Loading...
01/29/2009 - Report: P-Card Follow up Audit Report - City Council - Audit Committee Page 1 TO: Audit Committee Members FROM: Ty Elliott, City Internal Auditor DATE: January 29, 2009 SUBJECT: Purchasing Card Follow-up Audit Report The purchasing card follow-up audit was conducted in accordance with the fiscal year 2009 audit plan. This audit report summarizes the purchasing card audit recommendations, management’s responses, and the audit follow-up findings (which describe how city management has implemented the auditor’s recommendations). This audit was conducted in accordance with government auditing standards, which are promulgated by the Comptroller General of the United States. 1. Audit Recommendation: The City Manager should issue a directive that every city performance evaluation has a section dealing with compliance with city policy. In addition, employees who conduct performance evaluations should be instructed to (1) incorporate the proper use of the card as a factor in the evaluation and (2) hold approving officials accountable for performing adequate timely reviews as part of the evaluation. Management Response: The City Manager concurs with this recommendation. Employees should already understand that being in compliance with city policy is required of employment. But to ensure this is happening, staff will be directed to include compliance with city policies as part of annual employee evaluations. Audit Follow-up Finding: The City Manager gave verbal and written instruction to the Management Team on April 23, 2008. A reminder notice was sent to all city staff on November 15, 2008. The City Manager directed the city staff as follows: “Employees who conduct performance evaluations should be instructed to (1) incorporate the proper use of the procurement card as a factor in the evaluation (if applicable); (2) hold employees who approve procurement card transactions accountable for performing adequate timely reviews as part of the evaluation; and (3) all other city policies and procedures must be adhered to.” In order to determine the effectiveness of the City Manager’s directive, I reviewed at least one randomly selected performance evaluation from each department. I could not find any language within the performance evaluation relating to policies and procedures for the Department of Planning and Development Services. All other departments had evaluation criteria directly related or loosely related to compliance with city policies and procedures. There was also evidence that departments TY ELLIOTT City Internal Auditor telliott@cstx.gov CITY INTERNAL AUDITOR’S OFFICE 1101 TEXAS AVENUE COLLEGE STATION, TEXAS 77842 TEL: (979) 764-6269 FAX: (979) 764-6377 AUDIT COMMITTEE Councilmember Lawrence Stewart Councilmember Lynn McIlhaney Councilmember James Massey Page 2 were evaluating employees’ compliance with purchasing card policies and procedures. This is a significant improvement over last year, when only Police and Parks and Recreation departments had criteria on their performance evaluations related to compliance with city policies and procedures. 2. Audit Recommendation: Purchasing card spending limits should be established that are commensurate with the needs of the cardholder. The City Manager should direct departments to adjust their cardholders’ monthly and single transaction limits based on an evaluation of cardholders’ needs. One way this could be accomplished is to use the automated reporting tools available in the PaymentNet system to perform a spending analysis. The spending analysis may reveal that cardholders’ of similar position have comparable spending needs that require no more than a certain purchasing card threshold. Management Response: The City Manager concurs with this recommendation, and would like to review the spending analysis to be performed. If different spending limits were used, the goal would be to group similar categories of staff together. It would not be feasible for each employee to have a different limit. Audit Follow-up Finding: Each department director submitted to the Department of Fiscal Services recommended changes for each cardholder in their respective department based on the following categories: (1) maximum limit per transaction: $3,000, $1,500, $1,000, and $500 and (2) maximum limit per month $10,000, $5,000, $3,000, and $1,000. As a result, single transaction limits were reduced by $517,929 or 36.2 percent and monthly transaction limits were reduced by $2,067,300 or 41.5 percent. The tables below summarize the changes the city has made with cardholder transaction limits in order to fully implement the audit recommendation. Current Monthly Transactions Limits Category Cards % of Total Amount % of Total $10,000 169 32.6% $1,690,000 57.9% $5,000 159 30.7% $795,000 27.2% $3,000 122 23.6% $366,000 12.5% $1,000 68 13.1% $68,000 2.3% Totals: 518 $2,919,000 Previous Monthly Transactions Limits Category Cards % of Total Amount % of Total $25,000 2 0.4% $50,000 1.0% $10,000 478 92.3% $4,780,000 95.9% $5,000 22 4.2% $110,000 2.2% $4,000 7 1.4% $28,000 0.6% $3,000 5 1.0% $15,000 0.3% $1,000 3 0.6% $3,000 0.1% $300 1 0.2% $300 0.0% Totals: 518 $4,986,300 Current Single Transaction Limit Category Cards % of Total Amount % of Total $2,999 166 32.0% $497,834 55.7% $1,500 156 30.1% $234,000 26.2% $1,000 129 24.9% $129,000 14.4% $500 67 12.9% $33,500 3.7% Totals: 518 $894,334 Previous Single Transaction Limit Category Cards % of Total Amount % of Total $5,000 2 0.4% $10,000 0.7% $2,999 437 84.4% $1,310,563 92.8% $2,000 14 2.7% $28,000 2.0% $1,500 8 1.5% $12,000 0.8% $1,000 45 8.7% $45,000 3.2% $800 3 0.6% $2,400 0.2% $500 8 1.5% $4,000 0.3% $300 1 0.2% $300 0.0% Totals: 518 $1,412,263 Page 3 3. Audit Recommendation: The City Manager should direct department heads to evaluate whether or not all the employees who are issued a card, within their respective departments, need a purchasing card to better perform their essential job duties. Management Response: The City Manager concurs with this recommendation. Please provide a list of employee purchasing card usage which will be provided to department directors to determine if employees need a purchasing card to perform essential job duties. Audit Follow-up Finding: Each department director submitted to the Department of Fiscal Services recommended changes to each cardholder in their respective department. As a result, approximately 85 cards were recommended to be deleted. However, several cardholders were added during this period—resulting in a net decrease of 9 cardholders. Approximately 60 percent of the city workforce was issued a purchasing card when the purchasing card audit was conducted. Currently, approximately 57 percent of the city workforce has been issued a purchasing card. There is evidence of cardholders who are issued purchasing cards that may not need them. For example, I identified 9 cardholders who were issued purchasing cards prior to fiscal year 2008 and did not make any transactions within the fiscal year. Two of these cardholders were issued purchasing cards prior to fiscal year 2007 and did not make any transaction during fiscal year 2007 and fiscal year 2008. Although it is clear that efforts have been made to implement the audit recommendation, there is still room for improvement in this area. 4. Audit Recommendation: The Chief Financial Officer should work with department directors to ensure that (1) there are no cardholders who are approving officials for their supervisors and (2) all approving officials are sufficiently independent and of a sufficient rank to question the cardholder when additional information is needed about specific transactions. Management Response: Management concurs and will establish internal controls that ensure that (1) there are no cardholders who are approving officials for their supervisors and (2) all approving officials are sufficiently independent and of a sufficient rank to question transactions. Audit Follow-up Finding: The Department of Fiscal Services has contacted several individuals and groups to establish better purchasing card transaction approval controls. Corrective measures have been taken in Economic Development, Fire, Fleet, and Communication departments. However, I identified 12 approving officials who were not sufficiently independent and of sufficient rank to question the transactions of cardholders. Several of these approving officials approved transactions of their supervisors within the last 6 months. 5. Audit Recommendation: The Chief Financial Officers should correct situations where the responsibilities of cardholders, approving officials, and program coordinators overlap. Management Response: Management concurs, and will review and establish internal controls that prevent a program administrator (coordinator) from also approving subordinate program administrator transactions. A program administrator is restricted from approving their own transactions. Management will review current internal controls and consider revisions to address the recommendation. Audit Follow-up Finding: The Department of Fiscal Services has taken the corrective action necessary to ensure that the responsibilities of cardholders, approving officials, and program coordinators do not overlap. 6. Audit Recommendation: The purchasing card currently preemptively blocks purchases from six vendor categories not reasonably related to city purchasing needs. The Chief Financial Officer should Page 4 consider additional vendor categories the purchasing card could block in order to further take advantage of preventive controls and minimize the city’s risk exposure. Management Response: Management concurs and will investigate other Merchant Category Code restrictions that could be put on all cards in order to further take advantage of preventative controls and minimize the city’s risk exposure. Management will consider whether restricting certain cards use solely for travel and training would help restrict the number of general procurement cards outstanding. Audit Follow-up Finding: The Department of Fiscal Services has revised the city’s acceptable merchant category code list and has submitted this list JPMorgan Chase. As a result, several additional questionable merchant categories have been blocked from cardholder use. 7. Audit Recommendation: The Chief Financial Officer should implement procedures for purchasing card coordinators to prevent multiple purchasing cards from being issued to an employee who transfers from one department to another. For example, prior to issuing a card, the program coordinator could query the PaymentNet system for a card applicant to see if the employee has already been issued a card. Management Response: Management concurs. Issuing administrators will confirm there are no duplicate entries/cardholder prior to issuing a new card beginning immediately. Audit Follow-up Finding: The Department of Fiscal Services has implemented a procedure of checking each application for duplicate cardholders before a purchasing card is issued. I also reviewed PaymentNet records and verified that there are currently no active cardholders who have been issued multiple purchasing cards. 8. Audit Recommendation: Because transactions are not approved or declined instantaneously based on the number of transactions allowed per day or per month, the Chief Financial Officer should remove this statement from the purchasing card policies and procedures manual. Management Response: Management concurs that the policy should be revised. The procurement policy will be reviewed to determine what changes, if any, should be made to ensure appropriate controls are in place regarding purchasing card transactions. Any revised policy will then be communicated to the organization and implemented. Audit Follow-up Finding: The 2008 Purchasing Manual was revised and the statements noted above have been stricken from the manual as approved on May 15, 2008. 9. Audit Recommendation: The Chief Financial Officer should improve mandatory purchasing card training in the following ways: (1) instruct cardholders on how they should be properly and timely reconciling their purchasing card accounts, (2) stress the importance of keeping purchasing cards signed and in a secure place, (3) present examples of the proper types of documentation necessary to support the legitimate business purpose of purchasing card transactions, and (4) explain the rationale for the necessity of timely review and approval of transactions. Management Response: Management concurs and will develop and implement enhanced purchasing card training for cardholders covering all aspects of the purchasing card program including reconciliation and documentation, and ramifications of non compliance with established policy. These ramifications could include canceling individual cards for non-compliance, and/or securing personal repayment of purchases not in full compliance with policy. Page 5 Audit Follow-up Finding: The Department of Fiscal Services has made significant enhancements to purchasing card training in order to fully implement the audit recommendation. 10. Audit Recommendation: The Chief Financial Officer should consider using additional automated monitoring tools available, such as the declined transaction report or the transaction audit report. The Chief Financial Officer should also consider instructing approving officials to use additional automated tools at various levels throughout the city. Management Response: Management concurs and will enhance staff training on the automated oversight tools available. Audit Follow-up Finding: The Department of Fiscal Services has developed a procedure wherein program administrators furnish the Chief Financial Officer and assistant finance directors with (1) monthly and quarterly usage reports and (2) declined transaction and transaction audit reports on a periodic basis. In addition, missing receipts and unapproved transaction reports are emailed to all directors on a monthly basis.