04-10 Audit Report

Cwrzesinski

Informations

• Publié par: Mephor
• Nombre de lectures: 29
• Langue: English

Extrait

 

    REPORT OF INTERNAL AUDIT   PRESENTED TO   THE CITY COUNCIL CITY OF BOISE, IDAHO   AUDIT/TASK: #04-10, Procurement Cards AUDIT CLIENT: Purchasing Department / Cross-Functional   AUDIT DATE: August 23, 2004 REPORT DATE: January 11, 2005   AUDITOR: Steven Rehn CIA, CBA, CFSA APPROVAL: Steven Purvis CPA      

      INTRODUCTION   The Office of Internal Audit undertook a review of recent purchasing activities, specifically with respect to the use and administration of Procurement Cards assigned to various City departments. The Audit was scheduled and performed in accordance with Boise City Municipal Code, Title 1, Chapter 9.   The use of Procurement Cards to facilitate acquisitions of goods and services has become relatively widespread in government organizations. This holds true for all levels of government, from the federal level down to local municipalities. The cards allow these entities to de-centralize purchasing functions where those activities might otherwise place unnecessary burdens on centralized purchasing and payable functions. Units of government can acquire and utilize goods and services in a more timely and efficient manner; thus eliminating the need for purchase orders, invoicing, and the issuing of checks for numerous small-dollar transactions. Personnel are provided with cards, similar to credit / debit cards, which allow them to acquire needed items. Expenditures are then paid for on a monthly basis.

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO     The City of Boise recognized the benefits to be gained from this type of process, and adopted a “P-Card” program several years ago. In response to the Jefferson Wells audit report issued in early 2003, the program was re-designed in order to implement recommendations contained in that report. The overall objective of the re-design was to enhance the controls and procedures in place with respect to the P-Cards. Internal Audit undertook this review in order to gauge the effectiveness of the measures that were implemented, and to assess the current status of the P-Card program.   The review was carried out in conformance with standards prescribed by The Institute of Internal Auditors , and in conformance with Generally Accepted Government Auditing Standards.         SCOPE AND METHODOLOGIES     Specific objectives established for the Procurement Card audit included the following:   •   Determine that management has implemented processes and procedures that provide for an adequate level of control over the program •   Determine whether appropriate monitoring and oversight of on-going activity is occurring •   Determine that cardholders have been properly authorized, and that expenditures are appropriate •   Determine that appropriate accounting controls are in place when expenditures are funded and costs are allocated   Given that the program underwent significant revision at the end of FY’03 and the beginning of FY’04, Internal Audit established a scope period that included only those activities occurring in FY’04. This period was selected in order to assess the condition of the program as it is currently configured and operating.   Work steps consisted of interviews, observations, documentation reviews, detailed transaction testing, and analyses. Three months of P-Card activity was reviewed in general, with specific tests also being applied to those months’ activities, representing a combined total of 1,593 individual purchase transactions. Additionally, 39 individual card accounts were detail tested with respect to system-based controls. Overall, the work steps were deemed to be sufficient to support the findings contained within this report.    

 

2

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO     EVALUATION AND COMMENTS     The Procurement Card program consists of a combination of manual and system-based controls. Manual control measures appeared to be in place and functioning effectively. However, the key system-based controls do not appear to have been operating as originally envisioned when they were reviewed by Internal Audit. Internal Audit believes the overall state of the control environment at that point in time can best be characterized as “Marginal.” Reportable issues existed with respect to those key, automated program controls. Those issues related more closely to the “behind-the- scenes” aspects of the program rather than to use by individual cardholders.   As indicated above, Internal Audit tested a sizable sample of individual purchase transactions during the course of its work. During this portion of the review, Audit did not note any activity that appeared to be indicative of improper or abusive purchasing practices by front-line personnel. Rather, the goods and services acquired with the cards appeared to be legitimate and necessary to the on-going operations of the departments acquiring them. Front-line personnel in possession of the cards appear to have been using them in a manner consistent with their job assignments.   The primary weaknesses noted during Audit’s review relate to failures within the program’s system of automated controls. When the P-Card program was restructured, it was accepted by City Council with a well-defined, custom-tailored control framework, unique to the City of Boise. There are strong indications that two pieces of that framework have not performed as originally envisioned. Restrictive spending limits were assigned to the individual cards based on experience and perceived need. Also, merchant codes that limit where goods and services can be acquired were assigned to the cards based on demonstrated need, and on perceived risk. Subsequent to the implementation of these measures, a system upgrade by the card vendor apparently resulted in the City’s customized controls being superseded. As a result, more liberal spending limits were allowed on some or all of the cards. And a more liberal structure of merchant codes was apparently applied to an unknown number of cards as well. Audit did not note any misuse of the cards as a result of these changes. However, the integrity of these controls is crucial to the on-going effectiveness and efficiency of the program. How to assure control integrity going forward is an area that is in need of management attention.   Audit findings indicate there are opportunities for improvement in the following areas as well: (1)Quarterly program reporting; (2)Updating existing P-Card policy and program documents; (3)Monitoring of on-going purchasing patterns to detect unexpected spending  

 

3

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO   patterns; and, (4)Procedural enhancements in areas related to accounting processes, and card application processes. Some of these issues are a low priority, and have been left to management’s discretion as to follow-up and implementation. Others are included in this Report, and should receive management attention as soon as practicable.   In following up on recapture of P-Cards, Internal Audit also noted that the Human Resources department has created a checklist that aids in the capture of the cards when employees terminate their relationship with the City. The checklist is used on a voluntary basis only. Internal Audit believes this, or a similar tool should be made mandatory if such would be possible.   Procurement Card programs have been found to be beneficial in many organizations based on their ability to relieve the administrative burdens associated with procurement, and related remittance functions. However, since they do tend to result in the decentralization of purchasing authority, the establishment and observance of a strong set of controls and procedures on the part of both management and program administrators is critical to the success of the program. The City’s program framework, as envisioned, appears to be fundamentally sound. It provides a combination of both manual and systemic controls that can mitigate the risk involved with distributed purchasing authority. Monitoring of the automated control mechanisms through testing of P-Card activities will help ensure that the program fulfills its potential in terms of cost savings, efficiency, and effectiveness.   A detailed presentation of Internal Audit’s findings can be found in the report sections that follow.  

 

4

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO     FINDINGS AND RECOMMENDATIONS     1.   FINDING:     System-Based Controls     The re-designed P-Card program, as accepted by the City Council, contained a number of both systemic and operational control mechanisms. Merchant Classification Codes was one of two major system-based controls incorporated into the program. The other was a system of pre-established spending limits – for both individual transactions, and for monthly spending totals. While reviewing the system-based controls within the Procurement Card program, Internal Audit tested both Merchant Classification Codes and card spending limits in order to determine whether the desired controls had been established and were functioning as originally envisioned. The results of the review indicate that this part of the control structure has not functioned properly.   With respect to Merchant Classification Codes: •   A sample of 99 individual transactions was tested. 20 transactions occurred at merchants that were not authorized for the card(s) in question. •   39 individual cards were tested to verify that codes assigned to the cards were authorized. 11 of the 39 cards tested contained discrepancies between the codes assigned, and the codes that were actually authorized. Eight of the 11 cards had unauthorized codes assigned to them. Ten of the cards did not include all of the codes that had been authorized. Seven of the cards displayed both error types. •   After testing was completed,   vendor reports associated with the MC Codes were found to be inaccurate with respect to at least two of the 39 card accounts tested.   With respect to pre-established spending limits: •   A sample of 1,593 individual purchases was tested for compliance with the pre-established, individual transaction limits. 20 instances were noted where purchase amounts exceeded the individual transaction limits. •   Three months of purchasing activity was tested for compliance with pre- established monthly spending limits. Nine instances were noted where spending on individual cards exceeded monthly spending limits.

 

5

     

   

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO     The card vendor set the City’s framework of Merchant Codes and spending limits in place during February 2004, and confirmed that set up in early March 2004. During a series of staged upgrades made by the card vendor, the City’s framework was altered. Testing indicated that the alteration occurred on or before March 11, 2004. This resulted in more liberal spending and transaction limits on an indeterminate number of cards. Also, some portion of the City’s desired restrictions on merchant types appears to have been replaced with a system of more liberal merchant types commonly found in the card vendor’s program. The issues noted during audit tests appear to be directly attributable to these system alterations. And as noted above, accuracy failures likely attributable to the same causal factors were evident in some of the reports supplied by the card vendor.   Purchasing staff and management, working in conjunction with vendor representatives, appear to have succeeded in correcting these issues subsequent to their discovery by Internal Audit in September 2004. The card vendor has provided assurances that the control framework has been re-established. Also, Purchasing has tested one card for both transaction limits and merchant classifications and found both to be operating correctly – thecard was declined for a larger than authorized transaction, and was also declined during an attempted purchase at an unauthorized vendor. Additionally, a number of cardholders across the City have experienced declined transactions subsequent to the re-implementation of the City’s control framework. The “declines” are consistent with their intended card profiles.  

RECOMMENDATION:     Internal Audit recommends additional scrutiny on the part of program administrators. Over-ride of the City’s control framework, which may not have been readily detectable using normal system inquiries, might have been discovered earlier had more intensive monitoring procedures been in place. Additional monitoring and oversight of the program should be strongly considered so that integrity of the system, i.e. the City’s desired control framework, can be assured going forward.

6

 

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO   MANAGEMENT RESPONSE:       There appear to be no expenditures on any cards that are not in compliance with Boise City purchasing practices during this audit, including goods and services procured and spending limits for those procurements.   The City designed a custom Procurement Card program that redistributed Merchant Classification Codes (MCC) into groupings that are not consistent with existing MCC’s for the Procurement Card vendor. The software upgrades implemented by the vendor to its Procurement Card program did not apply to the custom program just like any other software program would not apply upgrades to customized sections of the program. Information received from the card vendor supports that system upgrades resulted in many problems on the Boise City Procurement Cards.   The data on the Vendor’s web site that is utilized to verify spending limits and MCC code restrictions would show that both spending limits and code restrictions were in place and functioning and would not indicate the card restrictions were not functioning properly.   We agree that some errors existed on specific codes on specific cards. Those specific errors were the result of manual input errors and have been corrected. Some code changes had been approved by the Department and implemented by Purchasing.   We agree that some of the “declines” that occurred were consistent with the original custom program. However, many of those restrictions had been removed to serve the needs of the Department and have been re-implemented to accommodate the needs of those Departments.   We do not agree that any cards were implemented without MCC codes. The report utilized to indicate those cards was reported by the Vendor as an “error report”. That incident on the report initiated the review that found the vendor’s system was not reading the MCC restrictions correctly.   We agree that some spending limit restrictions were not functioning, however the data on the web would have indicated that the restrictions were in place and functioning. Purchasing personnel in conjunction with support from the vendor have completed corrective actions on the restrictions and are confident that all

7

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO   controls are in place and functioning. There were no purchases made in violation of the Boise City Purchasing guidelines, some purchases exceeded the individual limits assigned to the cards.     MANAGEMENT’S RECOMMENDATION   Purchasing and vendor personnel have expended a large amount of hours reviewing each four digit code on the City’s customized process. Purchasing and the vendor agree that a less customized program has the potential to be a more efficient and effective program.    We recommend that we stay with the existing custom system while evaluating the risk and effort to convert to the Vendor’s MCC groupings. The use of the existing custom system may create similar problems with the next vendor software upgrade. In the interim we will recommend a testing protocol to the Mayor and Council. Based on the testing we will evaluate the time necessary to maintain the existing system versus the risk of using a more generic system.   We will continue with the testing until July 1, 2005 and present our evaluation to the Mayor and Council to determine the continuation of the custom program. The determination can then be made to continue with the custom program or change to the Vendor’s more generic application.

8

 

 

 

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO     2.   FINDING:     Oversight Reporting   Internal Audit reviewed documentation associated with the “re-design” of the P- Card program, part of which involved a review of the acceptance of the program by Council, and associated requirements that may have been pertinent to that acceptance.   The Council accepted the “re-designed”program that was presented to it on October 14, 2003. At that time, a motion was passed that mandated Council approval of any policy-level changes that were instituted going forward. In order to maintain an on-going flow of information relative to the P-Card program, Council also included in the motion a requirement that it be provided quarterly reports on P-Card usage. Tapes of the session suggest the Council’s interest included information relative to changes impacting the cards themselves, such as the number of cards outstanding, spending limits, etc... To date it does not appear that quarterly reports have been provided to the Council as required. Providing this type of information to the Council assists that body in the exercise of its governance responsibilities.     RECOMMENDATION:     Internal Audit recommends that a quarterly reporting protocol be implemented as required. Audit also suggests the following information be included in order to provide the Council with a reasonable overview of program usage, and any pertinent changes to the program that would be of interest: Overall card usage / purchase volume; Changes in number of cards outstanding; Changes in approved Merchant Classification Codes or Code Groups; Average transaction and monthly spending caps on the card population; and, Developing trends or patterns that may require program changes or other interventions.

9

 

                                       

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO   MANAGEMENT RESPONSE:       We agree that the Purchasing Card custom program as authored and presented by Mr. Steve Purvis was adopted for implementation by Boise City Council. The program required quarterly reports for the Council to remain current on the Procurement Card program.   We recommend that the standard reports available on the web site from the vendor be presented to Council prior to initiating custom reports. Those reports include Program Management, Financial Management, Supplier Management and Administrative Management.    

10

   

 

  REPORT OF AUDIT   PRESENTED TO: THE CITY COUNCIL CITY OF BOISE, IDAHO   3.   FINDING:     Analysis of Spending Patterns   The P-Card program distributes purchasing capabilities across the employee base where needed, facilitates the acquisition process, and relieves a considerable amount of administrative burden normally associated with procurement activities. However, it appears that policy enhancements and additional procedural clarifications may be needed.   Internal Audit analyzed data from three recent months’ activities, and detected several instances where high purchase volumes, big-ticket purchase transactions, and / or exclusive purchasing relationships appeared to be in evidence. Assuming these trends continued, purchase volumes with the vendors in question would likely exceed $25,000 per year. From the standpoint of policy, Code, and statute, the situations detected suggest the following:   •   City Code requires that annual expenditures of $25,000 or more must be conducted in a formal bidding environment. Frequent, on-going use of the P- Cards could allow departments to circumvent this requirement; evading scrutiny by the Mayor and City Council as a result.   Improper use of P-Cards could allow departments to establish and sustain a • de-facto “sole source” relationship witha vendor or vendors. “Sole source” relationships must be declared and approved by the appropriate authorities under both City Code, and state statute.   The Purchasing Manual section dealing with P-Cards is silent with respect to these issues specifically, but does impose the general requirement that City code and department purchasing policies be followed. Sections of the Manual that deal with competitive bids, and with “sole-source” relationships are silent with respect to the issue of P-Cards.  

11