelry repair; or (6) lottery tickets, casino gaming chips, off-track betting and wagers. No purchasing card transactions were identified that were made in any of these categories. Change Processes for Spending Limits are Adequate As of December 2007, there are no current cardholders who have monthly spending limits that exceed $10,000. However, there have been instances where cardholders’ monthly credit limits were temporarily increased based on need and the approval of their department directors. Documentation of department directors’ written authorizations to change a cardholder’s credit limit was reviewed and determined to be sufficient evidence to conclude that Finance has an adequate process to ensure credit limits are not inappropriately changed. Some Transactions are not Being Adequately Approved The official record of approval is contained in the city’s purchasing card management system (i.e. PaymentNet). The city’s policy requires cardholders to review their transactions and cardholders’ supervisors to approve these transactions and record their reviews and approvals respectively in the PaymentNet system. Adherence to this policy requirement is an effective internal control for the following reasons: (1) supervisory approval is the best preventative control against purchasing card misuse because supervisors are the most 20 Purchasing Card Audit knowledgeable in the purchasing needs of the organization, (2) the system’s security control allows only authorized approving officials to approve cardholder transactions, and (3) centralized data management systems allows for efficient and reliable monitoring of cardholder transactions, which enables program coordinators to quickly identify the cardholder accounts that are not being timely reviewed and approved. Between December 1, 2005 and November 30, 2007 there were approximately 36,000 purchasing card transactions for $5,200,000. During this period, there were 2,110 unapproved transactions for approximately $342,000. There were eleven out of eighteen city departments whose amount of unapproved purchasing card transactions exceeded five percent of their total transaction amount— and three departments whose amount of unapproved transactions exceeded 28 percent. The City’s Process for Canceling Cards is Adequate Cardholders are notifying the Department of Finance when their cards are lost or stolen and the Department of Finance is promptly canceling these cards. New cards are issued to employees provided that (1) the employee has the approval of their supervisor and (2) the employee submits a signed cardholder agreement form to the Department of Finance. The Department of Finance also has record of all cancelled purchasing card documentation through PaymentNet’s Cardholder Status Report. Purchasing Card Audit 21 Recommendations The purchasing card program needs a few slight improvements, encompassed in the following audit recommendations. Implementing these recommendations would strengthen internal controls to further prevent any inappropriate card use and help ensure the future success of the purchasing card program. 1. The City Manager should issue a directive that every city performance evaluation has a section dealing with compliance with city policy. In addition, employees who conduct performance evaluations should be instructed to (1) incorporate the proper use of the card as a factor in the evaluation and (2) hold approving officials accountable for performing adequate timely reviews as part of the evaluation. 2. Purchasing card spending limits should be established that are commensurate with the needs of the cardholder. The City Manager should direct departments to adjust their cardholders’ monthly and single transaction limits based on an evaluation of cardholders’ needs. One way this could be accomplished is to use the automated reporting tools available in the PaymentNet system to perform a spending analysis. The spending analysis may reveal that cardholders’ of similar position have comparable spending needs that require no more than a certain purchasing card threshold. 3. The City Manager should direct department directors to evaluate whether or not all the employees who are issued a card, within their respective departments, need a purchasing card to better perform their essential job duties. 4. The Chief Financial Officer should work with department directors to ensure that (1) there are no cardholders who are approving officials for their supervisors and (2) all approving officials are sufficiently independent and of a sufficient rank to question the cardholder when additional information is needed about specific transactions. 5. The Chief Financial Officers should correct situations where the responsibilities of cardholders, approving officials, and program coordinators overlap. 22 Purchasing Card Audit 6. The purchasing card currently preemptively blocks purchases from six vendor categories not reasonably related to city purchasing needs. The Chief Financial Officer should consider additional vendor categories the purchasing card could block in order to further take advantage of preventive controls and minimize the city’s risk exposure. 7. The Chief Financial Officer should implement procedures for purchasing card coordinators to prevent multiple purchasing cards from being issued to an employee who transfers from one department to another. For example, prior to issuing a card, the program coordinator could query the PaymentNet system for a card applicant to see if the employee has already been issued a card. 8. Because transactions are not approved or declined instantaneously based on the number of transactions allowed per day or per month, the Chief Financial Officer should remove this statement from the purchasing card policies and procedures manual. 9. The Chief Financial Officer should improve mandatory purchasing card training in the following ways: (1) instruct cardholders on how they should be properly and timely reconciling their purchasing card accounts, (2) stress the importance of keeping purchasing cards signed and in a secure place, (3) present examples of the proper types of documentation necessary to support the legitimate business purpose of purchasing card transactions, and (4) explain the rationale for the necessity of timely review and approval of transactions. 10. The Chief Financial Officer should consider using additional automated monitoring tools available, such as the declined transaction report or the transaction audit report. The Chief Financial Officer should also consider instructing approving officials to use additional automated tools at various levels throughout the city. Purchasing Card Audit 23 APPENDIX 1 AUDIT RESPONSE – CITY MANAGER’S OFFICE To: Ty Elliot, Internal Auditor From: Glenn Brown, City Manager Date: February 22, 2008 Subject: Responses to Draft Audit Report – Purchasing Card Policies Following are the recommendations accompanied by management’s response: 1. The City Manager should issue a directive that every city performance evaluation has a section dealing with compliance with city policy. In addition, employees who conduct performance evaluations should be instructed to (1) incorporate the proper use of the card as a factor in the evaluation and (2) hold approving officials accountable for performing adequate timely reviews as part of the evaluation. Management Response: The City Manager concurs with this recommendation. Employees should already understand that being in compliance with City policy is required of employment. But to ensure this is happening, staff will be directed to include compliance with city policies as a part of annual employee evaluations. 2. Purchasing card spending limits should be established that are commensurate with the needs of the cardholder. The City Manager should direct departments to adjust their cardholders’ monthly and single transaction limits based on an evaluation of cardholders’ needs. One way this could be accomplished is to use the automated reporting tools available in the PaymentNet system to perform a spending analysis. The spending analysis may reveal that cardholders’ of similar position have comparable spending needs that require no more than a certain purchasing card threshold. Management Response: The City Manager concurs with this recommendation, and would like to review the spending analysis to be performed. If different spending limits were used, the goal would be to group similar categories of staff together. It would not be feasible for each employee to have a different limit. 3. The City Manager should direct department directors to evaluate whether or not all the employees who are issued a card, within their respective departments, need a purchasing card to better perform their essential job duties. Management Response: The City Manager concurs with this recommendation. Please provide a list of employee purchasing card usage which will be provided to department directors to determine if employees need a purchasing card to perform essential job duties. 24 Purchasing Card Audit Purchasing Card Audit 25 APPENDIX 2 AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES the heart of the Research Valley To: Ty Elliott, City Internal Auditor Through: Glenn Brown, City Manager From: Jeff Kersten, Chief Financial Officer Date: February 21, 2008 Subject: Purchasing Card Audit Report - Fiscal Services Response Attached is the Fiscal Services Department response to the Purchasing Card Audit Report. Each of the seven recommendations addressed to the Chief Financial Officer includes a response on how the recommendation will be addressed. Please let me know if any additional information is needed. cc: Cheryl Turney, Assistant Director Fiscal Services Janet Dudding, Assistant Director Fiscal Services PO Box 9960 1101 Texas Avenue College Station, TX 77842 www.cstx.gov 26 Purchasing Card Audit APPENDIX 2 (continued) AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES Procurement Card Internal Audit Internal Audit Recommendations and Fiscal Services Response: Responses to Recommendations 1-3 are being prepared by the City Manager. 4. Recommendation: The Chief Financial Officer should work with department directors to ensure that (1) there are no cardholders who are approving officials for their supervisors and (2) all approving officials are sufficiently independent and of a sufficient rank to question the cardholder when additional information is needed about specific transactions. Response: Management concurs and will establish internal controls that ensure that (1) there are no cardholders who are approving officials for their supervisors and (2) all approving officials are sufficiently independent and of a sufficient rank to question transactions. 5. Recommendation: The Chief Financial Officer should correct situations where the responsibilities of cardholders, approving officials, and program coordinators overlap. Response: Management concurs, and will review and establish internal controls that prevent a program administrator (coordinator) from also approving subordinate program administrator transactions. A program administrator is restricted from approving their own transactions. Management will review current internal controls and consider revisions to address the recommendation. 6. Recommendation: The purchasing card currently preemptively blocks purchases from six vendor categories not reasonably related to city purchasing needs. The Chief Financial Officer should consider additional vendor categories the purchasing card could block in order to further take advantage of preventive controls and minimize the city’s risk exposure. Response: Management concurs and will investigate other Merchant Category Code restrictions that could be put on all cards in order to further take advantage of preventative controls and minimize the City's risk exposure. Management will consider whether restricting certain cards use solely for travel and training would help restrict the number of general procurement cards outstanding. 7. Recommendation: The Chief Financial Officer should implement procedures for purchasing card coordinators to prevent multiple purchasing cards from being issued to an employee who transfers from one department to another. For example, prior to issuing a card, the program coordinator could query the PaymentNet system for a card applicant to see if the employee has already been issued a card. PO Box 9960 1101 Texas Avenue College Station, TX 77842 www.cstx.gov Purchasing Card Audit 27 APPENDIX 2 (continued) AUDIT RESPONSE – DEPARTMENT OF FISCAL SERVICES Response: Management concurs. Issuing administrators will confirm there are no duplicate entries/cardholder prior to issuing a new card beginning immediately. 8. Recommendation: Because transactions are not approved or declined instantaneously based on the number of transactions allowed per day or per month, the Chief Financial Officer should remove this statement from the purchasing card policies and procedures manual. Response: Management concurs that the policy should be revised. The procurement policy will be reviewed to determine what changes, if any, should be made to ensure appropriate controls are in place regarding purchasing card transactions. Any revised policy will then be communicated to the organization and implemented. 9. Recommendation: The Chief Financial Officer should improve mandatory purchasing card training in the following ways: (1) instruct cardholders on how they should be properly and timely reconciling their purchasing card accounts, (2) stress the importance of keeping purchasing cards signed and in a secure place, (3) present examples of the proper types of documentation necessary to support the legitimate business purpose of purchasing card transactions, and (4) explain the rationale for the necessity of timely review and approval of transactions. Response: Management concurs and will develop and implement enhanced purchasing card training for card holders covering all aspects of the purchasing card program including reconciliation and documentation, and ramifications of non compliance with established policy. These ramifications could include canceling individual cards for non-compliance, and/or securing personal repayment of purchases not in full compliance with policy. 10. Recommendation: The Chief Financial Officer should consider using additional automated monitoring tools available such as the declined transaction report or the transaction audit report. The Chief Financial Officer should also consider instructing approving officials to use additional automated tools at various levels throughout the city. Response: Management concurs and will enhance staff training on the automated oversight tools available. PO Box 9960 1101 Texas Avenue College Station, TX 77842 www.cstx.gov