Inappropriate P-card Practices

Inappropriate P-card Practices

Courtenay Thompson. The Internal Auditor. Altamonte Springs: Jun 2004. Vol. 61, Iss. 3; pg. 97, 3 pgs

Abstract (Summary)
At a major research university, the internal auditors were tasked with performing routine documentation reviews for the university's procurement card (p-card) program. The lessons to be learned about p-cards from a fictional case study include: 1. Routine audits, although not glamorous, may provide opportunities for internal auditors to identify material control weaknesses in routine processing systems that can have wide ranging impact. 2. The p-card process should have an outlet, by hotline or anonymous e-mail, to allow individuals involved in transaction processing and oversight to report suspected abuse without fear of retribution. 3. Budget pressures may so impact established internal controls that the control is eliminated, resulting in significantly increased risk of fraud.

An understaffed university accounting department gets some much needed help from campus internal auditors and uncovers fraudulent use of procurement cards.

AT A MAJOR RESEARCH UNIversity, the internal auditors were tasked with performing routine documentation reviews for the university's procurement card (p-card) program. Although the audit director was not generally in favor of his department performing routine monitoring, he had agreed to the reviews as a service to the accounting director, whose department recently had been a target of budget cuts.

The accounting department had only one person assigned to review p-card transactions processed through the accounting office. With 1,200 p-cards in staff and faculty hands, the review clerk was responsible for manually reviewing nearly 71,000 transactions totaling more than $11 million from the previous year. The p-card program relied solely on internal control processes in user departments and the monitoring practices of one accounting clerk to ensure the cards were used only for appropriate university expenses.

Previous documentation reviews in other departments had revealed random missing documents, a few instances of card use by someone other than the person to whom the card was assigned, and occasional pyramiding of transactions. (Pyramiding is the use of multiple, or split, transactions - for example, multiple card swipes - in an attempt to break transactions into smaller pieces to circumvent card limits.) These transactions are usually easy to identify with data sorts by vendor and date, or by date, vendor, and accounting transaction number. They are also usually fairly easy to spot by their even-dollar amount and by data extraction that highlights purchase amounts reasonably close to the transaction limit. Despite these occurrences, no evidence of fraud had been identified.

As the current round of documentation reviews was drawing to a close, the internal audit director decided to review one of the university's remote locations that had several p-cards assigned to staff and faculty. His reasoning was that the location had not been visited in recent years by internal auditing, had a history of "creative" accounting related to other transactions, and perhaps was in need of a control-awareness wake-up call.

Using the automated financial system query capabilities, the p-card transactions for the previous year were downloaded, and approximately ioo transactions were selected for document verification. Among those transactions were several suspected instances of pyramiding and unusual descriptions of items purchased.

The audit director scheduled a visit to the remote unit for Tuesday morning. The unit was notified in advance and asked to schedule approximately four hours for documentation verification. Upon arrival, the audit director presented the accounting clerk with a list of transactions to be reviewed and asked the clerk to pull the appropriate documentation. The first receipt document pulled was from a well-known discount store and listed, along with the items that would be used by the university, several children's DVDs and video games. The audit director also noticed several items that were crossed out, with a different description handwritten on the receipt. When queried about the appropriateness of the purchases, the accounting clerk responded that the purchaser had told her the chain's receipt didn't always actually describe the item purchased, and what appeared to be unauthorized purchases were actually different items that were authorized.

The audit director, recognizing that the discount chain's financial success "lived and died" by the accuracy of its inventory control, suspected something was wrong. The director continued reviewing the remaining receipts, identifying an additional 12 questionable purchases, which totaled more than $1,200. he contacted the local chain store manager and verified that "if the receipt says video game, it is a video game," and that the manager could specifically identify each game. After visiting with the manager and identifying all the questionable items, the internal auditor contacted the university police department, as was standard practice, to coordinate a criminal investigation of what was now a suspected p-card fraud.

The auditor identified and downloaded all p-card purchases made by the individual since he had received his card three years earlier and identified multiple suspected unauthorized purchases. The following week, the internal auditor, along with an experienced investigator from the university police department, returned to the unit to review documentation of these transactions and to interview individuals involved. While the auditor reviewed and documented scores of unauthorized purchases, the investigator interviewed staff, and through the senior administrator responsible for the unit, scheduled an interview with the suspect for the following day.

When the accounting clerk was asked whether she had wondered about the appropriateness of the purchases, she became very emotional, commenting that she knew they were wrong, but, "it's a small town and I need my job." After questioning several of the earliest transactions, she had quit doing so. Apparently, management pressured her to ignore the discrepancies because the suspect reported to the dean, and "we don't question what the dean was believed to know about."

The audit director, investigator, and senior administrator arrived for the interview with the suspect the following day armed with the internal auditor's documented evidence of suspected unauthorized transactions dating back three years, just one week after the p-card was issued to the suspected individual. Early in the interview, the suspect admitted purchasing unauthorized items for personal use, but also indicated that many of the purchases were for the university but were being "stored" by him at no cost because the school had limited storage space.

Using a search warrant obtained by the university police department, the audit director and university police removed nearly four van-loads of suspected unauthorized purchases from the suspect's home and personal vehicle. he was terminated immediately.

The total estimated loss from the fraud was more than $60,000, but only $32,000 was considered provable. Many other purchases, though apparently excessive and clearly unnecessary, were not traceable because they could not be individually identified. The suspect was arrested, and the university is currently pursuing the case through the courts.

LESSONS LEARNED

* Routine audits, although not glamorous, may provide opportunities for internal auditors to identify material control weaknesses in routine processing systems that can have wide ranging impact. The p-card process was designed as a pilot program of 30 cards and 15 users and was never truly updated to reflect the growth in the process. As a result, controls that worked for a small program were inadequate for a full-scale program.

* The p-card process should have an outlet, by hotline or anonymous e-mail, to allow individuals involved in transaction processing and oversight to report suspected abuse without fear of retribution. Economic realities often shape actions, and even the most honest people will overlook or ignore fraud if they suspect their job or livelihood will be in jeopardy if they report the suspected abuse. When the tone from the top does not encourage and support ethical actions, fraud can grow rapidly.

* Budget pressures may so impact established internal controls that the control is eliminated, resulting in significantly increased risk of fraud. In the search for efficiency, the first activity to be cut is often the control activity, because practicing good internal controls takes time and doesn't normally contribute to processing efficiency in a budget-conscious environment. This can be a costly decision when control processes become overwhelmed by transaction activity.

* Financial system capabilities must be used to allow detective internal controls to effectively identify and evaluate high-risk transactions. Having one clerk assigned to review all p-card transactions - if the clerk does nothing other than review transactions eight hours a day, five days a week - results in just over one minute per transaction for review. Analysis of buying trends and usage patterns through data extraction and analysis, or periodic system queries, should be implemented to identify potentially fraudulent transactions.

* Individuals responsible for p-card use and monitoring must be continually trained and made aware of fraud risk in card use. Annual refresher courses, including fraud awareness, for all individuals involved in p-card processes should be required. No infraction of p-card rules should be considered minor, and management must be made aware of even seemingly accidental infractions.

* Real consequences for misuse of p-cards need to be formalized and enforced. The tone at the top must clearly convey that fraudulent use of p-cards will be prosecuted. A p-card program without "teeth" to address misuse is a "fraud waiting to happen." Even the best run and most well-controlled p-card program will experience fraud.

* P-card fraud may be indicative of fraud in other areas of purchasing.

P-cards are just one purchasing method. A purchasing card fraud investigation should include review of other purchasing methods available to suspected fraudsters. In this fraud, the suspect was also making unauthorized purchases, totaling many thousands of dollars, through direct-billed purchases and standing (framework) orders, as well as using other individuals' p-cards to which he had access.