fairfax county public schools review of internal controls for

Fairfax County Public Schools Internal Audit

Fairfax County Public Schools Review of Internal Controls for the Procurement (Credit) Commercial

Card Program

Internal Audit Office

Superintendent’s Office January 2004

Review of Internal Controls for the FCPS Credit Card Program

1


TABLE OF CONTENTS

Fairfax County Public Schools ........................................................................................... 1 Review of Internal Controls for the Procurement (Credit) Commercial Card Program..... 1 Internal Audit Office........................................................................................................... 1 Superintendent’s Office ...................................................................................................... 1 January 2004 ....................................................................................................................... 1 Introduction Background .................................................................................................... 3 Purpose and Scope .............................................................................................................. 5 Executive Summary ............................................................................................................ 6 Comments and Recommendations...................................................................................... 7

1. The Procurement (Credit) Card Management program has adopted a majority of what are considered best practices in card management. ................................... 7 2. The Accounts Payable unit in the Office of Finance responsible for administering the credit card program is also responsible for authorizing credit card electronic payments......................................................................................... 7 3. Records containing credit card information are not always safeguarded by school and department personnel............................................................................ 8 4. There was no requirement in the regulations that cardholders and approving officials receive training prior to using the card. .................................................... 9 5. Spending limits on FCPS p-cards are not always established commensurate with needs. ............................................................................................................ 10 6. Signature cards were not on file for more than half of a random sample of credit cards issued by the Office of Finance......................................................... 11 7. The usage of more than one quarter of credit cards issued was limited to less than one transaction a month. ............................................................................... 12 8. Management information for card usage should be shared with Supply Operations. ............................................................................................................ 13 9. The number of allowable credit card transactions per day and per month exceeds the needs of users. ................................................................................... 14 10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures. ................................................................................ 15

Appendix 1........................................................................................................................ 17 Best Practices for Procurement Cards............................................................................... 17 Appendix 2........................................................................................................................ 18 Response from Department of Financial Services............................................................ 18 GENERAL RESPONSE................................................................................................... 19


2


Introduction Background Fairfax County Public Schools, like many other school districts, purchase a large volume

of goods that represent a small percentage of the dollars spent. Procurement (credit) cards

or p-cards are a form of what might be termed a “commercial credit card.” They are held

by specified authorized individuals within an organization. They simplify the purchasing

process and reduce the transaction handling cost associated with this activity. P-cards

have built-in safeguards and management controls to minimize misuse. The safeguards

include a monthly and single purchase dollar cap assigned to the card. There are also

safeguards that restrict purchases from certain vendor categories by blocking

authorization against those merchant activity codes. P-cards also provide an incentive

payment that the government entity can earn based on the activity volume. In 1995,

Fairfax County implemented a pilot program intended to supplement and expand the

existing small purchase systems. Fairfax County Public Schools participated in the pilot

program. The objective was to provide schools and administrative offices with the

flexibility to make purchases directly from vendors using appropriated funds. The

program was expanded to the entire school system near the end of 1995 allowing schools

to purchase instructional supplies and textbooks. Administrative offices were allowed to

use the cards for additional types of expenditures as well. During FY 1998, the

Department of Financial Services implemented a pilot program for non-appropriated

local school funds. FCPS also expanded the program allowing the use of credit cards for

staff development and special education.

In FY 2001 credit card transactions exceeded $17.5 million for 3,833 vendors and in FY

2002 they were more than $18 million to 4,248 vendors. For FY 2003 FCPS credit card


3


transactions exceeded $20 million to more than 4,200 vendors. At the time of this audit

there were 1,088 credit cards issued to 256 Fairfax County Public School facilities. The

transaction limit for these 1,088 cards was almost $5.5 million and the monthly limit was

set at more than $13 million. The largest type of purchases made with p-cards was text

books which comprised more than 48 per cent of the total purchased for the combined

fiscal years. The next largest categories were instructional supplies at 21 per cent, central

procurement supplies at 16 per cent and office supplies at 4 per cent.

Industry estimates are that p-cards can save up to 80% in processing costs of small-dollar

transactions. The FCPS cost of processing purchase transactions in FY 2003 using

traditional methods was approximately $11.12 per transaction in salary costs ($1,028,499

divided by 92,482 transactions). Typically using a card can save up to 80% in processing

costs of small-dollar transactions. If the average cost to process a purchase request cost

FCPS about $11 using traditional methods, the cost to process a P Card transaction is $2.

Each transaction results in a $9 savings. The total number of p-card transactions for 2001

and 2002 was 75,315 which means, using p-cards saved FCPS an estimated $675,000

over traditional methods. FCPS also earned significant incentive payments based on the

purchase volume activity. FCPS received $104,532 and $151, 243 in incentive payments

in calendar year 2002 and 2003 respectively.


4


Purpose and Scope This audit is being conducted in accordance with Regulation 1420. I included this audit in

the Internal Audit Plan approved by the Division Superintendent. The purpose of this

audit is to verify that:

• Internal controls for purchase card administration and training are

reasonable;

• Controls are in place to reasonably prevent purchase card misuse and

abuse;

• Internal controls for card deactivation are adequate;

• Card user billing reports are reconciled in accordance with the

regulation.

We analyzed the credit card transactions for FY 2001 and FY 2002. We interviewed staff,

examined documents and records in the Office of Finance, at schools and central

administrative offices. We selected a sample of credit cards based on the entire universe

of cards issued and verified that the cards were in the possession of the authorized

cardholders. We also selected a sample of credit card transactions and reviewed

supporting documentation to ensure that the charges were properly authorized in

accordance with the guidelines for credit cards. We performed other audit tests as deemed

necessary.


5


Executive Summary The p-card program is achieving the objectives set out when the program was first

established. The oversight provided by the Credit Card Administrator Unit in the

accounts payable section of the Office of Finance contributed significantly to the success

of the program. Additionally based on a review of best practices in procurement (credit)

card management we found that FCPS substantially complies with most of the

universally accepted best practices. A major area of concern however is the degree of

control that resides with the Credit Card Administrator Unit. The individuals responsible

for controlling the issuance, authorization and removal of cards also have control of

electronic payments for credit card charges. This represents a control exposure that in our

opinion requires a change in responsibility that separates the administrative aspects of the

program from the payment process. The primary responsibility for oversight of

individual charges made to credit cards is at the school level. Our report provide detailed

comments and recommendations to enhance the current procurement (credit) card

management system and improve management controls.


6


Comments and Recommendations

1. The Procurement (Credit) Card Management program has adopted a

majority of what are considered best practices in card management.

Several organizations including the U.S. General Accounting Office, the

Australian National Audit Office and Acquisition Solutions Inc. have studied best

practices in procurement (credit) card management. We compared FCPS policies

and procedures to a composite list of best practices for card management and

determined that FCPS substantially complies with most universally accepted best

practices. We commend the Office of Finance for steps taken to establish these

best in class procedures. We have identified some areas in our review where

FCPS could improve and adopt additional best practices. They are discussed in

the balance of this report.

2. The Accounts Payable unit in the Office of Finance responsible for

administering the credit card program is also responsible for authorizing credit card electronic payments.

A key component of a system of internal controls requires the segregation of

responsibilities so that one person or unit cannot control the complete processing

of transactions from initial authorization to approval and final disposition. We

found that the accounts payable unit in the Office of Finance was responsible for

issuing and approving p-cards was also responsible for approving electronic

payment of the monthly billings. It would therefore be possible to establish new

accounts, process p-card transactions and pay the monthly billing without

adequate oversight. The function of administering and approving credit cards for


7


departmental/school use as well as monitoring and approving payments should

not be under the control of one department. This constitutes an inadequate

segregation of duties as the department approving the issuance of credit cards also

authorizes credit card payments. We recommend that these incompatible

functions be split so that different individuals within the Office of Finance are

responsible for oversight and monitoring of the activities within the accounts

payable unit responsible for credit card transactions.

Management Response

In January 2004, The Office of Finance segregated the responsibility of

downloading and authorizing payment of the weekly billings. The Financial

Systems and Control Section is responsible for downloading the credit card

transactions before the payment is made. Accounts Payable submits the wire

payment request to the Fairfax County Government Center, Office of Finance for

processing.

3. Records containing credit card information are not always safeguarded by

school and department personnel.

A standard internal control activity involves safeguarding vulnerable assets. We

found in out testing that schools and department do an excellent job of physically

securing the credit cards by keeping them locked in the school safe, locked desks

or locked file cabinets. However we found that the records containing the credit

card numbers such as the monthly billing statements are sometimes left unsecured

in files on the finance officer or administrative assistant’s desk or in unlocked file

cabinets or desk which are accessible by school staff including custodians. We


8


recommend that all records for the credit cards be physically secured to limit

access only to FCPS authorized staff.

Management Response

The Office of Finance will include an article in the Department of Financial

Services newsletter to remind schools and department personnel to maintain all

credit card related documentation in a locked or secure area. We will further

communicate this information in the finance and budget liaison meetings.

4. There was no requirement in the regulations that cardholders and approving

officials receive training prior to using the card.

After identifying appropriate personnel to entrust with FCPS credit cards and

approving official authority, the key to a successful program is educating all

participants in the proper execution of the program. Training is a recognized best

practice and should be a mandatory prerequisite to card issuance. Both the

supervisor and the employee who maintains the card records should not be

eligible for card issuance until they have both completed the training. The training

should cover procurement, budget, or appropriations requirements and

restrictions. Training could be done in effectively in several ways. One way

would be to provide cardholders with a “reminder card” or pamphlet that could be

stored with the card. The pamphlet could be used by cardholders to consult as a

quick reminder on appropriate use of the card. The Office of Finance provided

limited training to program managers and other school individuals using the cards

and training on the use of the p-cards is not mandatory. We recommend that the


9


Office of Finance implement a training program to certify employees before

issuing new cards.

Management Response

The Office of Finance will develop a “quick reference guide” outlining topics

such as proper procurement, budget and appropriations management and other

relevant information for FCPS credit cards users. The program manager and

credit card reconciler will be required to sign an agreement acknowledging receipt

and understanding of this material.

We will also send periodic updates when new information becomes available.

5. Spending limits on FCPS p-cards are not always established commensurate

with needs.

Cardholder limits should be aligned with school or department needs in order to

minimize FCPS’ financial exposure. When departments apply for a p-card they

complete an enrollment form and establish single transaction and monthly credit

limits. The Office of Finance reviews the procurement card request for

completeness and accuracy and forwards the request directly to the financial

institution. There is no supporting documentation required for the enrollment

form that would provide the reviewing authority with a basis for determination as

to the need for a card or whether the requested limits are appropriate. We

recommend that the Office of Finance require departments or schools to identify

the primary purpose of the card and justification for the spending (credit limit)

established.


10


Management Response

The Office of Finance will revise the Credit Card Enrollment Form and request

that the program manager provide additional information to justify the intended

purpose of the card and spending (credit limits).

6. Signature cards were not on file for more than half of a random sample of

credit cards issued by the Office of Finance.

FCPS regulations issued by the Department of Financial Services require that a

signature authorization card shall be on file in the Department of Financial

Services (Office of Finance, Accounts Payable Section) for all individuals

authorized to approve financial transactions including credit card transactions. We

selected a random sample of 228 cards and found that signature authorization

cards were not on file for 124 cards (54.4%). Without signature authorization

cards it would be difficult to verify whether credit card transactions were properly

authorized by individuals given specific signature authority. We recommend that

the Office of Finance include a checklist for credit card issuance that includes

completion of a signature authorization card for all approved users of credit cards

including the principal or program manager and other authorized staff.

Management Response

The Accounts Payable section, Office of Finance has revised the signature card,

FS-126 to include a section for credit card signature authorization. Notices are

sent to program managers to update or complete new signature cards to ensure

current information is on file. Signature Cards will be scanned to provide easy

retrieval for Accounts Payable staff to verify signature authority.


11


7. The usage of more than one quarter of credit cards issued was limited to less

than one transaction a month.

Credit cards should only be issued to schools or departments that have

demonstrated a need for the card based on their procurement history. We found

that a high percentage of credit cards are not being used enough to justify issuing

them. We analyzed the FY 2001 credit card transaction file for 806 cards and

determined that 210 cards (26.1%) had one or less transaction per month. Of those

210 cards, 33 had only one transaction for the entire fiscal year. The Office of

Finance should look at those departments issued cards that have low activity and

analyze their procurement transactions to determine if there are other purchases

that they could be using the cards for but are not. If the Office of Finance

determines that the department or school has chosen not to use the card for

purchasing eligible goods or services then the card should be returned and

cancelled.

Management Response

The Office of Finance will send annual notices to program managers with low or

no credit card activity and request justification to maintain the credit card

account(s). If credit cards are no longer needed, they will be cancelled.

Some Departments have requested to place certain credit card(s) on inactive status

during low use periods. The Office of Finance will encourage this practice as it

provides additional safeguards for the credit cards by reducing the risk of

unauthorized use.


12


8. Management information for card usage should be shared with Supply Operations.

A major benefit of procurement card programs is that comprehensive information

reports on buying trends can be easily summarized and provided to purchasing

officials. These reports can provide valuable information that purchasing officials

can use to negotiate contracts, gain volume discounts, and utilize to help FCPS

get quality products at the best price. Supply operations should receive periodic

reports detailing credit card usage by vendor. At the time of the audit reports

were not being done on a regular basis but rather on request. We recommend that

the Office of Finance and Supply Operations agree on a list of standardized

reports to run either monthly, semiannually or annually. These should be based on

the needs of Supply Operations to facilitate purchasing decisions. The Office of

Finance could develop a checklist to ensure that all reports are run and distributed

as per the agreement.

Management Response

The Office of Finance will provide the Office of Procurement Services (formerly

Supply Operations) monthly management reports regarding credit card

transactions. Support documentation of inappropriate purchases will also be

provided for review and follow-up and corrective action by department or school

personnel. We will also provide the Office of Procurement Services access to the

Procurement Card Provider (ProCard) credit card management product so they

may generate various reports and review activity trends.


13


9. The number of allowable credit card transactions per day and per month

exceeds the needs of users.

The daily and monthly limit on the number of transactions per credit card is

currently set at the default level of 99 and 999. In our review of credit card

transactions we found that the daily and monthly level of transactions was

significantly lower than the default level. The defaults are set at a high level to

ensure that volume users are not hampered by transaction limits. The majority of

FCPS users would not be considered high volume users and therefore the default

limits far exceed the transaction levels for most schools and departments. By

using the default settings the risk level of unauthorized transactions taking place

before school administrators became aware of them is increased. The Regulation

should require the user to establish the authorizations per day and the transactions

per cycle to limit the liability of the school system should the card be lost or

stolen. The Office of Finance could include this information on the new card

enrollment form as an indication of expected number of daily and monthly

transactions. The limit could then be set to accommodate each department’s needs

while minimizing risk to the school system.

Management Response

We will review transaction activity for all existing cards and recommend new

limits based on average daily and monthly expenditures. We will ask program

managers to provide anticipated monthly dollar volumes and transactions for new

card requests to assist with establishing reasonable per day and per month limits.


14


10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures.

Adequate monitoring and periodic oversight is an important component of

procurement card programs. According to Purchase Card Best Practices identified

by Acquisition Solutions, organizations should establish a multi-faceted, strategic

approach of monitoring and oversight. These would include who conducts

reviews and how they should be conducted. The current regulation covering

procurement (credit) card management places all the responsibility for ensuring

compliance with the regulation on principals and program managers. Principals

and program managers are required to sign the monthly statement indicating that

they have reviewed the charges but there is no requirement for periodic follow up

to ensure that there is supporting documentation for the purchases. There are

standard reports that the bank can generate showing account activity, declined

authorizations, disputes, unusual spending activity and lost or stolen cards. The

regulation should require standard report generation and review by Financial

Services and periodic audits of the supporting documentation maintained by

principals and program managers.

Management Response

The Office of Finance reviews credit card transactions on a weekly basis and

follow-up with departments or schools on questionable purchases. Beginning

fiscal year 2005, we will procure the services of an external independent audit

firm to conduct annual audits.


15



16


Appendix 1

Best Practices for Procurement Cards

A. Policy FCPS Yes No

1. Relevant Documents All card holders should be familiar with the relevant documents governing the use of the card

X

2. Purpose of the card

Descriptions of positions and work functions that qualify for using the card

X

Transactions where the card is not to be used are specified X Specify expenditure and individual limits. Identify types of transactions that require prior approval. X

3. Payment Methods Identify the approved methods of processing transactions (otc, telephone, mail, internet)

X

4. Discipline Statement regarding trust, improper use and periodic review. X B. Controls Over Card Issuance

1. Card Application Requests should be in writing by the requesting individual X 2. Assessment criteria Criteria for evaluating applications should be established. X 3. Approval The individual in the agency/department school approves the

use of the card. X

4. Register of users Maintain a register of card holders including the name, account number, credit limit and expiry date.

X

C. Operational Controls 1. Review of transactions Monthly statements provided to the cardholder for review and

certification including expenditure approved per established criteria.

X

2. Reporting to management

Periodic report on credit card use including summary expenditure, instances where use is contrary to guidelines (exceeding credit limit, unsigned statements, inappropriate use, and efficiency and effectiveness such as low use of cards or cards not used).

X

3. Instructions for use Specific instructions for use should be developed and issued to all card holders.

X

Review of Statement Statement review to verify correct charges and disputed transactions.

X

Expenditure Acquittal Submission of supporting documentation. X Review of card use Independent review of documentation to ensure that the

expenditures are valid and incurred in an official capacity. X

Periodic reconciliation Each cardholder should periodically reconcile records against statements provided by the credit card company.

X

Increases in credit limit Application completed for temporary credit limit increases and reversion to the original approval amount at a specific date.

X

Cancellation Where cards are no longer required they should be promptly cancelled after ensuring that all transactions are cleared and properly accounted for. Card should be returned to the administrator along with an acknowledgement for the return.

X

Safe custody Cardholders are required to secure the card at all times against loss or theft. Promptly report loss or theft to bank and the credit card administrator.

X

D. Card Holder Obligations The cardholder is to acknowledge receipt of the card and instructions for use.

X


17


Appendix 2

Response from Department of Financial Services

Office of Finance FAIRFAX COUNTY Westmore Center PUBLIC SCHOOLS 11000 Berry Street Fairfax, Virginia 22030 May 04, 2004 TO: Jim Kaplan, Internal Audit Director Office of the Superintendent FROM: Constance Downing, Director Office of Finance SUBJECT: Response to the Final Draft of the Internal Controls for the Procurement

(Credit) Commercial Card Program Attached is the response and action plan addressing the recommendations presented in the final draft copy of the Procurement (Credit) Commercial Card program audit dated November 2003. We have considered all feedback and look forward to incorporating your recommendations in our program. Several recommendations have already been implemented.

If you have any questions regarding this matter, please contact me at (703) 246-6700.

Thank you.


18


GENERAL RESPONSE The Fairfax County Public Schools (FCPS) Procurement (Credit) Card Program has experienced tremendous growth since it’s inception in 1995. For calendar year 2003, credit card expenditures exceeded $22 million. Based on this annual spend, FCPS received a rebate of $183,000 in March 2004. As mentioned in your report, the Office of Finance has adopted many of the industries’ best practices in procurement card management. We will continue to seek opportunities to enhance this program and provide additional internal controls when appropriate. The Accounts Payable Section, Office of Finance, has implemented several of the recommendations stated in your report. Beginning fiscal year 2005, the Office of Finance will utilize an independent auditing firm to conduct annual audits of the credit card program. FINDINGS 1. The Procurement (Credit) Card Management program has adopted a majority of what are considered best practices in card management. No action required. 2. The Accounts Payable unit in the Office of Finance responsible for administering the credit card program is also responsible for authorizing credit card electronic payments. In January 2004, The Office of Finance segregated the responsibility of downloading and authorizing payment of the weekly billings. The Financial Systems and Control Section is responsible for downloading the credit card transactions before the payment is made. Accounts Payable submits the wire payment request to the Fairfax County Government Center, Office of Finance for processing. 3. Records containing credit card information are not always safeguarded by the school and department personnel. The Office of Finance will include an article in the Department of Financial Services newsletter to remind schools and department personnel to maintain all credit card related documentation in a locked or secure area. We will further communicate this information in the finance and budget liaison meetings.


19


4. There was no requirement in the regulation that cardholders and approving officials receive training prior to using the card. The Office of Finance will develop a “quick reference guide” outlining topics such as proper procurement, budget and appropriations management and other relevant information for FCPS credit cards users. The program manager and credit card reconciler will be required to sign an agreement acknowledging receipt and understanding of this material. We will also send periodic updates when new information becomes available. 5. Spending limits on FCPS p-cards are not always established commensurate with the needs. The Office of Finance will revise the Credit Card Enrollment Form and request that the program manager provide additional information to justify the intended purpose of the card and spending (credit limits). 6. Signature cards were not on file for more than half of a random sample of credit cards issued by the Office of Finance.

The Accounts Payable section, Office of Finance has revised the signature card, FS-126 to include a section for credit card signature authorization. Notices are sent to program managers to update or complete new signature cards to ensure current information is on file. Signature Cards will be scanned to provide easy retrieval for Accounts Payable staff to verify signature authority. 7. The usage of more than one quarter of credit cards issued was limited to less than one transaction a month.

The Office of Finance will send annual notices to program managers with low or no credit card activity and request justification to maintain the credit card account(s). If credit cards are no longer needed, they will be cancelled. Some Departments have requested to place certain credit card(s) on inactive status during low use periods. The Office of Finance will encourage this practice as it provides additional safeguards for the credit cards by reducing the risk of unauthorized use. 8. Management information for card usage should be shared with Supply Operations.


20


The Office of Finance will provide the Office of Procurement Services (formerly Supply Operations) monthly management reports regarding credit card transactions. Support documentation of inappropriate purchases will also be provided for review and follow-up and corrective action by department or school personnel. We will also provide the Office of Procurement Services access to the Procurement Card Provider (ProCard) credit card management product so they may generate various reports and review activity trends. 9. The number of allowable credit card transactions per day and per month exceeds the needs of users. We will review transaction activity for all existing cards and recommend new limits based on average daily and monthly expenditures. We will ask program managers to provide anticipated monthly dollar volumes and transactions for new card requests to assist with establishing reasonable per day and per month limits.

10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures.

The Office of Finance reviews credit card transactions on a weekly basis and follow-up with departments or schools on questionable purchases. Beginning fiscal year 2005, we will procure the services of an external independent audit firm to conduct annual audits.


21