Internal Control Noncompliances in Purchase Card Program

Just like commercial companies including Government contractors, the U.S. Government issues purchase cards to selected employees to streamline the acquisition process. Purchase cards provide a low-cost, efficient way to obtain goods and services directly from vendors. All companies have (or should have) effective internal controls to manage the cards and ensure the propriety of purchases paid through such cards. Larger companies often have internal audit departments that periodically assess employee compliance with such controls. Smaller companies may not have the resources available to dedicate to such internal auditing. As a result, they may be at more risk for fraud, waste, and abuse than larger companies. No company (or Government contractor) that we know of shares the results of their internal auditing publicly. So we never really know the effectiveness of controls put in place by contractors or the level of compliance achieved. We don't have that problem with internal audits by Government entities. Most of their internal control reports are available to the public. And these reports are often instructive for companies to review and find out what works and what might not be effective when it comes to protecting company assets.

The State Department's Office of Inspector General recently concluded an audit of the Department's purchase card program to determine whether (i) card holders used their Government card only for purchases allowed by laws and regulations, (ii) card holders recorded purchases, documented purchases, and reconciled monthly statements as required by Department policy, and (iii) the Department administered the purchase card program in accordance with established policies. Contractors with purchase card programs should study this report and assess their level of vulnerability in inappropriate purchasing.

The IG reviewed 580 purchase card transactions selected from nearly 2,000 State Department card holders and noted only 17 exceptions. Three purchases had been split into six separate transactions to circumvent micro-purchase limitations. Eleven transactions were used to inappropriately pay for catering services. Most notably however, the IG did not find any instances of cardholder fraud, wast or abuse.

The IG did find that record keeping was a mess. They found that 27 percent of the 580 transactions were missing one or more pieces of required documentation and nine percent failed to provide evidence that monthly statements were reconciled (as required). These record keeping deficiencies were attributable to the fact that cardholders did not maintain required documents.

Had this failure occurred at a Government contractor, there wold be a strong likelihood that contract auditors would have questioned the costs for lack of support and equally likely that the contracting officer would have sustained the finding. Would you want that to happen?

Read the full State Department report here.

More on Setting Up Internal Controls Over Company-Issued Purchase Cards

Internal controls over company-issued purchase cards should be of paramount concern to Government contractors. Regular readers of this blog will recall several reports where the cost of improper purchases using company-issued purchase cards were passed along to the Government and fraud charges resulted. Its serious enough when employees defraud their employer but when those charges pass through to a Government contract, things get much more serious. A contractor cannot just let those involved slip quietly off into the night. There will be consequences for both the individual(s) and the contractor.

But purchase card fraud is not just a contractor problem. It affects the Government as well. In fact, GSA's (General Services Administration) Office of Inspector General recently (OIG) published an audit that found GSA's purchase card program is vulnerable to illegal, improper, and erroneous purchases.

The OIG reported three deficiencies, each serious enough in its own right but when viewed in their totality, leaves the Government (and taxpayers) highly vulnerable to improper, if not fraudulent, purchase card charges. These deficiencies include:

• GSA does not have assurance that purchase cards are used exclusively for approved, business-related goods and services because controls to support and review transaction documentation are not performed consistently
• GSA may not identify illegal, improper, or erroneous purchases because controls over the resolution of questionable purchase card transactions are not operating effectively
• GSA lacks controls for identifying split purchase card transactions, making GSA vulnerable to cardholders violating federal procurement regulations.

Contractors might want to assess their own purchase card policies and procedures against these reported (and common) deficiencies. Here's a few ideas you can use to enhance your own internal controls.

1. Create a formal purchase card policy. Who is authorized to have a card?. What type of purchases are allowable? 
2. Require substantiation. Require original receipts. Document business purpose to ensure purchase has a legitimate business purpose. Require formal approvals.
3. Periodic internal reviews. Require independent (skeptical) internal review to periodically review purchase card statements and supporting documentation for propriety.

Remember, "trust" is not an internal control.

Purchase Card Programs - DoD Employees Caught

Right on the heels of the House Committee on Veterans' Affairs hearing on waste, fraud, and abuse in the VA purchase card program, the DoD-IG (Inspector General) issued a report yesterday finding that DoD cardholders improperly used their Government travel charge cards for personal use at casinos and adult entertainment establishments. During the year ended June 30, 2014, DoD cardholders had 5,300 charges totaling more than $1 million at casinos for personal use and for adult entertainment. These transactions went undetected for several reasons. First, DoD's travel management office provided no help at all in assisting agency program coordinators to identify personal uses. Second, DoD policy does not specifically identify high-risk merchants such as casinos and adult entertainment establishments. And finally, the credit card issuing bank is not required to notify program coordinators or management officials of potential fraudulent activity or suspension of accounts.

Additionally, during the course of their audit the DoD-IG noted the following:

• transactions with no associated travel status
• automated teller machine (ATM) withdrawals that exceeded the overall Meal and INcidental Expense (MI&E) amounts while in a travel status
• transactions at known casinos and adult entertainment establishments
• declined authorization activity that could indicate personal use, and 
• activity outside the required official Government travel locations.

We bring this up because contractors suffer from the same type of abuse found in Government agencies and the recommendations made by the IG may work in contractor locations. So, here are the recommendations.

1. Develop better tools to identify and prevent personal use of Government charge cards. Current technology (data mining) should be able to identify transactions that do not have associated travel status, ATM withdrawals that exceed the MI&E allowance, transactions at known casinos and adult entertainment establishments, and activity outside the official Government travel location.
2. Deactivate travel cards and/or reduce travel card limits for cardholders while not of official travel.
3. Publicize merchant categories that are considered high risk for personal use.
4. Require management to review declined authorization report every month.
5. Require management to use existing tools in the reviews of travel charge activity (there are some tools available but not in wide use).
6. Get the card issuing company to block usage at specific casino locations or adult entertainment establishments.
7. Get the card issuing company to notify management of potential fraudulent use or suspension of  travel cards.

Do you see a potential for any of these recommendations being beneficial to your management of company issued credit cards?

You can read the entire report by clicking here.

Purchase Card Programs - Recommendations to Reduce Risks

We've spent the past couple of postings discussing our gleanings from last week's House Committee on Veterans' Affairs hearing on waste, fraud, and abuse in the VA purchase card program. The idea behind doing so is to offer some best practices to contractors who face similar issues in administering their own purchase card programs. The lessons learned by Government managers could be equally applied to commercial enterprises.

The following comes from the prepared testimony of the VA's acting assistant secretary for management and interim chief financial officer and highlights activities that the VA has done or plans to do to curb fraud waste and abuse in its purchase card program.

1. The VA consolidated its purchase card program under its Financial Services Center enabling it to have centralized oversight and management. The number of purchase cards were reduced by 31 percent from 37,000 to 25,500.
2. The VA reduced card spending limits due to inactivity, invalid training certificates, and lack of valid warrants.
3. Controls have been implemented with the bank to limit the use of Government purchase cards for specific types of merchants.
4. Training is required prior to the issuance of a card, with refresher training required every two years (anyone who has had an internal control audit by DCAA knows that training is always a recommendation).
5. The VA conducts two types of oversight reviews, data mining and statistical sampling. The data mining seeks patterns or relationships in the data and identifies areas of potential non-compliance with policy requirements. The statistical sampling seeks to select and evaluate a representative sample of transactions to review for compliance with policy.
6. The VA issues quarterly memoranda to responsible officials to notify them of potential unauthorized commitments such as split purchases and transactions that exceeded micro-purchase limits that may require ratification. The VA requires positive feedback on actions taken.

VA employees spend about $4 billion annually on 6 million transactions (that's an average of $667). Certainly these numbers dwarf what any single contractor might spend and therefore the levels of oversight (both internal management and Congressional) is warranted. However, contractors have been significantly harmed by purchase card abuse and to the extent that those abuses are passed on to the Government through flexibly-priced contracts, purchase card programs will be on the Government's radar. Should DCMA (Defense Contract Management Agency) decide to initiate a CPSR (Contractor Purchasing System Review) at your facility, it is almost a certainty that they will look at your purchase card program.

Purchase Card Programs - How Effective are Your Internal Controls

We finished last week by discussing the House Committee on Veterans' Affairs hearing on waste, fraud, and abuse in the Veteran Administration's (VA) purchase card program. Although the hearing was limited to problems in the VA, issues with purchase card programs is widespread among Government contractors and can significantly affect contractors' ability to ensure the propriety of costs charged to Government contracts. By studying the Government's purchase card problems, the methods used by its oversight arms to ferret out fraud, waste, and abuse, and the internal controls established to reduce the risk of fraud in the program, we might be able to offer up best practices for contractors.

The Government Charge Card Abuse Prevention Act of 2012 (Charge Card Act or CCA) requires agencies to establish and maintain safeguards and internal controls for purchase cards. Under the CCA, Inspectors General must conduct periodic risk assessments of agency purchase card programs to analyze the risks of illegal, improper, or erroneous purchases. Inspectors General then use these risk assessments to determine the necessary scope, frequency, and number of audits or reviews of these programs. Long time readers of this blog and those involved in internal audits will recognize the "risk assessment" is the second of the five elements of internal controls.

At the Hearing, the VA's Assistant Inspector General for Audits and Evaluations described their risk assessment as follows:

For the fiscal year (FY) 2015 risk assessment, we performed data mining on credit card transactions using a set of defined criteria designed to identify transactions or patters of activity that appear to represent potential fraud, waste, or abuse. Our risk assessment examined

• Cardholders with a high volume of transactions
• Multiple transactions made on the same day with the same vendor, amount and purchase card
• Credit card purchases that exceeded established purchase card limits
• Recurring transactions made with the same vendor
• Transactions occurring on holidays, weekends, in the last two months of the fiscal year, and during unusual times of the day
• Transactions made by a facility that were more than double the nationwide average number of transactions and costs per purchase card.

This would seem like a likely starting point for contractors to assess their risks and vulnerabilities in purchase card programs. There doesn't seem to be anything in this listing that would test or point to the use of cards to make "personal" purchases so that might be an additional risk factor that contractors consider.

Continuing on with the testimony, the Assistant IG  noted that from the above risk assessment, the organization identified seven high risk areas that included:

• Cardholder transactions that exceed authorized purchase limits including unauthorized commitments.
• Inadequate financial controls prohibiting duplicative and split payments
• An excessive number of cardholders making purchases with inadequate justifications
• An unmanageable span of control resulting from an unbalanced ratio or cardholders to approving officials.
• Inadequate recording or reporting of financial information.
• Insufficient oversight of year-end spending
• Inadequate review of purchases by approving officials.

Based on the risk assessments, the IG plans to conduct audits and reviews to identify control weaknesses, strengthen program control, and address inefficiencies in VA’s Purchase Card Program. Its recent work has identified significant control weaknesses that did not prevent transactions involving unauthorized commitments, improper payments, split purchases, and purchases that lacked appropriate supporting documentation.  

So evidently, the controls that are in place to prevent unauthorized commitments, improper payments, split purchases, and purchases that lacked supporting documentation were not working. Now its up to the auditors and management to improve its system of internal controls to prevent that from happening in the future.

"Freebies" Given to Purchase Card Holders

Contractors that issue purchase cards to employees for small purchases need to consider whether their policies and procedures cover the fairly common practice by retailers to offer something "free with purchase". Who gets the freebies? The card holder or the company?

So for example, on today's Office Depot website, you can get a free $15 gift card when you purchase $75 in HP (Hewlett Packard) ink. Does that $15 belong to the company or can the card holder retain it for personal use? What if the company didn't need $75 worth of ink? What if the company needed only $60 worth of ink but the card holder, in order to get $15 for himself, added another ink cartridge to his shopping cart. After all, its easy to rationalize that the ink will eventually be needed, right? Or suppose that the same cartridges that cost $75 at Office Deport were only $65 on Amazon but the card holder bought from Office Depot in order to secure that gift card. Its very easy to see that the prospect of gaining freebies can lead to poor purchasing decisions.

The very nature of purchases using purchase card - many small dollar items by many employees makes it difficult to monitor the activities for which the cards are being used. A "reviewer" - whatever that title brings - looking over a charge card statement would probably not even hesitate at a $75 dollar charge to Office Depot. Such a charge would be a reasonable use of purchase cards held by an employee responsible for office supplies. But that charge card statement would not have disclosed that a gift card had been issued.

Does it happen a lot? Is there a significant problem where purchase decisions are influenced with the promise of freebies and where the freebies are not going to the company but to private use? We have no way of knowing. But we will say this. Those gifts, gift cards, and other freebies should be considered company property. The company, not the employee, should be making the decision on how to dispose of the property. Gift cards can be used to defray the cost of future purchases. Other gifts, if not usable for business purposes, can be given to charities. There are other options but the thing companies need to avoid is situations where such gifts influence purchase decisions. Any time a purchase decision is so-influenced, bad things are likely to happen.

Contractor policies and procedures governing the use of purchase cards should directly address this matter. Gift cards, rebates, etc. are the property of the company and procedures should address the process for disposition of these items.

FAR 31.201-5 states that the applicable portion of any income, rebate, allowance or other credit relating to any allowable cost and received by or accruing to the contractor shall be credited to the Government. This FAR cost principle would likely extend to gifts accruing from purchase card transactions.

March 16, 2015 UPDATE:

Here's an example to illustrate our point.

Let's say you need some bond paper for your copier and printers. Your employee checks in on the Office Depot website and find it's only $27.99 per case and if you buy $75 or more, you get a free gift.

So, the employee buys three cases for a total of $83.97 and gets to choose a free gift.

However, if you look Office Depot's weekly add (found in the Sunday paper), you will find the same paper selling for $19.99. Buying three cases at that price totals $59.97, a $24 savings. That means you've paid 40 percent more than you should have just so your employee can obtain his/her free gift.

We say, avoid the freebies and go for the cheapest price.