A REPORT FROM THE OFFICE OF INTERNAL AUDIT

Transcription

1 A REPORT FROM THE OFFICE OF INTERNAL AUDIT PRESENTED TO THE CITY COUNCIL CITY OF BOISE, IDAHO AUDIT / TASK: #11-09 S2, P-Card Purchasing Review AUDIT CLIENT: DFA / Cross-Functional REPORT DATE: December 22, 2011 AUDIT GRADE: Low Satisfactory REPORT AUTHOR: APPROVED FOR RELEASE: Steven Rehn CIA, CFSA Steven Rehn CIA, CFSA AUTHORITY: Boise City Code, FY2011 Work Plan

2 Task #11-09 Series 2, P-Card Purchasing Review Date of Audit: July 22, 2011 INTRODUCTION Purchasing Cards, hereafter referred to as P-Cards, are designed to facilitate the purchase of goods and services by City employees. Although the card is one of several purchasing options used by the City, the card s advantage is realized through the efficiencies it brings to the purchasing process. Efficiencies are realized through the reduction in time and costs required to gain approvals; to process requisitions, purchase orders, and invoices; and to produce checks most of which occur when more traditional purchasing methods are employed. When compared to prior audits, P-Card usage noted this year reflects an increase in total spending, total number of transactions, number of participating employees, average dollars per transaction, average spending per card, and average number of transactions per card. (See Exhibit A, attached.) As currently envisioned, use of this purchasing medium will likely increase substantially as the City migrates to a new ERP platform, and business processes are updated and streamlined in order to gain efficiencies. However, P-Card programs are also generally recognized as being inherently more risky than other purchasing processes. Accordingly, a sophisticated set of control processes and procedures should be in place and functioning in order to mitigate risks, and to avoid the potential for misuse of the cards. Within the City of Boise, those control measures include the following: Formal application and approval processes for card applicants; Periodic training and certification of approved cardholders; Regulations covering card use; Established overall credit limits, as well as single-purchase transaction limits on all cards; Established limits on the number of transactions allowed per day; Prohibitions on transactions with certain un-approved vendors, based on the Merchant Classification Code (MCC) used by the vendors; Review and approval processes for all purchase transactions by designated personnel; and, Periodic account activity reviews by central P-Card administrators. Due to the risk profile generally presented by P-Card programs, Internal Audit schedules an annual review of this activity in order to detect divergence from established program parameters and / or from industry-recognized best practice. 2

3 Overall, it appears that purchase activities within the Purchasing Card program are occurring as intended, and the City continues to realize increasing economies through this method of acquisition. SCOPE AND METHODOLOGIES Internal Audit established a scope period of one year duration subsequent to the last P-Card review. This period included all P-Card transactions that were present in billing cycles from May 2010 to May Purchase transactions dated between May 8, 2010 and May 7, 2011 were subject to review. The detailed objectives established for the review consisted of the following: Good or services purchased with the cards supported the mission of the department for which it was acquired Use of P-Cards did not circumvent formal purchasing processes P-Cards were issued under proper authorization by departments Systemic restrictions on P-Cards were in place and functioning New and existing cardholders have received training in card use P-Card accounts were closed and cards captured promptly from terminated employees Internal Audit employed various methodologies during the review which included staff interviews, the review of associated documentation, and testing of activities surrounding P-Card purchases. The methods employed and the evidentiary materials developed were deemed to be adequate to support the conclusions contained within this report. 3

4 EVALUATION AND COMMENTS Based on the review performed, it appears that administrative controls and processes that facilitate expenditures transacted under P-Card Program Regulations are functioning in a Low Satisfactory manner. The evaluation scale used by Internal Audit in assigning grades to audits defines one of the key attributes of a Low Satisfactory level of performance as: issues exist within the audited area, and are encountered frequently enough to lose the appearance of isolated... Systems of internal control appear to be marginally adequate at best Audit s testing resulted in the discovery that one of the key control mechanisms that should have been in place in the bank s systems was not. No improper purchases appear to have occurred as a result, but the risk of occurrence was present. Also, another important process related to the capture / deactivation of cards upon employee termination was also noted to be deficient. To recap our testing, we performed the following: Reviewed 16,629 transactions for compliance with purchasing processes Reviewed 329 cards for compliance with various transaction limits i.e. number of purchases, dollar amounts, and Merchant restrictions Detail tested 100 transactions for propriety Detail tested 69 cardholders for training in P-Card usage, and compliance with card issuance guidelines Tested the time elapsed between employee terminations, and card capture / card account deactivation In brief, goods and services that were acquired during the period under review appeared to support the function of the department for which they were purchased. Purchases were generally transacted in accordance with established control limits, and card holders appear to have attained the certification required in order to obtain and to use City P-Cards. Internal Audit did not note any activities that appeared to be indicative of abuse in the P-Card program. We did, however, discover base-level deficiencies in two critical aspects of the control structure that require immediate management attention and corrective action. Our detailed findings and observations appear in the following report sections. (Refer to Exhibit B for additional details concerning Internal Audit s existing grading scale.) 4

5 FINDINGS AND RECOMMENDATIONS Audit s Findings are detailed below; including any recommendations that were made, and management s responses to those suggestions. 1. P-CARD ACCOUNT CLOSURE AND CARD CAPTURE As a best practice, purchasing cards should be collected and closed promptly after a cardholder terminates employment with the City. However, it appears that cards are not being closed within a reasonable time after employment termination based on the testing of employment terminations and card closures dated May 8, 2010 through May 7, Internal Audit detected 10 terminations where cardholder accounts were not deactivated timely. The elapsed time between termination and account deactivation for these 10 cards ranged from 4 days to 81 days. RECOMMENDATION Internal Audit recommends management review card capture and card closure practices, and implement strategies to reduce the time it takes to close employee cards post-termination. Establishment and observance of written formal procedures that result in timely capture of cards when employees are terminated is critical to ensure policies are followed and the likelihood of fraud, waste, and abuse is minimized. MANAGEMENT RESPONSE DFA-Accounting concurs with Internal Audit s position that timely purchasing card termination is an important internal control in managing the City s P-Card program. The business practice within the Division has always been to deactivate a user upon receipt of notification from departments when an employee is terminated. The goal within F&A- Accounting has always been to reconcile the canceling of purchasing cards to employee terminations on a monthly basis. In actual practice, this has often occurred on a bimonthly basis. On a go forward basis, the Division will work to ensure that all the P-Cards for terminated employees are closed within 48 hours of receiving notification from the departmental P-Card liaison. Furthermore, DFA- Accounting issued a memorandum to all City P-Card liaisons reiterating the Purchasing Card Program Regulation requirements of timely notification to Finance and Administration when terminations of employees who have had P-Card privileges occur. 5

6 2. SYSTEM CONTROLS During testing of P-Card transactions dated May 8, 2010 through May 7, 2011, Internal Audit identified a purchase transacted with a Merchant Category Code (MCC) that was prohibited according to documentation sourced from program administration. Follow up by the program administrator revealed an apparent breakdown either during, or subsequent to the set up of MCC prohibitions on card profiles. The exact cause of the breakdown may not be determinable. Because of this condition, a group of MCC prohibitions desired by management was not present on the system, and apparently had not been in place and active during some portion of, or perhaps all of, the period under review. While Internal Audit detected only one transaction that occurred in association with the prohibited list, (that transaction was ultimately deemed to be appropriate), the general population of cardholders was afforded the opportunity to purchase goods and services outside of the program s defined parameters. The potential for misuse of the cards was present. RECOMMENDATION Internal Audit recommends that management work with the card-issuer (the bank) to ensure that all intended MCC prohibitions are activated in the system. These control mechanisms help ensure the City is presented with a level of risk that is consistent with management s wishes. MANAGEMENT RESPONSE DFA-Accounting concurs with Internal Audit s finding and contention that maintaining a listing of prohibited Merchant Classification Codes (MCC) on the card issuer electronic banking platform is an important preventative internal control. After reviewing the historical P-card setup correspondence between DFA-Accounting and the card issuer, it is believed that a listing of prohibited MCC s was originally setup for the migration to a new P-card processor during April The event that caused the removal of the original code setup cannot presently be determined. Currently, DFA-Accounting is working with the card issuer to once again block a series of twenty (20) prohibited MCC s from P-Card use. As an additional detective control, the P-Card Administrator will scan transactions and monitor banking system controls on a quarterly basis to help ensure that the prohibited MCC codes are still in effect. The City Controller will be updated as to the results of this testing and/or findings each quarter in order to take corrective action where warranted. 6

7 OTHER AREAS OF CONCERN Internal Audit utilizes Other Areas of Concern to comment on issues noted during a project that appear to deserve management attention at some level. P-CARD REGULATIONS / PROGRAM OPERATIONS To be effective, the internal control framework surrounding the purchase card program should be aligned with program policies and procedures. These guidance documents are a critical component of the framework, and minimize the likelihood of fraud, misuse, and abuse in the system. Internal controls help provide reasonable assurance that the objectives of the function are being achieved. Based on discussions with management and subsequent audit field work, it appears the internal control framework supporting the program is significantly different than the framework outlined in program regulations; actual operations of the program do not align with regulation, and vice-versa. The adoption of a new card-issuer system has resulted in greater exchange of information between departments and program administrators. As a result, the purchasing process has been streamlined; and many of the control mechanisms and procedural steps involved in card system management that are mentioned in the regulation have become outdated. Significant change in the program has led to a divergence between the control framework and the associated regulations and procedures. Therefore, Internal Audit is renewing its recommendation from 2010 that management align internal control policies, procedures, and activities with the goals and objectives for the function; and revise guidance documents to minimize risk. We recognize that additional changes to the P-Card program are likely to be forthcoming as a result of the new ERP system that is currently in the planning / configuration stages. However, management should provide card users with a basic level of program guidance in order to ensure consistency in card usage and administration. MANAGEMENT PARTICIPANTS Debbie Broughton, CFO / City of Boise Mollie Holt, Manager / Financial Services 7

8 EXHIBIT A Purchasing Card Usage Statistics Total Transaction Dollars Average Dollars per Transaction # Active Cards Average Spending per Card Average Transactions per Card Total # of Month Transactions May , , Jun , , Jul , , Aug , , Sep , , Oct , , Nov , , Dec , , Jan , , , Feb , , , Mar , , , Apr , , , Total $1,807, ,731 n/a n/a n/a n/a Period Monthly Average Prior Period Monthly Average* $272, ,394 $ $ $150, ,071 $ $ Change 44.69% 23.19% 27.15% 12.59% 35.97% 12.16% * Average program statistics for the twelve (12) month period immediately preceding the period under review. 8

9 EXHIBIT B Evaluation and Grading of Audits Each audit will be evaluated or graded, and will receive one of the five following ratings. Grades will be assigned based on the perceived best fit. Thus, not all attributes associated with an assigned grade may be present within a given Department or Division. High Satisfactory No significant weaknesses or deficiencies were noted during the audit. If any issues were noted, they were clearly insignificant or inconsequential. The audited area displays a high degree of control and management oversight is effective. Satisfactory Reportable issues may exist within the audited area, but they are not deemed to be representative of pattern or practice within the area. Issues are typically of an isolated nature. Overall, systems of internal control are effective, and management oversight is adequate and supportive of the accomplishment of goals and objectives. Low Satisfactory Reportable issues exist within the audited area, and are encountered frequently enough to lose the appearance of isolated. Systems of internal control appear to be marginally adequate at best. Management oversight is not always effective to ensure the quality of operations. Needs Improvement Weaknesses or deficiencies are encountered on a relatively frequent basis within the audited entity or function. Issues noted, and their frequency, are suggestive of a pattern or practice of inadequate oversight. Internal control mechanisms may not be universally in place, implemented, or actively observed. Management oversight is weak, or is not always effective. Unsatisfactory Material or significant deficiencies are noted within the operations under review. Issues may pose risks that are either missioncritical or mission-fatal. Management has failed to implement appropriate internal controls. Management oversight is ineffective, absent, or willfully avoided. 9