ARCHIVED - Audit of Acquisition Card Transactions - 2008-09: Executive summary
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
This report presents the findings of the National Research Council (NRC) Canada audit of Acquisition Card Transactions – 2008-09. The decision to conduct the audit was approved by the President following the recommendation of the Audit, Evaluation and Risk Management Committee on March 19, 2008 as part of the NRC 2008-09 to 2010-2012 Risk Based Internal Audit Plan. Expenditures in 2008-09 made for goods and services purchased by acquisition cards were $12.9 million.
Audit objective, scope and methodology
The audit objective is to provide assurance that NRC is compliant with the Government of Canada and NRC acquisition card policies and directives. The audit was conducted between January and September 2009 and examined acquisition card transactions recorded during the 2008-09 fiscal year, as well as NRC’s overall management control framework related to the use of acquisition cards.
The scope of the audit included a detailed review of a randomly selected sample of 50 acquisition card transactions from five institutes/branches/programs (IBPs). The individual IBPs were selected for detailed testing upon risk and control analyses performed during the planning stage of the audit as well as on the basis to ensure that no one IBP is audited more so than others or conversely that smaller entities are ignored entirely in NRC’s multiyear audit cycle, and finally to ensure coverage across NRC’s different sectors. A review of the entire population of NRC acquisition card transactions was also undertaken, through the use of data mining audit techniques and analyses, to identify trends and NRC-wide implications for compliance and acquisition card management. Data mining audit techniques resulted in the review of an additional 30 acquisition card transactions for the appropriateness of purchases, evidence of contract splitting, etc.
The audit was conducted using a series of detailed audit criteria that addressed the audit objective against which we drew our observations, assessments and conclusions. These audit criteria were derived primarily from, but not limited to, the Financial Administration Act (FAA), the Treasury Board Policy on Acquisition Cards, and the related Acquisition Cards Program – Management Guide, as well as NRC policy and directives.
Audit Opinion and Statement of Assurance
Within the limitations of the samples drawn and the audit procedures performed we conclude that overall the application of Government of Canada and NRC policies and directives pertaining to acquisition cards are adequate in that most areas of practice / process are in compliance but there are some opportunities for improvementFootnote 1. Significant improvements were observed over the previous audit conducted for 2006-07 transactions, including improvements made with respect to FAA Section 32 approvals and procedures and aspects of FAA Section 34 verification as well as increased monitoring activities undertaken by Finance Branch. Opportunities for improvement include periodically assessing the adequacy of cardholder acquisition card limits and realizing potential cost efficiencies that may be incurred by increased use of acquisition cards for small dollar value purchases.
In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence has been gathered to support the accuracy of the conclusions reached and contained in this report. The conclusions were based on a comparison of the situations, as they existed at the time of the audit, against the audit criteria. The evidence was gathered in accordance with the Treasury Board Policy, directives and Standards on Internal Audit, and the procedures used to meet the professional standards of the Institute of Internal AuditorsFootnote 2.
Conclusion and recommendations
We observed significant improvements made with respect to FAA Section 32 approvals and procedures and aspects of FAA Section 34 verification since our last audit for 2006-07 transactions. For FAA Section 32 the audit team did not note any case of non-compliance for 2008-09. NRC Finance Branch has reinforced through training and communications the requirement that all acquisition card transactions have to be authorized by budget holders, i.e., managers or individuals that have been allocated funds and have been delegated financial signing authority. For FAA Section 34 we did not note any cases of non-compliance with NRC’s “Financial Signing Authorities” document, nor did we note any instances where acquisition cardholders performed certification for their own transactions. We noted varying practices among the different IBPs with regard to FAA Section 34 post-verification and certification. In accordance with NRC’s Financial Signing Authorities document, these procedures were performed by invoice clerks or other designates of budget holders in three of the five IBPs examined. In the other IBPs they were performed by the originating budget holders which, in our opinion, is a process that presents fewer risks for inappropriate expenditures.
We observed that acquisition cards are not always cancelled in a timely manner for employees that are struck off strength. For all employees that were struck off strength during fiscal year 2008-09, for example, there were three former employees (20 percent or 3 of 15 cases) who did not have their cards cancelled until several months had passed. However, in all three cases it was verified that no purchases had been made by them subsequent to their termination of employment. Improvements to the monitoring system were implemented in June 2009.
Since the beginning of fiscal year 2009-10 the newly established Financial Monitoring Division (FMD) within NRC Finance Branch has been actively monitoring acquisition card transactions and has started the process of periodically presenting reports to management with detailed findings and based on them providing additional guidance and training to IBPs.
Current processes followed by NRC do not include formal periodic assessments of the need for acquisition cards or their expenditure limits. Limiting credit cards to what is actually needed represents a best practice in the financial services sector for controlling inherent risks associated with them. An analysis of NRC transactions for fiscal year 2008-09 suggests that there may not be a need for all of the acquisition cards currently active at NRC and that monthly spending limits for individual cards may in some cases be too high.
As it was observed for the 2006-2007 internal audit of acquisition cards, a large number of small dollar value goods and services were purchased using traditional contract procurement methods rather than using acquisition cards. Thus potential opportunities to realize cost efficiencies may be missed.
1. NRC Finance Branch should clarify its policies and procedures for acquisition card purchases so that they are clearly understood and consistently followed by all IBPs, particularly in regard to FAA Section 34 post-verification and certification procedures.
NRC Management Response:
NRC Finance Branch had changed its policy on acquisition cards in June 2008 to require only budget holders with budgetary responsibilities to approve FAA Section 34 on acquisition card transactions. Subsequent to further analysis, the introduction of financial monitoring, and consistent with most other purchases at NRC, NRC Finance Branch accepted the practice of having specified officers with delegated financial signing authority who are not necessarily budget holders approve acquisition card transactions, but the stated policy had not been appropriately updated. NRC Finance Branch will clarify the policies and procedures surrounding acquisition card purchases to properly communicate expectations.
As recognized in the findings, all acquisition card purchases were appropriately approved for FAA Section 32 and 34 by individuals holding financial authority to do so, and in accordance with the NRC Financial Signing Authorities matrix. Since all transactions must be authorized by budget holders and signed off by the cardholder on a “Section 34 Report”, it is appropriate that FAA Section 34 can be assigned to designated support staff (i.e. Administrative Coordinators and Invoice Clerks) who ensure that the approved goods or services were received in good order before FAA Section 34 sign off. Some IBP’s have taken advantage of this delegation based on their business processes.
The NRC Accounts Payable group reviews all acquisition card transactions to ensure that they are approved for FAA Section 34 as well as verified and signed off by the cardholder. A proper segregation of duties is maintained as the card holder can never also sign for FAA Section 34. With the requirement to have the responsibility centre manager (including IBP Administrative Coordinators) approve the purchases, the current NRC policy is in compliance with FAA requirements and TB Policy as they relate to purchases with acquisition cards. This ensures that acquisition card transactions have a verifiable trail to the responsibility centre manager.
In addition, the Financial Monitoring Division, through the use of statistical sampling and data mining techniques, reviews acquisition card purchases, individual deviations are followed up on, and reports presented to management.
2. NRC Finance Branch should consider a comprehensive review of the frequency and materiality of acquisition card use by individual card holders at NRC, and, in consultation with budget centre managers, re-assess the need for infrequently used cards and / or the appropriateness of the credit limits.
NRC Management Response:
We agree with the recommendation. A yearly request to IBPs by the NRC Acquisition Card Coordinator (or designate) will be made requesting confirmation of cards outstanding and associated credit limits. This procedure will be included in the Financial Dashboard by March 2010.
3. With the goal of achieving greater cost efficiencies, NRC Finance Branch in consultation with NRC Administrative Services and Property Management Branch (ASPM), should continue to explore options that would stimulate greater use of acquisition cards for lower dollar value transactions while maintaining appropriate controls to mitigate assessed risks.
NRC Management Response:
We agree with the recommendation. In 2009, Finance Branch and ASPM have been analyzing the use of acquisition cards and opportunities to increase its usage. An NRC Purchase Order Spend analysis was made in May 2009, and BMO Financial Group performed a Spend Analytics and Opportunity Identification analysis in October and November 2009 to identify NRC opportunities to increase card spend. Results are being analyzed and the larger opportunities being pursued on an ongoing basis.
Jayne Hinchliff-Milne, CMA, Chief Audit Executive
NRC Audit Team MemberFootnote 3:
Irina Nikolova, F.C.C.A, CIA, CISA
Appendix: Potential Overall Ratings
Management Attention Required – Significant issues exist that require management’s attention.
Needs Improvement – some areas of practices / processes are in compliance with Government of Canada and NRC policies and directives pertaining to acquisition cards but many deficiencies exist.
Adequate – most of the areas of practices / processes are in compliance with Government of Canada and NRC policies and directives pertaining to acquisition cards but there are opportunities for improvement.
Strong – all areas of practices / processes are in compliance with Government of Canada and NRC policies and directives pertaining to acquisition cards. No areas for improvement were identified.
Return to footnote 1 source See Appendix for the list of potential overall ratings.
Return to footnote 2 source Although this Audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing, NRC Internal Audit has not undergone an external assessment at least once in the past five years as required.
Return to footnote 3 source The NRC Audit team was supplemented by a team of experienced auditors that were contracted to assist in conducting the audit work.
Report a problem or mistake on this page
- Date modified: