Procurement Card City Agencies Performance Audit

Transcription

1 Procurement Card City Agencies Performance Audit September 2009 Office of the Auditor Audit Services Division City and County of Denver Dennis J. Gallagher Auditor

2 The Auditor of the City and County of Denver is independently elected by the citizens of Denver. He is responsible for examining and evaluating the operations of City agencies for the purpose of ensuring the proper and efficient use of City resources and providing other audit services and information to City Council, the Mayor and the public to improve all aspects of Denver s government. He also chairs the City s Audit Committee and oversees the City s Comprehensive Annual Financial Report (CAFR) The Audit Committee is chaired by the Auditor and consists of seven members. The Audit Committee assists the Auditor in his oversight responsibilities of the integrity of the City s finances and operations, including the integrity of the City s financial statements. The Audit Committee is structured in a manner that ensures the independent oversight of City operations, thereby enhancing citizen confidence and avoiding any appearance of a conflict of interest. Audit Committee Dennis Gallagher Robert Haddock Charles Husted Timothy O Brien Maurice Goodgaine Jeffrey Hart Bonney Lopez Audit Staff John Carlson, JD, CIA, CICA, Deputy Director Nancy Howe, Internal Audit Supervisor Adeniyi Kelani, Lead Internal Auditor Jessica Quintana, Senior Internal Auditor Brandon Blomquist, Staff Internal Auditor You can obtain free copies of this report by contacting us at: Office of the Auditor 201 W. Colfax Avenue, Dept. 705 Denver CO, (720) Fax (720) Or view an electronic copy by visiting our website at:

3 City and County of Denver Dennis J. Gallagher Auditor 201 West Colfax Ave., Dept. 705 Denver, Colorado FAX September 17, 2009 Mr. Derek Brown, Manager Department of General Services City and County of Denver Dear Mr. Brown: Attached is the Auditor s Office Audit Services Division s report of their audit of the Procurement Card Program City Agencies for the year ending December 31, The purpose of the audit was to determine whether internal controls in place were adequate to reduce the risk of fraud and misuse of procurement cards and to identify potential areas for improvement. No material exceptions were noted as a result of the audit. In fact, audit work found a number of areas in which audit testing resulted in no exceptions. I commend the Purchasing Division on the effectiveness of the controls in place. However, audit work did identify areas where the Division could enhance its controls to further encourage compliance and dissuade misuse and fraudulent use of PCards in the future. If you have any questions, please call Kip Memmott, Director of Audit Services, at Sincerely, DJG/nah Dennis J. Gallagher Auditor cc: Honorable John Hickenlooper, Mayor Honorable Members of City Council Members of Audit Committee Ms. Amy Mueller, Deputy Chief of Staff Mr. Claude Pumilla, Chief Financial Officer Mr. David T. Roberts, Chief Services Officer Mr. David Fine, City Attorney Mr. L. Michael Henry, Staff Director, Board of Ethics Ms. Lauri Dannemiller, City Council Executive Staff Director Ms. Beth Machann, Controller Mr. Jim McIntyre, Director of Purchasing To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

4 City and County of Denver Dennis J. Gallagher Auditor 201 West Colfax Ave., Dept. 705 Denver, Colorado , FAX AUDITOR S REPORT We have completed an audit of the City s procurement card (PCard) program for City agencies for the audit period January 1, 2008 through December 31, The purpose of the audit was to determine whether internal controls in place were adequate under the circumstances, to determine whether PCards were being used in accordance with applicable rules and policies, and to identify possible opportunities for improvement. This performance audit is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, General Powers and Duties of Auditor, and was conducted in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Audit work indicated that the City and County of Denver s PCard program has adequate internal controls in place to reduce the risk of PCard fraud and misuse. However, auditors identified areas where the Purchasing Division could enhance its controls to further encourage compliance and improve controls. We extend our appreciation to the Purchasing Division personnel who assisted and cooperated with us during the audit. Audit Services Division Kip Memmott, MA, CGAP, CICA Director of Audit Services To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people. We will monitor and report on recommendations and progress towards their implementation.

5 TABLE OF CONTENTS EXECUTIVE SUMMARY 1 Existing Controls are Operational and Generally Effective, but Opportunities to Strengthen Them Exist 1 INTRODUCTION & BACKGROUND 2 SCOPE 3 OBJECTIVE 3 METHODOLOGY 3 FINDING 4 Existing Controls are Operational and Generally Effective, but Opportunities to Strengthen Them Exist 4 Controls Related to the Use of PCards Can be Enhanced 5 Executive Order No. 33 and PCard Policies and Procedures Need to be Updated and Enhanced 7 RECOMMENDATIONS 9 AGENCY RESPONSE 11

6

7 EXECUTIVE SUMMARY Existing Controls are Operational and Generally Effective, but Opportunities to Strengthen Them Exist This summary highlights the finding of our performance audit of the Purchasing Division s Procurement Card (PCard) program, which is more fully described in the Finding section beginning on page four. The Purchasing Division s response to our finding is attached and can be found on page eleven. Audit work indicated that the City and County of Denver s PCard program has adequate internal controls in place to reduce the risk of PCard fraud and misuse. However, auditors identified areas where the Purchasing Division could enhance its controls to further encourage compliance and improve controls. Specifically, audit work found limits that can be programmed into individual PCards were not consistently used, that many of the limits were excessive given the cardholders purchase history, and that twelve PCard accounts did not have any transactions posted since the account had been opened. Additionally, auditors found that the Purchasing Division has implemented a pilot shared card (SCard) program that represents additional risk to the City. Audit work also identified areas in which the Purchasing Division s guidance for cardholders could be updated, strengthened and clarified. As a result of audit work, we offer recommendations to assist the Purchasing Division in enhancing internal controls related to PCards. P a g e 1 Office of the Auditor

8 INTRODUCTION & BACKGROUND A Procurement Card (PCard) is a credit card issued to City personnel who, as a part of their job responsibilities, are required to purchase good or services. In 2008, there were approximately 260 employees in the City and County of Denver with PCards. Cardholders are trained and authorized to use PCards to make job-related purchases that do not exceed a predetermined limit. The City s PCard is a MasterCard that was originally offered by Bank One, under the State of Colorado Procurement Card contract. On July 1, 2004, J.P. Morgan Chase & Co. and Bank One Corporation merged to form J.P. Morgan Chase & Co. (J.P. Morgan). J.P. Morgan is the City s current PCard vendor. The Purchasing Division (Purchasing) within the Department of General Services is responsible for administering the PCard program. These responsibilities include approving applications for new PCards and training new cardholders. Agencies are responsible for ensuring purchases are appropriate and job-related. Within the Purchasing Division, the PCard Administrator manages the PCard program for all agencies under the Mayor and independent agencies who request to participate in the PCard program. 1 Each City agency utilizing PCard(s) also has a PCard Coordinator who administers the PCard program at the agency. The City s Executive Order No. 33 governs the use of City PCards. In February, 2003, Executive Order No. 33 established the Delegated Purchasing Authority (DPA). DPA is the authority provided by the Director of Purchasing to agencies under the Mayor to execute minimal dollar and contract-based procurements without the necessity of undergoing formal requisition through the Purchasing Division. 2 Policies and procedures related to the use of PCards are found in the Purchasing Division s Procurement Card User Guide. The City implemented the PCard program to: Reduce the cost of high volume, low dollar amount transactions; Reduce staff time involving purchases; Reduce paperwork; Increase the number of vendors immediately accessible by the City; and Improve management reporting on low dollar amount transactions. 3 1 Executive Order 33B, 1.9 (February 2003). 2 Executive Order 33A, 1.4 (February 2003). 3 City and County of Denver Procurement Card User Guide, page 3. City and County of Denver P a g e 2

9 SCOPE Our audit focused primarily on procedures in place as of December 31, 2008 and transactions occurring from January 1, 2008 through December 31, Some audit work included testing the entire population of transactions in the audit period. Other testing was conducted on a sample of six business units within four City agencies. 4 OBJECTIVE The objectives of this audit were to: Determine whether internal controls in place were adequate to reduce the risk of fraud and misuse of procurement cards; Determine whether procurement cards were being used in accordance with Executive Order No. 33 and the Procurement Card User Guide; and Review best practices to identify potential areas for improvement. METHODOLOGY Several evidence gathering and analysis techniques were used in order to meet the audit objectives, including but not limited to: Using Computer Assisted Audit Tools (CAAT) to review and test more than $8.5 million in transactions for calendar year 2008; Interviewing appropriate agency personnel; Attending the training class the Purchasing Division provides to new cardholders; Contacting J.P. Morgan, the PCard Administrator, PCard Coordinators, and agency management for information regarding charges to PCards; Reviewing supporting documentation maintained at the agencies in the sample, such as receipts or invoices; Evaluating agency compliance with Executive Order No. 33 and the Purchasing Division s Procurement Card User Guide; and Conducting a telephone survey of four cities that utilize PCards, and researching best practices to identify areas for improvement. 5 4 Auditors judgmentally selected the sample by focusing on high dollar amount transactions and a high number of transactions for the size of the agency during the audit period. The sample included the Department of Excise and Licenses, the Mayor s Office of Education and Children, the Mayor s Office of Emergency Management, the Mayor s Office of Financial Management, the Department of Public Works, and the Department of Safety. 5 Auditors judgmentally selected local governments that were similar in size to Denver. Survey participants included San Diego, CA; Orlando, FL; Austin, TX; and Dallas, TX. P a g e 3 Office of the Auditor

10 FINDING Existing Controls are Operational and Generally Effective, but Opportunities to Strengthen Them Exist Internal Controls are Generally Adequate Audit work indicated that the City and County of Denver s Procurement Card (PCard) program has adequate internal controls in place to reduce the risk of PCard fraud and misuse. Audit work included the use of Computer Assisted Audit Tools (CAAT) which enabled auditors to include the entire population of 2008 PCard transactions for some audit testing. Audit testing of the population included the following risk areas where no exceptions were found: Split Purchases Splitting orders or costs to circumvent the transaction limit is prohibited. No split transactions were identified. Transaction Limits The limit on a single purchase of goods or services using PCards is $2,000. Auditors tested the entire population of transactions for the audit period, and did not find any transactions that exceeded this limit without documented approval. Cash Advances The PCard User Guide prohibits using PCards for cash advances. Audit testing of the population of transaction data directly from the J.P. Morgan website found no cash advances. Sales Tax Using CAAT to test more than $8.5 million in transactions, audit work identified approximately $8,000 in sales tax that was paid in 2008 using the PCard. From a sample that included almost $1,900 in potential sales tax payments, audit work found only a single transaction in the amount of $17.37 on which sales tax was paid and not reimbursed to the City. Certain audit procedures were completed on a sample of agencies. Audit testing included the following risk areas where no exceptions were found: Requirements to Obtain a PCard Executive Order No. 33 and the User Guide contain five requirements that must be met before an employee can be issued a PCard. Auditors found full compliance with these requirements in a sample of agencies tested. Cards Used by Someone Other Than the Cardholder According to the User Guide, PCards can only be used by the person whose name appears on the face of the PCard. Audit testing of purchases for the agencies in the sample found that all purchases were made by the appropriate person. Prohibited and Inappropriate Purchases Each PCard has a magnetic strip programmed with descriptive categories of valid or restricted vendors (merchant category codes, or MCC). Testing of all transactions in the audit period found no occurrences of prohibited purchases without proper approval. However, visual review of supporting documentation during testing identified one questionable charge, which is discussed further in the body of the report. City and County of Denver P a g e 4

11 Due Diligence Reports On a quarterly basis, agencies are required to submit a Due Diligence form to the Director of Purchasing that documents their due diligence procedures. Auditors tested one quarter for the agencies in the sample, and found they completed and submitted Due Diligence forms in accordance with Executive Order No. 33. Supporting Documentation The PCard User Guide requires cardholders to retain receipts and reconcile these slips with monthly statements. Audit testing of a sample of agencies found adequate supporting documentation. Separation of Duties This is a control to ensure that no single person has full control of a transaction. Audit work found that the agencies tested had adequate separation of duties. We commend the Purchasing Division on the effectiveness of the controls that have been implemented. However, audit work did identify areas where the Purchasing Division could enhance its controls to further encourage compliance and dissuade misuse or fraudulent use of PCards in the future. Controls Related to the Use of PCards Can be Enhanced While audit testing indicted that controls related to the use of PCards are adequate, auditors identified several areas where enhanced controls could help further reduce the risk of PCard misuse. Transaction Amount Limits are Under Utilized The City s PCards can have certain transaction amount limits programmed into the cards, thereby prohibiting cardholders from making purchases that exceed those limits without approval. Audit review of these limits revealed that 11% of PCards did not have the $2,000 single transaction limit programmed into them. Without this limit, the cardholder is able to exceed the $2,000 limit set out in Executive Order No. 33 without the approval of the Purchasing Division. Even though some accounts did not have the $2,000 single transaction limit programmed in, audit testing found that these cardholders did not exceed this limit in the audit period. Enhanced PCard Controls and Guidance Could Further Improve the Program The Purchasing Division can also program PCards with monthly and daily transaction amount limits. Audit work found that even fewer of these limits were utilized. Specifically, audit testing found that approximately 14% of PCards did not have a monthly transaction limit, and approximately 89% did not have a daily transaction limit. While monthly and daily limits are not established in Executive Order No. 33, a best practices document developed by J.P. Morgan entitled Auditing and Compliance Strategies for a Solid Purchasing Card Program recommends that P a g e 5 Office of the Auditor

12 transaction limits be defined and set on all cardholders. 6 Both monthly and daily limits would provide an additional level of control on the use of PCards. Because monthly and daily limits are already available, they represent a low-cost, automated way to help the Purchasing Division further reduce the opportunity for PCard misuse and fraud. Some Existing Transaction Amount Limits Are Excessive Additionally, audit work found that many of the limits that were programmed into individual PCards were excessive given the cardholders purchase history. For example, 25% of the monthly transaction limits were between $19,157 and $194,268 higher than the amount of the respective cardholders largest aggregate monthly total amount of PCard transactions. As a simpler example, audit work identified a PCard with a $20,000 monthly limit and a 2008 monthly purchase average of $2.11. Additionally, the limit established for daily transactions ranged from $10,000 $50,000. Audit work indicated these limits are too high as there were only seven cardholders whose highest daily expenditure in 2008 exceeded $10,000, and most day-to-day purchases were well below that amount. The effectiveness of transaction amount limits is inhibited if they are set too high. As previously noted, PCard best practices suggest reasonable credit limits on all cards, as these limits serve as a control that helps reduce the risk associated with available credit. Some Active PCards Have Never Been Utilized Audit testing found twelve PCard accounts which were opened prior to the end of the audit period (December 31, 2008), but did not have any transactions posted since the account had been opened. Some accounts had been open as long as five years. The Procurement Card User Guide states that Cards are issued to employees who need to purchase goods and services as part of their job. 7 Before a City employee obtains a card, the employee or agency should have an identifiable need. If a need exists, then cardholders would be expected to have purchases posted to their account. Cards without activity are unlikely to come to the attention of the Purchasing Division, as there is currently no requirement to review cardholders activity levels, and because non-use does not break any law, rule, or policy. However, many of the routine controls that have made the City s PCard program successful can be easily overlooked on accounts that are not expected to post transactions. Unused active PCards create an unnecessary risk to the City in the form of available credit and increase the possibility of improper use. Shared PCard Pilot Program Does Not Have Specific Controls During audit work, auditors discovered that the Purchasing Division has implemented a pilot Shared 6 Auditing and Compliance Strategies for a Solid Purchasing Card Program Industry Leaders Share Real-World Best Practices to Better Control Procurement Spending, J.P. Morgan, page 5. 7 City and County of Denver Procurement Card User Guide, page 6. City and County of Denver P a g e 6

13 Procurement Card (SCard) program. While a PCard is assigned solely to one individual, a shared card is assigned to one employee who is designated as the Shared Card Coordinator. The SCard may be logged out to other personnel on an as-needed basis and can be used by multiple people. The SCard program began in December 2008 and piggybacks off the State Award Procurement Card Program. To date, SCards have been activated for three Divisions within the City s Parks and Recreation Department Community Recreation, Marketing, and Denver Golf Administration. SCards function like PCards in many ways, although some differences exist. For example, personnel using SCards to make purchases are not required to take the training provided by the Purchasing Division. Because SCards do not have a specific employee name on them, their use presents additional risk, and may increase the opportunity for fraud and misuse. The Purchasing Division has implemented several controls regarding SCards. For example, in order to obtain an SCard, the user agency must agree to give up all dispute rights for charges made on the card. However, Purchasing also utilizes some PCard documentation for the SCard program that is not always applicable. For example, although the User Guide serves as the policies and procedures for SCards, it allows only the cardholder whose name appears on the card to use it to make purchases. This does not apply to and directly contradicts how SCards are utilized. Audit work included a benchmarking survey of four local governments that utilize PCards, and none of them reported having a shared card program. If the Purchasing Division decides to make the SCard program permanent, formally including additional controls in policy would help reduce the risks associated with SCards. Executive Order No. 33 and PCard Policies and Procedures Need to be Updated and Enhanced The City s Executive Order No. 33 provides the primary rules and guidance regarding the use of PCards. In addition, the Procurement Card User Guide developed by the Purchasing Division has served as the primary policies and procedures (P&Ps) for cardholders. Audit work identified several ways that both documents could be updated, strengthened and clarified. Control Procedures are Not Mandated For example, auditors noted that the Executive Order does not mandate DPA Due Diligence procedures such as monthly random reviews of transactions. Rather, the Executive Order states that they are suggested best practices provided as guidance. 8 Also, the reconciliation process described in the User Guide is a general description of 8 Executive Order 33B, 7.0 (February 2003). P a g e 7 Office of the Auditor

14 the process. 9 Purchasing s ability to oversee PCard use is hindered when it cannot be sure agencies due diligence procedures are consistent. Guidance in Policy is More Flexible The Executive Order has a list of allowable purchases and purchases not allowed. Guidance such as this might be better suited to incorporation in P&Ps so Purchasing has the flexibility to adjust it as the need arises. Clarity of Policies and Procedures Could be Improved Since it is Purchasing s intent to use the User Guide as P&Ps, it must make this clear to cardholders and update it when needed. Audit work found that some agencies with PCards have additional P&Ps related to the use of PCards, and some do not. Purchasing Division management reported that due to the significant differences among the agencies, it is acceptable and even advisable for agencies to develop additional P&Ps regarding PCard use and oversight. However, clear baseline P&Ps would ensure a consistent minimum level of guidance and control. J.P. Morgan s best practices document recommends that organizations with PCards be consistent when establishing parameters. Only then can rules be enforced without confusion. 10 Clarity Regarding Allowable Purchases May be Needed Audit work also indicated that additional clarity regarding allowable purchases may be needed. During testing at the Mayor s Office for Education and Children, auditors found an instance in which tuition for a college course was paid using a PCard. Although tuition is not listed on either the allowable purchases or the list of purchases not allowed in the User Guide, the PCard Administrator stated that PCards are generally not used to pay tuition. However, the Mayor s Office for Education and Children has a program called Child Care Initiatives. This program promotes quality early childhood education and care through collaboration and resource sharing with local early childhood partners. Through the program, funding is available to early childhood providers who have a fiscal agreement with the City to provide care for low-income families. 11 Funds can be used for professional development opportunities, including college courses, for these providers. The tuition payment identified was for an individual who applied for professional development through the Mayor s Office for Education and Children. Although the payment appears in line with the agency s purpose, it is not clear whether this was an appropriate transaction because the Executive Order is unclear. The City has a wide variety of agencies with even more missions and goals. We acknowledge the difficulty the Purchasing Division faces in striking an appropriate balance between overly broad and overly restrictive definitions regarding what 9 City and County of Denver Procurement Card User Guide, page Auditing and Compliance Strategies for a Solid Purchasing Card Program Industry Leaders Share Real-World Best Practices to Better Control Procurement Spending, J.P. Morgan, page Quality Improvement Fund Overview, Mayor s Office of Education and Children (Revised January 2008). City and County of Denver P a g e 8

15 types of purchases are acceptable. However, current guidelines can result in multiple interpretations regarding what constitutes an appropriate purchase. As the administrator of the City s PCard program, the Purchasing Division is responsible for providing agencies and PCard users with clear guidance. Inadequate or confusing documentation inhibits its ability to ensure PCard purchases are appropriate and oversight practices are adequate. Further, it inhibits the ability of agencies with PCards to adequately oversee their PCard purchases. RECOMMENDATIONS 1. The Purchasing Division should ensure the $2,000 single transaction limit is entered into the card files of all cardholders. 2. Because daily and monthly limits are available and provide another level of control, the Purchasing Division should require daily and monthly transaction limits and ensure J.P. Morgan enters these limits. The limits should be defined by the agency on an individual cardholder basis, and should be justifiable given the purchasing history of the cardholder. For example, an account with a monthly transaction limit of $50,000 and highest aggregate monthly total of $10,000 poses an inherent liability to the City, and the limit should be reduced to be approximately $10, The Purchasing Division should require that the PCard Administrator complete a broad review of PCard accounts on an annual basis. This review should include a review of the number of transactions for each active account, and the reasonableness of the single, daily and monthly limits given the transaction history of the cardholder. For limits that appear excessive, the PCard Administrator should work with the cardholder and the PCard Coordinator at the agency to determine the reasonableness of limits and change them if warranted. The PCard Administrator should also work with agencies to determine if PCards that have no transactions during the given year are still needed. If the PCard is no longer needed, the account should be closed and the card returned to the PCard Administrator. 4. If the Purchasing Division decides to continue the Shared PCard program, it should identify controls to address the increased risk to the City that shared cards represent and formalize them in policies and procedures. 5. The Purchasing Division should take steps to improve the clarity of PCard guidance by clarifying the purpose of Executive Order No. 33 and the User Guide and update them to reflect these purposes. Additionally, Purchasing should evaluate current PCard control practices, and clearly mandate those that it determines are necessary, and periodically update them as needed to reflect changes to the program. P a g e 9 Office of the Auditor

16 6. The Purchasing Division should more clearly define appropriate procurement card purchases when multiple interpretations regarding allowable purchases are possible (e.g., tuition payments). City and County of Denver P a g e 10

17 AGENCY RESPONSE P a g e 11 Office of the Auditor

18 City and County of Denver P a g e 12

19 P a g e 13 Office of the Auditor

20 City and County of Denver P a g e 14