Fairfax County Public Schools Review of Internal Controls for ...

539 views
447 views

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
539
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
7
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Fairfax County Public Schools Review of Internal Controls for ...

  1. 1. Fairfax County Public Schools Internal Audit Fairfax County Public Schools Review of Internal Controls for the Procurement (Credit) Commercial Card Program Internal Audit Office Superintendent’s Office January 2004 Review of Internal Controls for the FCPS Credit Card Program 1
  2. 2. Fairfax County Public Schools Internal Audit TABLE OF CONTENTS Fairfax County Public Schools ........................................................................................... 1 Review of Internal Controls for the Procurement (Credit) Commercial Card Program..... 1 Internal Audit Office........................................................................................................... 1 Superintendent’s Office ...................................................................................................... 1 January 2004 ....................................................................................................................... 1 Introduction Background .................................................................................................... 3 Purpose and Scope .............................................................................................................. 5 Executive Summary ............................................................................................................ 6 Comments and Recommendations...................................................................................... 7 1. The Procurement (Credit) Card Management program has adopted a majority of what are considered best practices in card management. ................................... 7 2. The Accounts Payable unit in the Office of Finance responsible for administering the credit card program is also responsible for authorizing credit card electronic payments......................................................................................... 7 3. Records containing credit card information are not always safeguarded by school and department personnel............................................................................ 8 4. There was no requirement in the regulations that cardholders and approving officials receive training prior to using the card. .................................................... 9 5. Spending limits on FCPS p-cards are not always established commensurate with needs. ............................................................................................................ 10 6. Signature cards were not on file for more than half of a random sample of credit cards issued by the Office of Finance......................................................... 11 7. The usage of more than one quarter of credit cards issued was limited to less than one transaction a month. ............................................................................... 12 8. Management information for card usage should be shared with Supply Operations. ............................................................................................................ 13 9. The number of allowable credit card transactions per day and per month exceeds the needs of users. ................................................................................... 14 10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures................................................................................. 15 Appendix 1........................................................................................................................ 17 Best Practices for Procurement Cards............................................................................... 17 Appendix 2........................................................................................................................ 18 Response from Department of Financial Services............................................................ 18 GENERAL RESPONSE................................................................................................... 19 Review of Internal Controls for the FCPS Credit Card Program 2
  3. 3. Fairfax County Public Schools Internal Audit Introduction Background Fairfax County Public Schools, like many other school districts, purchase a large volume of goods that represent a small percentage of the dollars spent. Procurement (credit) cards or p-cards are a form of what might be termed a “commercial credit card.” They are held by specified authorized individuals within an organization. They simplify the purchasing process and reduce the transaction handling cost associated with this activity. P-cards have built-in safeguards and management controls to minimize misuse. The safeguards include a monthly and single purchase dollar cap assigned to the card. There are also safeguards that restrict purchases from certain vendor categories by blocking authorization against those merchant activity codes. P-cards also provide an incentive payment that the government entity can earn based on the activity volume. In 1995, Fairfax County implemented a pilot program intended to supplement and expand the existing small purchase systems. Fairfax County Public Schools participated in the pilot program. The objective was to provide schools and administrative offices with the flexibility to make purchases directly from vendors using appropriated funds. The program was expanded to the entire school system near the end of 1995 allowing schools to purchase instructional supplies and textbooks. Administrative offices were allowed to use the cards for additional types of expenditures as well. During FY 1998, the Department of Financial Services implemented a pilot program for non-appropriated local school funds. FCPS also expanded the program allowing the use of credit cards for staff development and special education. In FY 2001 credit card transactions exceeded $17.5 million for 3,833 vendors and in FY 2002 they were more than $18 million to 4,248 vendors. For FY 2003 FCPS credit card Review of Internal Controls for the FCPS Credit Card Program 3
  4. 4. Fairfax County Public Schools Internal Audit transactions exceeded $20 million to more than 4,200 vendors. At the time of this audit there were 1,088 credit cards issued to 256 Fairfax County Public School facilities. The transaction limit for these 1,088 cards was almost $5.5 million and the monthly limit was set at more than $13 million. The largest type of purchases made with p-cards was text books which comprised more than 48 per cent of the total purchased for the combined fiscal years. The next largest categories were instructional supplies at 21 per cent, central procurement supplies at 16 per cent and office supplies at 4 per cent. Industry estimates are that p-cards can save up to 80% in processing costs of small-dollar transactions. The FCPS cost of processing purchase transactions in FY 2003 using traditional methods was approximately $11.12 per transaction in salary costs ($1,028,499 divided by 92,482 transactions). Typically using a card can save up to 80% in processing costs of small-dollar transactions. If the average cost to process a purchase request cost FCPS about $11 using traditional methods, the cost to process a P Card transaction is $2. Each transaction results in a $9 savings. The total number of p-card transactions for 2001 and 2002 was 75,315 which means, using p-cards saved FCPS an estimated $675,000 over traditional methods. FCPS also earned significant incentive payments based on the purchase volume activity. FCPS received $104,532 and $151, 243 in incentive payments in calendar year 2002 and 2003 respectively. Review of Internal Controls for the FCPS Credit Card Program 4
  5. 5. Fairfax County Public Schools Internal Audit Purpose and Scope This audit is being conducted in accordance with Regulation 1420. I included this audit in the Internal Audit Plan approved by the Division Superintendent. The purpose of this audit is to verify that: • Internal controls for purchase card administration and training are reasonable; • Controls are in place to reasonably prevent purchase card misuse and abuse; • Internal controls for card deactivation are adequate; • Card user billing reports are reconciled in accordance with the regulation. We analyzed the credit card transactions for FY 2001 and FY 2002. We interviewed staff, examined documents and records in the Office of Finance, at schools and central administrative offices. We selected a sample of credit cards based on the entire universe of cards issued and verified that the cards were in the possession of the authorized cardholders. We also selected a sample of credit card transactions and reviewed supporting documentation to ensure that the charges were properly authorized in accordance with the guidelines for credit cards. We performed other audit tests as deemed necessary. Review of Internal Controls for the FCPS Credit Card Program 5
  6. 6. Fairfax County Public Schools Internal Audit Executive Summary The p-card program is achieving the objectives set out when the program was first established. The oversight provided by the Credit Card Administrator Unit in the accounts payable section of the Office of Finance contributed significantly to the success of the program. Additionally based on a review of best practices in procurement (credit) card management we found that FCPS substantially complies with most of the universally accepted best practices. A major area of concern however is the degree of control that resides with the Credit Card Administrator Unit. The individuals responsible for controlling the issuance, authorization and removal of cards also have control of electronic payments for credit card charges. This represents a control exposure that in our opinion requires a change in responsibility that separates the administrative aspects of the program from the payment process. The primary responsibility for oversight of individual charges made to credit cards is at the school level. Our report provide detailed comments and recommendations to enhance the current procurement (credit) card management system and improve management controls. Review of Internal Controls for the FCPS Credit Card Program 6
  7. 7. Fairfax County Public Schools Internal Audit Comments and Recommendations 1. The Procurement (Credit) Card Management program has adopted a majority of what are considered best practices in card management. Several organizations including the U.S. General Accounting Office, the Australian National Audit Office and Acquisition Solutions Inc. have studied best practices in procurement (credit) card management. We compared FCPS policies and procedures to a composite list of best practices for card management and determined that FCPS substantially complies with most universally accepted best practices. We commend the Office of Finance for steps taken to establish these best in class procedures. We have identified some areas in our review where FCPS could improve and adopt additional best practices. They are discussed in the balance of this report. 2. The Accounts Payable unit in the Office of Finance responsible for administering the credit card program is also responsible for authorizing credit card electronic payments. A key component of a system of internal controls requires the segregation of responsibilities so that one person or unit cannot control the complete processing of transactions from initial authorization to approval and final disposition. We found that the accounts payable unit in the Office of Finance was responsible for issuing and approving p-cards was also responsible for approving electronic payment of the monthly billings. It would therefore be possible to establish new accounts, process p-card transactions and pay the monthly billing without adequate oversight. The function of administering and approving credit cards for Review of Internal Controls for the FCPS Credit Card Program 7
  8. 8. Fairfax County Public Schools Internal Audit departmental/school use as well as monitoring and approving payments should not be under the control of one department. This constitutes an inadequate segregation of duties as the department approving the issuance of credit cards also authorizes credit card payments. We recommend that these incompatible functions be split so that different individuals within the Office of Finance are responsible for oversight and monitoring of the activities within the accounts payable unit responsible for credit card transactions. Management Response In January 2004, The Office of Finance segregated the responsibility of downloading and authorizing payment of the weekly billings. The Financial Systems and Control Section is responsible for downloading the credit card transactions before the payment is made. Accounts Payable submits the wire payment request to the Fairfax County Government Center, Office of Finance for processing. 3. Records containing credit card information are not always safeguarded by school and department personnel. A standard internal control activity involves safeguarding vulnerable assets. We found in out testing that schools and department do an excellent job of physically securing the credit cards by keeping them locked in the school safe, locked desks or locked file cabinets. However we found that the records containing the credit card numbers such as the monthly billing statements are sometimes left unsecured in files on the finance officer or administrative assistant’s desk or in unlocked file cabinets or desk which are accessible by school staff including custodians. We Review of Internal Controls for the FCPS Credit Card Program 8
  9. 9. Fairfax County Public Schools Internal Audit recommend that all records for the credit cards be physically secured to limit access only to FCPS authorized staff. Management Response The Office of Finance will include an article in the Department of Financial Services newsletter to remind schools and department personnel to maintain all credit card related documentation in a locked or secure area. We will further communicate this information in the finance and budget liaison meetings. 4. There was no requirement in the regulations that cardholders and approving officials receive training prior to using the card. After identifying appropriate personnel to entrust with FCPS credit cards and approving official authority, the key to a successful program is educating all participants in the proper execution of the program. Training is a recognized best practice and should be a mandatory prerequisite to card issuance. Both the supervisor and the employee who maintains the card records should not be eligible for card issuance until they have both completed the training. The training should cover procurement, budget, or appropriations requirements and restrictions. Training could be done in effectively in several ways. One way would be to provide cardholders with a “reminder card” or pamphlet that could be stored with the card. The pamphlet could be used by cardholders to consult as a quick reminder on appropriate use of the card. The Office of Finance provided limited training to program managers and other school individuals using the cards and training on the use of the p-cards is not mandatory. We recommend that the Review of Internal Controls for the FCPS Credit Card Program 9
  10. 10. Fairfax County Public Schools Internal Audit Office of Finance implement a training program to certify employees before issuing new cards. Management Response The Office of Finance will develop a “quick reference guide” outlining topics such as proper procurement, budget and appropriations management and other relevant information for FCPS credit cards users. The program manager and credit card reconciler will be required to sign an agreement acknowledging receipt and understanding of this material. We will also send periodic updates when new information becomes available. 5. Spending limits on FCPS p-cards are not always established commensurate with needs. Cardholder limits should be aligned with school or department needs in order to minimize FCPS’ financial exposure. When departments apply for a p-card they complete an enrollment form and establish single transaction and monthly credit limits. The Office of Finance reviews the procurement card request for completeness and accuracy and forwards the request directly to the financial institution. There is no supporting documentation required for the enrollment form that would provide the reviewing authority with a basis for determination as to the need for a card or whether the requested limits are appropriate. We recommend that the Office of Finance require departments or schools to identify the primary purpose of the card and justification for the spending (credit limit) established. Review of Internal Controls for the FCPS Credit Card Program 10
  11. 11. Fairfax County Public Schools Internal Audit Management Response The Office of Finance will revise the Credit Card Enrollment Form and request that the program manager provide additional information to justify the intended purpose of the card and spending (credit limits). 6. Signature cards were not on file for more than half of a random sample of credit cards issued by the Office of Finance. FCPS regulations issued by the Department of Financial Services require that a signature authorization card shall be on file in the Department of Financial Services (Office of Finance, Accounts Payable Section) for all individuals authorized to approve financial transactions including credit card transactions. We selected a random sample of 228 cards and found that signature authorization cards were not on file for 124 cards (54.4%). Without signature authorization cards it would be difficult to verify whether credit card transactions were properly authorized by individuals given specific signature authority. We recommend that the Office of Finance include a checklist for credit card issuance that includes completion of a signature authorization card for all approved users of credit cards including the principal or program manager and other authorized staff. Management Response The Accounts Payable section, Office of Finance has revised the signature card, FS-126 to include a section for credit card signature authorization. Notices are sent to program managers to update or complete new signature cards to ensure current information is on file. Signature Cards will be scanned to provide easy retrieval for Accounts Payable staff to verify signature authority. Review of Internal Controls for the FCPS Credit Card Program 11
  12. 12. Fairfax County Public Schools Internal Audit 7. The usage of more than one quarter of credit cards issued was limited to less than one transaction a month. Credit cards should only be issued to schools or departments that have demonstrated a need for the card based on their procurement history. We found that a high percentage of credit cards are not being used enough to justify issuing them. We analyzed the FY 2001 credit card transaction file for 806 cards and determined that 210 cards (26.1%) had one or less transaction per month. Of those 210 cards, 33 had only one transaction for the entire fiscal year. The Office of Finance should look at those departments issued cards that have low activity and analyze their procurement transactions to determine if there are other purchases that they could be using the cards for but are not. If the Office of Finance determines that the department or school has chosen not to use the card for purchasing eligible goods or services then the card should be returned and cancelled. Management Response The Office of Finance will send annual notices to program managers with low or no credit card activity and request justification to maintain the credit card account(s). If credit cards are no longer needed, they will be cancelled. Some Departments have requested to place certain credit card(s) on inactive status during low use periods. The Office of Finance will encourage this practice as it provides additional safeguards for the credit cards by reducing the risk of unauthorized use. Review of Internal Controls for the FCPS Credit Card Program 12
  13. 13. Fairfax County Public Schools Internal Audit 8. Management information for card usage should be shared with Supply Operations. A major benefit of procurement card programs is that comprehensive information reports on buying trends can be easily summarized and provided to purchasing officials. These reports can provide valuable information that purchasing officials can use to negotiate contracts, gain volume discounts, and utilize to help FCPS get quality products at the best price. Supply operations should receive periodic reports detailing credit card usage by vendor. At the time of the audit reports were not being done on a regular basis but rather on request. We recommend that the Office of Finance and Supply Operations agree on a list of standardized reports to run either monthly, semiannually or annually. These should be based on the needs of Supply Operations to facilitate purchasing decisions. The Office of Finance could develop a checklist to ensure that all reports are run and distributed as per the agreement. Management Response The Office of Finance will provide the Office of Procurement Services (formerly Supply Operations) monthly management reports regarding credit card transactions. Support documentation of inappropriate purchases will also be provided for review and follow-up and corrective action by department or school personnel. We will also provide the Office of Procurement Services access to the Procurement Card Provider (ProCard) credit card management product so they may generate various reports and review activity trends. Review of Internal Controls for the FCPS Credit Card Program 13
  14. 14. Fairfax County Public Schools Internal Audit 9. The number of allowable credit card transactions per day and per month exceeds the needs of users. The daily and monthly limit on the number of transactions per credit card is currently set at the default level of 99 and 999. In our review of credit card transactions we found that the daily and monthly level of transactions was significantly lower than the default level. The defaults are set at a high level to ensure that volume users are not hampered by transaction limits. The majority of FCPS users would not be considered high volume users and therefore the default limits far exceed the transaction levels for most schools and departments. By using the default settings the risk level of unauthorized transactions taking place before school administrators became aware of them is increased. The Regulation should require the user to establish the authorizations per day and the transactions per cycle to limit the liability of the school system should the card be lost or stolen. The Office of Finance could include this information on the new card enrollment form as an indication of expected number of daily and monthly transactions. The limit could then be set to accommodate each department’s needs while minimizing risk to the school system. Management Response We will review transaction activity for all existing cards and recommend new limits based on average daily and monthly expenditures. We will ask program managers to provide anticipated monthly dollar volumes and transactions for new card requests to assist with establishing reasonable per day and per month limits. Review of Internal Controls for the FCPS Credit Card Program 14
  15. 15. Fairfax County Public Schools Internal Audit 10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures. Adequate monitoring and periodic oversight is an important component of procurement card programs. According to Purchase Card Best Practices identified by Acquisition Solutions, organizations should establish a multi-faceted, strategic approach of monitoring and oversight. These would include who conducts reviews and how they should be conducted. The current regulation covering procurement (credit) card management places all the responsibility for ensuring compliance with the regulation on principals and program managers. Principals and program managers are required to sign the monthly statement indicating that they have reviewed the charges but there is no requirement for periodic follow up to ensure that there is supporting documentation for the purchases. There are standard reports that the bank can generate showing account activity, declined authorizations, disputes, unusual spending activity and lost or stolen cards. The regulation should require standard report generation and review by Financial Services and periodic audits of the supporting documentation maintained by principals and program managers. Management Response The Office of Finance reviews credit card transactions on a weekly basis and follow-up with departments or schools on questionable purchases. Beginning fiscal year 2005, we will procure the services of an external independent audit firm to conduct annual audits. Review of Internal Controls for the FCPS Credit Card Program 15
  16. 16. Fairfax County Public Schools Internal Audit Review of Internal Controls for the FCPS Credit Card Program 16
  17. 17. Fairfax County Public Schools Internal Audit Appendix 1 Best Practices for Procurement Cards A. Policy FCPS Yes No 1. Relevant Documents All card holders should be familiar with the relevant documents X governing the use of the card Descriptions of positions and work functions that qualify for X 2. Purpose of the card using the card Transactions where the card is not to be used are specified X Specify expenditure and individual limits. Identify types of transactions that require prior approval. X Identify the approved methods of processing transactions (otc, X 3. Payment Methods telephone, mail, internet) 4. Discipline Statement regarding trust, improper use and periodic review. X B. Controls Over Card Issuance 1. Card Application Requests should be in writing by the requesting individual X 2. Assessment criteria Criteria for evaluating applications should be established. X 3. Approval The individual in the agency/department school approves the X use of the card. 4. Register of users Maintain a register of card holders including the name, account X number, credit limit and expiry date. C. Operational Controls 1. Review of transactions Monthly statements provided to the cardholder for review and X certification including expenditure approved per established criteria. 2. Reporting to Periodic report on credit card use including summary X management expenditure, instances where use is contrary to guidelines (exceeding credit limit, unsigned statements, inappropriate use, and efficiency and effectiveness such as low use of cards or cards not used). 3. Instructions for use Specific instructions for use should be developed and issued to X all card holders. Review of Statement Statement review to verify correct charges and disputed X transactions. Expenditure Acquittal Submission of supporting documentation. X Review of card use Independent review of documentation to ensure that the X expenditures are valid and incurred in an official capacity. Periodic reconciliation Each cardholder should periodically reconcile records against X statements provided by the credit card company. Increases in credit limit Application completed for temporary credit limit increases and X reversion to the original approval amount at a specific date. Cancellation Where cards are no longer required they should be promptly X cancelled after ensuring that all transactions are cleared and properly accounted for. Card should be returned to the administrator along with an acknowledgement for the return. Safe custody Cardholders are required to secure the card at all times against X loss or theft. Promptly report loss or theft to bank and the credit card administrator. D. Card Holder Obligations The cardholder is to acknowledge receipt of the card and X instructions for use. Review of Internal Controls for the FCPS Credit Card Program 17
  18. 18. Fairfax County Public Schools Internal Audit Appendix 2 Response from Department of Financial Services Office of Finance FAIRFAX COUNTY Westmore Center PUBLIC SCHOOLS 11000 Berry Street Fairfax, Virginia 22030 May 04, 2004 TO: Jim Kaplan, Internal Audit Director Office of the Superintendent FROM: Constance Downing, Director Office of Finance SUBJECT: Response to the Final Draft of the Internal Controls for the Procurement (Credit) Commercial Card Program Attached is the response and action plan addressing the recommendations presented in the final draft copy of the Procurement (Credit) Commercial Card program audit dated November 2003. We have considered all feedback and look forward to incorporating your recommendations in our program. Several recommendations have already been implemented. If you have any questions regarding this matter, please contact me at (703) 246-6700. Thank you. Review of Internal Controls for the FCPS Credit Card Program 18
  19. 19. Fairfax County Public Schools Internal Audit GENERAL RESPONSE The Fairfax County Public Schools (FCPS) Procurement (Credit) Card Program has experienced tremendous growth since it’s inception in 1995. For calendar year 2003, credit card expenditures exceeded $22 million. Based on this annual spend, FCPS received a rebate of $183,000 in March 2004. As mentioned in your report, the Office of Finance has adopted many of the industries’ best practices in procurement card management. We will continue to seek opportunities to enhance this program and provide additional internal controls when appropriate. The Accounts Payable Section, Office of Finance, has implemented several of the recommendations stated in your report. Beginning fiscal year 2005, the Office of Finance will utilize an independent auditing firm to conduct annual audits of the credit card program. FINDINGS 1. The Procurement (Credit) Card Management program has adopted a majority of what are considered best practices in card management. No action required. 2. The Accounts Payable unit in the Office of Finance responsible for administering the credit card program is also responsible for authorizing credit card electronic payments. In January 2004, The Office of Finance segregated the responsibility of downloading and authorizing payment of the weekly billings. The Financial Systems and Control Section is responsible for downloading the credit card transactions before the payment is made. Accounts Payable submits the wire payment request to the Fairfax County Government Center, Office of Finance for processing. 3. Records containing credit card information are not always safeguarded by the school and department personnel. The Office of Finance will include an article in the Department of Financial Services newsletter to remind schools and department personnel to maintain all credit card related documentation in a locked or secure area. We will further communicate this information in the finance and budget liaison meetings. Review of Internal Controls for the FCPS Credit Card Program 19
  20. 20. Fairfax County Public Schools Internal Audit 4. There was no requirement in the regulation that cardholders and approving officials receive training prior to using the card. The Office of Finance will develop a “quick reference guide” outlining topics such as proper procurement, budget and appropriations management and other relevant information for FCPS credit cards users. The program manager and credit card reconciler will be required to sign an agreement acknowledging receipt and understanding of this material. We will also send periodic updates when new information becomes available. 5. Spending limits on FCPS p-cards are not always established commensurate with the needs. The Office of Finance will revise the Credit Card Enrollment Form and request that the program manager provide additional information to justify the intended purpose of the card and spending (credit limits). 6. Signature cards were not on file for more than half of a random sample of credit cards issued by the Office of Finance. The Accounts Payable section, Office of Finance has revised the signature card, FS-126 to include a section for credit card signature authorization. Notices are sent to program managers to update or complete new signature cards to ensure current information is on file. Signature Cards will be scanned to provide easy retrieval for Accounts Payable staff to verify signature authority. 7. The usage of more than one quarter of credit cards issued was limited to less than one transaction a month. The Office of Finance will send annual notices to program managers with low or no credit card activity and request justification to maintain the credit card account(s). If credit cards are no longer needed, they will be cancelled. Some Departments have requested to place certain credit card(s) on inactive status during low use periods. The Office of Finance will encourage this practice as it provides additional safeguards for the credit cards by reducing the risk of unauthorized use. 8. Management information for card usage should be shared with Supply Operations. Review of Internal Controls for the FCPS Credit Card Program 20
  21. 21. Fairfax County Public Schools Internal Audit The Office of Finance will provide the Office of Procurement Services (formerly Supply Operations) monthly management reports regarding credit card transactions. Support documentation of inappropriate purchases will also be provided for review and follow-up and corrective action by department or school personnel. We will also provide the Office of Procurement Services access to the Procurement Card Provider (ProCard) credit card management product so they may generate various reports and review activity trends. 9. The number of allowable credit card transactions per day and per month exceeds the needs of users. We will review transaction activity for all existing cards and recommend new limits based on average daily and monthly expenditures. We will ask program managers to provide anticipated monthly dollar volumes and transactions for new card requests to assist with establishing reasonable per day and per month limits. 10. There is no requirement in the Regulation for periodic post audit process or independent management review of credit card transactions ensuring that expenditures are valid and cardholders are in compliance with the procurement card policies and procedures. The Office of Finance reviews credit card transactions on a weekly basis and follow-up with departments or schools on questionable purchases. Beginning fiscal year 2005, we will procure the services of an external independent audit firm to conduct annual audits. Review of Internal Controls for the FCPS Credit Card Program 21

×