Controls over the Board's Purchase Card Program Can Be Strengthened

March 28, 2013

We appreciate the opportunity to comment on the draft report of the OIG's audit of the Board's purchase card program. We are pleased that the audit did not identify any fraudulent purchases and that you did not find any weaknesses with the design and operating effectiveness of controls for issuing cards, training new cardholders, and recording and reconciling purchases by cardholders. We concur with the process improvements included in your recommendations and have begun implementing parts of the recommendations. The following comments provide additional perspective on the recommendations and management's planned or completed actions to further enhance our processes and related controls.

Recommendation 1: We recommend that the Director of the Financial Management Division update the Purchase Card Procedures to

• require initial and periodic training for approving officials,
• require periodic training for cardholders,
• ensure that approving officials' responsibilities for reviewing documentation during monthly reviews of cardholders' transactions are aligned with cardholders' responsibilities for retaining documentation on purchases, and
• refer to reports and tools for reconciling transactions provided by the current card issuer.

DFM Response:

Concur. Procurement staff have begun reviewing the Purchase Card Procedures to address the observations discussed in the draft audit report regarding training for, and the responsibilities of, approving officials and cardholders. As part of the updated procedures, the Purchase Card Coordinator will maintain a database of approving officials and cardholders and will notify them of the need for refresher training.

Approving officials and cardholders will be required to sign an acknowledgement form indicating that they received training on their responsibilities, which include requirements for document retention . In addition, approving officials will be required to run and sign the Transaction Detail Report or similar report to validate the purchase card log of the cardholder. As part of the monthly purchase card reviews, the Purchase Card Coordinator will review the Transaction Report to verify that the approving officials are carrying out their duties and responsibilities.

Recommendation 2: We recommend that the Director of the Financial Management Division ensure that the program coordinator

• provides training at regular intervals to approving officials and cardholders to ensure that they are aware of their duties and responsibilities,
•  reviews employee separation reports to maintain an accurate listing of approving officials, and
• conducts sufficient and timely cardholder and division reviews of the Board's purchase card program to ensure compliance with policy and procedures and reduce the risk that unauthorized and fraudulent purchases may go undetected.

DFM Response:

Concur. As noted above, Procurement staff will provide initial and periodic refresher training to approving officials and cardholders to ensure that they are aware of and are carrying out their duties and responsibilities consistent with applicable policies and procedures.

The Purchase Card Coordinator will review the employee transfer and separation report on a regular basis to ensure that an accurate listing of approving officials and cardholders is maintained,and that purchase cards of transferring or separating employees are deactivated in a timely fashion.

To strengthen program oversight, the Purchase Card Coordinator will conduct monthly reviews of two divisions ; depending upon the number of cardholders in a division, the review may include all division cardholders or a single cardholder within the division. We began the monthly review process last month, and the purchase card procedures are currently being revised to clarify the review schedule and requirements. Going forward, when the Purchase Card Coordinator identifies split purchases,the Coordinator will contact the appropriate approving official to note the action in the cardholder's log, monitor the cardholders posted transactions over the next three months, and conduct a random purchase card review within six months to ensure that the cardholder is adhering to the policies and procedures.

Recommendation 3: We recommend that the Director of the Financial Management Division ensure that the program coordinator strengthens the controls to prevent and detect unauthorized purchase card transactions by

• reviewing and updating the list of allowable, flagged, and blocked merchant category codes (MCCs), and
• conducting regular reviews of card issuer reports of suspicious and failed transactions and providing notice to cardholders' managers as appropriate.

DFM Response:

Concur. We agree that a periodic review of MCCs is prudent to (1) identify codes that should be blocked to prevent unallowable purchases and (2) flag other codes that may pose a risk of improper use.The Purchase Card Coordinator will review the MCC listing report semiannually.

The Purchase Card Coordinator will also begin conducting regular reviews of the Unusual Activity Analysis Report, and the Declines Report. Should there be evidence of questionable transactions,the Purchase Card Coordinator will contact the approving official to determine whether the transactions represent appropriate business-related activities.