Finding 1
Formal responsibility for oversight of the CPCP has not been established. Recommendation 1
We recommend that responsibility for oversight of the CPCP be formally established. Specifically, we recommend that GAD and other appropriate State agencies enter into a formal memorandum of understanding to establish areas of formal responsibility and authority over the various CPCP functions, including payment and procurement. These responsibilities should also address the various oversight issues raised elsewhere in this report.
Response 1
The auditor notes that the General Accounting Division has issued a policies and procedures manual on the Corporate Purchasing Card Program. In addition, the Division has established transaction limits for card use. The Division has implemented a statewide block on certain merchant category codes (e.g., liquor stores) to prevent agencies from using the card at certain establishments and the Division has conducted numerous training sessions for agencies. Furthermore, monthly the Division reviews agencies’ purchases on a statewide basis and develops a listing of questionable purchases and follows up with the respective state agency to determine the propriety of these purchases. The Division conducts, to the extent permitted by available resources, reviews of the corporate purchasing card program at state agencies and makes recommendations for improvement. The Division also issues one check each month to the bank for all corporate credit card purchases and allocates the charges to the respective state agencies’ appropriation accounts.
In addition, the Corporate Purchasing Card Program Steering Committee has been in existence since the inception of the program. Members include representatives from the General
Accounting Division, the Board of Public Works and the University of Maryland Systems. The committee meets on a monthly basis. At the inception of the Program a representative from the Department of General Services attended the meetings. When the DGS assigned representative retired, the Department did not assign a replacement to attend the meetings. We will again request participation from the Department of General Services. In addition, we will request that a representative from the Department of Budget and Management attend the meetings.
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
policy and procedures manual clearly states that state procurement regulations (COMAR Title 21) must be followed. Therefore, the formal responsibility and authority for procurement has remained unchanged. Furthermore, in our opinion the steering committee provides appropriate oversight vehicle for the program.
Finding 2
Agencies are not required to provide any assurance to GAD regarding the validity of monthly CPCP charges.
Recommendation 2
We recommend that GAD require agencies to provide written assurance as to the validity of their monthly CPCP charges.
Response 2
We agree with the auditors’ recommendation and will require a certification from the agencies. This certification will include statements that:
! Cardholder bank statements were reconciled to corresponding activity logs
! Documentation is available for each transaction listed on the cardholder bank statement
! All activity logs are signed by the cardholder and approved by supervisory personnel.
! The vendor was sent a written statement of all disputed items
This certification will be required within 45 days from the cycle end date. Any agency going two months without submitting a certification will have all their cards suspended until they complete this requirement.
Finding 3
Agencies’ purchasing card transactions were often not properly documented and certain transactions appeared to be inappropriate or questionable in nature.
Recommendation 3
We recommend that GAD, in conjunction with the applicable agencies, ensure that the aforementioned transactions are properly resolved, including obtaining reimbursement from employees if appropriate. In addition, we recommend that GAD reiterate to all participating agencies the need to comply with all CPCP Manual documentation guidance,
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
including retaining all components of the Activity Log and complying with procurement regulations.
Response 3
GAD has investigated all of the transactions identified by the auditor with the following results:
! GAD has reviewed the 4 transactions identified by the auditor as being undocumented
from the test selection of 97 transactions and has received documentation for all 4 of the transactions. Additionally, for 7 of the 8 transactions identified as having “incomplete documentation”, the state agencies have supplied GAD with complete documentation (signed log, invoice, etc.). For the one remaining transaction in the amount of $109.79 the Department of Public Safety was unable to locate the invoice.
! GAD has documentation that supports the appropriateness of 31 of the 37 transactions
identified as questionable. Specifically, in the instance of the hotel costs supported by a reservation form, GAD has received an itemized hotel receipt and a conference agenda listing the cardholder as a presenter representing the State of Maryland. Additionally, a transaction in the amount of $1,178.80 by the State Highway Administration was for the purchase of tires for a bi-directional tractor. The auditor also identified a purchase for “golf shirts” by a state university as questionable. Our investigation revealed that these shirts were for employee uniforms. The six remaining transactions with incomplete documentation lacked an approved activity log and in two instances an original invoice.
Table 1
Transactions with Incomplete Documentation
Agency Amount Vendor Purpose
DPSCS1 $227.10 Xpedx Copier paper *
MSU2 $24.55 Giant Food, Inc. Photo development for
program *
MSU $31.50 Deer Park Water Water for office
MSU $16.00 FedEx Package delivery
MSU $2,350.00 Visual Communications Audio visual equipment for
classroom
MSU $256.00 Visual Communications Audio visual equipment for
classroom * Agency unable to locate original invoice
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
! As a result of GAD’s investigation of transactions identified as “split purchases,”
documentation was supplied for 16 of the 27 items supporting them as being legitimate purchases made within COMAR guidelines. Specifically, in the instance where
telephones were purchased by the University of Maryland College Park, the order dates on the invoices show that the transactions are one month apart. In another instance, a review of documentation (monthly billing statement) for two transactions for the University of Maryland at Baltimore reveals that the transactions took place 2 weeks apart.
We are willing to cooperate with the auditors to expand the investigation, if necessary, to resolve this issue to the auditor’s satisfaction. In the event that further investigation reveals that any of these charges are inappropriate, GAD will take the necessary action including the suspension of the cards in question.
Review of the Activity Log is a part of our Agency Review process. Section 11.04 of the CPC manual clearly states: “The Activity Log may be recreated electronically, however, all current wording and signatures must be retained.” We will re-emphasize the current manual
documentation requirements as recommended and the CPC manual revision will reiterate the importance and necessity of the using the Activity Log as a control tool.
Finding 4
GAD’s oversight of CPCP use was not sufficiently comprehensive to ensure guidelines are followed by user agencies.
Recommendation 4
We recommend that GAD establish a formal enforcement process to help ensure significant deficiencies are corrected. This process should include sanctions, such as possible
termination of CPCP participation. We also recommend that GAD implement an agency review schedule based on a documented risk analysis and consider expanding the number of reviews performed. Finally, we recommend that GAD modify the existing CPCP review procedures to include all critical internal control components.
Response 4
Most of the problems detected by our limited review program were related to incomplete activity logs and failure to obtain signatures. When necessary, GAD senior management did meet with senior agency personnel to re-enforce the policies stated in the Comptroller’s Corporate
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
Purchasing Card Manual. GAD will terminate individual cards and if necessary state agencies from the program in the event that there is fraud or the agency refuses to take corrective action. The Division relies primarily on agency audits performed by the Office of Legislative Audits and on the internal audit staff of large state agencies. GAD’s program review is limited by the availability of existing staff (currently one full time and one part time employee for program administration and audits). Since the larger state agencies normally have a sufficient number of employees for separation of duties and have on-going internal audit programs, we did not include them in the initial group of agencies to be reviewed. The Corporate Purchasing Card Program does not have an internal audit staff to review all components of internal control nor do we possess the expertise required to develop an in-depth risk analysis for conducting reviews. Therefore, our reviews to date have focused almost entirely on the propriety of the agency
purchases; however, we will include the critical components of internal control identified by the auditor in our review program. Additionally, we are requesting the auditor’s assistance in developing the aforementioned risk analysis. At the present time, based on current staffing, we do not believe it is possible to expand the number of reviews.
Finding 5
Guidance contained in the CPCP Manual was often not comprehensive. Recommendation 5
We recommend that GAD modify the CPCP Manual, with input from other agencies (such as the Department of General Services), to provide participating agencies with specific guidance on all critical facets of the CPCP. For example, the Manual should include guidance on how agencies should reconcile card vendor data and account for equipment purchases.
Response 5
The specific guidance on all critical facets of the CPCP are included in the CPCP manual. The manual also contains a detailed series of procedures for record keeping and the reconciliation of activity logs with card statements, approvals by supervisory personnel, and reconciliations required by both the PCPA and the agency Fiscal Officer. These procedures include a detailed series of instructions that requires the cardholder, PCPA and Fiscal Officer to reconcile all transactions, each month.
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
21.05.07.06G. In this regard, Section 1.03 of the CPCP manual clearly states, “…nothing in this policy and/or procedures is intended to replace current policy and/or procedures defined
under the Code of MarylandRegulations (COMAR) or USM Policies and Procedures.”
Equipment purchases made with the Corporate Purchasing Card are no different from
equipment purchases made by check, except for the payment method. Furthermore, GAD does provide additional guidance in the Accounting Procedures Manual for equipment purchases. According to General Inventory Controls included in the Department of General Services (DGS) Inventory Manual (section II.01General Inventory Controls) “each agency is vested with
responsibility for the control, care, and maintenance and security of all State property within its organization regardless of value”. In addition, “systems used for controlling inventory will vary among agencies and may even vary within an agency”.
We do not disagree that the Corporate Purchasing Card Manual can be improved. Therefore, we will include the text of the aforementioned DGS Inventory Manual in the next CPCP manual revision.
Finding 6
GAD did not ensure the propriety of the annual rebate paid under the current contract. Recommendation 6
We recommend that GAD establish procedures to ensure the annual rebate payment made by the card vendor is accurate in accordance with the terms of the contract.
Response 6
We concur that the reconciliation for the 2001-2002 period was not performed completely. While there were certain preliminary calculations performed, when the rebate check exceeded those calculations by $28,000, no further action was taken.
The rebate timeframe was not specified in the contract and subsequently the bank calculated the rebate amount based on monthly purchases versus GAD’s calculation on a billing cycle basis. Conversations with the bank were conducted and it was decided that future rebate payments would be calculated based on payments made to the Bank for 12 billing cycles. This allows for an easier reconciliation by the state.
The rebate for the 2002-2003 period was reconciled immediately upon receipt. In the future, GAD will attempt to verify the rebate figures for the ‘Piggyback’ agencies.
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
Finding 7
Statewide CPCP information was not available to procurement agencies to achieve more cost efficient purchases.
Recommendation 7
We recommend that GAD provide comprehensive statewide CPCP usage and procurement information to those State agencies responsible for the centralized procurement of goods and services (for example, DGS, DBM). This would enable those agencies to identify opportunities for more efficient and economical card usage.
Response 7
We negotiated, at no additional costs to the state, that the purchasing card vendor provide customized database interfaces with the University of Maryland System and that PC software be made available for additional reporting required by the University System. Two years of
purchasing card data is available to the University of Maryland System from the purchasing card vendor using the vendor’s automated system.
Additionally, the General Accounting Division has maintained, since the inception of the program, monthly electronic purchasing card transaction files for subsequent audit or use by any state agency. We will advise state control agencies concerning the availability of
information in the statewide purchasing card transaction files that could be used by their agencies. We will respond to any requests to develop additional reports, which will benefit all state procurement personnel.
Finding 8
Managing for Results data did not adequately measure CPCP performance. Recommendation 8
We recommend that GAD take the necessary actions to ensure the accurate reporting of performance measures related to the CPCP. In addition, we recommend that GAD reevaluate its measures to help ensure that they sufficiently align with CPCP’s primary objectives.
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
Response 8
The Division concurs with the finding that the Managing for Results data contained errors for the reporting periods identified. The Division will alter the computer program that creates the report to account for the higher spending limits (i.e. $5,000) used by the University System of Maryland. The reporting mechanisms that capture the “total vendor payment transactions eligible for card use” will be revised in order to identify the
transactions that are eligible at each specific spending level (i.e. $2,500 and $5,000). In response to the specific observations made by the auditor:
! We believe the performance measurements established by the Division are appropriate;
however, we will review the current categories to determine if there are additional performance measurements we can include in our report. One of the performance measures used is the dollar amount of corporate charge card purchases. As previously noted, this dollar amount is the basis of the rebate calculation.
! Since purchase orders are not required for Category I Small Procurements, it is not
possible to accurately state how many purchase orders have been eliminated through the use of the Corporate Purchasing Card. In addition, there have been no late payments to state vendors when the corporate purchasing card is used.
! With regard to the elimination of personnel, it is our opinion that it is unrealistic to
consistently measure this attribute since themajority of personnel reductions or re-
assignments would have taken place in the early years of the program.
Finding 9
Opportunities exist to maximize State agency purchasing card usage.
Recommendation 9
We recommend that GAD, in conjunction with the Board of Public Works and centralized procurement agencies (including the Judiciary), determine the feasibility of expanding program use, including using the cards to pay recurring transactions. Decisions to expand use should consider the related risks (such as the effectiveness of internal controls).
Comptroller of Maryland
Corporate Purchasing Card Program
June 2002 – May 2003
Response 9
While GAD has periodically reviewed transaction data to determine why agencies did not make payments with the Corporate Card (e.g. tax reporting, purchase orders outstanding, limited personnel assigned cards) we will conduct a review of agencies with card use under 30%. Additionally, both under the previous card vendor and the current card vendor, the Account Manager visits agencies in order to expand business through the sharing of best practices ideas, including way to grow the agencies CPC programs.
Previous attempts to expand card use for utility payments were unsuccessful (i.e., the vendor was not willing to pay a fee). However, GAD will work with state operating and control agencies to define and develop new vendor or procurement category reports using data from both the Corporate Purchasing Card and R*STARS databases. We believe the program can only be expanded at the vendor level if there is an agency consolidated payment cost allocation process, a willingness of the vendor to accept card payment and incur card fees and the agency is
prepared to adjust all purchasing transactions which might have been entered into their encumbrance or purchase order system. This expansion, if feasible, would require numerous changes to computer systems and business processes and additional administrative costs to maintain purchase card limits by vendor. Furthermore, preliminary discussions with the bank
indicate that the rebate on large purchases would not be as great as on small purchases.
In addition, a management review team assembled by the Comptroller recommended higher purchasing card transaction limits and we are currently working with the Procurement Advisory Council and the Board of Public Works on this issue.
GAD has made numerous attempts to increase the participation of state agencies in the CPC program. Specifically, the Judiciary was contacted no less than eleven times, including a total of three letters from Comptrollers Goldstein and Swann. In addition, GAD has arranged for three Purchasing Card overview presentations to staff members of the Judiciary (the last was April 2002).
A
UDITT
EAM Edward L. Shulder, CPAAudit Manager Thomas J. Dagley
Senior Auditor
Sharon V. Carrington