Risk Management for Company-Paid Purchase Cards
June 2008
Several of my clients have recently shifted
to the company-paid purchase card (P-card) to attempt to improve controls over
spending. I tell them to beware.
by
Scott Langlinais
Langlinais
Fraud and Audit Advisory Services
The Government Accountability Office (GAO), which for years has used data
analysis software to search for and identify inappropriate and unauthorized
transactions on its government purchase cards, reported the following transactions
in its most recent audit of card purchases by government employees.
During a six-year period, [a Forest Service] cardholder fraudulently wrote
approximately 180 [convenience] checks to an individual with whom the cardholder
lived and shared a bank account…. The cardholder was sentenced in November
2007 to 21 months imprisonment followed by 36 months of supervised release
and was required to pay over $642,000 in restitution.
[A Navy] cardholder purchased 19 pilferable items, including 2 LCD monitors,
5 iPods, a laser jet printer, a PDA, and other computer accessories, 18
of which are now lost and presumed stolen.
Over a 15-month period, a postmaster used the government purchase card to
subscribe to two Internet dating services.1
The report lists numerous examples of fraudulent, unauthorized, and abusive
purchases. It concludes more than 48 percent of purchases over $2,500 between
July 1, 2005, and June 30, 2006, failed to meet the standard of proper authorization,
independent receipt and acceptance, or both.
Another GAO report details this:
An Air Force cardholder used the purchase card to prepare a shoulder mount
of a mule deer head. The deer was a "road kill" that was found on the roadside
by an approving official who approved the purchase of taxidermy services.
The deer head was hung on the wall in the Natural Resources Office. The
cardholder, approving official, and two other employees occupy the office
where the deer head currently hangs.2
The Perceived Benefits of P-cards
Chief financial officers and controllers claim that with P-cards, their company
is able to systematically block certain classes of vendors, such as retail stores
and gambling sites, to prevent employees from buying suits at Macy's or establishing
accounts at Poker.net. A P-card also allows spending ceilings, so if an employee
does make inappropriate purchases, the system caps the damage.
Most alluring to CFOs and controllers is the cash back: banks administering
P-cards often provide refunds up to one percent of the company's purchases.
If your company spends $60 million a year in common purchases and travel, then
it can receive a $600,000 refund at year end. Some executives believe such a
refund can offset the exposure inherent in the new process.
But one or two employees can devour this amount. Consider the credit card
problems at the Dallas Independent School District. Over a 2-year period, one
administrative assistant spent $383,788 on her card but had no receipts to support
her purchases. She supposedly bought supplies for several departments, "but
her favorite places were the grocery store and Base Exchange on Carswell Air
Force Base in Fort Worth, where she spent $101,500 over an 18-month period.
She made 170 purchases between January 2004 and July 2005, almost all of them
on weekends."3
When considering P-card process implementation, CFOs and controllers also
cite the lure of streamlining controls, meaning it is much easier in theory
to allow a system to administer controls instead of forcing employees through
inefficient procedures of submitting purchase requests and then waiting for
purchase order approvals. But that is the point of controls—they are inefficient
and for good reason. By forcing reviews and approvals, the opportunity to perpetrate
fraud is reduced, and that is what we seek, at least up to the point where the
cost exceeds the benefit. Unfortunately, with the reduction in monitoring of
employee expenditures, the opportunity is increased for employees to perpetrate
fraud.
Implement Checks and Monitor
As with any other process, in order for your company to prevent fraud in
P-cards, your managers must first consider the risks (several are listed throughout
this article). Second, they must consider the symptoms of these frauds. Finally,
they must build processes to detect those symptoms and follow up on all symptoms
observed.
A defined selection process on the front end helps reduce the opportunity
for employees to perpetrate fraud. Realize not everyone deserves a P-card. If
you provide cards to people with credit problems and financial trouble, then
your employee's personal irresponsibility aggravates the risk of loss. Establish
parameters for recipients of cards based on credit scores. Everyone else needs
to go through traditional purchasing requirements (purchase requisition/purchase
order).
Also realize systematic vendor blocks and credit limits are not enough to
prevent employees from purchasing goods and services from unapproved vendors.
Certain vendors, such as gambling sites based in the Caribbean, have learned
how to circumvent vendor blocks, and credit limits are not enough for employees
savvy enough to pay their credit card balance down more than once per month.
Your company must have a process to monitor spending, and this is best done
with data analysis software such as
IdeaTM.
With such software, an employee can be assigned to monitor and test the "top
10s": the top 10 spenders every month by dollar amount and by number of transactions;
the top 10 vendors processing charges on the card; and the top 10 highest increases
in total spending from the previous quarter.
The types of behavior to monitor are limited only to the creativity of the
employees doing the monitoring. Managers understand what normal credit card
activity should look like in their areas, so preventing fraud on the P-card
becomes an exercise in seeking deviations from standard behavior. Most companies
with P-card programs simply fail to assign an employee or department to regularly
review and monitor P-card transactions, assuming that manager approvals will
suffice.
Regular and assertive monitoring of P-card transactions is essential if you
want to prevent your employees from using company money to mount road-kill deer
heads.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author's employer or IRMI. Expert Commentary articles
and other IRMI Online content do not purport to provide legal, accounting, or other
professional advice or opinion. If such advice is needed, consult with your attorney,
accountant, or other qualified adviser.