Internal Audit Report. Corporate Cards. July 26, 2001

Transcription

1 July 26, 2001 To: D.L. Hughes D.L. Hardy C.J. Chan J. P. Ashurst H.D. Harris J.E. Gemmill P. Kundur K.G. Peterson Group Controllers G.N. Sherlock D.A. Harrison M. Costello (Summary) Finance Committee(Summary) Internal Audit Report Corporate Cards AU0203CG Audit Services Prepared by: P.J. Howard S. Krogh A.Y. Lee

2 Internal Audit Report Corporate Cards TABLE OF CONTENTS EXECUTIVE SUMMARY...1 BACKGROUND...1 OBJECTIVE...1 SCOPE...2 CONCLUSION...2 COMPLIANCE WITH CORPORATE POLICIES...4 OBSERVATION...4 RECOMMENDATION...6 MANAGEMENT ACTION PLAN...7 USE OF THE PEOPLESOFT EXPENSE MODULE...9 OBSERVATION...9 RECOMMENDATION...12 MANAGEMENT ACTION PLAN...13 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS...14 RECOMMENDATION...14 MANAGEMENT ACTION PLAN...14

3 EXECUTIVE SUMMARY Background BC Hydro employees use corporate cards for business and travel expenses as well as for non-stock purchases under $5,000. In the past year, most of BC Hydro switched from three different cards to a single corporate card. Presently there are 2,934 cards issued to employees. Approximately 70% of these employees are set up to process their expenses online using PeopleSoft expenses, while the remaining employees process their expenses manually. In March 2001, $1.9 million was spent using the corporate card representing 12,390 transactions. Just over 50% of the expenses were for business and travel while the remaining expenses were for non-stock items. Cards are issued to employees after completion of an application with the employee acknowledging they have read corporate policy and will not use the cards for personal expenses. BC Hydro pays the corporate card balance for all employees each month. Employees are required to substantiate the expenses paid by submitting expense claims either online using PeopleSoft expenses or a written expense claim. Managers are to ensure the propriety of individual transactions as part of the approval process and to ensure that cards are cancelled for terminated employees. The Business Expense Claims Corporate Policy Statement, supported by Purchasing Policies and the Controller s Division Bulletins on Employee Expense Sheet Requirements, provide guidelines on allowable business expenses, and requirements for preparation and submission of an expense sheet or claim. Objective The audit objectives were to provide assurances to management that: Expenses incurred on the corporate card are in compliance with corporate policies; Expenses are being submitted and approved on a timely basis; and Management is being provided with the necessary reports to review department expenses. Corporate Cards Internal Audit Report Page 1 of 18

4 EXECUTIVE SUMMARY Scope The scope of the review included: An analytical review of corporate card expenses by merchant code and employee. A review of expenses for compliance with policy. A review of the process for the submission and approval of expense claims using the new corporate card. A review of the analytical tools and reports provided to management from the PeopleSoft system. Conclusion A review of 326 expense claims identified that 68% of the claims either had expenditures that were not compliant with policy, or were submitted incomplete or late. Our major concerns include: Employee recognition expenditures have increased in many areas of the organization. We noted that SBU guidelines and practices are no longer restricted to the purchase of lunch or dinner as stated in corporate policies. Entertainment expenses of one subsidiary exceed other areas of the organization. Previous recommendations to develop principles and further guidelines to support entertainment expenditures have not been addressed. Instances of personal use of corporate cards were identified, resulting in BC Hydro funding personal expenditures until payment is received from the employee. There is considerable disparity in the completeness of supporting documentation for non-stock items purchased using corporate cards. Corporate Cards Internal Audit Report Page 2 of 18

5 EXECUTIVE SUMMARY We noted ten instances where invoices were split to avoid the card s $5,000 single transaction limit. As well, for approximately thirty employees, the single transaction limit had been raised above $5,000, exceeding the existing purchasing policy limits. Acceptance of the PeopleSoft Expenses module, as well as the capabilities and requirements of users varies throughout the organization. Training issues, difficulties using PeopleSoft Expenses, and the low priority of some employees to submit expense claims has resulted in lengthy delays in the submission and approval of some expense claims. Our key control concerns include: Many expense sheets do not adequately support expenses claimed, as they are incomplete, or contain erroneous information, either due to a lack of guidance or due care. A process is not in place to ensure that expense claims are approved within established authority limits. Delegates are often used to both prepare claims and approve them online using their manager s password and identification. Without delegates being authorized and assigned their own unique identification, the actual identity of individuals approving expense claims can not be established. Payments are made directly to the employee s bank account for approved incidental expenses. Given the extensive sharing of approval authority, and ease of approval, this access to cash should be scrutinized to avoid error or irregularity. Management exception reports to support effective control and provide relevant information have not been developed. Our detailed comments follow in the next section. Corporate Cards Internal Audit Report Page 3 of 18

6 Compliance with Corporate Policies Observation Expenses, for the period from July 2000 until January 2001, were selected from a transaction listing obtained from the bank and expense sheets from the PeopleSoft system. High dollar value items, expenses with unusual merchant codes, expenses incurred on holidays, employees with large balances, and a random sample of other claims were selected for review. From the review of 326 expense claims, we identified that 68% of the claims included one or more exceptions related to either expenditures not compliant with policy or submission of an incomplete or late expense claim. The most common exceptions included: not submitting receipts for all expenses (22%), not listing meal participants (12%), late submission of expenses (11%) and local purchases between $1,000 and $5,000 that were not supported by tendering documentation (9%). Policies have been updated to reflect the use of the new corporate card, however further clarification is required with respect to some types of expenditures and the preparation of expense claims. Entertainment and Recognition Expenses Expenditures for employee recognition have increased in many areas of the organization. Corporate policy identifies that employees extra effort may be rewarded with a reasonable lunch or dinner. However, we found that gift certificates and merchandise that far exceed the cost of a lunch or dinner are being purchased to reward performance. We also found that entertainment and staff recognition expenses of one subsidiary exceeded other areas of the organization, but since there is little policy guidance on entertainment principles, the propriety of these claims is difficult to assess. Further policy guidance was recommended in the March 1999 Employee Expense Claim audit, but to date no subsidiary guidelines have been developed. Corporate policy identifies that theatre and sporting events must be pre-approved but does not provide overall direction on customer appreciation events. Corporate Cards Internal Audit Report Page 4 of 18

7 Compliance with Corporate Policies Personal Expenses BC Hydro corporate policy identifies that no personal expenses are to be incurred on the card however numerous personal expenses are being incurred by employees. With the direct payment of the corporate card balance each month this results in BC Hydro funding personal purchases. Examples range from the purchase of antique furniture in November 2000 costing $4,500 with subsequent repayment by the employee in January 2001 to smaller items such as parking charges or groceries. As well, we found three uncashed cheques filed with the receipts or attached to submitted claims that were intended to cover personal expenses. Since Disbursement Services had not found the cheques, BC Hydro still has incurred the expense. In October 2000, Toronto Dominion Visa cards were cancelled for all BC Hydro employees and any employees that had been using the card for personal expenses had to immediately clear the outstanding balance. In at least one instance, this created some hardship for the employee. In our opinion, more aggressive measures should be taken to provide a clear message to employees that the use of the corporate card for personal expenses is prohibited. Non-Stock Purchases Fifty percent of the corporate card purchases are for non-stock purchases such as small tools and equipment. Many of the corporate card users with the highest card usage are purchasing non-stock items. As with business and travel expenses, each purchase must be entered on the expense sheet with a business reason and supporting documentation sent to accounts payable. However, due to the large volume, which can exceed 40 items, the entry of a business reason for each item can be a time consuming process with little value added. Providing documentation for numerous non-stock items can be onerous as well. In addition to the receipt, documentation for non-stock purchases can include tendering requirements, receiving reports and warranty information. Also, if there is potential that an item may need to be returned or is under warranty, Corporate Cards Internal Audit Report Page 5 of 18

8 Compliance with Corporate Policies employees question whether supporting documentation for a purchase should be submitted to Disbursement Services as is currently required or remain in the department. As such, there is considerable disparity in the preparation of nonstock expense claims and the submission of supporting receipts. Expenses Exceeding $5,000 Corporate policy identifies that non-stock purchases are not to exceed $5,000. However, we identified several instances where purchase invoices were split to avoid the $5,000 limit. As well, six cases were found where individual transactions exceeded the $5,000 limit. In each instance, the credit limit for the cardholder had been raised above $5,000, which enabled the cardholder to purchase non-stock items in excess of corporate policy limits for local purchases. Completion of Expense Forms and Submission of Receipts Individuals not yet online must prepare a manual expense sheet supported by the corporate card statement and receipts. Our testing identified that expense sheets were rarely prepared. In most cases, coding was merely added to the corporate card statement with little or no documentation of the business purpose provided. Many of the statements were submitted without receipts attached for all transactions. Recommendation To ensure that all employee expense claims are valid and appropriate, we recommend the following: Review current corporate and subsidiary policies and guidelines related to employee recognition expenses. Clarify or develop policy to address current inconsistencies. Develop policy related to entertainment expenses for Hydro and subsidiaries. Strengthen the action to deal with and collect from employees who use corporate cards for personal expenses. Corporate Cards Internal Audit Report Page 6 of 18

9 Compliance with Corporate Policies Review the requirements for submission of supporting documentation and completion of expense sheets for the purchase of non-stock items. Ensure that management is only approving expense claims that have all receipts attached and provide a business reason for each expense. Review the issuance of corporate cards which allow single purchases to exceed $5,000 to ensure that they do not contravene current purchasing policy requiring a purchase order be issued for expenses exceeding $5,000. Management Action Plan It is management s opinion that the findings indicate the primary cause of many issues as either a lack of awareness to policies and procedures by both card users and approvers, and/or insufficient attention to following and enforcing policies and procedures i.e., accountability. Best practice organizations put full responsibility on card users and approvers to follow policies and procedures and non-compliance results in severe consequences. In addition the findings indicate that some issues are attributable to specific policies and procedures, processes and PeopleSoft Expenses application functionality. To address the issues, actions are being planned around four areas: Accountability, Policy and Procedures, Process and System (systems will be expanded upon in the Use of PeopleSoft Expense Module section). Accountability Accountability will be reviewed to assess what actions could be taken to strengthen individual s understanding of their accountabilities to follow policies and procedures and to ensure accountabilities are effectively enforced. The review will be completed by December Corporate Cards Internal Audit Report Page 7 of 18

10 Compliance with Corporate Policies Policy and Procedures Policy and/or procedural issues relating to employee recognition, entertainment expenses, supporting documentation and purchase limits will be reviewed to determine what changes need to be made and what supplementary information needs to be added. The review will be completed by December Process Process issues are often connected to accountability, policy and procedures and systems. Consequently as these are enhanced, processes will also change. In addition continuous process improvements will be implemented. These will also impact current processes. As such communication and training around processes is considered to be an ongoing exercise. To address process related issues specifically identified in the report the following actions are proposed: 1. Current processes will be reviewed to determine what changes need to be made; and 2. An Expenses Bulletin highlighting key problem areas, relevant policies and procedures, user and approver responsibilities and Internet locations where documentation resides will be developed. The bulletin will be distributed to all corporate cardholders and communicated to all users and approvers taking release 8 Travel & Expenses training in the fall of The action to be taken for each specific recommendation is included in the Summary of Recommendations and Management Plans. Corporate Cards Internal Audit Report Page 8 of 18

11 Use of PeopleSoft Expense Module Observation Acceptance of the PeopleSoft Expenses module, as well as the capabilities and requirements of users varies throughout the organization. Training issues, difficulties using PeopleSoft Expenses, and the low priority given by some employees to submit expense claims have resulted in lengthy delays in the submission and approval of some expense claims. In response to these issues, a decision was made in March by the Process Owners to stabilize the system before more users were added and to provide additional training to assist employees in the preparation of expense claims. Other areas of concern or difficulties in using PeopleSoft Expenses encountered during this audit include: Submission of Expense Claims BC Hydro pays the total balance due to the credit card company each month, records the payment to a clearing account and notifies the employees that corporate card transactions are available for processing. The controller s bulletins requires that expenses be submitted, through the mail or online, within seven days of the receipt of the corporate card statement. When the employee submits an expense claim, an accounting entry is made to reduce the clearing account balance and charge the appropriate expense accounts. Individuals using PeopleSoft are required to download the corporate card expenses, enter their expense claim information online and submit the receipts in an envelope to Disbursement Services. While we noted that some employees are diligent in inputting expense information to generate complete and accurate expense sheets, we found some expense sheets to be of questionable quality. Examples of improperly prepared claims included incomplete entries, duplication, incomplete descriptions for expenditures, and incorrect coding. We also identified that meal participants were not recorded in the system as per policy. PeopleSoft Expenses requests that meal participants are recorded, but listing the names (especially a long list) is difficult to enter in the system. Moreover, if a meal is included on a hotel bill, recording attendees is not possible Corporate Cards Internal Audit Report Page 9 of 18

12 Use of PeopleSoft Expense Module online. The entry of this information needs to be clarified and in particular how to record a large group of attendees. Employees are to submit their receipts in an envelope to Disbursement Services, but locating envelopes for the selected expense sheet was often difficult. In some cases the department was holding the envelopes, while other envelopes could not be located in Disbursement Services. Even when the envelopes were located, many receipts for both the corporate card and incidental expenses were missing including receipts for expenses exceeding $100. In some cases, the employee identified on the PeopleSoft system that receipts were not available. Online Approval The PeopleSoft Expenses module requires that all expense sheets be approved online. However, the system does not verify that the approver has the appropriate level of authority as delegated in the signing authority. A degree of control is established by the card s single transaction limit, but depending upon the monthly credit limit for the card, individual expense claims could be as high as $50,000. With these limits, it is necessary that a control be in place to ensure that approvers reviewing particularly large claims have the appropriate authority. The program allows for incidental expenses paid by the employee to be incorporated into the expense claim and approved online. Once an expense claim is approved, an automatic deposit is made to the employee s bank account. Given the potential risk of an input error being made by an employee and approved or the misuse of a manager s password by a delegate, we recommend a further control be implemented to ensure that large payments over a given amount are reviewed prior to disbursement. Use of Delegates Rather than have each employee use the online system as was initially intended, several departments have appointed delegates to both prepare and approve claims online. In some cases, a delegate enters the expenses for the employee and then signs on as the manager to approve the expenses. In other cases, an employee completes the expense claim and a delegate approves the claim using the computer identification of the approver. Corporate Cards Internal Audit Report Page 10 of 18

13 Use of PeopleSoft Expense Module While the use of delegates is a sensible approach for processing and approving claims, the delegates should be using their own password with the appropriate delegated authority. Further, they should be provided with clear instruction and training on their duties and responsibilities as a delegate. Clearing Account Due to the difficulties in using PeopleSoft Expenses and the low priority some employees place on expense claims, claims are not being submitted in a timely manner and the clearing account balance is growing. The balance in the clearing account was over $2 million at the end of February for employees not yet using PeopleSoft and was $0.4 million for employees online. Given that the majority of these new corporate cards were issued only 5-6 months prior, there is a concern that when more cards are issued, the growth in the clearing account will accelerate significantly unless expense claims are processed in a more timely manner. Consideration should be given to suspending card privileges for individuals who do not process their claims in a timely manner. Notifying employees that new corporate card transactions are available for review and notifying the approver that expenses require approval could help to reduce the delay in submitting expense claims. This could be accomplished through the use of Workflow which automatically routes information and provides reminders in the PeopleSoft system, however there was an earlier decision by the Steering Committee to defer its implementation given the customization required to meet BC Hydro needs. In response to the outstanding transactions, the Group Controllers have recently begun reviewing a monthly report and notifying employees to address the outstanding transactions. Management Reporting Certain management reports identified as being a useful component of the system have not been developed. As well, while some basic reports are available, managers rarely use them. Reports are not available for managers to address delays in processing, review approval of expenses within their department, confirm employees currently assigned a corporate card, review the signing hierarchy within the system, or to analyse expenses charged to the Corporate Cards Internal Audit Report Page 11 of 18

14 Use of PeopleSoft Expense Module department by expense type. If reports are to be of use, they need to focus on exceptions and be readily available to the manager. Recommendation To improve the acceptance of the PeopleSoft System and to ensure that adequacy of controls, we recommend the following: Re-emphasize the requirements for the preparation of expense sheets and adherence by all business units to the established standards. Review the requirement for the documentation of meal participants in PeopleSoft. Re-emphasize the requirement to submit envelopes to Disbursement Services and follow-up on missing envelopes with a brief message to the employee. Develop a report for review by the Corporate Card Administrator or Disbursement Services to ensure appropriate approval levels and determine whether a delegate is entering the approval. Implement a process to review incidental expenses exceeding a set amount before disbursement. Provide further training and instructions to delegates. Communicate to approvers that delegates should not access the system using the identification and password of the approver but instead require the delegate to obtain appropriate access and approval levels through Financial Systems and Disbursement Services. Provide approving managers with reports on an exception basis summarizing delays in processing, department approvals and expenses. Take appropriate action with individuals who continually fail to process their claims in a timely fashion. Re-evaluate the use of PeopleSoft workflow with subsequent upgrades to help reduce the delay in submitting expense claims. Corporate Cards Internal Audit Report Page 12 of 18

15 Use of PeopleSoft Expense Module Management Action Plan As in the Compliance with Corporate Policies section, a number of the issues identified in this section are connected to accountability, policy and procedures and processes. The proposed actions around these areas are outlined in that section of the report and also included in the Summary of Recommendations and Management Plans. For system related issues, the objective is to continually implement enhanced functionality and enable process improvements. A cross Business Unit Expenses Special Interest Group has been established to assist in providing direction and prioritizing enhancements. Currently Expenses is being upgraded to Release 8, in the fall all Expense System Users will receive training on the new application. During the training it is proposed that Expenses Bulletin items relating to accountability, policies and procedures and processes be communicated. With the significant amount of systems work in progress including the Release 8 upgrade, Finance Business Transformation and Portal Work Management and Supply Chain projects, it is proposed that only production critical enhancements will be implemented over the next 18 months. The action to be taken for each specific recommendation is included in the Summary of Recommendations and Management Plans. Corporate Cards Internal Audit Report Page 13 of 18

16 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS Recommendation Management Action Plan To address the issues, actions are being planned around four areas: Accountability, Policy and Procedures, Process and System. Accountability Accountability will be reviewed to assess what actions could be taken to strengthen individual s understanding of their accountabilities to follow policies and procedures and to ensure accountabilities are effectively enforced. The review will be completed by December Policy and Procedures Policy and/or procedural issues relating to employee recognition, entertainment expenses, supporting documentation and purchase limits will be reviewed to determine what changes need to be made and what supplementary information needs to be added. The review will be completed by December Process To address process related issues specifically identified in the report the following actions are proposed: 1. Current processes will be reviewed to determine what changes need to be made; and Corporate Cards Internal Audit Report Page 14 of 18

17 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS Recommendation Management Action Plan 2. An Expenses Bulletin highlighting key problem areas, relevant policies and procedures, user and approver responsibilities and Internet locations where documentation resides will be developed. The bulletin will be distributed to all corporate cardholders and communicated to all users and approvers taking release 8 Travel & Expenses training in the fall of Systems With the significant amount of systems work in progress it is proposed that only production critical enhancements will be implemented over the next 18 months. Compliance with Corporate Policies Review current corporate and subsidiary policies and guidelines related to employee recognition expenses. Clarify or develop policy to address current inconsistencies. A review of the employee recognition expenses will be included in the Policy and Procedure review. Any changes will be communicated through training and Expenses Bulletins. Develop policy related to entertainment expenses for Hydro and subsidiaries. Strengthen the action to deal with and collect from employees who use corporate cards for personal expenses. A review of the entertainment expenses will be included in the Policy and Procedure review. Any changes will be communicated through training and Expenses Bulletins. The misuse of the corporate cards will be communicated through training and Expenses Bulletins. The collection of outstanding amounts will be included in the Process review. Actions to deal with misuse will be included in the Accountability review. Corporate Cards Internal Audit Report Page 15 of 18

18 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS Recommendation Review the requirements for submission of supporting documentation and completion of expense sheets for the purchase of non-stock items. Ensure that management is only approving expense claims that have all receipts attached and provide a business reason for each expense. Review the issuance of corporate cards which allow single purchases to exceed $5,000 to ensure that they do not contravene current purchasing policy requiring a purchase order be issued for expenses exceeding $5,000. Management Action Plan Clarification of the requirements for non-stock items will be included in the Policy and Procedure review. Final supporting documentation requirements will be included in the Process review and communicated through training and Expenses Bulletins. Receipts are required for both manual and system prepared expense claims. This will be communicated through training and Expenses Bulletins. This will be included in the Policy and Procedure review. Use of PeopleSoft Expenses Re-emphasize the requirements for the preparation of expense sheets and adherence by all business units to the established standards. Review the requirement for the documentation of meal participants in PeopleSoft. Re-emphasize the requirement to submit envelopes to Disbursement Services and followup on missing envelopes with a brief message to the employee. Preparation requirements will be included in the process review and communicated through training and Expenses Bulletins. The handling of meal participants will be included in the policy and procedure review. Any process changes will be communicated through training and Expenses Bulletins. Process requirements will be included in the process review and communicated through training and Expenses Bulletins. Corporate Cards Internal Audit Report Page 16 of 18

19 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS Recommendation Develop a report for review by the Corporate Card Administrator or Disbursement Services to ensure appropriate approval levels and determine whether a delegate is entering the approval. Management Action Plan There is no link between ODMS signing authorities and limits and the expense application. However, approvers and their delegates are securely linked to the department they can approve. Approver and delegate signing authority will be communicated through training and Expenses Bulletins. Given this is system related, no action is planned until after November Until then the approver for a specific claim can be identified from the expense system at the claim level however it does not identify whether it is an approver or delegate. Implement a process to review incidental expenses exceeding a set amount before disbursement. Provide further training and instructions to delegates. Communicate to approvers that delegates should not access the system using the identification and password of the approver but instead require the delegate to obtain appropriate access and approval levels through Financial Systems and Disbursement Services. Provide approving managers with reports on an exception basis summarizing delays in processing, department approvals and expenses. Incidental expenses will be included in the process review. Any process changes will be communicated through training and Expenses Bulletins. Further training and instructions will be incorporated in the Release 8 training and will be included Expense Bulletins. The Expense Special Interest Group is reviewing Release 8 web reports. A monthly report already exists for overdue credit card transactions. The report is distributed to Group Controllers. The development of further reports is system related and no additional action is planned until November Corporate Cards Internal Audit Report Page 17 of 18

20 SUMMARY OF RECOMMENDATIONS AND MANAGEMENT PLANS Recommendation Take appropriate action with individuals who continually fail to process their claims in a timely fashion. Re-evaluate the use of PeopleSoft workflow with subsequent upgrades to help reduce the delay in submitting expense claims. Management Action Plan Process requirements will be communicated through training and Expenses Bulletins. Card Privileges will be included in the Accountability review. The revaluation of the use of PeopleSoft workflow will be considered after November A process has been implemented where all users get an notification when monthly transactions are available. This is similar to the workflow functionality. The requirement to notify approvers of ready to approve claims will be communicated through training and Expense Bulletins. Corporate Cards Internal Audit Report Page 18 of 18