HomeMy WebLinkAboutAudit Reports - Public - FY19 Citywide Procurement Card Audit - Q1 - 3/21/2019
Date: March 21, 2019
To: Kevin R. Phelps, City Manager
From: Candace MacLeod, City Auditor
Subject: FY19 Citywide Procurement Card Audit – Q1
As part of the FY19 audit plan, the City Auditor’s Office conducted a Citywide
procurement card (P-Card) audit in October 2018 for the months of July, August, and
September 2018 (Q1). The purpose of the audit was to assess compliance with
Finance’s P-Card Policy, P-Card User Manual, and Finance Administrative Policy No. 7 –
Travel.
During Q1, 392 cardholders spent approximately $1.6 million using their City P-Cards.
Auditors selected 30 P-Card statements from each month in Q1 across 20 City
departments. The results of our testing identified the following areas of non-compliance:
• 21% of statements were approved late
• 8% of transactions lacked adequate supporting documentation
• 6% of transactions had unsigned cash register receipts
• 6% of cardholders allowed another employee to use their P-Card, or P-Card number
• 2% of transactions had meal charges that were not supported by required
documentation
• P-Card documentation was not adequately secured for three cardholders
• Two travel expense reports were not completed at the time of the audit, and one
included P-Card expenses for a spouse which were later reimbursed to the City
We also noted that at the time of the audit, the P-Card Policy had not been updated
to reflect changes that occurred since the implementation of SimpliCity in July 2018.
The audit made 14 recommendations to strengthen internal controls. Management
concurred with 13 of the recommendations and have developed plans to address the
reported issues by June 30, 2019. Budget and Finance did not concur with one
recommendation to develop a policy addressing the purchase of items for employees
that exceed a de minimis amount.
Please contact me if you have any questions.
Attachment
cc: Chris Anaradian, Assistant City Manager
Michael D. Bailey, City Attorney
David Beard, City Engineer
Julie Bower, City Clerk
Jim Brown, Director of Human Resources
Jim Burke, Director of Public Facilities, Recreation, and Special Events
Lisette Camacho, Assistant Director of Budget and Finance
Stephen Dudley, Interim Director of Development Services
Trevor Ebersole, Director of Transportation
Elizabeth R. Finn, Presiding City Judge
Brian Friedman, Director of Economic Development
Terry Garrison, Fire Chief
Jenna Goad, Assistant Director of Public Affairs
Craig Johnson, Director of Water Services
Chuck Murphy, Director of Innovation and Technology
Vicki Rios, Director of Budget and Finance
Kari Sliva, Assistant to the Mayor
Stephanie Small, Director of Community Services
Rick St. John, Police Chief
Rob Sweeney, Interim Assistant City Manager
Brent Stoddard, Director of Public Affairs
Michelle Woytenko, Director of Field Operations
5850 West Glendale Avenue | Glendale, AZ 85301
Procurement Card Audit – FY19 Q1
October 2018
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 1 Q1 P-Card Audit
Introduction
As part of the FY19 audit plan, the City Auditor’s Office conducted a Citywide
procurement card (P-Card) audit in October 2018 for the statement periods of July,
August, and September 2018 (Q1). The P-Card program is managed by the Budget and
Finance Department.
In FY18, City cardholders spent approximately $7.0 million through P-Card transactions.
During the first three statement periods of FY19, 392 cardholders spent approximately
$1.6 million.
Auditors selected a sample of 90 cardholder statements from Q1 across 20 City
departments, which included 411 transactions totaling $129,104, as summarized in Table
1.
Table 1 – Citywide Q1 P-Card Sample
Department
No.
Cardholders
No.
Transactions Amount
Budget & Finance 4 11 $1,775
City Attorney's Office 1 13 $2,812
City Clerk's Office 1 3 $986
City Court 1 11 $824
City Manager's Office 1 6 $1,533
Community Services 6 31 $18,057
Council Office 6 12 $2,431
Development Services 3 24 $17,807
Economic Development 1 4 $189
Engineering 2 3 $1,033
Field Operations 9 48 $16,533
Fire 5 27 $5,022
Human Resources 3 20 $5,066
Innovation and Technology 1 2 $1,804
Mayor's Office 2 20 $3,369
Police 11 46 $5,959
Public Affairs 2 10 $2,586
Public Facilities, Recreation & Special Events 9 49 $14,173
Transportation 7 30 $3,732
Water Services 15 41 $23,413
Total 90 411 $129,104
These transactions and their associated supporting documentation were reviewed in
SimpliCity, discussed with department staff, and evaluated for compliance with the
Procurement Card Policy and Procedures Manual (P-Card Policy), Purchase Card User
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 2 Q1 P-Card Audit
Manual (P-Card User Manual), and Finance Administrative Policy No. 7 – Travel (FAP No.
7).
Purpose and Objectives
The purpose of the audit was to assess compliance with the City’s P-Card policies and
procedures and FAP No. 7.
Scope and Methodology
The scope of the audit was June 14, 2018 to September 13, 2018. To gain an
understanding of the applicable processes, policies, and procedures, we interviewed
staff from Budget and Finance and various City departments. We sampled 90
cardholder statements and reviewed documentation including:
• FAP No. 7
• P-Card Policy
• P-Card User Manual
• P-Card supporting documentation
• Travel expense reports
Observations, Recommendations, and Management Responses
1) Testing identified late approval of P-Card statements, inadequate supporting
documentation, and unsigned receipts.
Finance’s P-Card Policy assists cardholders, liaisons, and reviewers in understanding P-
Card rules and procedures which include:
• Using P-Cards for official City business
• Keeping P-Cards secured
• Not allowing anyone other than the cardholder to use the P-Card
• Attaching itemized and signed cash register receipts, paid invoices, or payment
confirmations as supporting documentation for purchases
• Completing a “Lost Receipt Form” for transactions missing a receipt, paid invoice, or
payment confirmation
• Providing the names of the attendees and a description of the business purpose for
meal and food purchases
• Obtaining department head approval for the purchase of refreshments for an event
honoring a departing employee’s contribution to the City
• Attaching a P-Card Statement Supplement form for purchases of $5,000 or more,
and copies of the signed contract and green sheet routing form if made under an
existing contract
• Recording the serial number, staff member name, and location on the invoice or
payment confirmation for non-capital equipment purchases
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 3 Q1 P-Card Audit
Additionally, the P-Card User Manual requires:
• Reviewing and approving P-Card statements by the last day of the month
• Linking transactions to the associated City contract, as applicable, although this
was not fully functional at system go-live
Auditors reviewed 90 P-Card statements from Q1 across 20 City departments
representing 411 transactions and noted the following exceptions:
21% of P-Card statements sampled were approved late
• 17 statements totaling $32,759 were approved late, ranging between 1 and 81 days
after the last day of the month.
• Two statements with credit balances totaling $2,342 had received no approval as of
the time of the audit. However, according to Finance, these statements were not
routed to the statement reviewers through the normal work flow process due to an
error in the system and were instead completed by Finance without the statement
reviewers’ approval.
8% of transactions sampled lacked adequate support or documentation
• 16 transactions totaling $1,837 had no supporting documentation attached.
• Eight transactions totaling $2,881 included supporting documentation that didn’t
provide sufficient detail to allow the reviewer to determine the business purpose of
the transaction.
• Two transactions totaling $18 included a “Lost Receipt Form” that was not signed by
the reviewer.
• Three transactions totaling $9,639 for the purchase of 10 iPad Pros did not include
the serial number or staff member they were assigned to or a P-Card Statement
Supplement form. The department had completed this document prior to the audit
but was unaware it was required to be uploaded in SimpliCity.
• One transaction for $327 for the purchase of a printer did not include the serial
number, staff member, and location on the invoice, and one transaction for $175 for
the purchase of a TV did not include the serial number on the invoice.
• One transaction for $63 included an invoice with a different amount than the
transaction amount.
6% of transactions sampled had unsigned cash register receipts
• 25 transactions totaling $1,592 had itemized cash register receipts that were not
signed by the cardholder.
6% of cardholders sampled allowed another individual to use their P-Card number
• Four elected officials allowed their assistants to use their P-Card, or P-Card number,
on their behalf.
• One cardholder allowed another employee in their office to use their P-Card to
book travel or catering events if it exceeded the individual’s P-Card limit.
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 4 Q1 P-Card Audit
2% of transactions sampled did not have department head approval or document the
attendees and/or business purpose of meal purchases
• Four food/meal purchases totaling $72 did not include a list of attendees and the
business purpose.
• Three food/meal purchases totaling $255 did not include a list of attendees.
• One purchase of refreshments for an event honoring a retiring employee totaling
$59 did not include the department head’s approval.
P-Card documentation was not adequately secured for three cardholders sampled
• P-Card documentation, including P-Card numbers for two elected officials, was
maintained by their assistant in a desk drawer that remained unlocked during
business hours.
• One cardholder left their P-Card documentation unsecured on the top of their desk.
12% of transactions sampled did not reference the contract number in SimpliCity
• 49 transactions totaling $12,329 did not have the associated contract number
referenced in the purchase card screen in SimpliCity. However, not all City contracts
were loaded into SimpliCity at the system go-live date; therefore, cardholders were
unable to reference contract numbers. Contracts were progressively added to the
system, and based on email communication from Finance to cardholders, were
available in October 2018. The auditors verbally discussed this issue with the
individual cardholders during the audit. Additionally, while the P-Card Policy requires
a copy of the signed contract and green sheet be attached as supporting
documentation, it is not addressed in the P-Card User Manual. Finance stated they
no longer require these items to be attached but have not yet updated the policy.
Purchase of FitBits for employees
A cardholder in Water Services purchased 50 FitBits totaling $2,580 for distribution to
Water Services employees to support and encourage participation in the City’s
Wellness Program. These FitBits were purchased from the Water Enterprise Fund and
were logged and distributed to employees, who were not required to return them if
their employment with the City terminated. The City had not developed written
procedures over the purchase, distribution, and use of the FitBits to employees.
Potential Risk: High – Noncompliance with P-Card policies and procedures can result in
errors and fraud. Purchases of items for employees greater than a de minimis amount
may result in potential tax implications for the City and its employees.
Recommendation
The exceptions for 1.1 through 1.7 are summarized by department and division in
Appendix A.
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 5 Q1 P-Card Audit
1.1 Affected City departments review and approve P-Card statements by the last
day of the month.
1.2 Affected City departments attach the necessary supporting documentation in
SimpliCity for all P-Card transactions.
1.3 Affected City departments sign itemized cash register receipts.
1.4 Affected City departments include the attendees and business purpose as
supporting documentation for all food/meal purchases made with P-Cards, and
department head approval for food/meal purchases related to events honoring
a departing employee.
1.5 Affected City departments secure P-Card documentation.
1.6 Affected City departments ensure P-Cards and P-Card numbers are only used
by the cardholder.
1.7 Budget and Finance develop controls to ensure P-Card statements are not
finalized until approved by the statement reviewer.
1.8 Budget and Finance upload contracts to SimpliCity in a timely manner to ensure
full system functionality.
1.9 Budget and Finance formalize a policy addressing the purchase of items for
employees that exceed a de minimis amount.
Management Response
1.1 See Appendix A
1.2 See Appendix A
1.3 See Appendix A
1.4 See Appendix A
1.5 See Appendix A
1.6 See Appendix A
1.7 Concur. Budget and Finance will develop controls to ensure P-card statements
are not finalized until approved by the statement reviewer by June 30, 2019.
1.8 Concur. Budget and Finance will ensure contracts are uploaded to SimpliCity in
a timely manner by June 30, 2019.
1.9 Do not concur. The IRS does not define a specific dollar amount as de minimis.
Budget and Finance met with Department Directors and explained the IRS
guidance on this issue. The Budget and Finance department will continue to
follow IRS policy.
2) Testing identified two travel expense reports that were not completed at the time of
the audit and P-Card charges for a spouse that were disallowed by policy and later
reimbursed by the elected official.
The P-Card Policy requires that cardholders only use their P-Cards for official City
business. Additionally, the original receipt for all travel expenses purchased with a
P-Card should be maintained with the monthly statement. It is not necessary to attach
a copy of the Travel Expense Report to the monthly statement.
FAP No. 7 states that travel expenditures should only be incurred when there is a clear
business need that benefits the City. FAP No. 7 also requires employees and/or elected
and appointed officials to:
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 6 Q1 P-Card Audit
• Complete a Travel Request and Reimbursement Form for out-of-state travel, which
requires both pre- and post-travel approval by their supervisor, department head,
and city manager or designee
• Complete a Travel Report and Reimbursement Form – Elected and Appointed
Officials, which requires post-travel approval
• Complete a meal worksheet if claiming per diem and attach it to the travel expense
report
• Complete travel forms within 30 days of the end of the trip to report all charges
incurred on the trip, regardless of how the expenses were paid
• Attach a receipt or other proof of payment for registration fees to the travel
expense report, along with a copy of the conference/registration form
Additionally, expenses relating to the inclusion of family or guests while traveling are
disallowed.
The City Council Guidelines adopted on May 23, 2017 states the following as it relates to
travel:
“The Council agrees to conform to the regulations that govern all City
employees on this matter. Accordingly, the current City Travel Policy is attached
and will be replaced as changes are made in the future.”
Of the 90 P-Card statements selected, 10 included travel related expenses. Auditors
reviewed these transactions and the associated travel expense reports and noted the
following:
• A cardholder charged $2,853 in travel expenses for an elected official’s trip to
Europe to commemorate the 100th anniversary of the death of Frank Luke Jr. These
P-Card charges were approved by the statement reviewer assigned in SimpliCity.
The auditor requested to review the “Travel Report and Reimbursement Form –
Elected and Appointed Officials”; however, it was not completed prior to auditor's
visit, which was 32 days after the end of the travel. This form only requires post-travel
approval by the cardholder’s reviewer. While FAP No. 7 does not clearly state who
should approve elected officials’ travel expense reports, Finance stated that the
Budget and Finance Director has the authority to approve an elected official’s
travel report. Additionally, $1,394 of the expenses charged to the cardholder’s P-
Card were for travel expenses of the elected official's spouse. These charges were
reimbursed to the City by the elected official 69 days after the last charge. While
FAP No. 7 states that reimbursement requests should be submitted within 30
calendar days from the end date of the business travel, it does not provide
guidance on how long employees or elected officials have to reimburse the City for
disallowed expenses. Auditors inquired as to whether there was any additional
documentation discussing these expenses; however, the cardholder did not have
any other information to provide at the time of the audit.
• A Public Facilities, Recreation, and Special Events (PFRSE) employee charged travel
expenses totaling $3,133 for a trip to New York for a media mission. These P-Card
charges were approved by the statement reviewer assigned in SimpliCity. The
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 7 Q1 P-Card Audit
auditor requested to review the “Travel Request and Reimbursement Form”;
however, it had not been completed and had not received the appropriate
supervisor and director post-travel approval prior to the auditor’s visit, which was 60
days after the end of the travel. The copy of the travel expense report initially
provided to the auditor did not adequately explain the ground transportation
charges and the per diem meal worksheet was not completed accurately.
Additional explanation of transportation charges and a revised meal worksheet
were later provided that corrected these errors.
The P-Card Policy is not clear on whether travel documents other than original receipts,
such as conference brochures and agendas, should be included in the supporting
documentation. These documents assist the reviewer in determining the allowability
and business purpose of the transaction. These documents are typically kept with the
travel expense report and are not always provided to the statement reviewer when
approving P-Card transactions. The statement reviewer is not always the same
individual that reviews the travel expense report. Auditors noted five statements with
travel expenses for attending an out-of-town conference totaling $2,228 that only
included the original receipt for either the hotel, airfare, or ground transportation,
without any additional supporting documentation to explain the purpose and business
need of the travel. Additionally, travel expense reports are retained in a hard copy
format rather than being retained electronically in SimpliCity for ease of reference and
retention.
The Travel Request and Reimbursement Form and Travel Report and Reimbursement
Form – Elected and Appointed Officials include a section requiring the employee or
elected official to identify the purpose of the travel. However, based on the travel
reports reviewed by the auditor, this section was typically not completed in an
adequate manner. Instead, a conference name or travel destination were listed, which
didn’t adequately explain the purpose and business need of the travel.
Potential Risk: High – Noncompliance with P-Card and travel policies and procedures
can result in errors and fraud. Additionally, the lack of sufficient supporting
documentation when reviewing P-Card transactions can result in the reviewer
approving transactions that do not best serve the interest of the City. Having different
reviewers for P-Card transactions and the associated travel expense reports can lead
to errors in review due to a lack of complete information.
Recommendation
2.1 Budget and Finance review, update, and streamline travel-related P-Card
policies and procedures and train staff. This includes clarifying who approves
travel expense reports for elected officials and what documents to include with
travel-related P-Card transactions.
2.2 Budget and Finance review, update, and streamline the travel expense forms,
train staff, and evaluate options for storing these reports in SimpliCity.
2.3 The Mayor’s Office ensure staff receive P-Card training and complete the Travel
Report and Reimbursement Form related to the audit finding.
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 8 Q1 P-Card Audit
2.4 PFRSE ensure staff receive P-Card training and complete the Travel Request and
Reimbursement Form related to the audit finding.
Management Response
2.1 Concur. Budget and Finance issued a revised P-card manual on January 30,
2019.
2.2 Concur. Budget and Finance issued a revised P-card manual on January 30,
2019. The Employee Expense Reimbursement (EER) module of Tyler Munis was
also implemented on December 22, 2018. All documents related to employee
travel and reimbursements are now stored electronically in Munis.
2.3 Concur. The Mayor’s Office staff met on January 17, 2019 to discuss the audit
findings and will schedule a meeting with Finance to obtain training. Staff will
complete and forward the Travel Report and Reimbursement Form to Finance by
January 31, 2019.
2.4 Concur. All management and staff in PFRSE will review P-Card training and
review with direct reports holding cards by January 9, 2019 and ensure all travel
forms are complete.
3) The P-Card Policy has not been updated to reflect changes after the SimpliCity ERP
implementation in July 2018.
Policies and procedures should be clear, comprehensive, accurate and accessible to
provide employees with the direction they need to perform their job duties and meet
management’s expectations.
On July 1, 2018, the City implemented the SimpliCity ERP system. With this
implementation, changes were made to the process of importing, classifying, and
reviewing P-Card transactions. City employees were provided a P-Card User Manual in
training sessions and the information was posted on the SimpliCity SharePoint page. The
P-Card User Manual explains how to process P-Card transactions from import through
approval. However, it does not include some information relating to direction and
accountability previously included in the P-Card Policy, which was last updated
February 26, 2018. Information not discussed in the P-Card User Manual includes:
• Procedures to obtain, modify, or cancel a P-Card
• Cardholder responsibilities for securing P-Cards/associated documentation, and
prohibiting use by other employees
• Items not allowed to be purchased with a P-Card
• Documentation required for food, entertainment, and technology purchases
• Requirements to document serial numbers, employee names, and the location for
noncapital equipment purchases
• Steps to report a lost or stolen P-Card and fraudulent activity
• Authorized reviewers for elected and appointed officials
Additionally, some information in the P-Card Policy is out of date or inaccurate,
including a reference to an IT form for approving technology purchases that is no
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office 9 Q1 P-Card Audit
longer used. Furthermore, the hyperlink in FAP No. 1 (page 29) is to an outdated version
(revised June 3, 2015) of the P-Card Policy.
The P-Card Policy states the cardholders, supervisors/reviewers, and liaisons are
encouraged to attend P-Card training at least annually. However, these trainings are
offered on a limited basis. While approximately 20 P-Card training sessions were offered
as part of the SimpliCity implementation training, only one training session was offered
previously in FY18, no training was offered in FY17, and one class was offered in FY16.
Currently, training is offered in a classroom setting, and not online in an on-demand
format.
Potential Risk: High – Having multiple policies that are unclear and outdated can lead
to confusion, resulting in noncompliance and transaction errors. A lack of training
increases the risk that policies are not followed. Live training sessions reduce efficiency
and limit attendance to current employees.
Recommendation
3.1 Budget and Finance review, update, and streamline P-Card policies and
procedures and train staff.
3.2 Budget and Finance consider providing P-Card training in alternate formats,
including online.
Management Response
3.1 Concur. Budget and Finance issued a revised P-card manual on January 30,
2019. Budget and Finance met with department P-card liaisons to train them on
new policies and procedures. Cardholder training will be completed by June 30,
2019.
3.2 Concur. Budget and Finance will consider providing alternative P-card training
by June 30, 2019.
_____________________________________________________________________________________
City Auditor’s Office Q1 P-Card Audit
Procurement Card Audit – FY19 Q1
Appendix A
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office i Appendix A
Department/Division 1.1 Statements Approved Late 1.2 Transactions Lacking Appropriate Supporting Documentation 1.3 Transactions with Unsigned Itemized Cash Register Receipt(s) 1.4 Meal/Food Purchase without Purpose, Attendees, and/or Department Head Approval Documented 1.5 - P-Card Documentation Not Secured 1.6 P-Card/P-Card Number Used by Individual Other than Cardholder Concur Do Not Concur Estimated
Completion
Date
Budget and Finance
Customer Service X X X 12/18/2018
City Council Office
Barrel District X X X 1/28/2019
Cactus District X X X 1/28/2019
Cholla District X X X 1/28/2019
Sahuaro District X X 1/28/2019
Community Services
Community Services Admin. X X X 2/6/2019
Community Revitalization X X X 2/6/2019
Development Services
Building Safety X X X 1/15/2019
Planning X X X X 1/15/2019
Engineering
CIP Management X X 10/25/2018
Field Operations
Landfill X X 12/31/2018
Recycling X X X 12/31/2018
Solid Waste Administration X X 12/31/2018
Fire
Fire Administration X X 12/20/2018
Fire Emergency Management X X 12/20/2018
Fire Operations X X 12/20/2018
Fire Resource Management X X 12/20/2018
PS Training Ops-Fire X X X 12/20/2018
Human Resources
Human Resources Admin. X X 1/31/2019
Organizational Development X X X 1/31/2019
Risk Management X X 1/31/2019
Mayor's Office
Mayor's Office X X X 1/17/2019
Office of Economic Development
Economic Development X X 12/1/2018
Police
Crime Investigations X X X 12/10/2018
Detention X X 12/10/2018
Foothills Patrol X X 12/10/2018
______________________________________________________________________________
_____________________________________________________________________________________
City Auditor’s Office ii Appendix A
Department/Division 1.1 Statements Approved Late 1.2 Transactions Lacking Appropriate Supporting Documentation 1.3 Transactions with Unsigned Itemized Cash Register Receipt(s) 1.4 Meal/Food Purchase without Purpose, Attendees, and/or Department Head Approval Documented 1.5 - P-Card Documentation Not Secured 1.6 P-Card/P-Card Number Used by Individual Other than Cardholder Concur Do Not Concur Estimated
Completion
Date
Police Administration X X X 12/10/2018
Police Support Services X X 12/10/2018
Police Training X X 12/10/2018
Public Facilities, Recreation &
Special Events
Foothills Rec & Aquatics Center X X X 1/9/2019
Parks Maintenance X X 1/9/2019
Park Rangers X X X X 1/9/2019
Recreation X X 12/28/2018
Transportation
Airport Operations X X 11/30/2018
Signs & Markings X X 1/9/2019
Street Maintenance X X X 12/13/2018
Water Services
Central System Maintenance X X 1/3/2019
Customer Service – Field X X 1/3/2019
Information Management X X 1/3/2019
Pretreatment Program X X 1/3/2019
Wastewater Collection X X X 1/3/2019
Water Distribution X X 1/3/2019