P-Card Fraud Controls. Introduction

Transcription

1 Introduction According to 2013 Association of Financial Professionals (AFP) Payments Fraud and Survey, the second most targeted payment type for fraud was corporate/commercial purchasing cards. 29% of the respondents who reported fraud on purchasing cards which is an increase of 20% from the 2011 survey. As many controllers and their accounts payable organizations have taken steps to reduce the number of invoices processed, more procurement cards (P-Cards) are issued. As a result, the needs for internal control programs and defined levels of accountability for each card holder have become more important. P-Card fraud is committed by both external and internal parties. An external party may counterfeit or copy pertinent information from valid P-Cards. This type of fraud is very similar to consumer credit card fraud in which valid cardholder information is used to create a counterfeit card to make purchases at merchants or the P-Card information is used to make internet purchases. Best Practice: Implementing a Purchase Order 9PO) and P-Card Policy As a best practice, many organizations have instituted corporate policies pertaining to both the use of P-Cards and purchase orders. Such policies mandate the use of a purchase order if the transaction amount is over a specified spending level. These policies also enforce that all have contracts in place to ensure that the best pricing is obtained. The amount of spending requiring a purchase order will vary depending on the size of the organization and may range anywhere from $2, to $10,000. Any transaction less than the designated spending levels will require a P-Card. The diagram below depicts the benefits that be achieved by organizations with purchase order and P-Card policies. 1

2 Environment with PO Policies and P-Card Cost Center Purchases Uses Approved Purchasing Vehicles Improved s and Visibility Benefits Summary Use of POs and contracts reduces legal risk. Internal controls are in place. Allows cost center audits Best Price is Obtained Enforces standard payment terms and improves DPO Automated Processing Benefits of a P-card Program There are several benefits to implementing a P-card program. Improve supplier relations from quicker payments. Improve efficiency in accounts payable by reducing the amount of invoices processed Can restrict types of purchases by Merchant Category Code or (MCC). Reduce the number of checks processed. Reduce amount of purchase orders created. Reduce number of vendors maintained in the vendor master file. P-cards (or ghost cards ) are used to pay vendors which can result in significant rebates back to the organization. Provides visibility to purchases made by utilizing the reporting provided by the issuing financial institution. 2

3 The Red Flags of P-card Fraud Unusual purchases made with a P-Card. Unusual number of purchases for amounts just below an organization-set minimum requiring management approval. Late reconciliations or incomplete reconciliations. Photocopied receipts instead of originals are submitted with expense reports. Split payments (an indicator of an attempt to circumvent purchase limit rules). Sudden unusual patterns in a particular employee s monthly P-Card purchases. Forged receipts. P-Card Internal s Program The following internal controls program was developed for a P-Card program. It specifies the internal controls, designates the type of control, and highlights the types of risks prevented. Internal Delegation of Authority (DOA) Approval and Review. Management with Delegation of Authority (DOA) is responsible for 100% audit of cardholder s statement and supporting documentation/receipts. Additionally, management s DOA signature approval required on cardholder s statement (DOA applies to each transaction on the statement, not the statement total). Refer to risks: C-l, C-2, C-3, C-4, C-5, C-6, C-7 and Detective C-6 Operations may be adversely affected as may refuse future business with the company. 3

4 Internal P-Card Fraud s C-7 Cash utilization may not be optimized P-Card Statement Submission and Tracking. 1) The Cardholder submits statement with supporting documentation for each transaction. 2) The P-Card Administrator reviews spending activity in credit card on-line recording and reporting system. 3) The P-Card Administrator reviews every statement upon receipt to ensure that it is: Date stamped with date received in A/P. Verified for appropriate management Delegation of Authority (DOA). 4) The P-Card Administrator tracks each statements on P-card audit log: Used to monitor submission of statements. Follow up on outstanding statements. Document audit activity. Refer to risks: C-l, C-2, C-3, C-4, C-5, C-6, C-7 and Detective C-6 Operations may be adversely affected as may refuse future business with the company. C-7 Cash utilization may not be optimized Random Audits. Conduct a minimum of 10% of the total cardholder population; however, on average audit 20 30% of all statement. The random audit process should include the following components. Supplier Review Appropriateness of purchase. Misuse of Card Personal purchases. Justification Documentation/explanation for unusual purchases and pre-approvals if applicable. Refer to risks: C-l, C-2, C-3, C-4, C-5 Detective 4

5 Internal Targeted Audits: Targeted audits should be conducted in addition to random audits and are specific to cardholder; general ledger account and supplier spend. The following components should be addressed, Review all charges over a designated dollar amount. Examples are $10,000.00, $15, or $20, Note: This amount is usually determined by your company s PO policy, Preferred supplier spending on office supplies. Look for any charitable contributions. Review 100% of statements for retail or restaurant spending to identify misuse or unusual purchases. Use credit card on-line reporting tools and reports to assist with audit and review spend activity. Review all payments to foreign. Review payments to employees. Refer to risks: C-l, C-2, C-3, C-4, C P-Card Policy and Training. The policy should state clearly what the P-card can and cannot be used to purchase. The policy also should identify the disciplinary action for accidental misuse versus intentional misuse. The policy contains a P- Card cardholder agreement and specifics the training requirements for the cardholder and their manager. Refer to risks: C-l, C-2, C-3, C-4, C-5 Detective 5

6 Internal Segregation of Duties. The P-Card Administrator should be allowed to make decisions on the company s P-Card program. Additionally, the P-Card Administrator should not be granted physical or system access to accounts payable or purchasing information. Refer to risks: C-l, C-2, C-3, C-4, C-5, C-6, C-7 C-6 Operations may be adversely affected as may refuse future business with the company. C-7 Cash utilization may not be optimized. 6