Acquisition Card Program
November 2007
Table of Contents
Introduction
Audit Objective
Audit Scope
Overall Audit Opinion
Statement of Assurance
Follow-Up on January 2006 Audit Report and Related Internal Control Improvements
Summary of Internal Control Weaknesses
Section One Audit Approach, Methodology, and Criteria
1.1 Audit Approach and Methodology
1.2 Audit Criteria
2.1 Planning, Organizing, and Monitoring
2.2 Issuance and Cancellation
2.3 Use of Acquisition Cards
2.4 Payment of Card Purchases
2.5 Accounting for Acquisition Card Transactions
2.6 Other Audit Findings
Section Three Audit Criteria and Conclusions
Appendix A Overview of the Acquisition Card Process
Appendix B Summary of Cardholders (By Limit)
Appendix C Decision Diagram for Cardholders
Executive Summary
Introduction
The internal audit of the Acquisition Card Program is part of the Risk-Based Annual Internal Audit Plan 2007-08 approved by the Canadian Institutes of Health Research (CIHR) Governing Council.
Acquisition cards provide a convenient and efficient method of procuring and paying for goods and services, while ensuring effective financial control. CIHR uses acquisition cards within the levels of procurement authority delegated to departments and agencies by Treasury Board (TB). The Bank of Montreal (BMO) is CIHR's acquisition card provider. Authorized employees at CIHR use the cards to charge purchases for which full payment is made through direct withdrawal by BMO on the 10th of the month following the date of transaction. There is no fee associated with the use of acquisition cards.
As of March 31, 2007, CIHR employees were in possession of 52 acquisition cards with limits ranging from $500 to $25,000. The audit examined acquisition card transactions that occurred between November 1, 2006 and March 31, 2007. In this period, there were 554 transactions with a total monetary value of $123,279. During the same period, 8 acquisition cards were issued and 9 were cancelled.
During the period under audit, the Director of Finance and Administration was accountable for the overall management of acquisition cards at CIHR. The Manager of Corporate Financial Services was responsible for: ensuring that Responsibility Centre (RC) Managers confirm contract price and performance in accordance with section 34 of the Financial Administration Act (FAA); reviewing a sample of transactions to ensure that the detailed charges are properly reviewed and authorized by cardholders and RC Managers; appointing an Acquisition Card Coordinator; and conducting a quality assurance review of the program. The duties of the Coordinator are to maintain the acquisition card system, issue and cancel cards, monitor expenses, and train employees in the appropriate use of the cards.
As a result of a recent reorganization, the newly created positions of Director of Financial Operations and Monitoring and Manager of Financial Operations have assumed their respective mandates for the card program. This report bases its observations and conclusions on the organizational structure that existed during the period under audit, but addresses its recommendations to the newly created positions.
Audit Objective
In January 2006, CIHR issued an audit report on the use of acquisition cards. The objective of the current audit is to follow-up on management actions in response to the 2006 report, in implementing adequate and effective internal controls over acquisition cards in compliance with TB Policy on Acquisition Cards, and its related guidelines.
Audit Scope
The audit covered all aspects related to the use of acquisition cards at CIHR for the period November 1, 2006 to March 31, 2007. The scope included:
- Management of the program;
- Issuance and cancellation of cards;
- Restrictions on and obligations for the use of cards;
- Verification of transactions;
- Accounting for transactions;
- Treatment of disputed transactions; and
- Payment of transactions.
The scope did not include CIHR policies on material management, expenditure management, and membership and registration fees.
Overall Audit Opinion
Although we found control deficiencies in the management framework that could be significant, we did not identify any financial impact as a result of these deficiencies during the audit period. As such, we have concluded that the management control framework for the acquisition card program has moderate issues: overall risk exposure is limited because either the likelihood or the impact of the risk is not high. Please see the detailed report for an assessment of each audit criterion.
Statement of Assurance
In my professional judgement as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided in this report. The audit of the Acquisition Card Program was conducted in accordance with the Federal Government Policy on Internal Audit and related professional standards. The audit opinion is based on a comparison of conditions that existed at the time of the audit against established audit criteria that were agreed upon with management. The evidence is sufficient to provide senior management with proof of the opinion.
Follow-Up on January 2006 Audit Report and Related Internal Control Improvements
The January 2006 audit report identified the following five observations. We note the related improvements that have been made since that time in the management control framework.
| 2006 Observations | Related Improvements |
|---|---|
| 1. The management framework established by Finance and Administration to mitigate risks associated with the acquisition card program is not consistently followed. In addition, the monitoring of acquisition card activities is weak. | The January 2006 audit report noted that the monitoring process was limited to the visual scanning of individual monthly acquisition card statements by the Acquisition Card Coordinator. The current audit observed that more detailed analysis was generally being performed, including the review and approval by the Acquisition Card Coordinator of supporting documentation and registers that were prepared and provided by individual cardholders. However, as noted in the Summary of Internal Control Weaknesses (below), the audit also identified instances where this practice had not been performed. |
| 2. The verification of monthly statements and their reconciliation to purchases by cardholders is weak. The audit team found many cases of incomplete reconciliations, missing supporting documentation, and expenses not accurately reflected in the accounting system. | |
| 3. Acquisition cards are often used without any evidence on file that pre-authorizations were obtained, as required by CIHR Financial Policy for the Use of Acquisition Cards, to pay for restricted items and for other items that require the prior authorization of the RC Manager. | Relative to the 2006 audit, the current audit found significantly fewer transactions where the required pre-authorization was not obtained. However, pre-authorizations were still not being consistently obtained. |
| 4. The audit team found many instances of non-compliance with CIHR Financial Policy for the Use of Acquisition Cards and TB Policy on Acquisition Cards. |
The 2006 audit indicated that PST was being charged on acquisition card purchases although TB and CIHR policies mandate that PST not be paid by the federal government. There was no evidence that Finance and Administration had questioned the payment of PST for the purpose of recovering the amounts paid and minimizing recurrences. The current audit identified evidence that Finance and Administration was contacting cardholders on the matter and the amount of PST that was paid was being recovered. The audit did not identify any instances where the money paid for PST in excess of $5 was not recovered as required by CIHR policy. The 2006 audit also found that there had been numerous instances where attractive items or travel related items had been purchased with acquisition cards, in contravention of CIHR policy. The current audit identified only 1 instance where an attractive item (a USB stick, which is a data storage device for computers) was purchased. The audit did not identify any travel related purchases that were not subsequently recovered. |
| 5. The number of cards in circulation seems high in comparison with the usage rate. | In the 2006 audit, it was noted that card inactivity was not being monitored by the Acquisition Card Coordinator. The current audit noted that an analysis was performed of the acquisition card limits and usage, which resulted in the reduction and cancellation of 2 acquisition cards during February 2007. In addition, transactions are being tracked on a monthly basis with amounts being calculated for the twelve-month high as well as the twelve-month average card balance. Cases where acquisition cards are not being utilized are identified and followed up on a timely basis. |
Summary of Internal Control Weaknesses
The following is a summary of the internal control weaknesses identified during the audit. Please refer to the detailed report for a description of the audit findings and recommendations.
Planning, Organizing, and Monitoring
- While the purchase registers had always been approved by the appropriate Responsibility Centre (RC) Manager per Section 34 of the FAA, there were some instances of a lack of evidence of formal approval of acquisition card transactions by the Senior Accounting Operations Officer (i.e., Acquisition Card Coordinator) per Section 33 of the Financial Administration Act (FAA).
- A formal process for the periodic review of the continued validity of the cardholders was not in place. However, an informal process did exist where the on-going validity of cardholders was being reviewed periodically.
- Quality assurance (QA) review procedures on acquisition card transactions, as required by CIHR policy, had not been conducted during the period under audit. However, Finance was performing account verification for 100% of transactions, thereby minimizing the impact of no formal QA.
Issuance and Cancellation
- An adequate audit trail for issuance and cancellation of acquisition cards had not been consistently maintained.
Use of Acquisition Cards
- Approved pre-authorization forms for specific transactions, as required by CIHR policy, had not always been completed.
- Limitations imposed by RC Managers on the acquisition card application forms had not been consistently followed.
Payments of Card Purchases
- In three instances, sufficient supporting documentation was not available to support payment transactions.
Accounting for Acquisition Card Transactions
- The general ledger allocations that were approved by RC Managers on the monthly registers did not always match the allocations that were actually recorded in the general ledger.
Other, lower-risk findings have been issued in a letter to management's attention.
Dev Loyola-Nazareth
Chief Audit Executive
Canadian Institutes of Health Research
Section One Audit Approach, Methodology, and Criteria
1.1 Audit Approach and Methodology
Through use of statistical sampling techniques, 203 random transactions totalling $46,526.50 were selected for testing from the transaction listing received from the client. The sample size was determined based upon an error rate of 5%, with a precision rate of 3%, and a confidence level of 95%. In addition, a judgemental sample of 32 high-risk transactions (i.e., unusual transactions; hospitality; transactions by new cardholders, and cancelled cards) totalling $26,666.38 was selected. For each of these samples, the audit verified whether the identified controls were functioning as intended. The combined total of the two samples represents $73,192.88, which is 59% of total acquisition card purchases of $123,279 for the audit period.
Audit fieldwork was conducted between June and August 2007.
1.2 Audit Criteria
The following categories of audit criteria were used for the audit, derived from TB Policy on Acquisition Cards, TB Acquisition Cards Program-Management Guide, and CIHR Financial Policy for the Use of Acquisition Cards:
- Controls over the Planning, Organizing, and Monitoring of the Acquisition Card Program.
- Controls over the Issuance and Cancellation of Cards.
- Controls over the Use of Cards.
- Controls over the Payment of Card Purchases.
- Controls over the Accounting for Card Transactions.
The detailed criteria and conclusions are contained in Section Three of this report.
Section Two Findings and Recommendations
The following are the audit observations on internal control weaknesses in the acquisition card program, based on audit criteria stated in Section Three and related audit procedures.
| Observation | Impact | Recommendation |
|---|---|---|
| 2.1 Planning, Organizing, and Monitoring | ||
|
2.1.1 Lack of evidence of formal approval of acquisition card transactions. The acquisition card registers are reviewed first by an Accounting Operations Officer. Once this review is completed and the Officer is satisfied that all the required supporting documentation has been provided, the registers and related documentation are forwarded to the Acquisition Card Coordinator for review and approval. In accordance with CIHR policy, the Acquisition Card Coordinator is to review the registers and documentation and initial the bottom of the register to indicate approval. For the random sample items, the audit identified 33 transactions on 15 different registers, totalling $13,346.56, for which there was no evidence of the Acquisition Card Coordinator's initials to indicate that the transactions had been reviewed and approved. For the judgemental sample, 4 transactions on 3 different registers, totalling $6,064.32, lacked the Acquisition Card Coordinator's initials to indicate that the transactions had been reviewed and approved. It should be noted that in these cases there was evidence (the highlighting of amounts and the use of tick marks) indicating that someone had performed some degree of review. |
It is possible that acquisition card transactions are not being reviewed and approved by the appropriate individual. As a result, transactions that are not in accordance with policy may be incurred by CIHR. |
It is recommended that, as required by CIHR policy, the Acquisition Card Coordinator sign off on all registers to verify that card transactions are in accordance with CIHR policy. |
|
2.1.2 No formal process for periodic review of the continued validity of cardholders. The audit noted that no formal procedures had been established for periodically verifying the continued validity of cardholders. Different procedures are used for communicating when an individual is no longer eligible to possess an acquisition card. When an employee is:
The Acquisition Card Coordinator requests a final register with the supporting documentation and then cancels the acquisition card. |
As there is no formal process in place for periodic review of eligibility or mandatory notification from RC Managers, there could be a delay between the cardholder becoming ineligible and the card being cancelled. As a result, there is a risk that an individual who is no longer eligible to use an acquisition card may still have the card and incur additional expenditures that are subsequently paid for by CIHR. It should be noted that an analysis of current cardholders versus employees of CIHR did not identify such anomalies. | It is recommended that the Director of Financial Operations and Monitoring, in consultation with RC Managers and HR, implement a formal process to inform the Acquisition Card Coordinator on a timely basis that a card should be cancelled. As part of this process, the RC Manager should inform Financial Operations promptly when an employee goes on a Leave of Absence. In addition, the Acquisition Card Coordinator should conduct periodic reviews of the acquisition card listing to ensure that individuals with active cards are still eligible to possess them. |
| 2.1.3 No quality assurance review.CIHR policy specifies that the Director of Corporate Financial Services is to conduct a monthly statistical sampling of transactions to ensure that all the requirements of Section 34 of the FAA are met. For the period under audit, a statistical review had not been performed. However, Finance was performing account verification for 100% of transactions, thereby minimizing the impact of no formal QA. | The impact is that transactions that do not comply with CIHR policy may be incurred and paid for by CIHR. | It is recommended that the Manager of Financial Operations select a statistical sample of monthly transactions and verify that these transactions are in accordance with CIHR policy. |
| 2.2 Issuance and Cancellation | ||
|
Lack of appropriate audit trail. The audit noted that an appropriate audit trail was not consistently maintained for both issuance and cancellation of acquisition cards. BMO provides a webpage confirming the date cards are issued or cancelled, which may be printed off and filed by the Acquisition Card Coordinator. During the audit period, 8 new acquisition cards were issued and for 3 of these cards there was no documentation from BMO to record the issuance; 9 acquisition cards were cancelled and for 2 of these cards there was no documentation from BMO to record the cancellation. In addition, for the 8 acquisition cards issued during the audit period, the audit identified 1 card for which an application was submitted to BMO prior to approval from Finance and Administration. For the 9 cancelled cards, no memos or other evidence from either the employee or RC Manager was included on file to indicate that the card was to be cancelled and why. |
Without an adequate audit trail, it is difficult to determine whether acquisition cards are being applied for and issued prior to the cardholder receiving approval from Finance and Administration and whether transactions have occurred after the cancellation of the cards. | It is recommended that the Acquisition Card Coordinator maintain an adequate audit trail on each individual's acquisition card file for all issuances and cancellations. |
| 2.3 Use of Acquisition Cards | ||
| 2.3.1 Pre-authorization form not completed or pre-authorization form completed after transaction was completed. CIHR policy requires that pre-authorization forms be completed for various types of expenditures such as hospitality less than $500, conference fees, training, and membership fees. For the random sample, the audit identified 10 instances totalling $3,098.90 where pre-authorization forms were not completed and 4 instances totalling $2,728.48 where pre-authorization forms were completed but signed subsequent to the date of the transaction. For the judgemental sample, the audit identified 1 instance of $3,470.97 where a pre-authorization form was not completed and one 1 instance of $39.31 where the pre-authorization form was completed but signed after the date of the transaction. | The impact is that purchases that are not in accordance with CIHR policy and within the authorized nature of purchases for a specified individual may be made. | It is recommended the Manager of Financial Operations and RC Managers require that, in accordance with CIHR policy, the pre-authorization form always be prepared and signed prior to the initiation of any transaction that requires this form. |
|
2.3.2 Limitations imposed by RC Managers not always followed. An RC Manager is able to restrict the nature of purchases made by specific cardholders within his/her cost centre. This restriction is noted on the application form when an acquisition card is first requested by the Manager. The audit noted that a comprehensive listing of cardholder limitations is not maintained by Finance. Also, a comparison of the nature of transactions incurred by a cardholder and their limitations is not performed. The audit identified 7 transactions totalling $7,200.12 in the random sample and 5 transactions totalling $6,235.16 in the judgemental sample where the limitations imposed by the RC Manager were not applied. |
The impact is that individuals may purchase goods that are not within their authorities and, as a result, CIHR may make payments for unnecessary or unauthorized purchases. | It is recommended that the Manager of Financial Operations maintain a listing of the limitations of individual cardholders and analyze these limitations as part of the review procedures. |
| 2.4 Payment of Card Purchases | ||
| Lack of supporting payment documentation. The audit identified 2 items totalling $109.41 from the random sample and 1 item of $39.31 from the judgemental sample that either did not have supporting documentation or had inadequate supporting documentation. | The impact is that inappropriate purchases may be paid for by CIHR. | It is recommended that the Acquisition Card Coordinator ensure sufficient and adequate supporting documentation is received and maintained for all acquisition card transactions (i.e., maintain an adequate audit trail). In addition, it is recommended the Accounting Operations Officer sign off on the monthly registers to indicate that all supporting documentation is attached to the individual registers. |
| 2.5 Accounting for Acquisition Card Transactions | ||
| Unsupported transactions entered into the General Ledger. The audit identified four 4 entries totalling $2,980.24 from the random sample and 2 entries totalling $234.27 from the judgmental sample where the account allocations recorded into the general ledger were different from those indicated on the approved register. | The impact is that entries that are recorded in the general ledger do not reflect the account allocations that were approved on the registers by RC Managers and, therefore, inaccurate financial information may be generated and used for decision-making. | It is recommended that the Manager of Financial Operations communicate changes made to account allocations to the RC Manager, obtain the Manager's agreement with the revised allocation, and document the change on the register. |
| 2.6 Other Audit Findings | ||
| No mandatory training of RC Managers. RC Managers are not required to attend training sessions on the application of CIHR policy on acquisition cards; however, they may attend the sessions offered to cardholders. | All RC Managers may not be aware of their responsibilities with respect to acquisition cards and, therefore, may be approving transactions that are not in accordance with CIHR policy. | It is recommended that the Manager of Policy, Training and Monitoring update the Financial Policy for the Use of Acquisition Cards to include mandatory training for all RC Managers. |
Section Three Audit Criteria and Conclusions
The audit uses the following definitions to make its assessment of the control framework.
| Conclusion on Audit Criteria | Definition of Opinion |
|---|---|
| Well Controlled | Well managed, no material weaknesses noted or only minor improvements are needed. |
| Moderate Issues | Control weaknesses, but exposure is limited because either the likelihood or the impact of the risk is not high. |
| Significant Improvements Required | Requires significant improvements in the area of material financial adjustments or control deficiencies represent serious exposure. |
Audit observations have highlighted weaknesses in the CIHR management control framework supporting the acquisition card program. Conclusions on each category of audit criteria considered whether there was a financial impact identified in the random and judgemental samples of acquisition card transactions that were tested, and the error rates found in the testing.
| Audit Criteria | Conclusion |
|---|---|
| Planning, Organizing, and Monitoring | Moderate Issues |
| Issuance and Cancellation | Moderate Issues |
| Use of Acquisition Cards | Moderate Issues |
| Payment of Card Purchases | Moderate Issues |
| Accounting for Acquisition Card Transactions | Moderate Issues |
Overall Conclusion
The audit has concluded that the majority of weaknesses in the management control framework for the acquisition card program represents moderate issues.
1. Planning, Organizing, and Monitoring.
Adequate and effective internal controls have been established to ensure the appropriate planning, organizing, and monitoring of the acquisition card program in accordance with TB policies.
| Criteria | Reference to observations | Conclusions |
|---|---|---|
| 1. CIHR has established a policy and related procedures to ensure the economical, efficient, and secure use of acquisition cards. | Well Controlled | |
| 2. The CIHR policy states clearly what constitutes abuse and wilful disregard of the operating policy and the consequences of these actions. Any misuse or wilful disregard of policies or operating procedures which results in a loss of money is subject to the TB Policy on Losses of Money and Offences and Other Illegal Acts Against the Crown. | Well Controlled | |
| 3. The CIHR Policy specifies the types of items that may be purchased, dollar limits of purchases, limitations on certain types of purchases, and kind of situations in which the acquisition card must be used. | Well Controlled | |
| 4. Under the policy, a CIHR Coordinator for Acquisition Cards has implemented a monitoring program designed to ensure reliable control over the use of acquisition cards and overall management of the acquisition cards program. This monitoring program covers the life-cycle of the card from its issuance to its termination. | Well Controlled | |
| 5. There is appropriate and adequate separation of duties between the authorities to issue cards; make purchases; authorize purchases; inventory purchases; authorize payment; make the payment; maintain records for audit trail purposes; and monitor and audit card use. | Well Controlled | |
| 6. The CIHR Coordinator undertakes periodic reviews and audits of the use of acquisition cards to determine whether they are being used in accordance with the TB and CIHR Policy. | 2.1.1 | Moderate Issues |
| 7. The CIHR Coordinator undertakes an annual review to verify the continued validity of existing cardholders. | 2.1.2 | Moderate Issues |
| 8. Appropriate oversight of the acquisition card program is performed by the Manager of Corporate Financial Services. | 2.1.3 | Moderate Issues |
2. Issuance and Cancellation
There are adequate and effective controls over the issuance and cancellation of acquistion cards to ensure compliance with TB and CIHR policies.
| Criteria | Reference to observations | Conclusions |
|---|---|---|
| 9. There is a well defined issuance process in place that is in accordance with CIHR Policy and TB policies. The process is documented, communicated, and well understood. | 2.2 | Moderate Issues |
| 10. There is a well defined cancellation process in place that is in accordance with CIHR Policy and TB policies. The process is documented, communicated and well understood. | 2.2 | Moderate Issues |
3. Use of Acquisition Card
Adequate and effective controls have been established to ensure acquisition card use is in accordance with TB and CIHR policies.
| Criteria | Reference to observations | Conclusions |
|---|---|---|
| 11. Acquisition cards are kept in a secure, controlled-access location. | Well Controlled | |
| 12. Every cardholder is informed of his or her responsibilities and restrictions regarding the use of the acquisition card. Each cardholder signs a written acknowledgement of responsibilities and obligations before receiving the acquisition card. | Well Controlled | |
| 13. The restrictions placed on the acquisition card are being appropriately respected. | 2.3.1, 2.3.2 | Moderate Issues |
| 14. TB and CIHR policies on losses of money are known and applied by managers and cardholders. | Well Controlled |
4. Payment of Card Purchases
Adequate and effective controls have been implemented to ensure payments to acquisition card companies are authorized, timely, accruate, and in accordance with TB and CIHR policies.
| Criteria | Reference to observations | Conclusions |
|---|---|---|
| 15. TB and CIHR policies on losses of money are known and applied by managers and cardholders. | Well Controlled | |
| 16. The policy on the Goods and Service Tax (GST) and the Provincial Sales Tax (PST) is observed for all purchases made with the acquisition card. | Well Controlled | |
| 17. Records of purchases made with acquisition cards are kept for audit trail purposes. | 2.4 | Moderate Issues |
| 18. Reconciliation and account verification are performed to ensure that only authorized and appropriate purchases of goods and services are paid; disputed items are identified and processed for resolution (shipment delays, shipment errors, and product quality issues are not considered disputed items and are settled directly with the vendor); and reimbursements are obtained from cardholders for unauthorized or inappropriate purchases. | 2.1.1 | Moderate Issues |
| 19. Payments to the acquisition card company are processed in a timely manner to avoid paying interest and to maximize the rebates payable to the government. Settling accounts according to the terms of the card payment option selected by CIHR will ensure this. It is important to note that, according to TB Policy, payments can be made before the regular payment on due date terms as indicated under 5h) of the Policy on Payment Requisitioning and Payment on Due Date. | Well Controlled |
5. Accounting for Acquisition Card Transactions
Adequate and effective controls are implemented to ensure that financial information impacted by acquisition card transactions is accurate and timely.
| Criteria | Reference to observations | Conclusions |
|---|---|---|
| 20. Accounting entries are made for acquisition card purchases when the monthly card account is paid. | Well Controlled | |
| 21. The payment and allocation of year-end transactions on acquisition cards comply with the concept of receipt of goods and services. In essence, allocations to the accounts of a given year reflect economic activity in that year. | 2.5 | Moderate Issues |
Appendix A Overview of the Acquisition Card Process
An application for a new acquisition card occurs subsequently to appropriate approvals from an RC Manager and Finance. When approving an application form, an RC Manager has the authority to apply restrictions to the type of transactions that an individual is allowed to purchase with the acquisition card. CIHR requires that a new cardholder attend a training course on the use of the acquisition card prior to receiving the card. The Acquisition Card Coordinator, who has been delegated the responsibility of managing acquisition cards for CIHR, receives the new acquisition card from BMO and alerts the new cardholder via email that the card is ready for pickup.
The acquisition card balances are paid monthly through direct withdrawal by BMO from CIHR's bank account. The financial accounting entry is then made to a suspense expense account in the general ledger. Cardholders are required, on a monthly basis, to prepare registers that detail their transactions and to provide supporting documentation. These registers are then approved by the employee's RC Manager and submitted to Finance who verifies that the transactions are allowable under the acquisition card policy. This approval by Finance is evidenced by the Acquisition Card Coordinator's initials on the register. Once a register is approved, the amount recorded in the financial records is reallocated from the suspense expense account to appropriate general ledger accounts.
When an individual leaves CIHR, HR notifies Finance of the employee's departure through the Release Form; Finance is required to complete and sign the form to indicate that all of the employee's acquisition and travel cards have been returned.
Acquisition card transaction volumes and dollars, by cardholder, are monitored by Finance on a monthly basis through the use of an Excel spreadsheet. Finance reviews the average spending for a twelve-month period in order to determine whether modifications are required of the card's limits and/or whether any cards should be cancelled.
Appendix B Summary of Cardholders (By Limit)
| Credit Limit | Total Number of Cardholders | % of Total | Total Transactions During Audit Period |
|---|---|---|---|
| $ 500 - $ 1,000 | 16 | 30.78% | $4,879 |
| $1,001 - $2,000 | 7 | 13.46% | $3,199 |
| $2,001 - $3,000 | 7 | 13.46% | $17,255 |
| $3,001 - $4,000 | 1 | 1.92% | $1,084 |
| $4,001 - $5,000 | 14 | 26.92% | $33,050 |
| $5,001 - $7,000 | 1 | 1.92% | $9,809 |
| $7,001 - $8,000 | 2 | 3.85% | $19,313 |
| $8,001 - $10,000 | 1 | 1.92% | $19,510 |
| $10,001 - $15,000 | 2 | 3.85% | $15,180 |
| $15,001 - $25,000 | 1 | 1.92% | $0 |
| 52 | $123,279 |
Appendix C Decision Diagram for Cardholders 1
Decision diagram - Is the acquisition card being used for...
| ... personal purchases or cash advance? | Yes | Stop. Acquisition cards can not be used for personal purchases or cash advances. Cash purchases must be submitted with receipts to Finance for review. |
| ...interdepartmental transactions or vehicle costs? | Yes | Stop. Acquisition cards can not be used to pay for interdepartmental transactions or vehicle expenses. |
| ...electronics or software licenses? | Yes | Stop. Only ITMS and Administrative Services are authorized to purchase electronic goods and software ('attractive items'). Contact ITMS helpdesk for more information on purchasing this type of good or service. |
| ...contracting for more than $5 000? | Yes | Stop. Contracting services in excess of $5 000 must go through contracting services. Contact the Manager, Procurement, for more information. Contracts can be paid for using acquisition cards if stipulated in the contract and fees are within card limits. Acquisition cards can be used to purchase services with approval from Administrative Services. |
| ...purchasing furniture? | Yes | Stop. Purchases of furniture must be approved by administrative Services before an acquisition card may be used. Contact the Manager, Administration for more information. |
| ...travel expenses? | Yes | Acquisition cards can be only used to reserve a hotel room, but can not be used to pay for a hotel room or any other travel expenses. |
| ...gifts or hospitality expenses? | Yes | Acquisition cards can not be used to pay for hospitality costs over 500$. All hospitality expenses require pre-approval through the Hospitality pre-Authorization and Expense Claim (available on the CIHR intranet). Contact the Accounting Operations Officer for information. Cards may be used to pay for gifts, but must be within the Policy on the Offer, Acceptance or Solicitation of Gifts, Hospitality, Honoraria and other Benefits. |
| ...conferences or training? | Yes | Cards can pay for conferences or training fees, but must be in accordance with the Continuous Learning Policy and pre-approved using the Admin. Services Internal Requisition form (available on the CIHR intranet). |
| ...purchases with an unreliable merchant? | Yes | Stop. Purchases should only be made with reliable merchants, and can take place in person, via the phone or the internet (provided the secure transaction icon appears on the page). |
Proceed with transaction with the following steps:
1) Provide merchant with CIHR's PST exemption number (available on the CIHR intranet).
2) Make the purchase, obtaining a slip containing the following information: card number, date, merchant name, itemized list of purchases, total amount owed including taxes; authorization number (if applicable). Acceptable slips include webpage electronic receipt print-offs, detailed store receipts, and as a last resort, a signed statement from the cardholder. Basic credit card signing slips are not acceptable as they do not include a list of purchased items.
3) If a transaction is reversed, both the original and reversal slip must be included in the file; if purchase and reversal occur in different months, the reversal slip should refer to the month of the purchase.
- This is a prototype decision tree designed to assist acquisition card holders decide whether a card should be used and what documentation is required for the transaction. The diagram was prepared by CIHR's Internal Audit section with input from RCGT, CIHR card users, and Finance staff. This tool is offered to the Director of Financial Operations and Monitoring for validation and implementation if it is considered useful.
Management Action Plan
November 2007
| Observation | Recommendation | Action Plan | Initial Timeframe |
|---|---|---|---|
| 2.1 Planning, Organizing, and Monitoring | |||
|
2.1.1 Lack of evidence of formal approval of acquisition card transactions. The acquisition card registers are reviewed first by an Accounting Operations Officer. Once this review is completed and the Officer is satisfied that all the required supporting documentation has been provided, the registers and related documentation are forwarded to the Acquisition Card Coordinator for review and approval. In accordance with CIHR policy, the Acquisition Card Coordinator is to review the registers and documentation and initial the bottom of the register to indicate approval. For the random sample items, the audit identified 33 transactions on 15 different registers, totalling $13,346.56, for which there was no evidence of the Acquisition Card Coordinator's initials to indicate that the transactions had been reviewed and approved. For the judgemental sample, 4 transactions on 3 different registers, totalling $6,064.32, lacked the Acquisition Card Coordinator's initials to indicate that the transactions had been reviewed and approved. It should be noted that in these cases there was evidence (the highlighting of amounts and the use of tick marks) indicating that someone had performed some degree of review. |
It is recommended that, as required by CIHR policy, the Acquisition Card Coordinator sign off on all registers to verify that card transactions are in accordance with CIHR policy. |
Responsibility: Action: |
Closed. |
|
2.1.2 No formal process for periodic review of the continued validity of cardholders. The audit noted that no formal procedures had been established for periodically verifying the continued validity of cardholders. Different procedures are used for communicating when an individual is no longer eligible to possess an acquisition card. When an employee is:
The Acquisition Card Coordinator requests a final register with the supporting documentation and then cancels the acquisition card. |
It is recommended that the Director of Financial Operations and Monitoring, in consultation with RC Managers and HR, implement a formal process to inform the Acquisition Card Coordinator on a timely basis that a card should be cancelled. As part of this process, the RC Manager should inform Financial Operations promptly when an employee goes on a Leave of Absence. In addition, the Acquisition Card Coordinator should conduct periodic reviews of the acquisition card listing to ensure that individuals with active cards are still eligible to possess them. |
Responsibility: Action: The Director, Financial Operations and Monitoring will meet with the appropriate Human Resources representatives to establish a formal process whereby the Acquisition Card Coordinator is advised when an employee/cardholder is on an extended leave period. The Director, Financial Operations and Monitoring will also be issuing a memorandum to all responsibility centre managers reminding them of their responsibility to advise the Acquisition Card Coordinator when their employee/cardholder is on extended leave of absence or changes organization. This message will be further reiterated as part of the Acquisition Card Training Course slated to begin in mid December 2007. The Manager, Financial Operations will be generating BMO acquisition card usage reports on a regular basis to monitor the actual cardholder usage. Cardholders whose card has not been used over a period of time may see their card put on hold or cancelled. No additional follow-up action required. |
Closed. |
| 2.1.3 No quality assurance review. CIHR policy specifies that the Director of Corporate Financial Services is to conduct a monthly statistical sampling of transactions to ensure that all the requirements of Section 34 of the FAA are met. For the period under audit, a statistical review had not been performed. However, Finance was performing account verification for 100% of transactions, thereby minimizing the impact of no formal QA. |
It is recommended that the Manager of Financial Operations select a statistical sample of monthly transactions and verify that these transactions are in accordance with CIHR policy. |
Responsibility: Action: The Manager, Financial Operations has already taken steps to set-up a statistical sampling process of monthly acquisition card transactions to verify that these transactions are in compliance with the CIHR policy on Acquisition Cards. No additional follow-up action required. |
Closed. |
| 2.2 Issuance and Cancellation | |||
|
Lack of appropriate audit trail. The audit noted that an appropriate audit trail was not consistently maintained for both issuance and cancellation of acquisition cards. BMO provides a webpage confirming the date cards are issued or cancelled, which may be printed off and filed by the Acquisition Card Coordinator. During the audit period, 8 new acquisition cards were issued and for 3 of these cards there was no documentation from BMO to record the issuance; 9 acquisition cards were cancelled and for 2 of these cards there was no documentation from BMO to record the cancellation. In addition, for the 8 acquisition cards issued during the audit period, the audit identified 1 card for which an application was submitted to BMO prior to approval from Finance and Administration. For the 9 cancelled cards, no memos or other evidence from either the employee or RC Manager was included on file to indicate that the card was to be cancelled and why. |
It is recommended that the Acquisition Card Coordinator maintain an adequate audit trail on each individual's acquisition card file for all issuances and cancellations. |
Responsibility: Action: The Acquisition Card Coordinator will maintain a Central Register of cards issued and cards cancelled including relevant dates, and will update this register as new cards are issued and when cards are cancelled. The register will also keep track of changes in cardholder RC Manager. No additional follow-up action required. |
Closed. |
| 2.3 Use of Acquisition Cards | |||
| 2.3.1 Pre-authorization form not completed or pre-authorization form completed after transaction was completed. CIHR policy requires that pre-authorization forms be completed for various types of expenditures such as hospitality less than $500, conference fees, training, and membership fees. For the random sample, the audit identified 10 instances totalling $3,098.90 where pre-authorization forms were not completed and 4 instances totalling $2,728.48 where pre-authorization forms were completed but signed subsequent to the date of the transaction. For the judgemental sample, the audit identified 1 instance of $3,470.97 where a pre-authorization form was not completed and one 1 instance of $39.31 where the pre-authorization form was completed but signed after the date of the transaction. | It is recommended the Manager of Financial Operations and RC Managers require that, in accordance with CIHR policy, the pre-authorization form always be prepared and signed prior to the initiation of any transaction that requires this form. |
Responsibility: Action: The Manager, Financial Operations will be issuing a memorandum to all RC Managers informing them of their responsibilities of preparing and submitting signed authorization forms for those transactions requiring prior authorization. This requirement will also be reiterated as part of the Acquisition Card Training Course slated to begin in mid December 2007. The Manager will also take steps to implement a process whereby transactions that are not supported by a required pre-authorization form are returned to the RC manager concerned for correction and that the pre-authorization form is signed after-the-fact by the RC Manager. Financial Operations plans to put in place a monthly report on CIHR acquisition cardholder activities including those acquisition cardholder activities that are non-compliant with CIHR policy. Corrective action may be taken as required. No additional follow-up action required. |
Closed. |
|
2.3.2 Limitations imposed by RC Managers not always followed. An RC Manager is able to restrict the nature of purchases made by specific cardholders within his/her cost centre. This restriction is noted on the application form when an acquisition card is first requested by the Manager. The audit noted that a comprehensive listing of cardholder limitations is not maintained by Finance. Also, a comparison of the nature of transactions incurred by a cardholder and their limitations is not performed. The audit identified 7 transactions totalling $7,200.12 in the random sample and 5 transactions totalling $6,235.16 in the judgemental sample where the limitations imposed by the RC Manager were not applied. |
It is recommended that the Manager of Financial Operations maintain a listing of the limitations of individual cardholders and analyze these limitations as part of the review procedures. |
Responsibility: Action: The Manager, Financial Operations is to instruct the Acquisition Card Coordinator to prepare a comprehensive list of restrictions by acquisition cardholder and RC Manager. This list will be shared/ reviewed with each of the RC Managers concerned in order that they in turn make reference to this list when approving their monthly acquisition card registers. The Manager, Financial Operations will ensure that this same list is utilized by the Acquisition Card Coordinator as a cross reference when reviewing all the monthly acquisition card registers. In addition this list of restrictions will be reviewed on a periodic basis with each RC Manager to ensure the restrictions are warranted and if not, the restrictions will be deleted by the Acquisition Card Coordinator Cardholders who fail to comply with the prescribed limitations as outlined on the list will be issued a warning in writing with a copy to their respective RC managers. Those cardholders who continue to acquire restricted goods and services may see their card suspended or cancelled. No additional follow-up action required |
Closed. |
| 2.4 Payment of Card Purchases | |||
| Lack of supporting payment documentation. The audit identified 2 items totalling $109.41 from the random sample and 1 item of $39.31 from the judgemental sample that either did not have supporting documentation or had inadequate supporting documentation. | It is recommended that the Acquisition Card Coordinator ensure sufficient and adequate supporting documentation is received and maintained for all acquisition card transactions (i.e., maintain an adequate audit trail). In addition, it is recommended the Accounting Operations Officer sign off on the monthly registers to indicate that all supporting documentation is attached to the individual registers. |
Responsibility: Action: The Acquisition Card Coordinator will be instructed to ensure sufficient and adequate documentation is received and maintained for all acquisition card transactions. No additional follow-up action required. |
Closed. |
| 2.5 Accounting for Acquisition Card Transactions | |||
| Unsupported transactions entered into the General Ledger. The audit identified four 4 entries totalling $2,980.24 from the random sample and 2 entries totalling $234.27 from the judgmental sample where the account allocations recorded into the general ledger were different from those indicated on the approved register. | It is recommended that the Manager of Financial Operations communicate changes made to account allocations to the RC Manager, obtain the Manager's agreement with the revised allocation, and document the change on the register. |
Responsibility: Action: These posting errors will be rectified by having the Accounting Operations Officer print out the Journal Voucher Reports which will then be checked for proper coding and initialled by the Acquisition Card Coordinator. See our response to 2.1.1 above. No additional follow-up action required. |
Closed. |
| 2.6 Other Audit Findings | |||
| No mandatory training of RC Managers. RC Managers are not required to attend training sessions on the application of CIHR policy on acquisition cards; however, they may attend the sessions offered to cardholders. | It is recommended that the Manager of Policy, Training and Monitoring update the Financial Policy for the Use of Acquisition Cards to include mandatory training for all RC Managers. |
Responsibility: Action: Operations and Monitoring intends to add a formal training session on the use of acquisition cards as part of the existing course on contract management. The implementation date for this recommendation is set of mid December 2007. It should be noted that the Acquisition Card Coordinator already provides individual training to new acquisition card holders. Financial Operations and Monitoring is planning in the near future to publish on the CIHR Web site copies of the Acquisition Card Policy and FAQ document to assist managers and cardholders in the exercise of their acquisition card authority. No additional follow-up action required. |
Closed. |
Supplemental content (right column)
- Modified: