KAREN E. RUSHING. Audit of Purchasing Card Program

Transcription

1 KAREN E. RUSHING Clerk of the Circuit Court and County Comptroller Audit of Purchasing Card Program Audit Services Jeanette L. Phillips, CPA, CGFO, CIG Director of Internal Audit and Inspector General David Beirau, CFE, CIGA Manager of Audit Services William Bousman Internal Auditor/Investigator August 2015

2 TABLE OF CONTENTS Page Executive Summary 3 Summary and Results 4 Opportunities for Improvement and 7 Page 2

3 Executive Summary As part of the Annual Audit Plan, the Clerk of Circuit Court and County Comptroller s Internal Audit Department and Office of the Inspector General conducted a continuous audit of the Purchasing Card Program (P- Card). Continuous audits have narrowly defined scopes, are conducted on a reoccurring basis to identify risks and test controls, and result in timely notification of gaps and weaknesses. The purchasing card application reflected a total of 315 active P-Cards as of April 2015, with a monthly credit limit totaling $8,810,028. The Independent Auditor reviewed approximately 20,000 P-Card transactions with a total value of roughly $6 million. Data analytic software was used to identify transactions that were characteristic of prohibitive purchases. The Independent Auditor sampled and reviewed, by exception, various types of P- Card purchases. The Independent Auditor reviewed the processes for assigning and deactivating P- Cards. The Independent Auditor reviewed the process for P-Card single transaction limit and credit limit increases or decreases. Previously, a P-Card audit was completed during July 2011 (Project County Purchasing Card Usage) and the results of that audit identified three (3) Opportunities for Improvement related to: split transactions, purchasing thresholds, and policy weaknesses. The Opportunities for Improvement identified in the current audit, were not similar to those noted in the previous audit. Opportunities for Improvement COMPLIANCE Identified seven (7) duplicate invoices submitted, approved, and paid by a single cardholder for a single vendor. Identified twelve (12) prohibited purchases, including capital assets, postage, and computer equipment. Identified one (1) instance of non-compliance with the P-Card Manual regarding timely deactivation of P-Cards. Identified one (1) instance of non-compliance with Florida Statute (2)(b) related to annual Statement of Financial Interest requirements. REPORTING / MONITORING Monthly Spend Analysis reports are not available for audit in nine (9) of twelve (12) months. PROCESS IMPROVEMENT Standard Operating Procedures need to be created for several areas related to the P- Card process. P-Card training program for Business Unit Managers and Directors must be created. Purchasing Card Suspension Notification Forms require proper document retention. Communication between Human Resources department and the P-Card Administrator regarding suspended employees or employees on extended leave must be enhanced. Standard time frame for temporary single transaction limit, credit limit, and card profile changes must be established. P-Card Manual must address the justification for maximum single transaction limit and credit limit increases. Segregation of duties must exist within the process of modifying the single transaction limit, credit limit, and card profile. Electronic cardholder files for access and retention should be created. Page 3

4 Summary and Results The Clerk of the Circuit Court and County Comptroller s Internal Audit Department and Office of the Inspector General has completed an audit of the purchasing card program. The scope of a continuous audit is very narrow and is performed on a recurring basis. A continuous audit provides for regular testing of controls, identifies risks, and results in timely notification of gaps and weaknesses to allow for managements follow-up and remediation. The audit was planned and conducted in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The purpose of the audit was to review internal controls and test compliance with applicable laws, rules, policies and procedures related to purchasing cards. Background A Purchasing Card (P-Card) is a payment method that streamlines procure-to-pay processes for increased efficiencies and cost savings. The Procurement Official is responsible for establishment of organizational policies governing the use of P-Cards and the administration of the County s Purchasing Card Program. A P-Card Manual has been established by the Procurement Official in order to explain and facilitate an understanding of the policies, procedures, roles and responsibilities related to the Purchasing Card Program. All purchases made on P-Cards are subject to the policies and procedures contained in County Ordinance No , Article VI, Chapter 2 (the Procurement Code). Purchasing Card Process Cardholder makes purchase & obtains receipts Bank authorizes or declines purchase Vendor is paid by Bank Bank transmits transaction to purchasing card application daily Cardholder approves and forwards receipts to Account Coordinator Cardholder reviews transactions with Coordinator and signs the billing statement Account Coordinator prepares and approves monthly reconciliation package P Card Business Unit Manager reviews transactions and approves monthly reconciliation package Director reviews transactions and approves monthly reconciliation package P Card Account Coordinator forwards reconciliation package to Clerk of Court Finance Clerk of Court Finance verifies transactions to statement and pays Bank P Card Administrator performs monthly spending analysis Page 4

5 P-Cards are assigned to authorized employees after a P-Card Business Unit Manager makes a request and the P-Card Administrator approves the request. P-Cards are generally set with a single transaction limit of $5,000 and a monthly transaction limit of $25,000; however limits do vary based on activity and need of each department. A limited number of P-Cards with single transaction limits above $20,000 have been assigned for use during emergencies. As of April 2015, there were a total of 315 active P-Cards assigned to County employees with a monthly transaction limit of $8,810,028. Of the 315 P-Cards assigned to County employees, the County utilizes the following transaction limits: Number of P-Cards Single Transaction Limit 28 Suspended to Credit Limit of $1 1 $500 1 $1,000 1 $2, $3, $5, $10,000 3 $25,000 2 $50,000 2 $75,000 Number of P-Cards Monthly Transaction Limit 28 Suspended to Credit Limit of $1 3 $5,000 9 $10, $20, $25, $50,000 9 $100,000 2 $500,000 Between the post dates of October 1, 2013 and September 30, 2014 there were a total of 19,891 purchasing card transactions totaling $5.86 million. The purchasing card application is a web-based application. The County utilizes the application to order new P-Cards, modify single transaction limits and credit limits, review and report information from P-Card transactions, suspend or revoke P-Cards, and electronically approve transactions by cardholders. Cardholders making purchases must adhere to the cardholder responsibilities listed in Chapter 2 of the P-Card Manual. They are required to utilize the County s tax exempt status, collect itemized receipts for each purchase, record the account number or project to be charged, and review and approve charges in the purchasing card application with their P-Card Account Coordinator at least monthly. During the monthly review process the Cardholder signs the billing statement, within the reconciliation packet, to acknowledge the transactions purchased on the Cardholder s P-Card. Page 5

6 The P-Card Account Coordinator reconciles purchases made on P-Cards for their specified group of Cardholders. The P-Card Account Coordinator reviews monthly statements with Cardholders, verifies account codes for each transaction, matches receipts to monthly statements, and compiles a reconciled packet to the Business Unit Manager and Director for review and approval. The reconciliation packet contains a statement of acknowledgement that states I certify that I am authorized to approve this expenditure and that the funds are being spent for a public purpose, in conformance with County Purchasing procedures and vendor contracts, and without overspending the applicable account or fund of the County budget. This statement is signed by the P-Card Account Coordinator, Business Unit Manager, and Director. The Finance Department receives the reconciliation packet and performs the final verification of receipts and charges, prior to payment to the bank. If questioned items are identified at this stage, they are flagged in the purchasing card application and the Cardholder, P-Card Account Coordinator, Business Unit Manager, and the P-Card Administrator are responsible for resolution. Objectives, Scope and Methodology The objectives of this audit were to determine if internal controls are operating effectively related to the Sarasota County Purchasing Card Program and if purchases made on County purchasing cards are in compliance with applicable laws, rules, policies and procedures. To meet the objectives of the audit, the procedures performed included, but were not limited to, the following: Obtained an understanding of the Sarasota County P-Card Manual, County Ordinance No and the Procurement Manual. Performed a walkthrough of the P-Card Administrators functions. Performed inquiries of county personnel. Reviewed and tested documentation relating to policies and procedures, split transactions, prohibited purchases, deactivation of P-Cards, and annual Statement of Financial Interest disclosure. Evaluated the internal controls related to the P-Card process, such as policies and procedures, issuance of P-Cards, deactivation of P-Cards, and P-Card training. Identified opportunities for improvement. Overall Results Based on the procedures performed, the County has an opportunity to enhance its internal controls specifically related to the Purchasing Card program s compliance, monitoring, and processes. Additionally, there are processes that lack documented Standard Operating Procedures. These areas are detailed in the Opportunities for Improvement section of this report. Page 6

7 Opportunities for Improvement The audit disclosed certain policies, procedures, and/or practices that could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the Opportunities for Improvement presented in this report may not be all-inclusive of areas where improvement may be needed. Thirteen (13) observations and recommendations related to communicating risk and control information to appropriate areas of the organization [Standard 2110], the effectiveness of controls, particularly the effectiveness and efficiency of operations and programs; safeguarding of assets; and compliance with laws, regulations, policies, procedures, and contracts [2130.A1] follow: 1. Duplicate invoices submitted, approved, and paid 2. Purchases prohibited on a P-Card 3. Non-Compliance with the P-Card Manual regarding timely deactivation of P-Cards 4. Non-Compliance with Florida Statute 5. Spend Analysis reports are not available for audit 6. Lack of Standard Operating Procedures for certain areas related to the P-Card process 7. Training program for Business Unit Managers and Directors related to P-Cards does not exist 8. Purchasing Card Suspension Notification Forms lack retention 9. Communication needs to be enhanced between Human Resources Department and the P-Card Administrator regarding suspended employees or employees on extended leave 10. Temporary changes to a single transaction limit, credit limit, and card profile lack an established time frame within the P-Card Manual 11. P-Card Manual lacks justification for exceeding the established single transaction limit and credit limit thresholds 12. Lack of segregation of duties exists within the process of modifying the single transaction limit, credit limit and card profile 13. Cardholder files lack the efficiency of automation Page 7

8 1. Duplicate invoices submitted, approved, and paid The P-Card Manual, section 5.11, states that inadequate record keeping and/or documentation of purchases are prohibited uses or practices with a County P-Card. The auditor identified seven (7) instances where an invoice was duplicated and submitted as supporting documentation for multiple purchases by a single card holder. Six (6) of the seven (7) invoices contained the same vendor, service dates, service description, service location, invoice numbers, and invoice amount. One (1) of the seven (7) invoices contained different invoice numbers, however, the rest of the document remained the same. The monthly payment request packets, which included the duplicate invoices, were reviewed and approved by the Account Coordinator, Business Unit Manager, and the Director of the department. The cardholder was interviewed and was unable to provide clarification regarding the duplicate payments. Ensure that each Cardholder, reviewer, and approver is trained properly to review supporting documentation within the payment request packets and to make certain authorized purchases are only paid once, are adequately documented, and are made for a public purpose. The County must pursue refunds of duplicate payments, as appropriate. The Cardholder in question had their card permanently suspended once the situation was brought to the Procurement Department s attention, the account is now closed. Procurement immediately held a meeting with the Department Director to make further inquires and to request that the cardholder s Department investigate any duplicate payments for work performed and take steps to rectify. #1) P-Card Holder Training: The Procurement Department will continue to provide mandatory P-Card holder training prior to card issuance, and continue to require the mandatory annual refresher training. The mandatory training has been successful in that the number of flagged transactions and errors has been greatly reduced. In 2012, prior to mandatory training, the flag count was averaging 117 per month, after mandatory training was implemented the flag count was reduced to an average of 10 per month with 325 cards in circulation. #2) Reviewer & Approver Training: The Procurement Department has recognized a need for training of those individuals involved in reviewing and approving of P-card transaction receipts each month. A new training curriculum has Page 8

9 now been created which will be mandatory for all reviewers and approvers. This training will focus on recognizing fraud indicators, fraud prevention, appropriate payment methods, strategic procurement directives and other topics to empower management in providing comprehensive oversight. Six classes will be provided between September and November, 2015, and are planned to be jointly presented with the Internal Audit Department and Office of the Inspector General. #3) Refunds from the Vendor for Duplicate Payments Input from the department of the card holder in question, has reported that of the invoices in question, one was a duplicate and was subsequently refunded by the vendor, and another was identified as an invoicing error by the vendor; which is still being reviewed. The others were clarified by locating the missing invoices. Training for Reviewers and Approvers will be available on TRAC starting in September, Page 9

10 2. Purchases prohibited on a P-Card The P-Card Manual, section 5.10, outlines the products and services that cannot be purchased on a P-Card. The auditor identified three types of prohibited purchases that were made on P-Cards: (1) capital assets, (2) postage (except for designated mailroom personnel), and (3) computers, computer hardware, or computer software (except for designated Enterprise Information Technology [EIT] personnel). To ensure efficiency and centralization, these types of purchases are prohibited. Capital Asset The Capital Asset Policy defines Capital Assets as real or personal property that have a value equal to or greater than the capitalization threshold for their respective asset class and have an estimated initial useful life of greater than one year. If a capital asset is purchased on a P-Card, the Cardholder is required to request a credit from the vendor, initiate a purchase order, and treat the purchase as an after-the-fact procurement. Of the 1,345 purchases that totaled $1,000 or more between the dates of October 1, 2013 and September 30, 2014, a random sample of 100 was selected and supporting documentation was reviewed for each sampled transaction. Of the 100 potential capital asset purchases reviewed, two (2) of the sampled purchases were unallowable since they met the requirements of a capital asset, as per the Sarasota County Capital Asset Policy. Postage, excluding allowed mailroom personnel There were 112 purchases that were classified as postage and freight between the dates of October 1, 2013 and September 30, Supporting documentation was reviewed and nine (9) of the purchases were prohibited by section 5.10 of the P-Card Manual. Computers, Computer Hardware, or Computer Software, excluding allowed EIT personnel There were 719 purchases, which appeared to be purchases for computers, computer hardware, or computer software between the dates of October 1, 2013 and September 30, Of the 719 purchases, a sample of 50 was selected and supporting documentation was reviewed. Of the purchases reviewed, one (1) purchase was prohibited by section 5.10 of the P-Card Manual. Page 10

11 To ensure that prohibited purchases are not made on P-Cards, implementation of Opportunity for Improvement #7 Create Training Program for Business Unit Managers and Directors related to P- Cards is recommended. The training program would provide additional assurance that prohibited purchases are detected and rectified. See page 16, for Opportunity for Improvement #7, for related items. In all cases where the P-Card policy has not been followed by the cardholder, the Procurement Department will obtain a written letter of explanation from the Department Director responsible and each case will be reviewed for corrective action. Corrective action will involve retraining on card policy on up to full suspension of card privileges. Department Directors will be contacted for explanation by October See the management response to Opportunity for Improvement #1 Duplicate invoices submitted, approved, and paid, regarding Reviewer and Approver Training, which addresses the topic of providing specific training for approvers of monthly P-card transactions and in providing department oversight of the cardholder activity. Training for Reviewers and Approvers will be available on TRAC starting in September, Page 11

12 3. Non-Compliance with the P-Card Manual regarding timely deactivation of P-Cards The P-Card Manual, section 10.1, states that the P-Card Administrator will deactivate the card within 24 hours of notification of transfer or termination. In order to test for proper deactivation of P- Cards, the auditor matched, by last name, all terminated employees during the audit period to the entire list of Cardholders within the application. A total of 54 terminated employees, once issued a P-Card, were identified during the audit period. The auditor selected a sample of 20 P-Cards from the terminated employee s listing in order to confirm the cards were deactivated within 24 hours of notification. During review, it was noted that one (1) of the total 20 Acknowledgement of Returned Purchasing Cards forms inspected, indicated that the P-Card was not suspended within 24 hours of notification of transfer or termination. Additionally, during review of the documentation, it was noted that three (3) of the total 20 Acknowledgement of Returned Purchasing Cards forms inspected, did not indicate either the date received by the P-Card Administrator or the date the P-Card suspension was performed. Documentation of these dates is important to ensure compliance with the P-Card Manual. To ensure compliance with P-Card Manual, section 10.1, implement a quality assurance process to make certain that all transferred or terminated employees that have been issued a P-Card, have their card timely suspended. Additionally, implement a quality assurance process to ensure that all Acknowledgement of Returned Purchasing Cards forms are dated by the P-Card Administrator or the P-Card Administrator s designee upon receipt of the form and that the form contains the date the P-Card was suspended. The Procurement Department concurs with the recommendation. Procurement had been receiving a report on a weekly basis from Human Resources. However, the report information was too dated to meet the 24 hour requirement. At the suggestion of the Procurement Department, a change has been made to the P-Card manual requiring the Department Director of any P-Card holder to immediately notify Human Resources of a change in status of the employment of the P-Card holder. Human Resources is now required to notify the Purchasing card Administrator immediately of the change in status. The policy will be implemented by September 1, For quality assurance, the P-Card Administrator will provide the Procurement Official with a monthly report which will indicate, among other things, employee change of status and cards returned. Page 12

13 4. Non-Compliance with Florida Statute The P-Card Manual, section 4.4, states that Cardholders who have a single transaction limit of $20,000 or higher are required to complete and file an annual Statement of Financial Interests form with the Sarasota County Supervisor of Elections in accordance with the Florida Commission on Ethics. The Annual Statement of Financial Interest form is required by Florida Statute (2)(b), which states that each state or local officer and each specified state employee shall file a statement of financial interests no later than July 1 of each year. Florida Statute (1)(a) states that a local officer means a purchasing agent having the authority to make any purchase exceeding the threshold amount. The threshold amount is defined in Florida Statute , Category One, as $20,000. This threshold amount has remained unchanged since The auditor identified seven (7) Cardholders with a single transaction limit of $20,000 or greater during the audit period and verified that they met the statutory filing requirement by searching for their names on the Florida Ethics Commission website. One (1) of the seven (7) Cardholders identified did not file an Annual Statement of Financial Interest with the Florida Ethics Commission. Additionally, the Procurement Department does not have written procedures related to the annual Statement of Financial Interest process. To ensure compliance with Florida Statute (2)(b), the Procurement Department must implement a process, and written procedures, to ensure that each required Cardholder timely files an annual Statement of Financial Interest with the Supervisor of Elections. Procedures for the annual Statement of Financial Interest process should address items such as notifying filers of the required disclosure, the filing requirements, and when and where to send annual notification. The P-Card Administrator has created a Standard Operating Procedure to describe the steps required to inform and record the handling of Financial Disclosure obligations by cardholders. Beginning for Fiscal Year 2016, the Procurement Department will generate an annual list of cardholders whom have spending authority of $20,000 or greater. This list will be provided to the County employee who coordinates with the State of Florida on financial disclosure filings. The Procurement Department brought the oversight to the attention of the County employee coordinating the information for the financial disclosure filing requirement as soon as it was brought to its attention. The subject cardholder s spending level was reduced below the $20,000 threshold on June 29, Page 13

14 5. Spend Analysis reports are not available for audit The P-Card Manual, section 2.5, states that the P-Card Administrator is to review and analyze aggregate county-wide and individual monthly spending, and report findings to the Procurement Official. The auditor reviewed the aggregate county-wide vendor spend reports and determined that nine (9) of the twelve (12) months during Fiscal Year 2014 were not available. The three (3) that were available did not reflect the conclusion of the analysis. To ensure compliance with P-Card Manual, section 2.5, implement a quality assurance process to ensure that each month s spend analysis report is being maintained. Additionally, documentation should be maintained that identifies when the spend analysis was performed, who was involved in the analysis, and the conclusion of the analysis. The P-card Administrator generates a monthly vendor spend report pulled from the Purchasing Card Application. The application has limited analytical abilities. The monthly report, after review, was being over-written by subsequent reports, so no history file folder existed with a full year of reporting. All monthly reports will be saved individually beginning August 1 st, The P-Card Administrator will immediately begin providing a monthly report which will contain data on the P-Card program to indicate; spend, volumes, activity, new cards issues, cards removed, flags and other pertinent program information to the Procurement Official. The Procurement Department is pursuing the purchase of data analytics software to provide for the ability to perform audits and spend analysis to a greater level than is available through the current application. Monthly spend analysis reports will now be saved and cataloged for historical purposes. A demonstration and price proposal from a data analytics software provider will be obtained by July 31, 2015 with a purchase requisition to follow. The submission of a monthly report generated by the P-Card Administrator will begin on August 1, Page 14

15 6. Lack of Standard Operating Procedures for certain areas related to the P-Card process There currently are written procedures for certain processes as they pertain to the Purchasing Card Program. However, there are areas lacking procedures related to the: (1) issuance of a P-Card, (2) deactivation of a P-Card, and (3) the annual training process. Create Standard Operating Procedures to define the following processes: (1) issuance of a P-Card, (2) deactivation of a P-Card, and (3) the annual training process. 1. Procedures for the issuance of a P-Card should address items such as the application process, the approval process, how to request a P-Card, the required training, and the distribution process. 2. Procedures for the deactivation of a P-Card should address items such as physical destruction of P-Cards, proper documentation of dates within the Acknowledgement of Returned Purchasing Card form, how to deactivate a P-Card, and the timing requirements. 3. Procedures for the annual training process should address items such as the training criteria, the notification process, and the time required to complete annual training. The P-Card Administrator has created Standard Operating Procedures for the 3 areas suggested; issuing cards, deactivating cards, and annual training. Standard Operating Procedures will be implemented for the three processes by August 1, Page 15

16 7. Training program for Business Unit Managers and Directors related to P-Cards does not exist The P-Card Manual, section 3.3, requires all Cardholders to complete initial P-Card training prior to receiving a P-Card and annual P-Card refresher training. These training sessions are presented by the P-Card Administrator and documented within the Training Registration and Activity Center (TRAC) application. However, the Business Unit Managers and Directors that review and approve the payments are not required to receive any training. To ensure that all persons involved in reviewing, reconciling, and approving P-Card payments receive formal training, implement a written policy and procedure that outlines an annual training program for Business Unit Managers and Directors. Ensure that all Business Unit Managers and Directors receive communication about the training program and that they receive the training within a reasonable period of time upon becoming a Business Unit Manager or Director. See the management response to Opportunity for Improvement #1 Duplicate invoices submitted, approved, and paid, regarding Reviewer and Approver Training. Procurement has recognized a need for training of those individuals involved in reviewing and approving of P-card transaction receipts each month. A new training curriculum has now been created which will be mandatory for all reviewers and approvers. This training will focus on recognizing fraud indicators, fraud prevention, appropriate payment methods, strategic procurement directives and other topics to empower management in providing comprehensive oversight. Six classes will be provided between September and November, 2015, and are planned to be jointly presented with the Internal Audit Department and Office of the Inspector General. The P-Card Administrator will also be updating the P-Card Manual to outline this training requirement as mandatory and to require a mandatory annual refresh of the training. Communication will be developed, released and directed at the target training audience. The training for Reviewers and Approvers will be available on TRAC starting in September, Page 16

17 8. Purchasing Card Suspension Notification Forms lack retention When the P-Card Administrator is notified that a Cardholder has violated the P-Card Manual, the Cardholder, Business Unit Manager, and the Director are notified of the recommended suspension of the violating employee s card. The P-Card Administrator fills out a Purchasing Card Suspension Notification Form, includes the justification for the suspension, signs and dates the form, and obtains a signature and date from the Procurement Official. This document is forwarded to all related parties. Upon receipt of the form, the Business Unit Manager and Director are to sign and date the form in acknowledgement of the suspension and forward the completed document back to the P-Card Administrator. During review of the Purchasing Card Suspension Notification Forms, it was noted that a history of Cardholder suspensions is not maintained. To properly monitor Cardholder suspensions, implement a retention program ensuring that all Purchasing Card Suspension Notification Forms are being maintained and tracked by the P-Card Administrator. The P-Card Administrator will begin immediately scanning and filing the executed Suspension Notification Forms for ease of electronic access. The process of maintaining and tracking Purchasing Card Suspension Notification Forms has already been implemented. Page 17

18 9. Communication needs to be enhanced between Human Resources Department and the P-Card Administrator regarding suspended employees or employees on extended leave During inquiry of the P-Card Administrator, it was noted that there is a lack of correspondence from the Human Resources Department to the P-Card Administrator regarding employees that are suspended or on extended leave. Improved communication would allow the P-Card Administrator to monitor these Cardholders during this time or, if necessary, temporarily suspend their P-Card so that they are unable to make purchases during their absence. To ensure that only County authorized purchases are being made on P-Cards, a process must be implemented that requires notification from the Human Resources Department to the P-Card Administrator regarding suspended employees or employees on a form of approved leave. At the suggestion of the Procurement Department, a change is planned to the P-Card manual requiring the Department Director of any P-Card holder to immediately notify Human Resources of a change in status of the employment of the P-Card holder. Human Resources will be required to notify the Purchasing card Administrator immediately of the change in status. Prior to this new procedural change, Procurement was only informed once per week of an employee change in status through the "Hired, Job Changes and Separations Weekly Report." For quality assurance, the P-Card Administrator will provide the Procurement Official with a monthly report which will indicate, among other things, employee change of status and cards returned. The revised policy will be implemented by September 1, Page 18

19 10. Temporary changes to a single transaction limit, credit limit, and card profile lack an established time frame within the P-Card Manual The P-Card Administrator currently implements the temporary single transaction limit, credit limit, and card profile changes when a request is made by a Business Unit Manager. When the P-Card Administrator implements the temporary profile change, the P-Card Administrator schedules the profile to revert back to the original limits and commodity types in 7 days. This process is not documented or approved in the P-Card Manual. To ensure consistency with the treatment of temporary P-Card modifications, create a policy and standard operating procedure related to temporary single transaction limit, credit limit, and card profile changes. The policy should address items such as the authorization process and the establishment of a standard time frame to revert back to the original profile. The standard operating procedure should address items such as who is responsible for the temporary profile changes and how to make temporary changes within the purchasing card application. The Procurement Department will modify the P-Card Manual to create a policy and also create a standard operating procedure related to temporary single transaction limit, credit limit, and card profile changes by August 1, The policy will address items such as the authorization process and the establishment of a standard time frame to revert back to the original profile and will be implemented by September 1, The standard operating procedure will address items such as who is responsible for the temporary profile changes and how to make temporary changes within the purchasing card application and will be implemented by August 1, Page 19

20 11. P-Card Manual lacks justification for exceeding the established single transaction limit and credit limit thresholds The P-Card Manual, section 4.1, states that the threshold limit requirements for P-Card purchases are limited to less than $5,000 for a single transaction, as outlined in the Procurement Manual. In section 4.4 it also states that a P-Card Business Unit Manager may request an increase or decrease of the single transaction limit and or monthly limit for a subordinate Cardholder. The request must be submitted to the P-Card Administrator for approval and implementation. However, there is not a policy that defines when, or under which circumstances, a single transaction limit and credit limit increase is appropriate. During review of the P-Card Manual and the transactions that occurred between October 1, 2013 and September 30, 2014, there were a total of 54 transactions that exceeded the stated Single Transaction Limit threshold of $5,000. To ensure compliance with the County s intention, create a policy and procedure to address when, and under which circumstances, a single transaction limit and credit limit increase is appropriate. The Procurement Department will add specific policy language to the P-Card Manual and create a standard operating procedure related to temporary single transaction limits, credit limits, and card profile changes by August 1, The policy will address items such as the authorization process, circumstances where a change is warranted, and the establishment of a standard time frame to revert back to the original profile and will be implemented by September 1, The standard operating procedure will address items such as who is responsible for the temporary profile changes and how to make temporary changes within the purchasing card application. Page 20

21 12. Lack of segregation of duties exists within the process of modifying the single transaction limit, credit limit and card profile The P-Card Manual, section 4.4, requires that any increase of a Cardholder s single transaction limit and or monthly credit limit be requested by a Business Unit Manager and that the request be submitted to the P-Card Administrator for approval and implementation. This form is also used to temporarily approve purchases prohibited by the policy. The P-Card Administrator is the only individual outside of the business unit reviewing and approving these requests. To ensure adequate segregation of duties exists, consider mitigating controls such as: (1) supervisory review of a report of all changes to P-Card limits, or (2) case by case approval by P- Card Official. To ensure segregation of duties exists, the P-Card Administrator will provide the Procurement Official with a monthly report which will indicate, among other things, all P-Card limit changes. These procedures will be implemented by August 1, Page 21

22 13. Cardholder files lack the efficiency of automation The P-Card Administrator currently creates, maintains, and updates hard copy files for each Cardholder. The information that is stored within these files include the initial request for a P-Card, the date of initial P-Card training, the Cardholder agreement, documentation relating to violations of policy, and an Acknowledgement of Returned Purchasing Card form if the P-Card is no longer active. This system functions well, however, it is not easily accessible for individuals, other than the P-Card Administrator. Implement an electronic filing system to create, maintain, and update Cardholder files. This will enhance the access, retrieval, and retention of records. Files are currently kept in paper form by the P-Card Administrator and housed in a file cabinet in the P-Card Administrator s office. Procurement is committed to converting from a paper based filing system to an electronic filing system to enhance the access, retrieval, and retention of records. Because of the size of the file, this transition will take several months. The electronic filing system will be fully implemented by October 1, Page 22