Overview
UMass Dartmouth allowed prohibited purchases on the university’s procurement cards (Procards), resulting in a higher-than-acceptable risk of misuse of university funds.
For our two-year audit period, UMass Dartmouth had more than 30,500 transactions on 422 Procards, totaling $5,481,569. According to the university’s Procard User Guide, Procards are issued to faculty and staff members “to purchase and pay for consumable commodities of a low dollar value, as well as travel expenses, when pre-approved.”
The university Procard User Guide establishes rules for the use of Procards, including specifically identifying items that are prohibited Procard purchases. We found 19 instances of prohibited purchases, totaling $9,129, in our test of Procard transactions, as described below:
- 3 cash advances, totaling $1,245, during a trip to India by a faculty member who was approved for only a $500 cash advance and did not have supporting documentation to explain how the money was spent
- 10 transactions for computer equipment (monitors, servers, and system boards), totaling $4,204
- 4 transactions for camera equipment, totaling $3,054
- 2 transactions, for a tablet computer and an e-reader, totaling $626
We also noted control deficiencies in the use and documentation of Procard purchases, as follows:
- Twenty-six cardholders lacked approvals and/or required backup documentation, including Procard activity logs, gift card recipient logs, and business expense forms, for 48 transactions, totaling $20,059.
- A Procard cardholder shared a card with students. We found 23 transactions during one billing period, totaling $645, charged by two authorized student groups for travel expenses on an employee’s card. Management told us that this was a routine practice and the employee was following an unwritten policy. Although this action was approved, we feel that there is a risk inherent in loaning out a card.
Authoritative Guidance
UMass Dartmouth’s Procard User Guide prohibits cardholders from using Procards to obtain cash advances or to purchase “Computers/Laptops, iPads, and E-Readers.”
The Procard User Guide also states that a Procard can be used to purchase equipment, including camera equipment, at a cost of less than $1,000 only if it is not to be tagged for inventory purposes. According to the Moveable Equipment Inventory User Manual, UMass Dartmouth is required to tag any equipment purchased for $5,000 or less that is considered “sensitive,” i.e., at a “high risk of loss”; this includes cameras, which the manual specifically identifies as an example of “sensitive equipment.”
The guide also states,
The cardholder will maintain adequate documentation to support the legitimate business purpose of all transactions made with the Procard. It is required that the Cardholder keep a monthly Card Activity Log of all his/her purchase transactions conducted with the Procard, to better track his/her purchases and available budget. . . .
Additionally, the statement must be reviewed by the cardholder’s supervisor. The supervisor must sign the statement as an indication of review/approval.
The UMass Dartmouth Business Expense Policy and Procedure states that departments issuing gift certificates or gift cards “must keep a record of all gift certificates/cards issued. This record should include recipient name and amount received. The recipient of such gift card must sign a receipt.” The policy also states, “Business expenses must be supported by a completed business expense form.”
Finally, the Procard User Guide identifies the “assignment or transfer of an individual’s card to another person” as an example of “misuse” of a Procard.
Reasons for Noncompliance
Although UMass Dartmouth’s policies and procedures for Procard use are clearly defined, the university lacks adequate monitoring controls to ensure that these policies and procedures are followed. For example, we found that supervisors were not reviewing Procard transactions, monthly statements, and supporting documentation; in addition, monthly Procard account reconciliations were not consistently completed and were missing supervisory reviews and approvals. Although UMass Dartmouth provides training on Procard use to cardholders, it does not provide that training to its supervisory staff.
Recommendation
UMass Dartmouth should enhance its training and monitoring controls to ensure that established policies and procedures are consistently followed.
Auditee’s Response
The timeframe of the audit was FY15 and FY16. A new CFO and Associate Vice Chancellor for Finance were hired in the summer of 2015 (FY16). During their tenure additional controls were added, including but not limited to:
- Weekly review of [Procard] spend using queries to show transactions by card holder and vendor to ensure appropriateness of purchases and compliance, and [enhanced] fraud prevention.
- Stringent requirements for the purchase of gift cards using a [Procard] were implemented in October 2016. These requirements include receipt of Administration and Finance approval prior to purchase of gift cards, log maintenance of recipients, including employee status for the addition of the card value to wage earnings, signed receipts by recipients, maximum value of card purchases, and procedures for excess gift card purchase (i.e., organization purchases 10 cards but only 9 are used).
- Discontinuance of cards available to holders who do not follow established policies and procedures.
The [Procard] purchases referred to as prohibited were appropriate business purchases; however, we understand that according to policy they should have been purchased by other means, e.g., via a purchase order.
As a result of the audit we will:
- Update our written policies to reflect current practices that already mitigate risk to a reasonable level;
- Enhance our [Procard] audit procedures to include unscheduled audit reviews by visiting departments throughout the campus; and
- Enhance monitoring controls by implementing mandatory supervisor training.
In addition, the majority of the IT purchases noted by the auditors were made by the IT department and consisted of small, quickly required items such as a mouse, keyboard or monitor. Dartmouth will formalize this exception to the [Procard] policy allowing only the IT department to purchase small items of an IT nature via a [Procard].
Auditor’s Reply
We believe UMass Dartmouth’s proposed changes to its internal practices will strengthen its oversight and monitoring of the Procard process. The implementation of unscheduled audits, weekly queries to monitor purchases, and mandatory supervisory training should reduce the purchases of prohibited items and help ensure that proper supporting documentation is available for each transaction. Updating the university’s policy to include these proposed practices and the information technology purchasing exception will help to clarify staff members’ responsibilities.
| Date published: | April 9, 2018 |
|---|