Board Report: 2013-AA-B-006 March 29, 2013
We found that internal controls to ensure that cardholders properly use their purchase cards and comply with the Acquisition policy, the Purchase Card Procedures, and the responsibilities outlined in the Purchase Card Acknowledgment Form were not working as described in the procedures. Specifically, we found that (1) approving officials did not conduct postcertification reviews to approve cardholders' purchases and ensure compliance with policies and procedures, (2) cardholders did not comply with policy and procedures, (3) procedures are incomplete and outdated, and (4) the program coordinator did not conduct monthly reviews of a sample of cardholders' and divisions' purchases. Approving officials were not trained to perform postcertification reviews, and according to the program coordinator, insufficient staff resources along with other procurement-related priorities limited the coordinator's ability to maintain proper oversight and monitor the purchase card program. As a result, management lacks assurance that purchases were authorized and received at the best value. The Board also incurred unnecessary costs due to cardholders' failure to notify vendors of the Board's tax-exempt status.
During our audit, we judgmentally selected a sample of 362 of the 7,325 purchases (approximately 5 percent) totaling $312,023.93, charged during the period of our review, December 31, 2010, to January 1, 2012, made by 25 of the 92 cardholders at the Board, to determine whether approving officials conducted postcertification reviews to approve cardholders' purchases and to ensure that cardholders' purchases complied with the Board's Acquisition policy, Purchase Card Procedures, and the responsibilities outlined on the Purchase Card Acknowledgment Form (see appendix A for details on our scope and methodology). We found that for 13 of the 25 cardholders, approving officials did not perform postcertification reviews as required and did not detect cardholders' noncompliance with the policy and procedures. These reviews were not performed because approving officials were unaware of their responsibilities - training is not provided to approving officials unless they request it. In addition, we found that the program coordinator did not maintain an up-to-date list of approving officials and some cardholders did not know who their approving official was.
Postcertification reviews are a control for detecting unauthorized transactions. Approving officials should conduct these reviews regularly to help ensure cardholder and purchase card program integrity. Each month, approving officials are required to review cardholders' transaction logs of monthly purchases along with supporting documentation to ensure that cardholders made purchases in accordance with the Board's Acquisition policy and Purchase Card Procedures. Approving officials are also required to initial cardholders' transaction logs as evidence of their review and approval of purchases. In addition to verifying that cardholders recorded all of their purchases in a log, approving officials conduct postcertification reviews to determine whether the cardholder
During our transaction testing, we noted that postcertification reviews were not obtained from, or conducted by, approving officials for 13 of the 25 cardholders we interviewed. These cardholders were responsible for 228 of the 362 sampled transactions (approximately 63 percent), totaling $178,951.48. We determined that these cardholders did not obtain the required approval because the cardholders (1) did not know who their approving official was or (2) provided their purchase logs for review, but the approving official did not sign the log. We found that approving officials did not conduct postcertification reviews because they were not aware of their responsibilities. As a result, management lacks assurance that these transactions were authorized.
Because of the absence of approving official reviews and the instances of noncompliance with policy and procedures identified below, we inspected the program coordinator's list of approving officials and surveyed a judgmental sample of 24 listed approving officials to determine whether they had received training on their responsibilities. We found that of the 18 listed approving officials who responded to our survey, 6 indicated that they did not receive any training, 5 indicated that they are no longer approving officials for purchase card transactions, 4 said that they were not assigned approving official responsibilities, and 3 indicated that they could not recall the dates training was provided to them.
We also found that the program coordinator neither periodically updated the approving officials listing with new division designees nor reviewed the Board's separations list to identify approving officials who were separating from the Board to identify replacements. We reviewed the list of approving officials that the program coordinator provided to us and found that it included three employees who had separated from the Board. We provided to the program coordinator for follow up a list of cardholders who could not identify their appropriate approving official. In response to the list that we provided to the program coordinator, he stated that all cardholders should have an approving official, and he assigned approving officials to those cardholders without one. The program coordinator noted that he had not regularly reviewed separation reports to identify separating or separated approving officials because of other procurement-related priorities and the lack of sufficient staff. The program coordinator added that he now has sufficient staff to perform the reviews.
Our testing revealed that 65 of the 362 purchases (approximately 18 percent), made by 20 cardholders, did not comply with one or more policy requirements. Specifically, we found that cardholders (1) did not keep invoices or other purchase confirmation documentation, (2) split purchases into two or more transactions and cumulatively exceeded their single-purchase limits, (3) did not properly inform vendors of the Board's tax exempt policy, (4) did not follow appropriate acquisition procedures for purchases exceeding $5,000, and (5) made three purchases that were not clearly linked to official Board business. Our discussions with these cardholders revealed that some were not aware of their responsibilities while others knew but still did not comply with the policy and procedures. For example, we found that one cardholder did not follow simplified purchasing procedures in order to expedite her transaction.
Cardholders are required to enter a complete description of each purchase and assign the correct accounting code to the transaction during the monthly reconciliation process. Vendors' invoices and other confirmations of purchase are the primary source for this information and should be reconciled with the purchase log, JPMC monthly Statement of Account, and allocation reports to ensure that all transactions are recorded and properly accounted for. In addition, cardholders are required to maintain for three years evidence of all purchases made. During the audit, we found that supporting documentation, such as the invoice or order confirmation, was not maintained for 35 of the 362 purchases (approximately 10 percent), which totaled $32,903.24 (table 1). In general, the eight cardholders responsible for these purchases told us that they received invoices for the purchases they made, but had lost or misplaced some of them. We did not find documentation, in general, that would indicate that an approving official reviewed and signed these cardholders' transaction logs.
| Cardholder | # of transactions tested | Item(s) purchased | Value of transaction(s) | Purchase log reviewed by approving official |
|---|---|---|---|---|
| 1 | 1 | Software maintenance | $2,611.06 | No |
| 2 | 1 | Tool box | 299.01 | No |
| 3 | 1 | Books | 1,115.68 | No |
| 4 | 2 | Uniforms and alterations of uniforms for staff | 6,230 | No |
| 5 | 1 | Laptop | 1,852.88 | Yes |
| 6 | 9 | Safety shoes for staff | 2,165.30 | No |
| 7 | 1 | S&P fact book | 113.37 | No |
| 8a | 19 | Pre-employment screening service, medical supplies, drug testing service, etc. | 18,515.34 | No |
| Total | 35 | $32,903.24 |
a Cardholder said that he transferred from one division to another division in September 2011 and left all of his invoices with another employee in the former division. Personnel from the former division informed the audit team that the division had discarded all of the cardholder's invoices. Return to text
In general, purchase card use is limited to purchases of goods and services costing $5,000 or less. The procedures state that "aggregated purchasing requirements that exceed cardholders' purchasing limits ... shall not be broken down into several purchases that are less than the limit in order to permit use of the government purchase card." To help the Board acquire the highest-quality supplies at the best possible price, purchases that exceed $5,000 should be made in accordance with other appropriate acquisition procedures outlined in the Acquisition policy.
During our testing, we found four purchases totaling $21,591.50 (which represents approximately 7 percent of the total value of purchases sampled) that were split into eight transactions by two cardholders who exceeded their single-purchase limit (table 2). These cardholders indicated that they were aware of the policy prohibiting split purchases and told auditors that they were instructed by a supervisor to split transactions. We provided the details of these transactions to the program coordinator for follow-up action. We did not find evidence to indicate that an approving official reviewed and signed the transaction logs of the cardholders who split their purchases to avoid exceeding their single-purchase limit.
| Cardholder | Transaction date | No. of transactions, same vendor/ same day | Transaction amounts | Description of purchase | Purchase log reviewed by approving official |
|---|---|---|---|---|---|
| 1 | 02/15/2011 | 2 | $2,550.00 each | Software | No |
| 04/13/2011 | 2 | 2,720.00 each | Laptops for two new employees | ||
| 2 | 02/08/2011 | 2 | 4,000.00 and 1,019.90 | Toner | No |
| 07/20/2011 | 2 | 4,888.80 and 1,142.80 | Uniforms | ||
| Total | 8 | $21,591.50 |
We discussed these transactions with the program coordinator, who acknowledged that these transactions should not have occurred. The program coordinator commented that the Procurement section is now fully staffed and will increase the number of monthly audits (cardholder and division reviews) that it performs as part of the section's oversight responsibility to ensure compliance with policies and procedures. As a result of our audit, the program coordinator stated that going forward, when he identifies split purchases, he will ask the appropriate approving official to note the action in the cardholder's log and take steps to ensure that the cardholder does not split future purchases.
The procedures state that cardholders should notify vendors that purchases are for official Board purposes and therefore are not subject to state and local tax. In the case of face-to-face transactions, vendors can verify the Board's tax-exempt status by inspecting the purchase card-the card is stamped "US Govt Tax Exempt" for additional clarification. Vendors can also request a tax-exemption certificate. Nonetheless, we found that 17 of the 362 purchases (approximately 5 percent) made by 14 cardholders included sales tax that totaled $563.31. Three of the 14 cardholders, each accounting for a single purchase, stated that they requested from the vendor a refund of sales taxes paid; however, we did not find any evidence of actual refunds.
Our discussions with cardholders suggest that some were unfamiliar with their responsibilities regarding taxes. For example, two cardholders told auditors that they did not realize that the vendor had added taxes to their purchases; one of the two also said that he was unaware of the Board's tax-exempt status. Another cardholder thought that the vendor would automatically refund the taxes paid.
The policy allows cardholders to use the purchase card for transactions that exceed $5,000 if the transaction is within the cardholder's purchasing limit and the cardholder follows other appropriate acquisition procedures, such as simplified purchase procedures. We used JPMC's Transaction Detail Report to identify single-purchase transactions greater than $5,000 and to determine whether cardholders complied with the Acquisition policy and Purchase Card Procedures. We identified six transactions made by four cardholders that exceeded $5,000. Of these six transactions, we found that two cardholders did not follow simplified purchase procedures or other appropriate acquisition procedures as required.
To determine what the two cardholders purchased, we inspected JPMC's Transaction Detail Report. One of the two cardholders had a single purchase limit of $7,500 and purchased china for a Board dining room costing $5,544.34. In this instance, the cardholder believed that purchases over $5,000 are allowable as long as the purchase did not exceed the cardholder's single purchase limit, so the cardholder did not perform additional required procedures for single purchases over $5,000. The second cardholder had a single purchase limit of $5,000, but made a single purchase of $11,947.50 for 10 user licenses. The cardholder told us that she did not follow simplified purchase procedures because there was insufficient time to complete the transaction before year-end. Although this transaction exceeded this cardholder's purchase limit, we determined that it was processed by JPMC because a single purchase limit was not recorded in JPMC's PaymentNet system when the account was created. According to Board officials, to establish a purchase card account and purchase limit, the program coordinator completes a JPMC paper application for the employee and forwards an electronic version to JPMC for processing. The cardholder's paper application identified $5,000 as her single purchasing limit, but JPMC inadvertently left that field blank.
The purchase cardholder acknowledgement form states that the cardholder agrees to use the purchase card only for official Board business and authorized purchases. During our testing, we found that management in three divisions requested three purchases that were not clearly linked to official Board business.8 According to the program coordinator, cardholders can use their purchase card for certain transactions at the discretion of division management. We found that two of the three purchases were reviewed and approved by approving officials during postcertification reviews, while the third was not reviewed.
During our review, we found that the Board's 2007 Purchase Card Procedures is incomplete and outdated. It does not require training for approving officials, does not align cardholder and approving official responsibilities, and does not require refresher training for cardholders. The procedures refer to Bank of America reports, tools, and software available to cardholders and approving officials (Bank of America previously held the purchase card contract) instead of JPMC PaymentNet reports that are currently available to cardholders. We believe that the program coordinator should revise the procedures to address these issues. During our discussions, the program coordinator commented that the procedures had not been revisited because their primary intent had not changed significantly and because other procurement matters were of higher priority. The program coordinator stated that he is currently revising the procedures to address issues identified in this report.
The procedures include key responsibilities for approving officials that the program coordinator communicates to them during training; however, this training is informal and is only given if requested by the approving official. To determine whether approving officials received training specific to the duties described in the procedures, we (1) inspected the program coordinator's list of approving officials and (2) evaluated the 18 survey responses that we received from approving officials.
According to the survey results, some approving officials did not conduct monthly reviews because they were not aware of their responsibilities. Based on the number of instances we discovered of cardholders' noncompliance with existing procedures, we believe the procedures should require training for approving officials, e.g., the program coordinator should be required to provide approving officials with mandatory training specific to their responsibilities. The program coordinator agreed that providing approving official training would be beneficial and said that plans are underway to start the first class.
In addition, we noted that approving officials' responsibilities, as noted in the procedures, require them to determine whether cardholders maintain backup documentation from the individual requesting a purchase; however, the procedures lack a corresponding requirement for cardholders to request the documentation. Based on these observations, we believe that the procedures should be revised to clarify program requirements. The program coordinator said that he was aware of the inconsistent language in the procedures but did not believe a problem existed because not all Board divisions have the same process for requesting purchases or require requests to be written. The coordinator did agree that the procedures could be clarified to reflect differences in methods for requesting a purchase.
The program coordinator told us he generally provides cardholders refresher training every three years to reinforce required duties and responsibilities and appropriate use of the card. However, we found that not all cardholders received refresher training every three years.
During the audit, we surveyed 49 of the 92 cardholders to determine whether they received refresher training.9 Based on our review of the program coordinator's training log, which identified when cardholders received training during the period 2008 through 2011, and responses from 37 of the 49 cardholders surveyed, we determined that 5 cardholders did not receive refresher training every three years. GSA best practices suggest that program coordinators should establish refresher training for cardholders to prevent cardholder misuse. We believe that the Board's Purchase Card Procedures should include a requirement for periodic refresher training for cardholders and approving officials.
The Procurement section is responsible for implementing key controls that provide oversight over the Board's purchase card program. To ensure that cardholders' purchases are for Board use and are authorized, the program coordinator is required, on a monthly basis, to review a sample of divisions' and cardholders' purchases and report the results to the appropriate official within each division. During our audit, we found that the program coordinator did not perform division and cardholder reviews as required.
According to the procedures, the program coordinator is required to conduct monthly division reviews to determine whether (1) purchase limits are followed, (2) charges are appropriate and do not include personal charges or unauthorized purchases, (3) vendors are rotated sufficiently, and (4) disputed transactions are identified. In addition to division reviews, the program coordinator should review transactions and supporting documentation for one cardholder each month to determine compliance with procedures for purchase card usage and report the results to the cardholder's approving official and senior division officials. During cardholder reviews, the program coordinator is required to inspect purchase logs and purchases receipts and verify supervisory signature approval of the purchase log. If the program coordinator identifies any issues, he should notify the cardholder, division administrator, and the approving official and request a response within 10 days.
The program coordinator did not perform any division reviews during 2011. According to the program coordinator, he did not perform division reviews because of staff shortages within the Procurement section. While we found that the program coordinator performed some cardholder reviews and prepared written summaries, these reviews did not occur at monthly intervals as required. We requested and inspected the results of 2011 cardholder reviews conducted by the program coordinator or members of his staff and discovered that only five cardholder reviews were conducted during the year: two each during March and December, and one during May. The scope of the reviews included an inspection of cardholders' purchase logs, purchase receipts, any correspondence related to transactions on JPMC's Statement of Account Report, and verification of the approving official's signature on the purchase log.
Based on our review of the above-mentioned written summaries, we determined that during the cardholder reviews, the program coordinator discovered that approving officials were not signing purchase logs to show that they had reviewed and approved the purchases listed on the log. In addition, written summaries of the cardholder reviews were not provided to the approving official or other appropriate senior division officials so that corrective action could be taken. The program coordinator did provide written summaries of his staffs' reviews to the Procurement Manager and to the Associate Director for Corporate Services in the Division of Financial Management, but did not provide the summaries to the appropriate approving official, Assistant Director, and Senior Associate Director as required. We discussed the matter with the program coordinator, who acknowledged that his office did not prepare some of the written summaries as required by the procedures. The program coordinator said that he did not have sufficient staff in 2011 to address every requirement in the procedures; however, a new hire has been added to current staff to help manage the purchase card program.
We spoke with the Procurement Manager to determine the expectations for cardholder reviews, and he acknowledged that the program coordinator and staff did not conduct reviews each month. The Procurement Manager attributed the lack of frequency in performing the reviews to other procurement-related priorities, such as technical evaluations of bid proposals for contracts, and to insufficient staff resources.
The lack of division reviews and cardholder reviews, coupled with a reliance on approving officials who were unaware of their responsibilities for reviewing and approving purchase card transactions, increases the risk of not detecting and timely addressing unauthorized and fraudulent transactions. Although we did not find fraudulent transactions in the sample of transactions we tested, we did find instances of noncompliance with existing procedures that were not detected and addressed.
Controls over the Board's purchase card program can be strengthened. Controls for issuing cards and training new cardholders were working as intended, and cardholders reconciled purchases and assigned accounting codes to purchases as required. However, we found that controls implemented to ensure that cardholders properly use purchase cards and comply with policy and procedures were not working as intended. We found that approving officials did not conduct postcertification reviews; several cardholders did not comply with proper use, documentation, and recordkeeping requirements; procedures were incomplete and outdated; and the program coordinator did not perform required cardholder and division reviews.
Our testing did not identify any fraudulent purchases. However, we found that more than 60 percent of the purchases in our sample lacked evidence of approval due to the absence of postcertification reviews. The Financial Management Division should strengthen existing controls to help prevent cardholders from making unauthorized purchases, detect possible card misuse, and ensure that purchase card transactions are recorded and approved in compliance with requirements.
We recommend that the Director of the Division of Financial Management
Regarding recommendation 1, the Division Director stated the following:
Concur. Procurement staff have begun reviewing the Purchase Card Procedures to address the observations discussed in the draft audit report regarding training for, and the responsibilities of, approving officials and cardholders. As part of the updated procedures, the Purchase Card Coordinator will maintain a database of approving officials and cardholders and will notify them of the need for refresher training.
Approving officials and cardholders will be required to sign an acknowledgement form indicating that they received training on their responsibilities, which include requirements for document retention. In addition, approving officials will be required to run and sign the Transaction Detail Report or similar report to validate the purchase card log of the cardholder. As part of the monthly purchase card reviews, the Purchase Card Coordinator will review the Transaction Report to verify that the approving officials are carrying out their duties and responsibilities.
Regarding recommendation 2, the Division Director stated the following:
Concur. As noted above, Procurement staff will provide initial and periodic refresher training to approving officials and cardholders to ensure that they are aware of and are carrying out their duties and responsibilities consistent with applicable policies and procedures.
The Purchase Card Coordinator will review the employee transfer and separation report on a regular basis to ensure that an accurate listing of approving officials and cardholders is maintained, and that purchase cards of transferring or separating employees are deactivated in a timely fashion.
To strengthen program oversight, the Purchase Card Coordinator will conduct monthly reviews of two divisions; depending upon the number of cardholders in a division, the review may include all division cardholders or a single cardholder within the division.
See appendix B for additional management comments related to this recommendation.
In our opinion, the actions described by the Division Director are responsive to our recommendation, and we plan to follow up on the Division's actions to ensure that the recommendation is fully addressed.
