OFFICE OF THE AUDITOR - City and County of Denver …€¦ · · 2018-03-17OFFICE OF THE AUDITOR...

OFFICE OF THE AUDITOR

PROCUREMENT CARD PROGRAM

DEPARTMENT OF AVIATION PERFORMANCE AUDIT

MAY 2009

Dennis J. Gallagher

Auditor

To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people.

We will monitor and report on recommendations and progress towards their implementation. 1

City and County of Denver 201 West Colfax Ave., Dept. 705 • Denver, Colorado 80202 • 720-913-5000, FAX 720-913-5247

www.denvergov.org/auditor Dennis J. Gallagher

May 21, 2009

Ms. Kim Day, Manager Mr. Derek Brown, Manager Department of Aviation Department of General Services City and County of Denver City and County of Denver Dear Ms. Day and Mr. Brown: Attached is the Auditor’s Office Audit Services Division’s audit report of the Procurement Card (PCard) Program for the year ending December 31, 2007. The purpose of the audit was to determine whether internal controls were adequate and to ensure the Department of Aviation complied with Executive Order No. 33 and other compliance terms of the PCard Program. The audit revealed significant reportable internal control weaknesses in the PCard Program and related procedures used by the Department of Aviation as disclosed within the accompanying report. If you have any questions, please call Kip Memmott, Director of Audit Services, at 720-913-5029.

Sincerely,

Dennis J. Gallagher

Auditor DJG/ect cc: Honorable John W. Hickenlooper, Mayor

Honorable Members of City Council Members of Audit Committee Kelly Brough, Chief of Staff Claude Pumilia, Chief Financial Officer David T. Roberts, Chief Services Officer David Fine, City Attorney Lauri Dannemiller, City Council Executive Staff Director Beth Machann, Controller Jim McIntyre, Director of Purchasing Michelle Davies, Purchasing Card Administrator Stan Koniz, Deputy Manager of Finance and Administration Division Laura Trujillo, Associate Manager of Accounting

Ms. Day and Mr. Brown May 21, 2009 Page Two

2

John Noe, Assistant Deputy Manager of Technical Services Alan Ochsenbein, Purchasing Card Coordinator

TABLE OF CONTENTS

Transmittal Letter 1

Table of Contents 3

Internal Auditor’s Report 4

Executive Summary 5

Background, Scope, Objective, and Methodology 6

Findings and Recommendations 9

Appendix A: Split Purchases 13

Appendix B: Department Totals for the 2007 Posting Period 14

Appendix C: Procurement Card Flowchart 15

Exhibit A: Agency Responses 17

3

To promote open, accountable, efficient and effective government by performing impartial reviews and other audit services that provide objective and useful information to improve decision making by management and the people.

We will monitor and report on recommendations and progress towards their implementation. 4

City and County of Denver 201 West Colfax Ave., Dept. 705 • Denver, Colorado 80202 • 720-913-5000, FAX 720-913-5247

www.denvergov.org/auditor Dennis J. GallagherAuditor

AUDITOR’S REPORT We have completed a performance audit of the Department of Aviation Procurement Card (PCard) Program. The purpose of the audit was to determine whether internal controls were adequate and to ensure the Department of Aviation complied with the terms of Executive Order No. 33 and applicable City rules and regulations. This audit was included in the Auditor’s Office Audit Services Division’s 2008 Annual Audit Plan and is authorized pursuant to the City and County of Denver Charter, Article V, Part 2, Section 1, General Powers and Duties of Auditor. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Based on our review, the Department of Aviation’s PCard internal controls have been in place since 2001 and are well-established. However, the audit revealed opportunities to improve the internal controls of the PCard program as disclosed within the accompanying report. We appreciate the Department of Aviation and Purchasing Division, within the Department of General Services, for taking proactive steps throughout the audit to mitigate the observed internal control weaknesses. We extend our gratitude to the personnel who assisted and cooperated with us during the audit. Audit Services Division

Kip R. Memmott, MA, CGAP, CICA Director of Audit Services Date: May 21, 2009 Staff: Sonia Montano, CGAP, CICA, Internal Audit Supervisor Rudy M. Lopez, Senior Internal Auditor Kristin Donald, Senior Internal Auditor Brandon A. Blomquist, Staff Internal Auditor

PROCUREMENT CARD PROGRAM – DIA EXECUTIVE SUMMARY

FOR THE YEAR ENDED DECEMBER 31, 2007

5

This summary highlights the findings of our performance audit of the Department of Aviation Procurement Card (PCard) Program, which is more fully described in the Findings and Recommendations section beginning on page nine. Exhibit A starting on page 17 contains the responses of the Department of Aviation and General Services Purchasing Department to our findings.

Finding I – Opportunities Exist to Improve DIA PCard Program Internal Controls

Specific control weaknesses indentified with the DIA PCard program included: the absence of training requirements for approving supervisors and cardholders, the lack of a specific DIA PCard policies and procedures manual, and the failure to consistently perform monthly Due Diligence reviews. Additionally, DIA personnel did not consistently identify monthly PCard variances between the Department of Aviation purchasing system (Maximo) and recorded PeopleSoft amounts during the reconciliation process. Furthermore, the causes of the monthly variances were not identified by DIA.

The absence of effective PCard program controls leaves the City susceptible to misappropriation, misuse or fraudulent use of limited resources and assets. Improved internal controls that include required supervisor training, an enhanced policy and procedure manual and increased monitoring of variances during the reconciliation process should strengthen the administration of DIA’s PCard Program.

Finding II – Opportunities Exist to Improve Citywide PCard Program Internal Controls

Audit work identified limitations with the overall City internal PCard program control environment, which is overseen by the Purchasing Division within the General Services Department. Specific control weaknesses identified included, the absence of a detailed and routine review process to analyze cardholder transactions and the lack of a formal procedure to document purchases that requiring Purchasing Division approval. Further, Executive Order 33 has not been updated to reflect recent agency reorganizations and system changes. In addition, cardholders have the ability to change the default fund number assigned to their card, meaning PCard charges could be inappropriately billed to other City agencies. The absence of effective PCard program controls leaves the City susceptible to misappropriation, misuse or fraudulent use of limited resources and assets.

PROCUREMENT CARD PROGRAM – DIA BACKGROUND, SCOPE, OBJECTIVE AND METHODOLOGY


6

BACKGROUND

Overview of City PCard Program

The Department of Aviation has been a participant in the City’s PCard program since the implementation of the pilot program in May, 2001. In February, 2003 Executive Order No. 33 and Memoranda A and B established the Delegated Purchasing Authority (DPA). DPA is the authority provided by the Director of Purchasing to agencies under the Mayor to execute minimal dollar and contract-based procurements without the necessity of undergoing formal requisition through the Purchasing Division, within the Department of General Services. The PCard is a credit card that is used to purchase minimal dollar goods and services that do not exceed a pre-determined limit authorized by the Department of General Services’ Purchasing Division. The PCard is a MasterCard that was originally offered by Bank One, under the State of Colorado Procurement Card contract. On July 1, 2004, J.P. Morgan Chase & Co. and Bank One Corporation merged to form J.P. Morgan Chase & Co. The City’s strategy for implementing this program was to reduce the cost and time of processing high volume/ low dollar amount transactions in order to increase the pool of available vendors, and to improve management oversight for these types of transactions. The City has implemented several internal controls that include several spending controls, such as restrictions of the type of merchants the card will accept, and a more defined reporting structure to oversee card transactions. Additionally, Executive Order No. 33 mandates tracking, verifying appropriateness of purchases, reporting, and/or verifying actual transactions. The Due Diligence review requires conscientious efforts by all agencies to prevent misuse, abuse, and fraudulent activity. Due Diligence “best practices” recommend monthly random reviews of transactions and non-random selected transaction reviews. The Department of Aviation currently reviews 100% of transactions. DIA PCard Program For the year ending December 31, 2007 DIA utilized approximately 80 PCards to make approximately $5.3 million in purchases (see Appendix B). Prior to any individual receiving a PCard and being authorized to use DPA authority, DIA personnel must complete PCard training provided by General Services Purchasing Division, and score at least 70% on a written exam at the conclusion of training. Once completed, the potential DIA cardholder must attend additional Maximo (the DIA purchasing system) and Smart Data Online (J.P. Morgan PCard System) training at the Department of Aviation. Approved DIA PCard holders must enter all charges into the Maximo system. This system automatically creates a sequentially numbered purchase order (PO). The cardholder records the invoice, packing list and charge slip information received from the vendor/merchant into the

BACKGROUND, SCOPE, OBJECTIVE, AND METHOLOGY PROCUREMENT CARD PROGRAM - DIA

Maximo system. The cardholder must then approve the PCard purchase in the Maximo system. Cardholders are also responsible for reconciling data in Maximo and Smart Data Online on a monthly basis. If amounts do not reconcile, the cardholder must determine why and if appropriate create a dispute form that notes the variance. Amounts must reconcile prior to submitting documentation to the DIA Accounting Department, see Appendix C. Cardholder supervisors must review and approve purchases monthly and are responsible for assuring that only proper purchases are made by the cardholder. SCOPE

The audit of the Department of Aviation’s PCard Program covers the period of January 1, 2007 through December 31, 2007. The scope of our audit was to examine and evaluate the adequacy and effectiveness of PCard internal controls utilized by Department of Aviation. The audit also examined the Department of Aviation’s compliance with applicable City rules and regulations. OBJECTIVE

The objective of our audit was to determine whether the process and internal controls for the PCard program at DIA are reasonable in order to monitor PCard requirements, and applicable City rules and regulations. Furthermore, we determined whether an adequate system of internal controls was in place to prevent card misuse, abuse, and fraudulent activity.

METHODOLOGY

Evidence gathering and analysis techniques used in order to meet the objectives included, but were not limited to the following:

• On a random and judgmental basis, we sampled and tested monthly cardholder PCard Packets1 and reviewed selected transactions to ensure that purchases were in accordance with defined spending limits and other program requirements. Our sample size consisted of 31 of 80 (39%) cardholders. Based on the level of card usage, we randomly selected twenty-seven packets and selected another four on a judgmental basis;

• Verifying that employee agreement forms and training had been successfully completed;

• Interviewing Department management and personnel in the Accounting, Purchasing, and Technical Services divisions;

• Reviewing compliance with Executive Order No. 33 and other applicable rules and regulations;

1 When reconciliation is completed, showing no variances, the cardholder signs the Reconciliation Sheet and the PCard Log in order to prepare the packet of information for approval. The packet also includes the signed DIA PCard Log, Transaction Review Report, all receipts, packing slips and any dispute or substitute receipt forms if necessary.

7

BACKGROUND, SCOPE, OBJECTIVE, AND METHOLOGY PROCUREMENT CARD PROGRAM - DIA

8

• Examining transaction details in Maximo, Advantage, Smart Data Online, and PeopleSoft; and

• Assessing current Due Diligence controls used for monitoring program requirements.

PROCUREMENT CARD PROGRAM – DIA FINDINGS AND RECOMMENDATIONS


9

Finding I – Opportunities Exist to Improve DIA PCard Program Internal Controls

Audit work identified several internal controls limitations related to the DIA PCard program. The absence of effective PCard program controls leaves the City susceptible to misappropriation, misuse or fraudulent use of limited resources and assets. As a result, we offer recommendations for assisting DIA to enhance controls governing the PCard program in order to diminish this risk. Several Factors Limit the Effectiveness of DIA PCard Control Environment – Audit work identified several weaknesses with the current DIA PCard control environment.

• Supervisor PCard Oversight is Limited - Audit work identified oversight limitations

related to the DIA PCard program. Specifically, supervisors are not required to pre-approve PCard purchases in the Maximo system. Currently, supervisors are only required to verify and approve purchases during the month-end reconciliation process. This limited oversight activity after a purchase has been made weakens DIA’s ability to ensure all PCard purchases are proper and in accordance with City requirements.

• Limited PCard Program Policies and Procedures - Since the program’s inception, DIA

historically relied exclusively on Executive Order No. 33 and Memoranda to guide PCard processes and have not developed specific policy and procedure guidance for their program. For example, DIA did not have a procedure to ensure the Due Diligence review is completed on a monthly basis. Further, DIA lacked a policy requiring supervisors to pre-approve purchases in the Maximo System. These policy and procedure limitations increased risks of unauthorized or inappropriate purchases. We commend DIA for taking action during the audit to correct this issue by developing an enhanced PCard policies and procedures manual.2 We offer further possible enhancements to this manual.

• Inadequate Training - Audit work identified training limitations related to the DIA

PCard program. For example, approving supervisors are not required to attend PCard or DPA training, reducing the supervisors’ ability to perform a detailed and effective review of purchases, which may lead to improper approvals. Further, PCard holders do not attend periodic “refresher” training. The lack of consistent and adequate training and awareness has led to improper purchases as discussed below.

• Lack of Effective Reconciliation - Audit work found that detailed reconciliations related

to PCard transaction variances are not conducted. According to DIA Accounting Department management any variance under $1,000 is deemed to be immaterial and no work is performed to ascertain the reasons for these variances. Owing to this policy position, DIA’s Accounting Department did not determine the cause of a variance of approximately $42k in PCard purchases for January 2007.

2 This manual contains Maximo and Smart Data Online instructions, the City and County of Denver Procurement Card User Guide, DPA training slides, Smart Data Online Account Holder Guide, and Executive Order No. 33.

FINDINGS AND RECOMMENDATIONS PROCUREMENT CARD PROGRAM - DIA

Identified DIA PCard Program Internal Control Weaknesses Have Several Negative Impacts – The lack of effective internal controls for the DIA PCard program increases the possibility for the misuse, abuse, and fraudulent activity. For example, while audit work did not find any instances of fraudulent activity related to the transactions we reviewed, test work did identify cases of split purchases that violate City PCard requirements. Specifically, audit work identified six spilt purchases. These purchases exceeded the $2,000 purchase limit (see Appendix A for details of these purchases). Further, because of issues cited with DIA’s PCard reconciliation process DIA’s ability to identify inappropriate purchase card transactions posted to their fund and to make accurate monthly and year-end postings was severely hampered. Specifically, audit work revealed that for several months, a cardholder from another city agency had inappropriately charged advertising expenses to DIA’s fund. Audit work also determined that other variances were due to amounts posted to incorrect months and years. For example, PCard transactions for 2006 year-end were incorrectly posted to January 2007. However, since this error was not identified an inaccurate journal was created to correct reconciling items for 2007 year-end. The amount was credited to an incorrect account without examining the reason for the variances. These type of incorrect journal entries affect the accuracy and reliability of DIA’s financial records.

Recommendations

We offer the following recommendations to assist DIA towards enhancing and strengthening their PCard control environment.

1. The Department of Aviation should enhance their policy and procedure manual in order to incorporate all facets of the procurement process including key roles and responsibilities of individuals involved with the process specific to DIA. In addition to the improvements made by DIA to their policies and procedures during the course of the audit, we recommend codifying additional policies addressing supervisor training requirements and enhanced monitoring activities related to the Due Diligence review process (discussed in Recommendations #2 and #3).

2. The Department of Aviation should require approving supervisors to attend PCard and

DPA training. Supervisors are the first line of examination and should have proper training and knowledge over PCard and DPA policies, in order to detect and prevent card misuse, abuse, or fraudulent activity prior to the Due Diligence review.

3. The Department of Aviation should include the recently created Due Diligence control

document with the quarterly Due Diligence report that is submitted to the Purchasing Department, which will reduce the likelihood of the Due Diligence reviews not being conducted.

4. The Department of Aviation should review a sample of PCard transactions on a monthly

basis to identify any instances of misuse or abuse. 5. The Department of Aviation’s Accounting Department should establish enhanced internal

controls to detect and determine why variances exist between Advantage (DIA System)

10


and PeopleSoft. DIA should separately monitor PCard activity and account for any variances by conducting a detailed review. Journal entries should not be created if variances have not been addressed and if reasons for the variances have not been documented. A thorough review will improve the accuracy and reliability of DIA’s financial records and assist in detecting card misuse.

Finding II – Opportunities Exist to Improve Citywide PCard Program Internal Controls

Audit work identified opportunities to enhance Citywide PCard program controls. Specifically, Due Diligence reports are not independently monitored, a formal procedure to document purchases that require the Purchasing Department’s approval is not in place, and Executive Order 33 has not been updated to reflect recent agency reorganizations and system changes. Additionally, cardholders have the ability to change the default fund number assigned to their card, which enables them to possibly charge transactions to the funds of other agencies. Several Factors Limit the Effectiveness of the City’s PCard Control Environment – Audit work identified the following issues that hinder the effectiveness of the City’s general PCard control environment:

• PCard Program Oversight is Limited - The Purchasing Division lacks detailed and routine review processes for analyzing cardholder transactions, performing Due Diligence reviews, and for assessing processes established by various agencies. Specifically, the Purchasing Department does not review the details of the quarterly Due Diligence reports submitted by agencies. As a result, the Purchasing Department was unaware that DIA did not conduct Due Diligence for the month of December 2007 discussed in Finding I.

• Limitation with Division’s Approval Process - The Purchasing Division does not have

a formal procedure to document purchases that require approval from their department. Audit work revealed that requests and approvals were made through e-mail correspondence. A documented procedure disseminated to participating agencies would ensure requests and approvals are submitted and documented in a consistent manner.

• PCard Program Executive Order Outdated - The Purchasing Division has not updated

Executive Order No. 33 to reflect recent City and system changes. For example, the Auditor’s Office is referred to as an accounting function, not reflecting the organizational change moving the accounting function under the Controller’s Office that occurred in January 2008. Moreover, there are references to the previous transaction capturing system PVSnet as opposed to the current system, Smart Data Online. The Purchasing Department has an obligation to monitor and ensure all relevant information is reflected in all City PCard program rules and requirements are accurate and up to date.

• Lack of Control to Prevent Improper Billing - Audit testing revealed that no control

has been established to prevent cardholders from changing their designated fund number in Smart Data Online, which enables them to charge transactions to other

11


12

agencies. Purchase cards are allocated specifically to the department the cardholder is assigned and purchases made must be directly relevant and germane to the department’s mission and work activities.

Identified PCard Program Internal Control Weaknesses Have Several Negative Impacts - The absence of effective PCard program controls leaves the City susceptible to misappropriation, misuse or fraudulent use of limited resources and assets. As a result, we offer recommendations for assisting the Purchasing Division to enhance controls governing the PCard program in order to diminish this risk. The Auditor’s Office will be conducting a comprehensive performance audit on the City’s PCard program as identified in the 2009 Audit Plan.

Recommendations

1. The Purchasing Division should develop and implement a monitoring protocol and process for the PCard Program that includes routine reviews of selected transactions, Due Diligence reports, and processes used by various agencies.

2. The Purchasing Division should develop a procedure and maintain a standardized request

form for purchase requests that require approval from the Purchasing Department in order to better monitor and track requests.

3. The Purchasing Division, in collaboration with the Executive Order Committee and

participating agencies, should assess Executive Order No. 33 and make all necessary changes to conform to the order.

4. The Purchasing Division should establish an internal control that discourages cardholders

from charging transactions to other agency budgets.

APPENDIX A – SPLIT PURCHASES PROCUREMENT CARD PROGRAM - DIA

Split Purchases Identified by Audit Work3

Date of Purchase Vendor

Dollar Amount Item Purchased

1/3/2007 Major Contracting Service $1,000.00 Port-O-Let

rental

1/3/2007 Major Contracting Service $1,368.00 Port-O-Let

rental Total $2,368.00

5/16/2007 EK Ekcessories $1,105.35 Lanyard 5/16/2007 EK Ekcessories $1,105.35 Lanyard

Total $2,210.70

7/5/2007 Colorado Wire & Cable $1,000.00 Cable 7/5/2007 Colorado Wire & Cable $1,005.79 Cable

Total $2,005.79

3 PCard Packet

13

APPENDIX B – DEPARTMENT TOTALS BY POSTING PERIOD PROCUREMENT CARD PROGRAM – DIA

DIA PCard Expenditure Totals for the 2007 Posting Period4

Department Amount No. of

Transactions Avg. Trans.

Amount Airport Legal $3,454 15 $230 Design Engineering $40,775 147 $277 Environmental SVCS $19,078 64 $298 Facility Maintenance $251,369 782 $321 Field Maintenance $105,145 254 $414 Finance – Administration $7,905 42 $188 Finance – Payroll $5,917 37 $160 Fleet Maintenance $53,628 120 $447 Hi Tech Electric $152,651 506 $302 HR Administration $10,822 55 $197 HR Training $32,692 97 $337 Information Technologies $82,887 258 $321 Landside – GT - Lost & Found $29,579 235 $126 Landside SVCS – GT $10,201 76 $134 Landside SVCS – GT Holding $1,971 11 $179 Landside SVCS – Parking $33,736 226 $149 Maintenance Administration $18,707 65 $288 Operations – Airside $10,397 46 $226 PRM – Administration $150,265 352 $427 PRM – Media Relations $5,459 14 $390 Properties $2,576 21 $123 Security – Access SVCS $45,263 141 $321 Tech SVCS – Material Maintenance $3,090,711 10437 $296 Tech SVCS – Purchasing $1,116,728 3015 $370 Technical SVCS – Administration $37,512 126 $298 Telecom $13,029 51 $255

TOTAL $5,332,457 17,193 $310

4 Source: PeopleSoft/ J.P. Morgan/ DIA Finance (Department Code List)

14

APPENDIX C – PROCUREMENT CARD FLOWCHART PROCUREMENT CARD PROGRAM - DIA

15

APPENDIX C – PROCUREMENT CARD FLOWCHART PROCUREMENT CARD PROGRAM - DIA

Start Reconciliation

JP Morgan Maximo

Cardholder Prints PCard

Log

Cardholder Prints Cost

Allocation Detail

Reconcile? Source of Error?No

Create PCard Packet

Yes

Complete Dispute Form &

Note on Rec. Form

Fix Entry Error

External

Internal

Supervisor Review

A/P Review

ReconcilesErrors

Expending Authority Signature

Reconciles

Controller Downloads to

PeopleSoft

Downloaded to Advantage

PS & Advantage Reconcile?

End

Yes

Monthly Due Diligence Review

DIA to determine varianceNo

Appendix C Flowchart(Cont.)

16

EXHIBIT A – AGENCY RESPONSE PROCUREMENT CARD PROGRAM - DIA

17


18


19


20


21


22


23


24


25


26

OFFICE OF THE AUDITOR - City and County of Denver …€¦ · · 2018-03-17OFFICE OF THE AUDITOR...

Documents

Transcript of OFFICE OF THE AUDITOR - City and County of Denver …€¦ · · 2018-03-17OFFICE OF THE AUDITOR...