Corporate Credit Card Audit

Transcription

1 Corporate Credit Card Audit Shire of Serpentine Jarrahdale Contact: Andrew Casella Procurement Consultant WALGA ONE70, LV 1, 170 Railway Parade West Leederville Phone: (08) Fax: (08) Mobile: Website:

2 Table of Contents Executive Summary Introduction Scope Methodology Findings and Recommendations General Corporate Credit Card Policy Practices Use of Director s Corporate Credit Card by other staff Reporting of Corporate Credit Card Expenditure to Council

3 Executive Summary The WALGA Procurement Consultancy Service was engaged by the Shire of Serpentine Jarrahdale to review the corporate credit card policy and procedures and to conduct an audit of corporate credit card transactions for the 2014/15 financial year. The audit was conducted by Andrew Casella, a Procurement Consultant employed by WALGA who is registered as a Procurement Probity Practitioner with the Institute of Arbitrators of Mediators Australasia (IAMA). The audit of corporate credit activity for the 2014/15 financial year did not reveal any disconcerting transactions or patterns that would require further investigation. However, the audit did identify that current practices in the management of corporate credit cards were not always aligned with the Shire s currently prescribed policy and practices. The Shire has an opportunity to review its policy and practices to further mitigate the risk of the misuse of corporate credit cards by ensuring a compliant, accountable and transparent framework is established and maintained. This will serve to minimise the perception of misuse as well as maximise the benefit that payment by corporate credit cards deliver in terms of process efficiency gains resulting in the reduction of the cost of processing low value low risk purchasing transactions. Culminating from the review process are a series of recommendations proposed by the reviewer that are designed to not only assist the Shire in improving the management of corporate credit card expenditure, but to also enhance its program to deliver the associated benefits that utilising corporate credit cards as a more common method of payment can deliver to an organisation. The recommendations arising from this audit are: 1. That the Shire issues a cardholder agreement form when each card is issued, in accordance with policy directive and that signed copies are maintained on the administrative file as well as the employee s personal file. 2. That the Shire keep a register of current cardholders in accordance with the policy directive. 3

4 3. That the policy wording be changed to state cardholders to be provided a copy of policy when amended. Cardholders would then need to sign confirmation of receipt and understanding of the new policy. 4. That the policy wording be updated to state Coordinator Finance & Customer Service as the Executive Manager Finance position no longer exists. 5. That the Shire ensures that the exit procedure makes explicit reference to the return of credit cards for departing staff. 6. That the Shire includes a statement in the cardholder agreement form to prescribe the process to be followed in accordance with policy for dealing with the circumstances when cardholders lose or misplace their corporate credit card. 7. That the Shire instigates a purchasing card program for regular buyers of low value/low risk purchases, rather than continuing the current practice of access Directors card details to make purchases. 8. That the Shire consolidates the surrender of corporate credit cards into the HR exit process. 9. That a clear statement be made in both the policy and cardholder agreement form that unauthorised use of, or demonstrated non-compliant use of the corporate credit card will result in disciplinary action. 10. That the policy statement is updated to provide the correct reference G001 Purchasing Policy. 11. That the Shire ensures that transactions are only authorised when the credit card holder obtains at least two (2) verbal quotes for purchase above $3, That the Shire ensures that future considerations of maximum monthly credit limits are based on need and not status. 13. That the Shire ensures that cardholders specify the names of all people in attendance on a memo or the receipt when transactions are made that relate to entertainment expenses. 14. That in every instance, statutory declarations are completed, signed and duly authorised to declare what the expense related to when receipts are reported as missing, except in exceptional circumstances where receipts are not produced (such as parking ticket machines). 15. That clear differentiation be made in the policy between corporate credit card (for CEO and Directors) and Purchasing Cards for other staff. 4

5 16. That the policy assigns delegation to CEO for maintenance of credit limits of all cardholders (with exception of CEO) at SJ Shire. 17. That the Shire discourages the practice of collection of reward points and reprimands staff when evidence suggests that personal benefits have been attained. 18. That the Shire create a delegation for the issue and management of corporate credit cards and notes the item in the register of delegations. 19. That the policy be updated to include a specific reference to the Shire s Purchasing Policy under Other Relevant Policies & Legislation. 20. That the Shire develops a concise management procedure for corporate credit card and purchasing card use, to be maintained by Finance. 21. That the Shire investigates the advancement of a purchasing card program to realise the efficiencies that purchasing cards can bring to the purchase to pay process for low value, low risk purchasing. 22. That the Shire report to Council on a monthly basis on the merchant category report appended to the financial activity statements. WALGA would like to thank the Shire of Serpentine Jarrahdale for the opportunity to conduct the audit and hopes that the report is received in favour. Andrew Casella AIAMA Procurement Consultant WALGA 5

6 1 Introduction WALGA Procurement Consultancy Services was engaged by the Shire of Serpentine Jarrahdale to review the corporate credit card policy and procedures and conduct an audit of corporate credit card transactions for 2014/15 financial year. The audit was conducted at the Shire of Serpentine Jarrahdale s administration office on Friday 22 May Andrew Casella, Procurement Consultant WALGA was appointed to conduct the audit. 2 Scope The scope of the audit as agreed between WALGA and the Shire of Serpentine Jarrahdale is as follows: Review Corporate Credit Card Policy & associated procedures Review list of authorised card holders (including transaction/monthly limits) for suitability Selection of a maximum of five (5) corporate credit card transactions to test against policy and report any inconsistencies with policy & procedures. Interview subjects (if required) Report on findings and make recommendations to improve management of risk in corporate credit card use and to improve compliance. Matters of non-compliance or misconduct will be reported directly to Director Corporate & Community. 3 Methodology The audit of credit card transactions was limited to the periods 6/6/14 to 6/4/15, representing all transactions for the financial year to date. The auditor examined each credit card statement by each cardholder to ensure that: a) The transaction was supported by a receipt or statutory declaration; b) The transaction appeared to be a business related expense; c) The transaction satisfied obligations under the Shire s Purchasing Policy; and d) Statements were authorised by the appropriate signatories. 6

7 The audit also examined whether corporate credit cards were administered in accordance with the Shire s policy. Findings and recommendations appear under 4.2 Corporate Credit Card Policy. To determine established practices, the examination also included informal interviews with: Kellie Bartley Coordinator Finance and Customer Service; and Leani Simpson Manager Human Resources. 4 Findings and Recommendations 4.1 General The Shire has three (3) current corporate credit card cardholders: 1. Richard Gorbunow Chief Executive Officer 2. Gordon Allan Director Engineering 3. Alan Hart Director Corporate Services and Community Corporate credit cards are offered to the Chief Executive Officer and Directors as an entitlement in their employment contract. The employment contract states that use of the corporate credit card must occur in accordance with the Shire s policy. Kellie Bartley (Coordinator Finance) does not hold a corporate credit card, but is an authorised signatory for the Shire s bank accounts, which includes corporate credit card accounts. The Shire s current Facility Limit (which is an imposed limitation on the dollar value the Shire can spend cumulatively on all credit cards in one month) is $25,000. This appears to be more than adequate as the average value of combined transactions per month was approximately $7,500. Monthly statements are paid by direct debit to ANZ, who administer the corporate credit card program to the Shire. 7

8 Common types of expenses purchased by corporate credit cards under the transactions audited were: Travel Airfare/Accommodation Training/seminars Car parking Miscellaneous office equipment purchases Hardware Catering expenses Employee incentive rewards (vouchers, gifts, etc.) 4.2 Corporate Credit Card Policy The Shire of Serpentine Jarrahdale currently administers Policy G917 that prescribes the intent and manner by which corporate credit cards are to be managed. The current policy was last reviewed adopted by Council on 13 May The following table tests each section of the Corporate Credit Card policy against current practice as evidenced by the auditor. Where opportunities for improvement could be established, the auditor has made recommendations to either improve the policy statements, or to change practices to enable compliance to the policy. General Agreement must be signed by the cardholder and the Shire setting out the cardholder s responsibilities and legal obligations when using the Corporate Credit Card. General statement in employment contract that employee must adhere to Shire s policies and management practices. That the Shire issues a cardholder agreement form when each card is issued, in accordance with policy directive and that signed copies are maintained on the administrative file as well as the employee s personal file. 8

9 No explicit cardholder agreement form evidenced. HR confirmed that there have never been any reports of misuse of corporate credit cards. Register kept of all current cardholders including card number, expiry date of the credit card, credit limit and details of goods and services the cardholder has authority to purchase All new and existing cardholders are provided with a copy of the policy relating to the use of credit cards on an annual basis In the event that a cardholder ceases employment, takes an extended period of leave, or they move to a position which does not require the use of a Corporate Credit Both Finance and Governance confirm that a register is not actively maintained Finance confirm that it is not common practice to issue a copy of policy to cardholders on an annual basis. HR confirms that credit card returns are not listed on the Shire s employee exit procedure. That the Shire keep a register of current cardholders in accordance with the policy directive. That the policy wording be changed to state cardholders to be provided a copy of policy when amended. Cardholders would then need to sign confirmation of receipt and understanding of the new policy. That the policy wording be updated to state Coordinator Finance & Customer Service as the Executive Manager Finance position no longer exists. 9

10 Card, the cardholder must notify Executive Manager Finance two weeks before termination date, to arrange cancellation and to ensure all receipts and their account has been settled. In the event that the cardholder loses or misplace their credit card they will need to report this to the issuing financial institution by telephone. Written notification must also be forwarded to the Executive Manager Finance Services. Cardholders cannot transfer the Corporate Credit Card account to other users. An account number will only be assigned to one cardholder. An ex staff members card was destroyed by Finance and issued notification to ANZ around 9/6/14, however the officer left the Shire on 31/1/2014. No instances of this occurring in 14/15. No procedures / templates available. No evidence of transferring corporate credit accounts account to other users. However, there is evidence to suggest that staff are accessing director s credit cards to make purchases. Only on occasions there was express authorisation received from the cardholder recorded against the transaction. That the Shire ensures that the exit procedure makes explicit reference to the return of credit cards for departing staff. That the Shire includes a statement in the cardholder agreement form to prescribe the process to be followed in accordance with policy for dealing with the circumstances when cardholders lose or misplace their corporate credit card. That the Shire instigates a purchasing card program for regular buyers of low value/low risk purchases, rather than continuing the current practice of access Directors card details to make purchases. 10

11 When the Corporate Credit Cards issued by the financial institution include reward schemes, these will be accumulated in the name of the Shire of Serpentine Jarrahdale. The Chief Executive Officer, at their discretion will decide how these rewards are utilised and could include offering these to charitable institutions, or sporting clubs. Under no circumstances is the reward scheme to be used for a Staff/Councillors private benefit. All surrendered Corporate Credit Cards must be returned to Executive Manager Finance Services who will make arrangements for the destruction of the card. Evidence of reward points being collected on transactions on numerous occasions, which may be for personal benefit. One of the card transactions was used for purchase of citizenship gift bags from Woolworths. The transaction shows that a Woolworths everyday reward card, presumably under a personal reward scheme, was used to collect points. Finance are unaware if a corporate rewards scheme is utilised. Finance confirms they receive the surrendered card for destruction and notifies bank of cancellation. That the Shire discourages the practice of collection of reward points and reprimands staff when evidence suggests that personal benefits have been attained. That the Shire consolidates the surrender of corporate credit cards into the HR exit process. 11

12 Cardholders breaching Corporate Credit Card Policy Any officer that believes a cardholder is entering into transactions that seem to be unauthorised, excessive, and unreasonable will be reported to the Chief Executive Officer. Any breach by a cardholder will require an investigation into activities and if necessary action taken by the Chief Executive Officer, resulting in withdrawal of the card or termination of employment. Cardholders that do not follow any component of the Policy, at the discretion of the Chief Executive Officer, may have their Corporate Credit Card cancelled. If the purchase has a component that is private in nature, the entire purchase will be recovered by the cardholder as private expenditure. None reported Not evidenced or reported. Unable to determine if any transactions relating to private expenses, although there appear to be good checks and balances in place by Finance, who review and scrutinise each transaction. That a clear statement be made in both the policy and cardholder agreement form that unauthorised use of, or demonstrated non-compliant use of the corporate credit card will result in disciplinary action. 12

13 Purchasing Corporate Credit Cards are only be used for purchasing goods and services on behalf of the Shire which is authorised in the current budget. Cardholders must follow G904 Purchasing Policy; Personal expenditure is prohibited Corporate Credit Card are not to be used for cash withdrawals Maximum credit limits are be based on the cardholder s need Where the purchase has been made via facsimile, telephone, or over the internet an invoice or receipt Purchasing Policy states: Up to $3,000 1 verbal quote $ $15k two verbal quotes Credit card transaction limits are less than thresholds, so will generally abide by policy. Unable to categorically determine if any are private expenses, although Finance confirms there are checks and balances in place. Facility doesn t allow for cash withdrawals and none were evidenced. CEO $10k Directors $5k All within limit and deemed appropriate. According to audit sample, this is being complied with. That the policy statement is updated to provide the correct reference G001 Purchasing Policy. That the Shire ensures that transactions are only authorised when the credit card holder obtains at least two (2) verbal quotes for purchase above $3,000. That the Shire ensures that future considerations of maximum monthly credit limits are based on need and not status. 13

14 is required in all circumstances and must contain details of the purchase For Fringe Benefits Tax purposes, any expenditure for entertainment must include the number of people who were in attendance and the full names of any Shire staff. Payments Some instances noted where internal memo for meal/entertainment expenses, detailing number of non SJ staff in attendance is good practice, although in many instances these details were not recorded. That the Shire ensures that in all instances, cardholders specify the names of all people in attendance on a memo or the receipt when transactions are made that relate to entertainment expenses. There will be a monthly account statement that will be sent to the respective cardholder to certify statement and they will also be required to attach all invoices/receipts for transactions. All paperwork must be returned to Finance Services within 7 days of receiving statement. Once the cardholder has returned the statement, it must be signed by their manager. The Shire President will be required to authorise and sign the Chief Noted a few instances where receipts were missing and expenditure not accounted for. The auditor acknowledges however, that in some instances, receipts for minor items (such as parking ticket machines) are not produced. Sample evidenced compliance with policy. That in every instance, statutory declarations are completed, signed and duly authorised to declare what the expense related to when receipts are reported as missing, except in exceptional circumstances where receipts are not produced (such as parking ticket machines). 14

15 Executive statement. Officer s All invoices/receipts must include the suppliers ABN, amount and whether GST applies, and a brief description of goods and services purchased Complied. Financial Institution The Shire s Corporate Credit cards are to be issued by the financial institution that municipal transactions are made (referred to as transaction account). Complied. Authorised Use and Limits Corporate Credit Cards may be issued to the Chief Executive Officer and any authorised officers that would benefit from using this payment method Council must approve the use of a credit card to the Chief Executive Officer and any changes to their credit card limit CEO and 3 directors each have a corporate credit card. Evidenced in OCM193/05/13 Review of G917 Corporate Credit Card Policy (SJ143) on 2/5/13 to increase CEO credit limit to $10k That clear differentiation be made in the policy between corporate credit card (for CEO and Directors) and Purchasing Cards for other staff. 15

16 The Chief Executive Officer may approve the use and any changes to credit card limits for any authorised officers. The Local Government Act 1995 does not allow for the issue of Corporate Credit Cards to elected members. There are no provisions within the Act which allow an elected member to incur a debt, as would be the case with a credit card. Evidenced authorised change to credit limits for Directors to $5k on 27/5/14 No credit cards are issued to elected members. CEO paid for President travel and accommodation expenses on his Corporate Credit Card on a trip to Adelaide. Chief Executive Officer Council approve the following conditions for the Chief Executive Officer; 1. That a Corporate Credit Card be issued 2. The card limit is $10,000 and may only be used for official Shire of Serpentine Jarrahdale Shire transactions 3. The Shire President must approve the monthly 1. Complies 2. Complies. Assumed all purchases relate to official SJ Shire business. 3. Complies in the sample audited. That the policy assigns delegation to CEO for maintenance of credit limits of all cardholders (with exception of CEO) at SJ Shire. 16

17 statements for the Chief Executive Officer. 4. All other terms and conditions set out in this policy and other relevant policies must apply. Finance Services Responsibilities Finance Services must; 1. Arrange the issues and cancellations of Corporate Credit Cards when requested by the Chief Executive Officer. 2. Maintain a register of all cardholders. 3. Provide cardholders with the Policy, and where required any changes to the policy and their responsibilities and obligations as cardholders. 4. Process payments of Corporate Credit Cards. This includes ensuring all receipts and tax invoices have been attached and the relevant authorising officers have signed off on the statements. 1. Complies 2. No register maintained. 3. No evidence that cardholders signed off on policy. 4. Complies. Where no receipt available, ensure cardholder signs statutory declaration. 17

18 5. Arrange for all cardholders to sign the Corporate Credit Cardholder Agreement (refer to Appendix A) on receipt of the issue of the new card and ensure the signed agreement is placed in the Corporate Credit Card Register in TRIM. 5. No evidence of agreement form available. No credit card register being maintained. Cardholders Responsibilities and Obligations Cardholder s must; 1. Keep their card in a safe place. 2. Make payments that are within their card limit, budget, and authority to do so. 3. Adhere to policy and procedures in relation to Corporate Credit Policy and Purchasing Policy. 1. Assumed. 2. Complies. 3. Some instances where cardholders not abiding by policy collecting reward points for personal use, allowing others to use cards. 4. Ensure all receipts and tax invoices are kept and submitted to Finance with credit card statements, within seven (7) days of receipt. 4. Complies. 18

19 5. Costing accounts must be against each item of the credit card statements. 5. Complies. Delegated Authority CG20 Corporate Credit Card Does not appear on register of delegations. That the Shire create a delegation for the issue and management of corporate credit cards and notes the item in the register of delegations. Other Relevant Policies & Legislation Local Government Act 1995 Other relevant legislation No reference to Purchasing Policy That the policy be updated to include a specific reference to the Shire s Purchasing Policy under Other Relevant Policies & Legislation. Work Procedures Nil. Basic internal procedure for finance for processing of credit cards evidence account change/credit card procedure however this does not offer any prescription on the management of corporate credit cards. That the Shire develops a concise management procedure for corporate credit card and purchasing card use, to be maintained by Finance. 19

20 4.3 Practices Use of Director s Corporate Credit Card by other staff There were instances found where employees had accessed Directors card details to make purchases (e.g. for online orders) on behalf of the Shire. This practice should be highly discouraged, as it introduces the risk for staff to be able to obtain credit card details that could possibly lead to misuse. From an audit perspective it may be difficult to establish the identity of the buyer without having to engage with the card provider s fraud agency. There was a template form that staff could complete where the Directors corporate credit card was used that acts as an authorisation from the Director to use the card to effect payment. However, this form was only used infrequently. Better control would be established if these buyers were issued their own Purchasing Cards. Purchasing cards are a common and very effective form of payment for low risk/low value transactions as it reduces the cost in the purchase to pay process and has added functionality of limiting authorised transactions to particular category types (e.g. travel). While there are associated risks (as with any method of procuring), these risks can be mitigated with the appropriate compliance controls and visibility over transactions. Further commentary on the benefits of purchasing card programs are available in the WALGA Procurement Handbook. There are examples in other WA local governments where this initiative has worked successfully. It is therefore recommended that the Shire investigates the advancement of a purchasing card program to realise the efficiencies that purchasing cards can bring to the purchase to pay process for low value, low risk purchasing Reporting of Corporate Credit Card Expenditure to Council One of the perceptions created by the use of corporate credit cards and purchasing cards is the reduced accountability and scrutiny over its transactions. Expenditure incurred through the traditional purchase to pay process (that is, payment of an invoice following a purchase order that has been approved by an authority) offers greater transparency in the Shire s financial statements that are reported to Council, than payments made through corporate credit cards. However, Regulation 34 of Part 4 of the Local Government (Financial Management) Regulations 1996 prescribes that financial activity statements are 20

21 to be prepared and presented an at ordinary meeting of the council. This should include all payments regardless of the payment method used. Merchant category report are provided with each credit card monthly statement, which categorises transactions for the month by expenditure. This report could be appended to the financial activity statements that are presented at monthly council meetings. The desired effect is to alleviate the perception of misuse of credit cards, by increasing transparency without showing details of cardholders individual purchases. It is therefore recommended that the Shire report to Council on a monthly basis on the merchant category report appended to the financial activity statements. End of Report 21