Loading...
HomeMy WebLinkAbout2021-8 Munis Purchasing topics-Part III PCards report (Final 5-25-21 )County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 County accounting system (MUNIS) purchasing topics Part III – Procurement cards To request this information in an alternate format, please call (541) 330-4674 or send email to David.Givans@Deschutes.org Deschutes County, Oregon David Givans, CPA, CIA Deschutes County Internal Auditor 1300 NW Wall St Bend, OR 97703 541-330-4674 David.Givans@deschutes.org Audit committee members: Daryl Parrish, Chair - Public member Jodi Burch – Public Member Tom Linhares - Public member Scott Reich - Public member Summer Sears – Public member Stan Turel - Public member Patti Adair, County Commissioner Nancy Blankenship, County Clerk Nick Lelack, Community Development Director Take a survey by clicking HERE County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 TABLE OF CONTENTS: HIGHLIGHTS 1. INTRODUCTION 1.1. Background on the Audit …………..…………….………………………………………. 1 1.2. Objectives and Scope ……………….……..…………….…………….……..………… 1-2 1.3. Methodology ………………………………….………….…………………………..……… 2-3 1.4. Background on procurement cards …………….…………………….……..…… 3-7 2. FINDINGS and OBSERVATIONS 2.1. Procurement card observations and findings ………………..………….… 7-15 3. MANAGEMENT RESPONSE 3.1. Finance …………………………………………..……………..……….…………..... 16-17 County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 HIGHLIGHTS Why this audit was performed: The County transitioned to a new integrated accounting and human resource system. What was recommended: Recommendations include: • establishing some quality assurance practices for supporting documentation; • updating policies and procedures to assure adherence to the delegated purchasing authority; • cardholders entering invoice/receipt numbers to help prevent duplicate payments; • clarifying use and issuance of P-Cards; and • suggested policy improvements. Part III - Procurement Cards The focus of this audit work is on purchasing topics for the County accounting system (Tyler Munis). The procurement card (P-Card) work entails review of setup and usage of procurement cards. Procurement cards have seen increased usage since implementation in 2017. For the calendar year 2020, there was $1.3 million transacted with P-Cards over 2,595 transactions. What was found During the audit, it was observed the backup documentation received to support procurement card charges could be improved. A random sample indicated approximately seven percent (7%) of transactions do not have adequate backup documentation. A potential conflict exists between procurement card limits established and purchasing authority limits set for department heads and their managers. There were a number of observations with procurement cards suggesting some policy and procedure improvements. Those included improvements addressing: • potential duplicate payments; • issuance of P-Cards; • use of P-Cards; • use of larger dollar P-Cards; and • additional banking controls that can be established on P-Cards. Analysis of 2020 P-Card transactions was performed using Benford’s Law to identify if the leading digits of the transactions follow the expected frequency distribution. No issues were noted. Deschutes County Internal Audit County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 1 1. Introduction 1.1 BACKGROUND ON THE AUDIT Audit Authority: The Deschutes County Audit Committee authorized the review of purchasing topics for the County Accounting system (Tyler Munis) with the FY 21 internal audit workplan. Purchasing topics will include procurement cards, new procurement workflows, and other adopted technology with the new accounting system. The overall topic was divided up due to the complexity of the topic and to release findings in a timelier manner. The first report issued in this series was on security and approval workflows (report #19/20-9) and the second report on vendor master file (report #20/21-6). This audit report is on procurement cards and handling with the Munis system. It would be beneficial to review in report #1 the background on the Munis accounting system. This report focuses on procurement card controls and administration. Additional anticipated report topics to be released from this work based on the audit objectives below will include: 1) Purchasing analyses 1.2 OBJECTIVES and SCOPE “Audit objectives” define the goals of the audit. Objectives included: (addressed in prior report or carried over to future report) 1) (Report #19/20-9) Assess and evaluate the security roles and approval workflows established for processing purchases through Munis. 2) Assess and evaluate risks to the vendor master file. The vendor master file manages who and how payments are made to vendors. a) (Report #20/21-6) Changes and associated support b) (Report #19/02-9) Segregation of duties and access 3) Assess and evaluate the use of County issued procurement cards. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 2 The audit work occurred during the COVID-19 pandemic. Additional impacts from pandemic noted with this symbol. 4) (Future report) Analyze purchases in a number of areas, including a) Effectiveness of approvals b) Duplicates search c) Use of discounts d) Whether transactions have been split to avoid proper approvals or purchasing requirements e) Benford’s analysis – identifies unusual disbursement amounts. 5) Be aware of any issues with compliance with federal and state regulations and requirements, as may be applicable. Scope and timing: The overall audit commenced in March 2020. The work was interrupted by a pressing audit request from the Board of County Commissioners and Budget committee. Work re-commenced in September 2020. Work on procurement cards occurred in February and March 2021with data through January 2021. The work on procurement cards did not include other store credit cards used by the County. The scope of the audit did not include all aspects of internal controls employed. The accounting system is only partly represented in Munis as there are numerous other internal control systems in place at the County including administrative, budgetary, and legal. 1.3 METHODOLOGY “Audit procedures are created to address the audit objectives” Audit procedures relevant to the reported topics in this report include: • Interviewing staff related to accounting system questions. • Reviewing associated accounting system documentation • Analyze background information on procurement cards within Munis • Analyses of procurement cards and associated settings. • Analyses for duplicates between P-Cards and invoices. • Benford’s law analysis of P-Card transactions for 2020 County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 3 • Review of backup documentation to support procurement card purchases. o Utilized a random sample of sixty-four transactions to assess whether the provided backup documentation supported the underlying transaction. o Transactions were taken from calendar year 2020. o The random sample represented 2.5% of the P-Card transactions. The sample size was calculated using a confidence level of 95%, 10% precision and with a tolerable error of 3%. This would allow two exceptions in the sample size of sixty-four. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. (2018 Revision of Government Auditing Standards, issued by the Comptroller General of the United States.) The County Internal Auditor was created by the Deschutes County Code as an independent office conducting performance audits to provide information and recommendations for improvement. 1.4 BACKGROUND ON PROCUREMENT CARDS The County started using P- Cards in 2017 Procurement cards (P-Cards or purchasing cards) are a procurement tool (credit card) that increases efficiency in the purchasing process; reduces administrative costs; and improves financial and managerial control. The County started using P-Cards in 2017 after much discussion. It streamlines and simplifies the purchasing and accounts payable functions by eliminating waste and low value activities, ultimately, reducing transaction costs, and improving vendor relations. The P-Card is a tool that facilitates the timely acquisition of materials, automates data transactions for accounting purposes, supports travel services and offers flexible controls to help ensure proper usage. P-Cards are not intended to avoid or bypass appropriate procurement procedures and controls, but rather, County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 4 TABLE I P-Card information and transactions for 2020 to complement the existing processes available. The County has a Purchasing Card Policy (F-3) governing the use of P-Cards. P-Cards are distributed across County departments and rely on established policy, procedure, and financial practices. All P-Cards have monthly transaction limits requested from departments and approved by Finance in consultation with the County Administrator. Since late 2019, all P-Cards provide the County a 1.5% rebate on purchases. It is up to cardholders to assure that supporting documentation is included with the electronic transactions. P-Card transactions are imported and reconciled within Munis. Munis allows supporting information and documentation to be attached to each individual charge. Individually submitted charges go through an approval process. Note: Monthly transactions are slightly different than the P-Card monthly cutoff periods. Finance has a $300 thousand P-Card that is dedicated to making payments on selected vendor invoices (after the payment has been approved through the Munis approval process) in order to County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 5 As of January 2021, there were 45 active P-Cards. GRAPH I Trend in P-Card transaction monthly amounts. obtain a rebate (see prior report). Information Technology has a $100 thousand P-Card dedicated to making purchases for County and departmental computer needs. As of January 2021, there were forty-five active P-Cards. P-Cards are used by a number of departments for various types of costs including capital purchases and client services. Prohibited uses of the P-Card include: a) fuel; b) cash; c) alcohol, tobacco, firearms, and casinos; d) personal items; and e) meals while on travel. For the calendar year 2020, there were $1.3 million transacted with P-Cards over 2,595 transactions. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 6 GRAPH II Calendar 2020 P-Card spending and composition by fund. Solid waste’s spending is primarily from Finance’s payment of approved solid waste hauler fees with the Finance A/P card. Benford’s Law analysis A test using Benford’s Law was performed for the 2020 P-Card transaction data to identify if the leading digits of the transactions follow the expected frequency distribution. It assumes the transaction amounts are random. Use of this analysis may identify unusual statistical anomalies in amounts for further investigation. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 7 GRAPH III Benford’s Law analysis on first digit of 2020 P- Card transaction amounts Overall, there was fairly close adherence to the expected distribution. Digit “7” was a little out of range and after review was due to a high incidence of payments of the same amount from the Clerk’s Office for election postage. Those are transactions explained by recurrent and expected payment values within the data. Therefore, the disbursements are not entirely random. No unusual activity was identified when reviewed at a high level. 2. Findings and Observations The audit included limited procedures to understand the systems of internal control around procurement cards. No significant deficiencies were found in this audit. A significant deficiency is defined as an internal control deficiency that could adversely affect the entity’s ability to initiate, record, process, and report financial data consistent with the assertions of management in the financial statements. The findings noted were primarily compliance and efficiency matters. Audit findings result from incidents of non-compliance with stated procedures and/or departures from prudent operation. The findings are, by nature, subjective. The audit disclosed certain policies, procedures and practices that could be improved. The audit was neither designed nor County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 8 intended to be a detailed study of every relevant system, procedure or transaction. Accordingly, the opportunities for improvement presented in the report may not be all-inclusive of areas where improvement may be needed and does not replace efforts needed to design an effective system of internal control. 2.1 PROCUREMENT CARD OBSERVATIONS AND FINDINGS Backup documentation supporting procurement card charges could be improved. At its most core level, the County wants adequate support in the form of attaching backup documentation (i.e. receipts, invoices, receiving documents, etc...) for all procurement card charges. A review of a sample of procurement card transactions and associated supporting receipts and documentation indicated (with 95% confidence) that 93% percent of the submitted costs were adequately supported. Observing seven percent (7%) that were not adequately supported was within expectations of the sample. Finding even some charges that were entered, approved, and paid without sufficient and adequate documentation is something meriting improvement. The one minor charge that was inadequately documented appeared to have an incorrect invoice attached. There did not appear to be adequate support in the system to warrant approval. This particular audit test did not necessarily look at the nature of the expenditure but to the adequacy of the support. The exception appeared to be viable County expenditure. County Purchasing Card Policy F-3 requires that cardholders are responsible for ensuring that each purchase is appropriate and in compliance with County purchasing rules and this policy, and maintaining proper documentation. Furthermore, Policy F-15 – County Policy for Payments to County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 9 Suppliers, indicates that all payments for goods or services are properly documented. Proper documentation such as a receipt, identifies the value transferred and usually includes who, what, where, when and how. For example, a purchase of a supply might identify employee X purchased a case of paper, from Amazon, on 12/20/2020 (10am), with their procurement card ending in 1234. Better yet is if the documentation indicates more about why it was purchased and that the services or goods were accepted or delivered by the County. The County’s Munis accounting system provides an electronic storage system for transaction support. Such systems provide a way to prepare, record, transfer, index, store, preserve and retrieve records. Much of this support is electronically imaged hardcopy documents. Reasonable controls should exist to ensure the integrity, accuracy, and reliability of the electronic storage systems. This should also include inspection and a quality assurance program evidencing regular evaluation of the electronic storage system. Information retained should provide adequate support for the associated accounting entry. The noted documentation exception could and should have been identified in the approval process. Any error speaks a bit to not periodically testing the support in the accounting system as well as to setting expectations for cardholders and approvers of the adequacy of supporting documentation. Though there was only one exception of relatively low dollar amount, the support problem could persist across the spectrum of charges. It is recommended Finance (with the guidance of Internal Audit) establish some quality assurance practices for supporting documentation in the Munis system. It is recommended Finance set expectations and train cardholders and approvers on adequate financial documentation for Munis. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 10 TABLE I Deschutes County purchasing authority levels Potential conflict exists between procurement card limits established and purchasing authority limits. Currently there are a number of procurement cards (as indicated in Table I) that have an ability to exceed purchasing authority limits set for department heads and their managers. • One department head has authority greater than their purchasing authority, • Two managers have purchasing authority greater than that allowed under delegation, • Two staff have purchasing authority greater than that allowed under delegation, and • One contracted staff person has authority greater than that allowed under delegation. The Purchasing Card Policy F-3 is silent on purchasing limits and their relationship to purchasing with P-Cards. It is well understood that with procurement cards, purchases can be made in one or more transactions up to the monthly limit. The policy is clear that the cards are not to be used to avoid existing purchasing rules and processes. The Payments to Suppliers policy (F-15) provides the policy for purchasing authority levels at the County. These include: Level Authority Delegation Department head (except for Health Services) Up to $25,000 Up to $10,000 to managers Health Services Department Head Up to $50,000 Up to $15,000 to managers* County Administrator $150,000 Up to $10,000 to managers Board of County Commissioners Over $150,000 See above * By County resolution 2017-009 Since procurement cards have been issued with no daily limit and some with monthly limits in County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 11 Impacts on policy seen during pandemic excess of the above authorities, there is potential for overspending the authority provided. The initial P-Card limit is usually $3,000 but some are requested above this level. Policy does not indicate what acceptable limits are and how they dovetail with purchasing authority. It is worthwhile to note that due to the COVID 19 pandemic there are spending limits that have been adjusted to accommodate emergency purchases. These include purchase of freezers to hold the COVID vaccines as well as providing housing for people who tested positive and needed to quarantine. The 2020 procurement card transactions identified that were over the employee’s delegated authority received appropriate approvals in Munis workflows. Without coordination of procurement card limits and spending authority at the transaction level, it is possible that purchases can be made in excess of the associated purchasing authority provided. It is recommended Finance update policies and procedures to assure adherence to the delegated purchasing authority. This might include changes to policy, altering P-Card limits, or modifying Munis processing. Observations with procurement cards suggest some policy and procedure improvements. The audit included review of the Purchasing Card Policy (F-3) as well as numerous analyses. The following are some of the areas with suggestions for improvement, including: DUPLICATE PAYMENTS A couple of invoices were identified as paid by normal means and by P-Card. In most of the cases, the vendor or staff identified the duplicate and were able to get a credit for the County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 12 Impact on policy seen during pandemic duplication. On entering P-Card transactions staff do not generally include the underlying invoice/reference number. The transactions identified were relatively minor in dollar amount and frequency. It is recommended for cardholders to enter in invoice/receipt numbers to help prevent duplicate payments. ISSUANCE OF P-CARDS Finance handles the issuance of P-Cards at the request of departments. • There are a couple of employees that have more than one procurement card assigned to them. Finance has the extra AP-Card assigned to the Chief Financial Officer. And one department uses the two P-Cards for various staff needing them. The P-Card policy should address these circumstances. • A contracted employee was assigned a procurement card and at a level above most Department heads signing authority. This contracted employee has certain pandemic response duties that require them to extend services and goods to those during the pandemic. The procurement card policy and supporting forms are written to only apply to employees. {In February 2021 the monthly spending limit on this card was reduced to a manager’s level.} • A number of departments are having cardholders share their cards with other employees. In discussion with the Bank, their preference is to have only the cardholder use the P-Card. The forms developed by Finance and not the policy indicate a cardholder can let another employee use their P-Card. If the County allows non-cardholders to make purchases, the purchaser should clearly be identified in the documentation. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 13 It is recommended the policy clarify whether an employee can have more than one P-Card assigned to them; whether other employees can use the P-Card; and whether non- employees can be provided a P-Card. LARGE DOLLAR PAYMENT P-CARDS Finance has issued a $300 thousand and a $100 thousand monthly limit P-Cards to Finance and Information Technology, for the primary purposes of making payments on large purchases or vendor balances for departments. These transactions (prior to payment) have been approved in workflow by departments. By using workflow, the specific department approvals support the underlying transactions. These cards are intended to be used only after workflow approval. As noted in the prior report, the use of P-Cards to make these payments is to obtain the benefit of a 1.5% rebate on P-Card purchases. For Finance’s P-Card, the name on the card did not agree with the cardholder and the cardholder is also the approver on the card. The cardholder and approver should never be the same and the approver should not be a subordinate to the cardholder. Both Finance P- Cards are also being used for departmental purchases. The policy is silent on Finance’s ability to issue P-Cards of this magnitude. It is recommended for the policy to address deployment of these high-dollar P-Cards and procedures and controls over their usage. ADDITIONAL POLICY RECOMMENDATIONS The following policy improvements were identified during the audit to help clarify expectations for staff and development of procedures and forms to manage the P-Cards, including: 1. Indicate the anticipated approach to monthly and daily P-Card limits (as well as special County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 14 requests for raising limits). a. Some cards appear to have exceeded their monthly transaction limits. It might be the limit was raised, but if so, the limit change made in the banking system was not also made to the Munis system. Finance should periodically monitor adherence to the limits established; 2. Provide for an expiration of all P-Cards; 3. The County’s bank can prevent P-Card purchases from identified Merchant Category Codes (MCC). This is an additional safeguard to prevent potential inappropriate transactions. The audit did not identify any inappropriate transactions. By limiting transactions by MCC Codes, transactions with these specific codes would not be processed. Consider disallowing transactions with particular types of MCC codes, such as a. drinking places (5813), b. dating and escort services (7273), c. massage parlors (7297), d. betting (7995), e. amusement parks (7996),, f. fines (9222) g. bail and bond payments (9223), or h. tax payments (9311). Note: P-Cards are already limited from being used to obtain cash. 4. Use the policy document to clarify expectations for good supporting documentation for uploading to the Munis system. Some of the additional areas to improve documentation include: a. Include invoice numbers, delivery address (and associated receipt acknowledgement), who received the goods or services, and detail any room taxes paid. b. When goods are delivered they should only be delivered to County locations. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 15 Support should indicate delivery location, if applicable. c. Restaurant receipts should be the detailed receipt (not the charge copy) and include the details of what was purchased, who was at the meal, and what the business purpose was. d. establishing separate accountability for purchases of gift cards, prepaid cards, phone minute cards, and phones; e. When a vendor account is created for purchases, the County should have access to the account and password for any purchase follow-up. This assures that any refunds or changes are credited back to the County. 5. Include in the policy what the responsibilities of the cardholder means to the cardholder’s credit standing. 6. Address in the policy the usage restrictions (such as during scheduled employee hours) when a P-Card is used by a non-exempt employee. Noticed that P-Cards are sometimes used on weekends or even after normal hours. Currently, it is difficult to know who makes purchases when cardholders let others use them. Non-exempt personnel should not be using the P-Card outside of their normal scheduled hours as it could potentially result in additional compensation. 7. Address when a P-Card should be revoked due to little or no activity. There were two P-Cards without transaction activity in 2020. This may not be a problem as P-Cards can be issued for emergency use. Cards with eighteen months of inactivity should be considered for closure. 8. In rare circumstances, if a receipt is lost and under a certain amount, a lost receipt form may be used with the approval of a supervisor. It is recommended for the County to consider the suggested policy improvements (1-8) in an updated policy and any associated changes to procedures. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 16 3. Management response Finance Department Greg Munn, Treasurer and Chief Financial Officer DATE: 5/21/2021 TO: David Givans, County Internal Auditor FROM: Greg Munn, Treasurer and Chief Financial Officer CC: Tom Anderson, County Administrator SUBJECT: Response to Munis Purchasing Audit, Part III – Procurement Cards Report #2021-8 _____________________________________________________________________________________________________________________________ 1. It is recommended Finance (with the guidance of Internal Audit) establish some quality assurance practices for supporting documentation in the Munis system. Agreed. The use of purchase cards, the related policy and procedures are relatively new to the County. After several years’ experience with purchase cards and the increase in their usage over the last year we have learned much. It is time to review our experience, compare it to policy and best practices and make adjustments where necessary. Finance will start a work group, including the Internal Auditor, to review the existing policy and procedures and make a recommendation for revisions. 2. It is recommended Finance set expectations and train cardholders and approvers on adequate financial documentation for Munis. Agreed. This will be part of the process identified in the response to item #1 above. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 17 Finance Department (continued) 3. It is recommended Finance update policies and procedures to assure adherence to the delegated purchasing authority. This might include changes to policy, altering P-Card limits, or modifying Munis processing. Agreed. This will be part of the process identified in the response to item #1 above. 4. It is recommended for cardholders to enter in invoice/receipt numbers to help prevent duplicate payments. Agreed. This will be part of the process identified in the response to item #1 above. 5. It is recommended the policy clarify whether an employee can have more than one P-Card assigned to them; whether other employees can use the P-Card; and whether non-employees can be provided a P- Card. Agreed. This will be part of the process identified in the response to item #1 above. 6. It is recommended for the policy to address deployment of these high-dollar P-Cards and procedures and controls over their usage. Agreed. This will be part of the process identified in the response to item #1 above. 7. It is recommended for the County to consider the suggested policy improvements (1-8) in an updated policy and any associated changes to procedures. Agreed. This will be part of the process identified in the response to item #1 above. County accounting system (MUNIS) purchasing topics: Part III – Procurement cards report #2021-8 May 2021 Page 18 {End of Report} Please take a survey on this report by clicking on the attached link: https://www.surveymonkey.com/r/PCard_2021-8 If you would like to receive future reports and information from Internal Audit or know someone else who might like to receive our updates, sign up at http://bit.ly/DCInternalAudit.