REPORT ON AN AUDIT OF THE CITY'S PURCHASE CARD PROGRAM AUDIT PROJECT #9914

Transcription

1 REPORT ON AN AUDIT OF THE CITY'S PURCHASE CARD PROGRAM AUDIT PROJECT #9914 Jim Carpenter Acting Audit Manager Auditor-In-Charge Beth Breier, CPA, CISA Senior Auditor Roberta McManus, CPA, CIA, CGFO Interim City Auditor AUDITING DEPARTMENT November 1999

2

3 Table of Contents TABLE OF CONTENTS I. SCOPE AND OBJECTIVES... 1 II. METHODOLOGY... 2 III. BACKGROUND... 4 IV. CONDITION STATEMENTS AND MANAGEMENT ACTION PLANS... 8 A. Planning Issues Management should establish additional performance measures to ensure continued success of the Purchase Card Program and the efficient use of City resources Management needs to address the lag time from transaction date to posting date in the new FMS, which can be as long as 40 days in the current process B. Control Issues Administrative procedures need to be developed for the Purchase Card Program to help departments implement and operate the Program All departments should establish internal controls (separation of duties) to ensure that no one person can order, approve, and reconcile a Purchase card transaction All departments should review their internal controls over purchasing to address issues of duplicate billings C. Additional Issues Guidelines should be established regarding local meals and food to ensure compliance with the spirit and the letter of the law V. EXIT CONFERENCE i

4

5 Scope and Objectives I. SCOPE AND OBJECTIVES Our audit plan included a review of the City of Tallahassee s Purchase Card (P-card) Program. Our audit period was from February 1998 to June Our primary objectives were to review the implementation of the Program and determine whether: there are adequate internal controls in place related to the P- card Program, and P-card purchases have been made properly and comply with City policies and procedures. Audit of the City s Purchase Card Program 1

6 Mehtodology II. METHODOLOGY Our review was conducted in accordance with generally accepted government auditing standards and accordingly included such tests of the records and such other auditing procedures as we considered necessary under the circumstances. This audit was conducted under the authority of Section 33 of the Tallahassee City Charter and in accordance with our audit work plan. We reviewed the program implementation process by examining the P-card application, the process and procedures used to phase in the departmental implementation, departmental and employee training, and the process of distributing P-cards to employees. We selected random samples of transactions from the InfoSpan (P-card application system provided by Bank of America) database to determine the adequacy of internal controls and assess whether P-card purchases were made in compliance with City policies and procedures. Our samples and tests were selected and designed to determine whether: P-card purchases, including those classified as high risk and those over $9,000, were made properly, approved, and documented; current cardholders in InfoSpan were also current cardholders per the Bank of America; cardholder spending and transaction limits were appropriate for the cardholder s position; purchases were made from vendors with restricted Merchant Category Codes, as defined by the City; 2 Audit of the City s Purchase Card Program

7 Methodology purchase cards were being shared among employees; multiple transactions occurred on the same day with the same vendor; InfoSpan users had appropriate capabilities to ensure proper segregation of duties; and the P-card department representatives were satisfied with the Program. Audit of the City s Purchase Card Program 3

8 Background III. BACKGROUND The Purchase Card (P-card) Program was initiated during early The first purchase card transaction took place in July 1998, and the Program was considered in full implementation by October The initial goal of the P-card was to enhance the purchasing process for small dollar purchases. The expected benefits were to reduce: paperwork requirements to make small purchases; employees time and effort to complete small purchase transactions; and delays in physically acquiring small purchase items, after authorization of the purchase. A P-card is assigned to an individual and can be used in place of purchase orders. Each card is assigned: 1) a single transaction limit, and 2) a spending limit per monthly billing period. The P-card Program does not change the City s nor the department s purchase authorization, payment, or competition requirements. It is each department s responsibility to monitor and ensure compliance with the procurement rules. The Implementation Stage of the P-card Program Process is scheduled to be completed by September 30, A Financial and Systems Analyst has been in charge during the implementation stage. There is also a Program Administrator. The current administrative procedures to perform many of the steps are considered a work in progress and have not been finalized or documented. These are expected to be completed by December 31, The maintenance stage is scheduled to begin on October 1, Audit of the City s Purchase Card Program

9 Background As of August 31, 1999, there are 28 departments in the City that have either implemented the P-card or are in the process of implementing it. Implemented Auditing City Commission City Manager s Office Organizational Support Customer Services Economic Development Electric Fire Gas Growth Management Human Resources Legal Not Yet Implemented Equal Opportunity Aviation Solid Waste Energy Services DMA - Procurement Services DMA - Acct/Budget/Administration DMA - ISS Neighborhood & Community Services Parks & Recreation Planning Police Public Works Taltran Treasurer-Clerk Utility Billing Services Water & Sewer The City Commission approved the request of the Department of Management & Administration (DMA) to submit an application to Bank of America (formerly NationsBank) on April 22, The City submitted their application on April 27, 1998, through an agreement with the State of Florida. Per the agreement, the bank provides application software at no cost to the City, charges no service fees, and will pay the City (through the State of Florida) an annual rebate of.4% of the net purchase volume, if net purchase volume is at least $100,000 and the City's account is in good standing (makes timely payments). The first year s rebate will be approximately $7,400. By September 30, 1999, the City had issued 600 active P-cards to employees. Audit of the City s Purchase Card Program 5

10 Background On the City s application to Bank of America, the Program Administrator had estimated that the City would: have annual expenditures between $5-8 million, limit per transaction amounts to $5,000, have an average small dollar transaction amount of $200, and have 300 cards active at full implementation. During the period of July 1998 through June 1999, the City: purchased a total of $2,294,691 (10,782 purchase transactions), implemented per transaction limits of $10,000, averaged $212 per transaction, and distributed 601 cards to employees (552 active cards). As can be seen in Chart 1 the implementation of the P-card Program has considerably reduced the number of purchase orders under $1,000 over the previous year. Likewise, Chart 2 shows a decrease in the number of purchase orders for less than $10,000 over the previous year and an increase in the number of P-card transactions. 6 Audit of the City s Purchase Card Program

11 Background Chart 1 - Transactions Under $1, Number of Purchase Orders Number of P-card Transactions 0 Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun 0 Purchase Orders Purchase Orders Purchase Card Chart 2 - Transactions Under $10, Number of Purchase Orders Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Number of P-card Transactions Purchase Orders Purchase Orders Purchase Card Audit of the City s Purchase Card Program 7

12 Condition Statements and Management Action Plans IV. CONDITION STATEMENTS AND MANAGEMENT ACTION PLANS Some internal controls over the P-card Program need improvement. Management responsibilities for operating programs are in four broad areas: planning, organizing, directing and controlling. We identified two areas in the administration and operation of the P-card Program where improvements could be made: planning and controlling. The specific opportunities for improvement in these areas are addressed in the condition statements below. During our review of transactions, we identified the need for the City to establish policies and procedures regarding the purchase of food. A. Planning Issues Documentation of the planning associated with the implementation of the P- card Program could be improved by: establishing additional performance measures to ensure continued success of the P-card Program and the efficient use of City resources, and addressing the transaction lag time from transaction date to posting date in the current FMS, which can be as long as 40 days. Each condition below discusses how planning can be improved to ensure the achievement of the operational objectives of the P-card Program. 8 Audit of the City s Purchase Card Program

13 Condition Statements and Management Action Plans 1. Management should establish additional performance measures to ensure continued success of the Purchase Card Program and the efficient use of City resources. Internal Control Guidelines (Administrative Policies and Procedures #630) recognize the usefulness of performance measures by stating that performance indicators that relate different sets of operations or financial data to one another should be periodically analyzed to determine the success of programs. While our survey of department representatives of the P-card Program indicated a high level of satisfaction with the Program, this does not preclude the need for performance measures. According to the GAO, in an effective performance management approach, measures are not used for assigning blame or to unknowingly comply with reporting requirements. 1 Quite simply, they are used to create and facilitate action to improve performance. Measures and performance information must link to strategic management processes. An effective performance management system produces information that delivers the following benefits: provides an early warning indicator of problems, and the effectiveness of corrective action; provides input to resource allocation and planning; and provides periodic feedback on the product or service. 1 United States General Accounting Office (GAO/AIMD-98-89) Executive Guide, Measuring Performance and Demonstrating Results of Information Technology Investments. Audit of the City s Purchase Card Program 9

14 Condition Statements and Management Action Plans Current performance measures focus on the volume of transactions, number of cardholders, and dollar amount of purchases. Additional performance measures could focus on Program results. For example, if the desired goal (performance output) is to increase the percent of small dollar P-card transactions (under $10,000) to 70% of all transactions, then the performance measure of this goal could be {number of P-card purchases under $10,000} divided by {total number of purchases under $10,000}. Chart 3 shows the percent of purchases under $10,000 with the P-card. The performance measure would provide management additional information as to whether or not the Program was achieving its goal. Chart 3 - Percent of Purchase Card Transactions Under $10,000 (August June 1999) 60% 50% 40% 30% 20% 10% 0% Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun The Program Administrator needs to establish additional performance measures to monitor the progress of the Program and ensure goals are achieved. 2. Management needs to address the lag time from transaction date to posting date in the new FMS, which can be as long as 40 days in the current process. 10 Audit of the City s Purchase Card Program

15 Condition Statements and Management Action Plans P-card transactions are downloaded to the City s P-card application system (InfoSpan) on a daily basis. Departmental staff access InfoSpan and code transactions to the appropriate general ledger codes and expense categories. The transactions are then uploaded to the City s FMS at the end of each monthly billing cycle, creating a lag time from transaction date to posting date of up to 40 days. Because money for the P-card expenditures is not encumbered, the departments are required to closely monitor their expenditures. As we visited the departments to review charges, we noticed that many departments use dual record keeping systems in order to keep up-to-date financial information. We found that P-card transactions were recorded in Excel spreadsheets or separate databases that were then added to current FMS records to monitor year end budgets. Departments need to have the ability to continuously monitor their budgets without maintaining multiple sources of information. Ideally, FMS would be updated daily with Purchase card transactions; or alternately, the ad hoc reporting system in InfoSpan could be used to prepare reports on transactions that would reduce the need for other databases. Management needs to explore the capabilities of the new FMS to update financial information for P-card transactions on a more timely basis or determine if other ways of providing departments with P-card financial data is feasible. The Program Administrator has developed the following action plan to ensure that planning for the implementation and operation of the P-card Program is improved. Audit of the City s Purchase Card Program 11

16 Condition Statements and Management Action Plans Objective: To improve the planning processes for the P-card Program. Step # Action/Task Responsible Employee Target Date 1. Develop additional Purchase Card Program Cathy 12/31/99 performance measures. Kilpatrick 2. Approve performance measures. David Reid 1/31/00 3. Review the new FMS and evaluate whether it will Cathy 3/31/00 reduce the lag time from transaction date to posting date in FMS or evaluate alternative systems to reduce the lag time. Kilpatrick/ Glenn Guertin 4. Implement a process to address the lag time for P- card transactions. David Reid 10/1/00 B. Control Issues We found there were opportunities to improve the controls over the P-card Program. The City s Internal Control Policy (#220CP) and Internal Control Guidelines (#630) address the role of policies and procedures in the system of internal administrative and accounting control required of all departments. The fact that InfoSpan and FMS log the cardholder for each transaction is a compensating control element that helps mitigate some of the risks associated with the P-card Program. Specific control issues identified are discussed below. 12 Audit of the City s Purchase Card Program

17 Condition Statements and Management Action Plans 1. Administrative procedures need to be developed for the Purchase Card Program to help departments implement and operate the Program. The Internal Control Guidelines (Administrative Policies and Procedures #630) recognize that administrative directives such as policies and procedures are a control activity and are necessary to communicate management philosophy and operating style to employees. Originally, P-card Program administrative policies and procedures were scheduled to be issued in October of The Financial and Systems Analyst indicates that they are now scheduled for completion at the end of December Policies establish the organization s direction, while procedures indicate how policies are to be implemented and followed. As policies and procedures are developed and organized into a standards manual, they can be tied directly to program goals and objectives. Sound policies and procedures provide benchmarks against which compliance can be measured and contribute to an effective control environment. Once the program policies and procedures are established, the Program Administrator can selectively review departmental charges and records and offer suggestions for best practices to improve documentation and record keeping. 2. All departments should establish internal controls (separation of duties) to ensure that no one person can order, approve, and reconcile a Purchase card transaction. Internal Control Guidelines (Administrative Policies and Procedures #630) identify segregation of key duties as a control activity necessary to reduce the risk Audit of the City s Purchase Card Program 13

18 Condition Statements and Management Action Plans of error or inappropriate actions. The guidelines state that no one individual should control all key aspects of a transaction or event. Key duties include: authorizing transactions, approving transactions, recording transactions, and reconciling transactions. During our tests of transactions, we identified 4 of 12 departments that did not have documented evidence of approval of the transactions. Furthermore, we identified 38 cardholders who also have input capability into InfoSpan, a clear lack of separation of duties. The Department of Management & Administration has provided guidance and assistance to departments so that adequate internal controls can be established. These internal controls provide for separation of duties or ensure that someone other than the cardholder approves the transaction. Controls that could be implemented to address the separation of duties at the department level include: review of cardholder monthly statements by managers, review of monthly reports from InfoSpan, reduced access to InfoSpan, and/or removal of card from cardholder if the cardholder can input data into InfoSpan. 14 Audit of the City s Purchase Card Program

19 Condition Statements and Management Action Plans = 3. All departments should review their internal controls over purchasing to address issues of duplicate billings. The Internal Control Policy (#220CP) provides that the City shall have an adequate system of internal control to provide reasonable assurance that funds are safeguarded against waste, fraud and abuse. Through our tests, we identified isolated cases (three transactions totaling $13.20) where invoices were paid with a Purchase card and again through the purchase order system. The department was able to get a refund from the vendor for the full amount. The vendor recommended that the City require all vendors to indicate on the invoice the method of payment. As part of the Program Administrative Procedures, each department should notify vendors that the method of payment should be included on each invoice. The Program Administrator has developed the following action plan to ensure that control processes for the operation of the P-card Program are improved. Objective: To improve the control processes for the P-card Program. Step # Action/Task Responsible Employee Target Date 1. Conduct periodic reviews of departments to Glenn Guertin 10/31/99 examine departmental internal controls related to segregation of duties and duplicate payments. 2. Develop Purchase Card Program administrative Glenn Guertin 12/31/99 procedures. 3. Revise cardholder guidelines to include a Glenn Guertin 12/31/99 requirement to notify vendors to include method of payment on all invoices. 4. Approve and issue administrative procedures. Cathy Kilpatrick 12/31/99 Audit of the City s Purchase Card Program 15

20 Condition Statements and Management Action Plans C. Additional Issues During our fieldwork we reviewed transactions made with the P-card for meals and food. We found that there are no guidelines that outline when disbursements for meals and food are appropriate. 1. Guidelines should be established regarding local meals and food to ensure compliance with the spirit and the letter of the law. Over the period July 1, 1998, through July 4, 1999, (end of the June billing period) cardholders charged over $33,000 for local meals and food. We reviewed 79 of these P-card transactions for local meals and food totaling $6,534. Documentation available from the departments indicated the purposes for the food and meals included: pastries for grand opening of a fire house, lunch while attending training, food for in-service training for volunteers, public meeting snacks, bagels for breakfast meeting, emergency work meal allowance, staff meeting snacks, special event planning lunch, going away reception, pre-meeting and after meeting meals, staff appreciation meal, and meal during work meeting. Generally, each expenditure for meals included at least one or more City employees and sometimes one or more persons not employed by the City. 16 Audit of the City s Purchase Card Program

21 Condition Statements and Management Action Plans Section , Florida Statutes, provides the authority for entities to pay for meals while an employee is in travel status. This Statute specifically includes cities within its scope. Furthermore, Attorney General Opinion #79-76 indicates that it is well settled that expenses incurred in attending conventions or meetings not for a public purpose may not be allowed. City Ordinance (Chapter 2, Article III, Section 2-47 through Section 2-55) addresses travel by City personnel. This is the only ordinance that covers meals and miscellaneous expenses. Personnel Policies (Chapter , Section C.) provides for meal allowances where employees are required to work for extended periods of time without relief, usually because of emergency circumstances. In these cases department directors may authorize the provision of meals at City expense. The policy goes on to state that where this is a regular situation, the department should establish rules covering meal allowances. At each department included in our testing, we requested staff to provide rules that would cover the provision of meals and miscellaneous expenses. None of the 12 departments had established additional rules covering meal allowances specific to their department. The Department of Management & Administration has agreed to develop guidelines regarding local meals and entertainment expenses. The following action plan has been developed to ensure the appropriateness of meal and food expenditures. Objective: To improve internal control over purchases. Step Action/Task Responsible Target # Employee Date 1. Develop guidelines for departments to follow for David Reid/ 1/31/00 Audit of the City s Purchase Card Program 17

22 Condition Statements and Management Action Plans meal allowances and other miscellaneous expenses. Beckye Simpson 18 Audit of the City s Purchase Card Program

23 Exit Conference V. EXIT CONFERENCE An exit conference was held on October 19,1999. Those attending were: Department of Management & Administration David C. Reid, Director Beckye Simpson, Manager - Budget & Policy Dinah R. Hart, Administrative Services Manager Vincent Gerheim, Financial & Systems Analyst Cathy R. Kilpatrick, Manager - Administrative Services & Procurement Glenn Guertin, Supervisor-Procurement/Contract Administrator Joan Austin, Administrative Specialist I Auditing Department Roberta McManus, Interim City Auditor James Carpenter, Acting Audit Manager Beth Breier, Senior Auditor Audit of the City s Purchase Card Program 19