2. Follow-Up Review of the Procurement Card Process Audit (Sep. 2020) ABSTRACT
Significant improvements to the p-card expense
approval and reporting processes have further
safeguarded about $5 million in resources. In
addition, enhanced monitoring procedures
"`✓' r facilitate compliance with procurement
1 regulations and cost effectiveness.
�r Internal Audit Department
City Auditor
AUDIT OF PROCUREMENT Madison Rorschach, CIA, CGAP
Audit Staff
CARD PROCESS NeerajSama, MBA
Follow-Up Report
I,,""
Y
DENTON
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Table of Contents
Follow-Up at a Glance..........................................................................................................................3
Introduction.........................................................................................................................................4
ManagementResponsibility.....................................................................................................................4
Audit Objectives, Scope, and Methodology..............................................................................................4
RecommendationStatus Update .........................................................................................................5
Compliance with Procurement Regulations .............................................................................................5
Excessive Number of Cards.......................................................................................................................7
SupervisoryApprovals ..............................................................................................................................8
P-Card Administration...............................................................................................................................9
Internal Controls Weaknesses................................................................................................................10
Needfor Training....................................................................................................................................11
Opportunityfor Savings..........................................................................................................................11
N
v
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Follow-Up at a Glance
Why we did this Follow-Up:
This report is intended to provide information on what changes have been made in response to the
Procurement Card Process audit issued in August 2019.The original audit reviewed controls over about
$6 million in procurement card transactions.This follow-up was included on the City's Fiscal Year 2019-
20 Audit Plan as approved by the City Council.
What we Found:
The Purchasing Division has significantly improved the p-card review and approval process through the
implementation of a p-card expense reporting system. In addition,significant monitoring improvements
have been made that further ensure compliance with procurement regulations and that the City is
receiving the best value for commodities.The status of each recommendation is summarized below:
Recommendation Mgmt. Response Status
1. Monitor p-card purchases for compliance with
procurement regulations. Concur Implemented
2. Educate dept. personnel about procurement
Concur Implemented
regulations.
3. Monitor p-card purchases to identify consolidation
Concur Implemented
opportunities.
4. Educate dept. personnel about procurement
Concur Implemented
regulations.
5. Eliminate sparingly used cards. Concur Implemented
6. Look for p-card user consolidation opportunities in
Concur Implemented
departments.
7. Suspend p-cards with unapproved purchases. Concur Implemented
8. Require p-card transactions receipts to be uploaded. Concur Implemented
9. Monitor and enforce the City's p-card procedures. Concur Implemented
10. Prohibit p-card administrators from having p-cards. Concur In Progress
11. Review active cards to determine appropriateness. Concur Implemented
12. Notify Compliance Officer of p-card audit results Concur Implemented
performed by Purchasing staff.
13. Provide p-card training to staff who supervise p-card Concur Implemented
transactions.
14. Evaluate the feasibility of participating in the State's
Partially Concur Implemented
Travel Management Program.
CM
014,
m
DENTON
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Introduction
The Internal Audit Department is responsible for providing: (a) an independent' appraisal of City
operations to ensure policies and procedures are in place and complied with, inclusive of
purchasing and contracting; (b) information that is accurate and reliable; (c) assurance that assets
are properly recorded and safeguarded; (d) assurance that risks are identified and minimized; and
(e) assurance that resources are used economically and efficiently and that the City's objectives
are being achieved.
The Internal Audit Department has completed an audit follow-up of the Procurement Card Process
Audit issued in August 2019. We conducted this follow-up review in accordance with generally
accepted government auditing standards. Those standards require that we plan and perform the
audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit objectives.
Management Responsibility
City management is responsible for ensuring that resources are appropriately managed and used
in compliance with laws and regulations; programs are achieving their objectives, and services are
being provided efficiently, effectively, and economically.
Audit Objectives, Scope, and Methodology
This report is intended to provide a progress update on recommendations from the Procurement
Card Process Audit (August 2019), which reviewed the effectiveness of internal controls over the
City's procurement card program.
Audit fieldwork was conducted during July and August 2020.The scope of review varied depending
on the procedure being performed. The following list summarizes the major procedures
performed:
• Reviewed documentation from the issued audit to develop criteria including industry
standards, best practices, policies, and procedures;
• Examined a sample of 373 p-card transactions from Oct. 2019 through May 2020 to ensure
adequately detailed receipts were attached;2
• Reviewed a judgement sample of 30 transactions to ensure they were approved;
• Compared a list of active cardholders to p-card transactions to review usage;
• Analyzed p-card transactions to determine if monitoring procedures adequately ensured
compliance with procurement regulations, City policy, and City contracts; and
• Interviewed Purchasing staff and reviewed provided documentation.
1 The City of Denton's Internal Audit Department is considered structurally independent as defined by generally accepted government auditing
standard 3.56. bA
2 This sample size provides with 95%confidence that the population mean is within±5%of the sample mean.
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Recommendation Status Update
This report summarizes the Audit of Procurement Card Process's recommendations, management
responses, and the Internal Audit Department's follow-up findings, which describe to what extent City
management has implemented Internal Audit's recommendations since the publication of the original
report (August 2019). The Purchasing Division of the Materials Management Department is generally
responsible for administering the procurement card (p-card) program.' The table below totals p-card
purchases between Oct. 2019 and May 2020 by department:
Table 1: P-Card Transactions by Department (Oct. 2019—May 2020)4
Department Amount Department Amount
Parks& Recreation $467,000 Tech Services $100,000
Water $322,000 Solid Waste $86,000
Electric $320,000 Library $67,000
Wastewater $287,000 Animal Services $53,000
Fire $276,000 Finance $50,000
Public Works $224,000 Materials Management $49,000
Facilities/Airport $182,000 Development Services $42,000
General Government $158,000 Community Services $36,000
Police $148,000 Customer Service $13,000
Total: $2,883,000
Compliance with Procurement Regulations
1. The Purchasing Division needs to satisfy its responsibility of monitoring purchases made by
using P-Cards and enforcing compliance with State procurement statutes.
Management Response: Concur
Improved monitoring effective 10/2018; updating monitoring processes in accordance with audit.
Audit Follow-Up Finding: Implemented
In order to safeguard municipal funds,Texas law requires different bidding requirements at differing
levels of purchases.5 These requirements are generally summarized in Table 2,though there are some
exceptions outlined in Texas Local Government Code Section 252.022.
Table 2:Texas Procurement Regulation Summary
• Invite competitive sealed bidding
More than $50,000 Award a contract to the lowest responsible bidder
• Attempt to acquire at least three quotes
Between $3,000&$50,000 9 Contact at least two historically underutilized businesses (HUB)
Up to$3,000 • None
3 Procurement Cards—or p-cards—are typically used by organizations to expedite the procurement process for small purchases by granting
employees the authority and ability to make purchases immediately.
4 Transaction totals are rounded to the nearest thousand dollars.
v
S Texas Local Government Code prohibits the use of"separate,sequential,or component purchases'as a means of avoiding bidding
requirements.
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
The City has contracted with Card Integrity to monitor p-card transactions for compliance with Texas
procurement regulations. This contractor provides monthly reports to Purchasing's Compliance
Officer that identifies purchases with the same commodity category or vendor that cumulatively
exceeds $50,000. A similar report is provided for employees who exceed their single transaction
thresholds; the single transaction limit for about 94 percent of the City's cardholders is $3,000.
Using p-card transaction data from Jan. 2020 through May 2020, only about 7 percent of transaction
value did not appear to comply with procurement law as shown in Table 3. This is a significant
improvement from what was reported in the original audit.
To address these compliance issues, cumulative spending trends are reviewed with departments
annually to identify instances where competitive bids or quotes are needed. In addition, all
noncompliant single purchases were appropriately addressed with a P-Card Misuse Warning from
Procurement.
Table 3: Summary of Noncompliant Transactions (Jan. 2020—May. 2020)
Procurement Compliance Test Noncompliant Value
Cumulative Spend Exceeded $50,000 $0.00
Cumulative Spend Exceeded $3,000 $115,548.24
Single Transaction Exceeded $3,000 $10,561.12
Noncompliant Total: $126,109.36
2. Educate the department personnel responsible for verifying P-Card transactions regarding
their duty for and information to verify compliance with procurement regulations.
Management Response: Concur
Training materials revised 10/2018 for new cardholders and approvers; will update in accordance
with audit;Additional training will be completed as new P-Card system is implemented—Q4 FY 18/19.
Audit Follow-Up Finding: Implemented
The Purchasing Division has provided monthly trainings to p-card users and approvers that appears
to include information about procurement regulation thresholds. The training makes it clear that
compliance with these laws is the responsibility of the cardholders. In addition, the Procurement &
Compliance Director distributed an email to all City staff that instructs employees to review the City's
online contracts list when making purchases.
The P-Card manual requires p-card users and approvers to attend training every 24 months.
3. The Purchasing Division needs to work with departments for the monitoring of purchases
made on P-Cards and attempt to identify consolidation opportunities to obtain lower prices
through contracting or receiving discounts.
Management Response: Concur
Improved monitoring and training material updates effective 10/2018; updating monitoring
processes in accordance with audit;A new P-Card system will be implemented and additional training
completed—Q4 FY 18/19.
v
nA
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Audit Follow-Up Finding: Implemented
The City's p-card monitoring contractor — Card Integrity — identifies potential consolidation
opportunities similarly to how it monitors for procurement regulation compliance. These
opportunities are reviewed with departments annually to identify instances where purchases could
be consolidated to ensure the City is receiving the best value. The City has entered into several
contracts specifically for p-card purchases since the original audit in an effort to consolidate spending
across the City.These vendors include:
Table 4: Vendor Contracts for P-Card Purchases
Vendor Contract Amount Vendor Contract Amount
Amazon $600,000 Sam's Club $220,000
Lowe's $425,000 Dealers Electrical Supply $200,000
Home Depot $300,000 Grainger $100,000
Likewise,the City spent about$20,600 a month on food during the original audit period (i.e.Jul. 2017
through Jul. 2018). During the follow-up period (Oct. 2019 through May 2020),this average monthly
spending significantly decreased to about$8,500.
4. Educate the department personnel responsible for verifying P-Card transactions regarding
their duty for and information to verify compliance with procurement regulations.
Management Response: Concur
Training materials revised 10/2018 for new cardholders and approvers; Additional training will be
completed as new P-Card system is implemented—Q4 FY 18/19.
Audit Follow-Up Finding: Implemented
See findings regarding Recommendation Two.
Excessive Number of Cards
5. Eliminate sparingly used cards and use other cards available to the respective Departments
for making necessary purchases.
Management Response: Concur
In progress prior to audit; will continue to review utilization and work with departments regularly.
Audit Follow-Up Finding: Implemented
The City currently has 367 active p-cards that have been issued to employees; this is about an 18
percent reduction in cards from the issuance of the original audit. In addition, we found a total of 17
p-cards that had not been used between Oct. 2019 and May 2020 — meaning about 5 percent of
cards may be underutilized. Previously, almost 17 percent of p-cards were considered underutilized.
The departments with underutilized cards are identified in Table 4:
v
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Table 4: Underutilized Cards by Department (Oct. 2019—May 2020)
Department Cards Sparingly Used Total Cards Percent Under Utilized
Engineering Services 1 5 20%
Materials Management 1 5 20%
Police 4 28 14%
Planning 1 10 10%
Wastewater 2 32 6%
Technology Services 2 32 6%
Electric 2 40 5%
Library 1 23 4%
Water 1 27 4%
Fire 1 43 2%
Parks& Recreation 1 47 2%
All Other Departments 0 75 0%
Total: 17 367 5%
6. Look for additional opportunity for consolidation of cards to facilitate better administration
of P-Cards.
Management Response: Concur
In progress prior to audit; will continue to review utilization and work with departments regularly.
Audit Follow-Up Finding: Implemented
Based on our findings from Recommendation Five, the number of underutilized cards has been
significantly reduced since the issuance of the original audit. In addition,opportunities to consolidate
p-cards are presented to departments during an annual procurement meeting. That being said,
Purchasing staff stated that the decision to eliminate or consolidate cards ultimately rests with the
departments' directors.
Supervisory Approvals
7. Suspend P-Cards for which transactions are not approved by the supervisors after giving
adequate warning.
Management Response: Concur
Compliance Officer has the authority to suspend cards effective 10/2018; monitors approvals
monthly and communicates with approvers accordingly.
Audit Follow-Up Finding: Implemented
The Procurement Division has implemented a new p-card expense reporting system called Certify,
which requires all transactions to be entered and approved as illustrated in Figure 1 on the next page.
Of a sample of 30 transactions, all had adequate evidence of approval. In addition, all expense'
transactions on the May 2020 bank statement were recorded in the Certify system; based on this
judgement sample all transactions appear to be reported.
00
6 Some reimbursement transactions were on the bank statement but were not found in Certify.Based on discussions with Procurement&
Compliance management,this is because no receipt is provided.Since the City is receiving money,these transactions are considered low risk
even without a receipt.
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Figure 1: P-Card Approval Process
• ' • • •
Makes purchase -Reconciles p-card
•Uploads trans.receipts reporting system to
•Creates monthly •Reviews trans. bank statement •Posts p-card trans.to
expense report -Approves cardholder financial system
expense report
8. Require employees to upload their receipts in J P Morgan system.
Management Response: Concur
Documentation required in JPMorgan effective 10/2018.
Audit Follow-Up Finding: Implemented
As shown previously, the Certify system requires cardholders to enter an itemized receipt for every
transaction. There is evidence that all 12,127 transactions entered into Certify between Oct. 2019
and May 2020 had a receipt attached. The following table assigns a risk level? to each sample
purchase reviewed based on the adequacy of the uploaded receipt.
Table 5:Adequacy of P-Card Receipts (Oct. 2019—May 2020)
Trans. Risk Level No.of Trans. Trans.Value
High 31 $20,905.16
Medium 4 $1,529.98
Low 338 $79,082.10
Sample Total: 373 $101,517.24
Based on this review,the recommendation appears to be implemented. Nevertheless,the Purchasing
Division should consider providing additional training or communication to cardholders and
approvers on the importance of providing an adequately detailed, itemized receipt.
P-Card Administration
9. The Compliance Officer needs to establish a process for monitoring compliance and enforce
the City's policy for noncompliance with P-Card procedures.
Management Response: Concur
Compliance Officer has the authority to suspend cards effective 10/2018; monitors transactions and
approvals monthly; communicates with cardholders and approvers accordingly.
C)
v
7 Receipts were categorized as high-risk if they did not include an itemized list of the commodities purchased,medium-risk if they were
itemized but did not include detail about the vendor or date of purchase,and low-risk if they were adequately detailed and itemized.
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Audit Follow-Up Finding: Implemented
The City's p-card monitoring contractor — Card Integrity — screens purchases for those that are
prohibited by the City's Procurement Card Manual and reports them to the Compliance Officer
monthly. This monitoring generally identifies the following policy violations:
• Transactions with sales tax;
• Transactions that should be purchased by Technology Services;
• Services that require insurance;
• Transactions seemingly against the City's travel policy; and
• Possible personal transactions like gifts, food, and fuel.
In addition, the P-Card Manual states that p-card misuse or fraud may result in termination of the
cardholder's privileges and additional disciplinary actions. There is evidence that the p-card
program's administrator has issued several P-Card Misuse Warning Memorandums since the
issuance of the original audit.
Internal Controls Weaknesses
10. The P-Card policies and procedures need to be updated prohibiting assigning cards to
individuals responsible for administering the program.
Management Response: Concur
Program administrators no longer have P-Cards.
Audit Follow-Up Finding: In Progress
Based on a review of the P-Card Manual, there is no written policy that prohibits assigning p-cards
to individuals responsible for administering the p-card program. That being said,there are currently
no p-card users with administrative access to the p-card reporting system (i.e. Certify) or the bank
system, indicating that this is prohibited in practice.' Still, the Purchasing Division should update its
P-Card Manual to reflect this.
11. Periodically, the Compliance Officer needs to review active cards to determine
appropriateness and business needs for the charge card accounts.
Management Response: Concur
In progress prior to audit; will continue to review utilization and work with departments regularly.
Audit Follow-Up Finding: Implemented
Based on our findings from Recommendations Five and Six, the City has significantly reduced the
number of active p-cards since the issuance of the original audit. In addition, p-card appropriateness
and business needs are discussed with departments during an annual procurement meeting. That
being said, Purchasing staff stated that the appropriateness and business need for a card are
ultimately the responsibility of the departments' directors.
12. Notify results of audits to the Compliance Officer.
O
v
8 We did find that the current Procurement&Compliance Director had a p-card for a short time due to a reorganization effective July 201h,
2020;however,this p-card has since been canceled. a
The City of Denton Internal Audit Report September 2020
Audit Follow-Up of the Procurement Card Process Audit(August 2019)
Management Response: Concur
As of 10/2018, the Compliance Officer completes the audits; Results provided to Director.
Audit Follow-Up Finding: Implemented
The City's new p-card monitoring contractor — Card Integrity — has begun conducting individual
cardholder audits per the Compliance Officer's direction. The completed audits are then reviewed
and followed-up by the Compliance Officer.
Need for Training
13. Provide training on P-Card policies and procedures to all supervisors who approve P-card
transactions.
Management Response: Concur
All new approvers trained effective-10/18; Additional supervisory training will be completed as new
P-Card system is implemented—Q4 FY 18/19.
Audit Follow-Up Finding: Implemented
As stated in the finding for Recommendation Two, the P-Card Manual requires all City employees
involved in the p-card program—both cardholders and supervisors—to attend p-card training every
24 months. The Purchasing Division was offering monthly, in-person training prior to the COVID-19
Pandemic and has been exploring online training solutions since then.
Opportunity for Savings
14. The Procurement and Compliance Office needs to evaluate feasibility of participating in the
State's travel Management Program.
Management Response: Partially Concur
Opportunities to save on travel expenses will be researched; the state program is likely not a viable
option.
Audit Follow-Up Finding: Implemented
The Purchasing Division has evaluated the feasibility of participating in the State's Travel
Management Program compared to the City's current contracts and Travel Expense Policy and
determined the following for each state contract:9
• Airline—could be utilized for airfare purchases that require an exception to the City's 21-day
advance notice travel policy, assuming they offer the best value;
• State Travel Card—could be utilized in the future, however,the City currently has a bankcard
vendor whose services were solicited via request for proposal;
• Hotel—could be utilized for hotel purchases assuming they are the best value.
• Rental Car—could be utilized for rental car services as its rates includes damage waiver and
liability coverage, which is encouraged by City policy; and
• Travel Agency—could be utilized for international travel assuming it offered the best value.
rl
rl
v
9 It should be noted that the Division had not distributed information to employees about this program and its potential usage as of August 2020.