SlideShare a Scribd company logo
1 of 4
Download to read offline
I V OLUME 57 I NUMBER 3 I FALL 2015 I
INSIDE:
What Internal Auditors Need to Know About
Sales Tax
Advisory Services: Balancing Value and
Independence
ACUA Award Winners
New Rising Star Award
Highlights From the 2015 Annual Conference in
Indianapolis, Indiana
DEVELOPING A PREVENTATIVE
AND SUSTAINABLE
P-CARD PROGRAM
AuditTools
Purchasing card (P-Card) spending is on the rise, particularly among colleges and
universities. The use of P-Cards is expected to increase 62 percent by 2018 reaching $377
billion, according to the 2014 RPMG Purchasing Card Benchmark Survey. The
expansion of P-Card programs and use is expected to continue given the myriad of benefits
P-Cards offer including streamlining the procurement-to-pay process, lowering operational costs
and taking advantage of supplier discounts. Originally, P-Cards were used for small dollar
transactions to help reduce or eliminate the need for petty cash. However, while P-Card use has
grown, it has become increasingly challenging to maintain compliance as organizations struggle
to gain insights into their program. Analyzing high transaction volumes using spreadsheets and
manually reviewing receipts becomes labor-intensive and inefficient.
TWO PERSPECTIVES, ONE COMMON GOAL
From the standpoint of internal audit, the objective of a P-Card system is to rid the organization
of fraud, waste and abuse. While there are a variety of ways to search for fraud, most are not
foolproof. Sampling is unreliable for detecting and preventing misuse, and card issuer
applications provide limited data. Spreadsheets have capacity limitations and are prone to errors.
Many auditors have found success in using purpose-built data analytics tools to extract and
analyze data from different sources and file types to detect instances of fraud, waste and abuse.
These tools provide the ability to examine 100 percent of the P-Card program data. More than
ever, auditors are embracing technology to stay ahead of risks and exposures that may lead to
revenue losses.
From a business standpoint, the objectives are slightly different. While detection of misuse is
important, stakeholders within the organization not only need to know that something went
awry; they want to dive deeper into specific risk areas to identify
underlying causes. Data analytics can help auditors look through
high volumes of transactional data to identify anomalies, but it
is often a reactionary approach. Infractions are seldom caught in
time to recover funds. In fact, it takes an average of 24 months
to detect procurement fraud at which time 89 percent of all
proceeds are unrecoverable. The business goal is to stay well
ahead of the problem.
PREVENT A CULTURE OF MISUSE
The tolerance threshold varies for every organization. If a $300
million P-Card program incurs $20,000 in annual misuse, the
convenience and administrative cost savings may offset the loss.
However, inappropriate spend involving large sums of money
could quickly become newsworthy and damaging to the
organization’s reputation. Stakeholders need assurance that
preventative measures are in place and working properly.
Transactional data can be analyzed, but misuse goes unnoticed
without information from other sources such as accounts
payables and human resources. For example, if John uses his
P-Card to purchase gasoline while on vacation, the misuse is
typically not found using traditional auditing techniques
Developing a Preventative and
Sustainable P-Card Program
By Andrew Simpson
ABOUT THE AUTHOR
Andrew Simpson, chief operating
officer of CaseWare Analytics, has
over two decades of experience in the
information systems audit and
security business, specifically data
analytics, continuous controls
monitoring, interrogation and
forensics.
“Continuous monitoring
is about creating a
sustainable internal
control environment, not
creating more work. It
goes beyond identifying
a single set of problems
to providing actionable
insights to the business.
Organizations can
create a collaborative
environment where
everyone works to
strengthen controls,
while expanding the
P-Card program.”
14 COLLEGE & UNIVERSITY AUDITOR
AuditTools
because fuel is a normal expense for John since his position requires business travel. John shares his
clever cost-saving tactic with a close coworker, who begins to take advantage of similar weaknesses in
the system for personal gain. The culture of misuse perpetuates and continues to go undetected.
When looking at exceptions, can you determine whether it was an isolated incident where clarification
of policies and procedures need further explanation or a habitual problem? How many times has each
employee violated the policies? Was one person in violation while the majority followed policy? Is there
a department that tends to have multiple violations on a regular basis? Is misuse related to specific
spending areas? These questions can only be addressed if the analysis includes data from different
sources, such as employee data, category of spend, etc.
Running data analytics to test P-Card data provides some valuable details about exceptions, especially
when you incorporate multiple data sources including:
•	P-Card Transaction Data – Provided by the card issuer and contains records of all transaction details
including merchant category code, item description, purchase date, amount and vendor name.
•	Cardholder Master – Provided by the card issuer and contains data for all cardholders in the P-Card
program. Details include last four digits of each card, monthly card limit, card status, date issued, etc.
•	Employee Master File – File of employees with details such as employee name, identification
number, department, vacation schedule and employment status.
•	Expense Signoff – Expenses submitted by employees with details such as purchase date, cardholder
comments and manager signoff details.
•	Accounts Payable (AP) – Lists payments made by AP and details such as invoice date and number,
vendor name, item description and transaction amount. This data can be used to detect duplicate
transactions across P-Card and AP processes.
Additionally, if the organization uses an expense management system such as Concur, data can be
automatically extracted and analyzed on a regular basis to ensure compliance. Expense management
systems allow employees to submit expenses for approval and/or reimbursements.
Broadening the scope of data being examined helps bridge gaps and allows you to see fraud schemes
that would be impossible to detect otherwise.
ASSESS RISK AND CONTROLS
To gain an understanding of the unique ways P-Cards are being used within the organization, and
whether policies and procedures are being followed, perform a risk and controls assessment. By testing
historical data, you can establish a benchmark to gauge the severity of issues and identify problem
areas. Begin by comparing current data with the year prior to detect patterns for normal or abnormal
spending trends. Calculate average spends by department to look for outliers and unusual spend
patterns. Historical data is useful for assessing the entire data population year to year.
Examples of Analytics Tests/Queries:
•	Monitor for duplicate payments between P-Card merchants and Accounts Payable vendors
•	Check for charges at inappropriate or unusual merchants (i.e. department stores, cash, personal care)
by MCC code or vendor name keyword search
•	Pinpoint split charges to circumvent purchasing card limits
•	Identify cards used by terminated employees and/or employees on leave of absence
•	Search for expenses that may be approved without verification of receipt
•	Look for cardholders who made purchases on weekends or holidays
•	Check for unused or duplicate cards, which may be causing unnecessary liability
•	Search for sales tax charges. As a non-profit organization, most universities are exempted from sales
tax.
•	Identify the top 20 spenders to pinpoint which cardholders have the highest total purchases
15 COLLEGE & UNIVERSITY AUDITOR
AuditTools
Next, break the queries down into sub-processes to pinpoint problem areas such as:
•	Card issuance: Involves the assignment of cards to appropriate departments and employees
•	P-Card usage: Involves examining card spend across departments and employees to detect outliers
or unusual spending patterns
•	Policy management: Determine whether existing policies and procedures are being followed by all
employees
Reliable Remediation
When an exception is detected, how is it dealt with, or is it dealt with at all? Traditional remediation,
usually involving emails, is time consuming, unreliable and error prone. Multiple follow-ups are
necessary between several parties to ensure resolution, and managers are not always updated about
whether or not the issue has been resolved. Continuous monitoring also automates remediation follow-
ups until resolution is achieved; including escalation if the issue is not addressed within a set
timeframe. This process can be customized to align with business processes and structure.
Get the Big Picture of the P-Card Program
Continuous monitoring tools offer dashboards that present information graphically on key program
metrics such as the amount of spend across a period of time and the level of exceptions. Dashboards
can be configured based on what the end users want to see or what information is beneficial to
department leaders.
Reviewing trend and patterns can help gauge the performance of controls and policies, and identify
any potential gaps that need addressing. Visualization helps the end user consume data and insights
by looking at patterns, not just rows and columns of numbers. Trends become more apparent, and the
data becomes more useful to everyone participating in the review process.
Sustained Growth
P-Card programs often lose the support of top management if there are repeated cases of misuse,
especially if they are discovered too late to take corrective action and recover losses. The administrative
cost savings, convenience and efficiency gains associated with using P-Cards benefits the organization,
but only if exposure and risk are managed properly. Management needs assurance that policies and
procedures are being followed, and audit is staying ahead of misuse.
The University of Miami, which includes academics, hospitals and research facilities, is growing at a
rapid pace. Their growth will undoubtedly lead to an increase in P-Card use. The university’s internal
audit department has already taken steps to move from periodically reviewing random samples of
P-Card transactions to continuously monitoring 100 percent through the use of data analytics
technology. Exceptions are shared with department managers to provide a comfort level about how
P-Cards are being used within the organization, and whether policies and procedures are being followed.
“As our corporate cards program grows, we provide assurance at both the department and management
levels that we have sufficient policies and procedures in place to review transactions,” said Hiram Sem,
Executive Director of Treasury Operations and Cash Management, University of Miami. “Card holders
must understand they are responsible and accountable, but we must also carefully monitor expenditures
to identify unauthorized charges early. Technology has helped us refine our review process and handle
larger data volumes that come with expansion.”
The value of continuous monitoring reaches well beyond exception detection. There are three
advantages driving the trend towards continuous monitoring:
•	access to more data sources to get a complete picture of what is transpiring within the organization;
•	the ability to assess whether policies are being followed; and
•	the empowerment to improve business processes by gaining deeper insights.
When an organization is working towards a problem-free environment, it provides a sustainable process
to proactively look for and address issues. When employees know every transaction is being monitored,
it creates a catalyst for behavioral changes within the organization. n
16 COLLEGE & UNIVERSITY AUDITOR

More Related Content

What's hot

predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banks
predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-bankspredictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banks
predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banksArup Das
 
Data analytics in finance broucher
Data analytics in finance broucher Data analytics in finance broucher
Data analytics in finance broucher Daniel Thomas
 
Forrester Report: The Power Of Real-Time Insight
Forrester Report: The Power Of Real-Time InsightForrester Report: The Power Of Real-Time Insight
Forrester Report: The Power Of Real-Time InsightSAP Concur
 
Keeping in Step With Strategic Business Objectives in Insurance through Analy...
Keeping in Step With Strategic Business Objectives in Insurance through Analy...Keeping in Step With Strategic Business Objectives in Insurance through Analy...
Keeping in Step With Strategic Business Objectives in Insurance through Analy...Vijai John
 
Predictive Response to Combat Retail Shrink
Predictive Response to Combat Retail ShrinkPredictive Response to Combat Retail Shrink
Predictive Response to Combat Retail ShrinkCognizant
 
Vendor strategies: Operational Business Intelligence for Agile Enterprises
Vendor strategies: Operational Business Intelligence for Agile EnterprisesVendor strategies: Operational Business Intelligence for Agile Enterprises
Vendor strategies: Operational Business Intelligence for Agile EnterprisesKishore Jethanandani, MBA, MA, MPhil,
 
Mitigating fraud, waste, and misuse in the procurement process
Mitigating fraud, waste, and misuse in the procurement processMitigating fraud, waste, and misuse in the procurement process
Mitigating fraud, waste, and misuse in the procurement processJean Gleason
 
Mitigating fraud waste misuse
Mitigating fraud waste misuseMitigating fraud waste misuse
Mitigating fraud waste misusejlsitler
 
Mitigating fraud waste_misuse
Mitigating fraud waste_misuseMitigating fraud waste_misuse
Mitigating fraud waste_misuseMulti Service
 
Whitepaper: Ventana Research - Sales Compensation Management
Whitepaper: Ventana Research - Sales Compensation ManagementWhitepaper: Ventana Research - Sales Compensation Management
Whitepaper: Ventana Research - Sales Compensation ManagementIconixx
 
Data Integrity White Paper
Data Integrity White PaperData Integrity White Paper
Data Integrity White PaperExperian
 

What's hot (12)

predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banks
predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-bankspredictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banks
predictive-analytics-the-silver-bullet-in-efficient-risk-management-for-banks
 
Data analytics in finance broucher
Data analytics in finance broucher Data analytics in finance broucher
Data analytics in finance broucher
 
Forrester Report: The Power Of Real-Time Insight
Forrester Report: The Power Of Real-Time InsightForrester Report: The Power Of Real-Time Insight
Forrester Report: The Power Of Real-Time Insight
 
Keeping in Step With Strategic Business Objectives in Insurance through Analy...
Keeping in Step With Strategic Business Objectives in Insurance through Analy...Keeping in Step With Strategic Business Objectives in Insurance through Analy...
Keeping in Step With Strategic Business Objectives in Insurance through Analy...
 
Predictive Response to Combat Retail Shrink
Predictive Response to Combat Retail ShrinkPredictive Response to Combat Retail Shrink
Predictive Response to Combat Retail Shrink
 
Vendor strategies: Operational Business Intelligence for Agile Enterprises
Vendor strategies: Operational Business Intelligence for Agile EnterprisesVendor strategies: Operational Business Intelligence for Agile Enterprises
Vendor strategies: Operational Business Intelligence for Agile Enterprises
 
HP Viewpoint: Shift from Data to Insight
HP Viewpoint: Shift from Data to InsightHP Viewpoint: Shift from Data to Insight
HP Viewpoint: Shift from Data to Insight
 
Mitigating fraud, waste, and misuse in the procurement process
Mitigating fraud, waste, and misuse in the procurement processMitigating fraud, waste, and misuse in the procurement process
Mitigating fraud, waste, and misuse in the procurement process
 
Mitigating fraud waste misuse
Mitigating fraud waste misuseMitigating fraud waste misuse
Mitigating fraud waste misuse
 
Mitigating fraud waste_misuse
Mitigating fraud waste_misuseMitigating fraud waste_misuse
Mitigating fraud waste_misuse
 
Whitepaper: Ventana Research - Sales Compensation Management
Whitepaper: Ventana Research - Sales Compensation ManagementWhitepaper: Ventana Research - Sales Compensation Management
Whitepaper: Ventana Research - Sales Compensation Management
 
Data Integrity White Paper
Data Integrity White PaperData Integrity White Paper
Data Integrity White Paper
 

Viewers also liked

Viewers also liked (9)

Time management
Time managementTime management
Time management
 
2016 Resume
2016 Resume2016 Resume
2016 Resume
 
Gerald Murphy Resume
Gerald Murphy ResumeGerald Murphy Resume
Gerald Murphy Resume
 
Halloween
HalloweenHalloween
Halloween
 
Dicas para compra e venda de empresas
Dicas para compra e venda de empresasDicas para compra e venda de empresas
Dicas para compra e venda de empresas
 
Résumé-Kenin R. Greer
Résumé-Kenin R. GreerRésumé-Kenin R. Greer
Résumé-Kenin R. Greer
 
Shruti_Tayal_Resume
Shruti_Tayal_ResumeShruti_Tayal_Resume
Shruti_Tayal_Resume
 
Calculo numérico y manejo de errores
Calculo numérico y manejo de erroresCalculo numérico y manejo de errores
Calculo numérico y manejo de errores
 
Reducing False Positives
Reducing False PositivesReducing False Positives
Reducing False Positives
 

Similar to College University Auditor Fall 2015 P-Card Program (Jan)

Analytics in banking services
Analytics in banking servicesAnalytics in banking services
Analytics in banking servicesMariyageorge
 
Business analytics assignment
Business analytics assignmentBusiness analytics assignment
Business analytics assignmentChandraniThakuria
 
191 Castro Street, 2nd Floor, Mountain View, CA 94041 P 6.docx
191 Castro Street, 2nd Floor, Mountain View, CA 94041    P 6.docx191 Castro Street, 2nd Floor, Mountain View, CA 94041    P 6.docx
191 Castro Street, 2nd Floor, Mountain View, CA 94041 P 6.docxfelicidaddinwoodie
 
Gmid associates services portfolio bank
Gmid associates  services portfolio bankGmid associates  services portfolio bank
Gmid associates services portfolio bankPankaj Jha
 
BRIDGEi2i Whitepaper - The Science of Customer Experience Management
BRIDGEi2i Whitepaper - The Science of Customer Experience ManagementBRIDGEi2i Whitepaper - The Science of Customer Experience Management
BRIDGEi2i Whitepaper - The Science of Customer Experience ManagementBRIDGEi2i Analytics Solutions
 
Data-Analytics-Resource-updated for analysis
Data-Analytics-Resource-updated for analysisData-Analytics-Resource-updated for analysis
Data-Analytics-Resource-updated for analysisBhavinGada5
 
WP_011_Analytics_DRAFT_v3_FINAL
WP_011_Analytics_DRAFT_v3_FINALWP_011_Analytics_DRAFT_v3_FINAL
WP_011_Analytics_DRAFT_v3_FINALJennifer Hartwell
 
Acquire Grow & Retain customers - The business imperative for Big Data
Acquire Grow & Retain customers - The business imperative for Big DataAcquire Grow & Retain customers - The business imperative for Big Data
Acquire Grow & Retain customers - The business imperative for Big DataIBM Software India
 
Improve Service Quality Through Enterprise Feedback Management
Improve Service Quality Through Enterprise Feedback ManagementImprove Service Quality Through Enterprise Feedback Management
Improve Service Quality Through Enterprise Feedback ManagementSpectos GmbH
 
Application of predictive analytics
Application of predictive analyticsApplication of predictive analytics
Application of predictive analyticsPrasad Narasimhan
 
Improving Customer Experience in Government-business Interaction.pdf
Improving Customer Experience in Government-business Interaction.pdfImproving Customer Experience in Government-business Interaction.pdf
Improving Customer Experience in Government-business Interaction.pdfdracomalfay
 
Data monetization shailesh d ubey
Data monetization   shailesh d ubeyData monetization   shailesh d ubey
Data monetization shailesh d ubeyShailesh Dubey
 
Deloitte B2B Payments 2015 Report
Deloitte B2B Payments 2015 ReportDeloitte B2B Payments 2015 Report
Deloitte B2B Payments 2015 ReportRichard Miller
 
Ariba Knowledge Nuggets: eProcurement Transformation
Ariba Knowledge Nuggets:  eProcurement TransformationAriba Knowledge Nuggets:  eProcurement Transformation
Ariba Knowledge Nuggets: eProcurement TransformationSAP Ariba
 
Experian dv2020 - the new rules of customer engagement - emea research report
Experian   dv2020 - the new rules of customer engagement - emea research reportExperian   dv2020 - the new rules of customer engagement - emea research report
Experian dv2020 - the new rules of customer engagement - emea research reportAltan Atabarut, MSc.
 
financial exec final
financial exec finalfinancial exec final
financial exec finalAdam Ortlieb
 
Marketing and HR Analytics
Marketing and HR AnalyticsMarketing and HR Analytics
Marketing and HR AnalyticsVadivelM9
 
Consumer Analytics A Primer
Consumer Analytics A PrimerConsumer Analytics A Primer
Consumer Analytics A Primerijtsrd
 
Data MiningData MiningData MiningData Mining
Data MiningData MiningData MiningData MiningData MiningData MiningData MiningData Mining
Data MiningData MiningData MiningData Miningabdulraqeebalareqi1
 

Similar to College University Auditor Fall 2015 P-Card Program (Jan) (20)

Analytics in banking services
Analytics in banking servicesAnalytics in banking services
Analytics in banking services
 
Business analytics assignment
Business analytics assignmentBusiness analytics assignment
Business analytics assignment
 
191 Castro Street, 2nd Floor, Mountain View, CA 94041 P 6.docx
191 Castro Street, 2nd Floor, Mountain View, CA 94041    P 6.docx191 Castro Street, 2nd Floor, Mountain View, CA 94041    P 6.docx
191 Castro Street, 2nd Floor, Mountain View, CA 94041 P 6.docx
 
Gmid associates services portfolio bank
Gmid associates  services portfolio bankGmid associates  services portfolio bank
Gmid associates services portfolio bank
 
BRIDGEi2i Whitepaper - The Science of Customer Experience Management
BRIDGEi2i Whitepaper - The Science of Customer Experience ManagementBRIDGEi2i Whitepaper - The Science of Customer Experience Management
BRIDGEi2i Whitepaper - The Science of Customer Experience Management
 
Data-Analytics-Resource-updated for analysis
Data-Analytics-Resource-updated for analysisData-Analytics-Resource-updated for analysis
Data-Analytics-Resource-updated for analysis
 
WP_011_Analytics_DRAFT_v3_FINAL
WP_011_Analytics_DRAFT_v3_FINALWP_011_Analytics_DRAFT_v3_FINAL
WP_011_Analytics_DRAFT_v3_FINAL
 
Acquire Grow & Retain customers - The business imperative for Big Data
Acquire Grow & Retain customers - The business imperative for Big DataAcquire Grow & Retain customers - The business imperative for Big Data
Acquire Grow & Retain customers - The business imperative for Big Data
 
The Quantified Self Goes Corporate
The Quantified Self Goes CorporateThe Quantified Self Goes Corporate
The Quantified Self Goes Corporate
 
Improve Service Quality Through Enterprise Feedback Management
Improve Service Quality Through Enterprise Feedback ManagementImprove Service Quality Through Enterprise Feedback Management
Improve Service Quality Through Enterprise Feedback Management
 
Application of predictive analytics
Application of predictive analyticsApplication of predictive analytics
Application of predictive analytics
 
Improving Customer Experience in Government-business Interaction.pdf
Improving Customer Experience in Government-business Interaction.pdfImproving Customer Experience in Government-business Interaction.pdf
Improving Customer Experience in Government-business Interaction.pdf
 
Data monetization shailesh d ubey
Data monetization   shailesh d ubeyData monetization   shailesh d ubey
Data monetization shailesh d ubey
 
Deloitte B2B Payments 2015 Report
Deloitte B2B Payments 2015 ReportDeloitte B2B Payments 2015 Report
Deloitte B2B Payments 2015 Report
 
Ariba Knowledge Nuggets: eProcurement Transformation
Ariba Knowledge Nuggets:  eProcurement TransformationAriba Knowledge Nuggets:  eProcurement Transformation
Ariba Knowledge Nuggets: eProcurement Transformation
 
Experian dv2020 - the new rules of customer engagement - emea research report
Experian   dv2020 - the new rules of customer engagement - emea research reportExperian   dv2020 - the new rules of customer engagement - emea research report
Experian dv2020 - the new rules of customer engagement - emea research report
 
financial exec final
financial exec finalfinancial exec final
financial exec final
 
Marketing and HR Analytics
Marketing and HR AnalyticsMarketing and HR Analytics
Marketing and HR Analytics
 
Consumer Analytics A Primer
Consumer Analytics A PrimerConsumer Analytics A Primer
Consumer Analytics A Primer
 
Data MiningData MiningData MiningData Mining
Data MiningData MiningData MiningData MiningData MiningData MiningData MiningData Mining
Data MiningData MiningData MiningData Mining
 

College University Auditor Fall 2015 P-Card Program (Jan)

  • 1. I V OLUME 57 I NUMBER 3 I FALL 2015 I INSIDE: What Internal Auditors Need to Know About Sales Tax Advisory Services: Balancing Value and Independence ACUA Award Winners New Rising Star Award Highlights From the 2015 Annual Conference in Indianapolis, Indiana DEVELOPING A PREVENTATIVE AND SUSTAINABLE P-CARD PROGRAM
  • 2. AuditTools Purchasing card (P-Card) spending is on the rise, particularly among colleges and universities. The use of P-Cards is expected to increase 62 percent by 2018 reaching $377 billion, according to the 2014 RPMG Purchasing Card Benchmark Survey. The expansion of P-Card programs and use is expected to continue given the myriad of benefits P-Cards offer including streamlining the procurement-to-pay process, lowering operational costs and taking advantage of supplier discounts. Originally, P-Cards were used for small dollar transactions to help reduce or eliminate the need for petty cash. However, while P-Card use has grown, it has become increasingly challenging to maintain compliance as organizations struggle to gain insights into their program. Analyzing high transaction volumes using spreadsheets and manually reviewing receipts becomes labor-intensive and inefficient. TWO PERSPECTIVES, ONE COMMON GOAL From the standpoint of internal audit, the objective of a P-Card system is to rid the organization of fraud, waste and abuse. While there are a variety of ways to search for fraud, most are not foolproof. Sampling is unreliable for detecting and preventing misuse, and card issuer applications provide limited data. Spreadsheets have capacity limitations and are prone to errors. Many auditors have found success in using purpose-built data analytics tools to extract and analyze data from different sources and file types to detect instances of fraud, waste and abuse. These tools provide the ability to examine 100 percent of the P-Card program data. More than ever, auditors are embracing technology to stay ahead of risks and exposures that may lead to revenue losses. From a business standpoint, the objectives are slightly different. While detection of misuse is important, stakeholders within the organization not only need to know that something went awry; they want to dive deeper into specific risk areas to identify underlying causes. Data analytics can help auditors look through high volumes of transactional data to identify anomalies, but it is often a reactionary approach. Infractions are seldom caught in time to recover funds. In fact, it takes an average of 24 months to detect procurement fraud at which time 89 percent of all proceeds are unrecoverable. The business goal is to stay well ahead of the problem. PREVENT A CULTURE OF MISUSE The tolerance threshold varies for every organization. If a $300 million P-Card program incurs $20,000 in annual misuse, the convenience and administrative cost savings may offset the loss. However, inappropriate spend involving large sums of money could quickly become newsworthy and damaging to the organization’s reputation. Stakeholders need assurance that preventative measures are in place and working properly. Transactional data can be analyzed, but misuse goes unnoticed without information from other sources such as accounts payables and human resources. For example, if John uses his P-Card to purchase gasoline while on vacation, the misuse is typically not found using traditional auditing techniques Developing a Preventative and Sustainable P-Card Program By Andrew Simpson ABOUT THE AUTHOR Andrew Simpson, chief operating officer of CaseWare Analytics, has over two decades of experience in the information systems audit and security business, specifically data analytics, continuous controls monitoring, interrogation and forensics. “Continuous monitoring is about creating a sustainable internal control environment, not creating more work. It goes beyond identifying a single set of problems to providing actionable insights to the business. Organizations can create a collaborative environment where everyone works to strengthen controls, while expanding the P-Card program.” 14 COLLEGE & UNIVERSITY AUDITOR
  • 3. AuditTools because fuel is a normal expense for John since his position requires business travel. John shares his clever cost-saving tactic with a close coworker, who begins to take advantage of similar weaknesses in the system for personal gain. The culture of misuse perpetuates and continues to go undetected. When looking at exceptions, can you determine whether it was an isolated incident where clarification of policies and procedures need further explanation or a habitual problem? How many times has each employee violated the policies? Was one person in violation while the majority followed policy? Is there a department that tends to have multiple violations on a regular basis? Is misuse related to specific spending areas? These questions can only be addressed if the analysis includes data from different sources, such as employee data, category of spend, etc. Running data analytics to test P-Card data provides some valuable details about exceptions, especially when you incorporate multiple data sources including: • P-Card Transaction Data – Provided by the card issuer and contains records of all transaction details including merchant category code, item description, purchase date, amount and vendor name. • Cardholder Master – Provided by the card issuer and contains data for all cardholders in the P-Card program. Details include last four digits of each card, monthly card limit, card status, date issued, etc. • Employee Master File – File of employees with details such as employee name, identification number, department, vacation schedule and employment status. • Expense Signoff – Expenses submitted by employees with details such as purchase date, cardholder comments and manager signoff details. • Accounts Payable (AP) – Lists payments made by AP and details such as invoice date and number, vendor name, item description and transaction amount. This data can be used to detect duplicate transactions across P-Card and AP processes. Additionally, if the organization uses an expense management system such as Concur, data can be automatically extracted and analyzed on a regular basis to ensure compliance. Expense management systems allow employees to submit expenses for approval and/or reimbursements. Broadening the scope of data being examined helps bridge gaps and allows you to see fraud schemes that would be impossible to detect otherwise. ASSESS RISK AND CONTROLS To gain an understanding of the unique ways P-Cards are being used within the organization, and whether policies and procedures are being followed, perform a risk and controls assessment. By testing historical data, you can establish a benchmark to gauge the severity of issues and identify problem areas. Begin by comparing current data with the year prior to detect patterns for normal or abnormal spending trends. Calculate average spends by department to look for outliers and unusual spend patterns. Historical data is useful for assessing the entire data population year to year. Examples of Analytics Tests/Queries: • Monitor for duplicate payments between P-Card merchants and Accounts Payable vendors • Check for charges at inappropriate or unusual merchants (i.e. department stores, cash, personal care) by MCC code or vendor name keyword search • Pinpoint split charges to circumvent purchasing card limits • Identify cards used by terminated employees and/or employees on leave of absence • Search for expenses that may be approved without verification of receipt • Look for cardholders who made purchases on weekends or holidays • Check for unused or duplicate cards, which may be causing unnecessary liability • Search for sales tax charges. As a non-profit organization, most universities are exempted from sales tax. • Identify the top 20 spenders to pinpoint which cardholders have the highest total purchases 15 COLLEGE & UNIVERSITY AUDITOR
  • 4. AuditTools Next, break the queries down into sub-processes to pinpoint problem areas such as: • Card issuance: Involves the assignment of cards to appropriate departments and employees • P-Card usage: Involves examining card spend across departments and employees to detect outliers or unusual spending patterns • Policy management: Determine whether existing policies and procedures are being followed by all employees Reliable Remediation When an exception is detected, how is it dealt with, or is it dealt with at all? Traditional remediation, usually involving emails, is time consuming, unreliable and error prone. Multiple follow-ups are necessary between several parties to ensure resolution, and managers are not always updated about whether or not the issue has been resolved. Continuous monitoring also automates remediation follow- ups until resolution is achieved; including escalation if the issue is not addressed within a set timeframe. This process can be customized to align with business processes and structure. Get the Big Picture of the P-Card Program Continuous monitoring tools offer dashboards that present information graphically on key program metrics such as the amount of spend across a period of time and the level of exceptions. Dashboards can be configured based on what the end users want to see or what information is beneficial to department leaders. Reviewing trend and patterns can help gauge the performance of controls and policies, and identify any potential gaps that need addressing. Visualization helps the end user consume data and insights by looking at patterns, not just rows and columns of numbers. Trends become more apparent, and the data becomes more useful to everyone participating in the review process. Sustained Growth P-Card programs often lose the support of top management if there are repeated cases of misuse, especially if they are discovered too late to take corrective action and recover losses. The administrative cost savings, convenience and efficiency gains associated with using P-Cards benefits the organization, but only if exposure and risk are managed properly. Management needs assurance that policies and procedures are being followed, and audit is staying ahead of misuse. The University of Miami, which includes academics, hospitals and research facilities, is growing at a rapid pace. Their growth will undoubtedly lead to an increase in P-Card use. The university’s internal audit department has already taken steps to move from periodically reviewing random samples of P-Card transactions to continuously monitoring 100 percent through the use of data analytics technology. Exceptions are shared with department managers to provide a comfort level about how P-Cards are being used within the organization, and whether policies and procedures are being followed. “As our corporate cards program grows, we provide assurance at both the department and management levels that we have sufficient policies and procedures in place to review transactions,” said Hiram Sem, Executive Director of Treasury Operations and Cash Management, University of Miami. “Card holders must understand they are responsible and accountable, but we must also carefully monitor expenditures to identify unauthorized charges early. Technology has helped us refine our review process and handle larger data volumes that come with expansion.” The value of continuous monitoring reaches well beyond exception detection. There are three advantages driving the trend towards continuous monitoring: • access to more data sources to get a complete picture of what is transpiring within the organization; • the ability to assess whether policies are being followed; and • the empowerment to improve business processes by gaining deeper insights. When an organization is working towards a problem-free environment, it provides a sustainable process to proactively look for and address issues. When employees know every transaction is being monitored, it creates a catalyst for behavioral changes within the organization. n 16 COLLEGE & UNIVERSITY AUDITOR