The University of Massachusetts Lowell’s Bank Card Transactions Did Not Always Comply With University of Massachusetts System Policies and Standards.

If UMass Lowell does not reconcile and upload bank statements and supporting documents to the UMass system’s online bank card transaction repository in a timely manner or at all, then UMass Lowell assumes a higher-than-acceptable risk of erroneous and potentially fraudulent bank card activity.

Overview

The University of Massachusetts (UMass) Lowell’s bank card transactions did not always comply with UMass system policies and standards. We inspected 110 bank card transactions (89 transactions through U.S. Bank and 21 transactions through Citibank), totaling $167,312, and found that some transactions were missing some or all supporting documents. Also, there were some instances where cardholders did not perform monthly bank statement reconciliations, either in a timely manner or at all. The following are details from our findings regarding these transactions.

Citibank Transactions

• Regarding documentation, 3 out of 21 transactions were missing a bank statement and a different 3 out of 21 transactions were missing both a bank statement and a receipt.
• Regarding state sales tax, 1 out of 21 transactions included this sales tax that was paid and never refunded to UMass Lowell by the vendor.

U.S. Bank Transactions

• Regarding documentation, 8 out of 89 transactions were missing a receipt, 3 out of 89 transactions were missing a bank statement, and 3 out of 89 transactions were missing both a bank statement and a receipt.
• Regarding state sales tax, 7 out of 89 transactions included this sales tax that was paid and never refunded to UMass Lowell by the vendor.
• Regarding travel, 7 out of 89 transactions related to out-of-state travel were missing a travel authorization number on either the bank statement, the receipt, or both.
• Regarding monthly reconciliations, the 89 transactions within our sample should have been included in a total of 87 requisitions. However, 5 requisitions were never created in the UMass system’s online bank card transaction repository, while 48 were submitted after the allowable 30 days. The average number of days past due for these 48 requisitions was 112 days.
• Regarding missing information, 47 out of 89 transactions were missing information on their corresponding receipts.¹² Specifically,

• The vendor name was missing from 3 receipts.
• A description of the item purchased was missing from 6 receipts.
• A transaction date was missing from 5 receipts.
• The beginning and ending dates of the subscription period were missing on 3 receipts that were for subscription purchases.
• The last four digits of the bank card’s number were missing from 15 receipts.
• A transparent business purpose was missing from 30 receipts.

If UMass Lowell does not reconcile and upload bank statements and supporting documents to the UMass system’s online bank card transaction repository in a timely manner or at all, then UMass Lowell assumes a higher-than-acceptable risk of erroneous and potentially fraudulent bank card activity. If UMass Lowell pays taxes when they are not applicable, then it takes on an unnecessary tax burden that reduces funds available to support its mission. Furthermore, having incomplete documentation for bank card transactions on reconciliations results in a lack of transparency.

Authoritative Guidance

UMass Lowell’s cardholders are responsible for making allowable purchases, maintaining proper documentation, and completing timely reconciliations, according to Sections 2, 4, 11, 12, 15, and 21 of the UMass Bank Card Use Standard, which was updated on September 20, 2021. The standard states,

2.   HOW IT WORKS . . .

      Each cardholder is responsible for downloading, reviewing, reconciling, and submitting their monthly statement to their supervisor . . . within 30 days of the statement issue date. . . .

4.   CARDHOLDER RESPONSIBILITIES . . .

      Cardholders are responsible for submitting all relevant receipts for all UMass Bank Card purchases. These receipts are to be submitted with the cardholder’s monthly reconciliation. . . . If a receipt is lost, the cardholder must make every possible attempt to contact the vendor and obtain a copy. If a copy cannot be obtained, a Missing Receipt Affidavit may be filled out as the absolute last resort. . . .

11.  SALES TAX EXEMPTION . . .

       It is the responsibility of the cardholder to ensure that sales tax is not charged when the University is exempt when making a purchase with the UMass Bank Card. . . .

       If a UMass Bank Card is charged tax, the cardholder is required to request a credit from the vendor as soon as the error is discovered. The cardholder is responsible for the follow-up until the vendor’s credit is received.

12.  RECEIPTS . . .

       Receipts must include the following information:

• Vendor name
• Description of item purchased
• Transaction date . . .
• Beginning and expiration dates for subscriptions
• Proof that charge was billed to the UMass Bank Card (i.e., last 4 digits of card number)
• If not self-evident, a business purpose for the purchase. . . .

15.  RECORD KEEPING

       The Cardholder or their designee is responsible for obtaining a printed copy of the statement at the cycle end . . . and all receipts, packing slips, credit card slips, and invoices. . . .

21.  TRAVEL RELATED INFORMATION . . .

        If the travel required prior authorization . . . then travel authorization number must be referenced on the bank card statement and receipt.

Reasons for Issue

Regarding transactions that were missing some or all supporting documents, UMass Lowell stated that the UMass system’s online bank card transaction repository is new to the UMass system. UMass Lowell management attributed the uploading of bank statements and supporting documents beyond the required timeframe, which we calculated to be an average of 112 days late, to the learning curve involved with using the new bank card transaction repository.

Regarding missing information, UMass Lowell management stated that the policy that calls for cardholders to write the travel authorization number on the bank statement and receipt(s) is not in practice throughout the entire UMass system. UMass system management also stated that the self-evidence of a transaction’s business purpose is only required by the cardholder and supervisor, and further stated that the UMass Bank Card Use Standard does not officially document to whom the business purpose must be self-evident. After reviewing the supporting documents for the transactions in our sample, we also noted that some of the missing information was caused by (1) the vendor’s receipt not capturing certain details of the transaction, (2) a cardholder not capturing a full image of the receipt in a screenshot, or (3) the cardholder’s submission of only the charge slip, which only displays a portion of the required information.

Regarding the state sales tax charges, UMass system management stated that some state sales tax charges were out of a cardholder’s control, because of (1) the fact that some vendors would not accept UMass Lowell’s sales tax–exempt status, especially vendors operating outside of Massachusetts, and (2) the inability to submit the Massachusetts tax exempt form to third-party vendors on platforms such as Amazon or eBay. Given these two issues, UMass system management stated that the small amount of sales tax charged is not always worth the time spent by the cardholder in trying to have the sales tax refunded.

Recommendations

1. UMass Lowell should ensure that cardholders reconcile and upload all bank statements and supporting documents into the UMass system’s online bank card transaction repository within 30 days of the bank statement date.
2. UMass Lowell should ensure that each bank card transaction receipt captures the full business purpose and that all required information is on the receipt. If this is not feasible within the requirements of the current standard, then the UMass system should update the UMass Bank Card Use Standard to reflect appropriate and feasible requirements.
3. UMass Lowell should ensure that state sales tax is not charged when bank card purchases are made by cardholders. If this is not feasible within the requirements of the current standard, then the UMass system should update the UMass Bank Card Use Standard to reflect appropriate and feasible requirements.
4. UMass Lowell should ensure that travel authorization numbers are referenced on the bank statement and receipt(s). If this is not feasible within the requirements of the current standard, then the UMass system should update the UMass Bank Card Use Standard to reflect appropriate and feasible requirements.

Auditee’s Response

1. As part of its ongoing efforts to innovate and constantly improve efficiency and effectiveness of its operations, UMass is implementing a new University-wide expense system, which will improve the bank card reconciliation process. This new system will create a streamlined automated process where bank card transactions are imported and available daily for review. The new expense system includes monitoring controls to prompt timely review. As a result, the University will no longer utilize the online repository, and the Bank Card Standard will be updated to reflect new protocols.
2. The new expense system has a digital receipt capture feature that allows for them to be uploaded directly from a computer or mobile device. In addition, a mandatory field for business purpose is utilized in the new expense system. Cardholders are being trained to utilize these functions. As a result, the Bank Card Standard will be updated to reflect the new protocols. It is important to note that there were no fraudulent or inappropriate business purchases found during the audit and an explanation was provided for all transactions.
3. [UMass Lowell] understands the importance of minimizing its tax burden while also utilizing its resources efficiently. The total unrecovered sales tax found in this audit was approximately $1,400. In addition, while the University is generally exempt from paying Massachusetts sales tax on purchases, that may not be the case in some other states. Each state’s laws determine what organizations are exempt from its own sales tax. A reminder about the University’s sales tax exemption will be communicated to cardholders and the Bank Card Standard will be reviewed and if necessary updated. . . .
4. To capture all trip related expenses in one place for the reviewer, travel authorization numbers were recorded in the finance system along with trip related bank card transactions instead of on a receipt or bank statement. The new expense system captures travel-related information, including, but not limited to, expenses, receipts and travel authorizations. As a result, the Bank Card Standard will be updated to reflect the new protocols.

Auditor’s Reply

We commend the UMass system for implementing a new expense system for all UMass campuses and for ensuring that it will include a mandatory field for documenting the business purpose for each bank card transaction. We note that this new system is being implemented by the UMass system, and the weaknesses identified in this audit occurred independently at UMass Lowell. The new system may still be vulnerable to management and control weaknesses, such as the ones we identified, that occur at the level of each individual UMass campus.

We acknowledge that we ultimately determined the bank card transactions in our sample to be appropriate business purchases. However, this was not known by UMass Lowell. It is also possible that this issue occurred with transactions outside our sample. To determine whether the transactions in our sample were for appropriate business purchases, we requested that UMass Lowell management reach out to cardholders and their supervisors for clarification, because the necessary information was not captured on the receipts. Not capturing the full business purpose (when not self-evident) of each transaction on the receipt is a violation of the UMass Bank Card Use Standard and increases the risk that this information is not retained when employees leave UMass Lowell. It also increases the risk of fraud and financial loss if non–business-related transactions have occurred and not been detected by UMass Lowell.

We also acknowledge that the total dollar amount of unrecovered state sales tax found in our sample of transactions was approximately $1,400. However, the UMass Bank Card Use Standard is clear in assigning responsibility to the cardholder for obtaining a refund in the event that state sales tax is charged and considered exempt, no matter how minimal the dollar amount. In its response, UMass Lowell mentioned that it is generally exempt from paying sales tax, depending on the state. However, out of the eight transactions in our sample that were charged sales tax, seven transactions were charged Massachusetts sales tax and were never refunded by the vendor. The one remaining transaction involved a vendor address within New York, which is a tax-exempt state, based on the information that the Office of the President of the UMass system posts on its website. Therefore, all eight transactions should have had their sales taxes refunded to UMass Lowell by the vendor. The fact that our sample revealed transactions with unrecovered sales taxes means that the total population of 19,556 bank card transactions likely contains other transactions with unrecovered sales taxes of varying amounts. We commend the UMass system for planning to issue a reminder about its sales tax exemption to cardholders and for reviewing and updating the UMass Bank Card Use Standard, as necessary.

We also acknowledge that the travel authorization numbers from our sample were recorded in the finance system instead of the bank statements and receipts. However, referencing the travel authorization number on the bank statements and receipts is required by the UMass Bank Card Use Standard. If the expectation is for staff members to record travel authorization numbers in the finance system, rather than on bank statements and receipts, then the UMass Bank Card Use Standard should be updated to reflect this. The UMass Bank Card Use Standard was updated at least twice (first on September 20, 2022, and then again on June 1, 2023) after our audit period, and it still requires that travel authorization numbers be referenced on bank statements and receipts. We commend the UMass system for planning to update the UMass Bank Card Use Standard to reflect the new protocols but note that the management and control weaknesses referenced in this audit occurred at the level of an individual university, which did not comply with policies. The changes in computer systems and policies at a central level may therefore not resolve these issues, as they must be addressed, in this instance, by UMass Lowell itself.

Based on its response, the UMass system is taking measures to address our concerns by implementing new systems and policies, but we urge UMass Lowell to fully implement our recommendations, as they relate to issues found at the level of the university, not the entire UMass system.

12.   Some of these 47 transactions had one or more instances of missing information on their corresponding receipts. In total, there were 62 instances of missing information.

Date published:	April 19, 2024