Audit of Acquisition Cards

1. Introduction

1.1. Background

Government acquisition cards (GACs) are credit cards used by federal employees to buy approved low-value goods and services for government business. They are issued under contractual arrangements between selected card issuers and the Government of Canada and have been used across government since 1991 as a convenient way to reduce the administrative burden and costs associated with traditional procurement and payment processes.

The management and administration of acquisition cards is governed by the Treasury Board (TB) Policy on Financial Management and the TB Directive on Payments, which set out requirements for establishing management practices and internal controls that support the responsible, secure, and economical use of the cards. The Receiver General Government of Canada acquisition card program guide also provides departments with comprehensive guidance on control standards across the card life cycle, from issuance and use to monitoring and cancellation.

While acquisition cards are encouraged for authorized purchases where operationally feasible and secure, they remain a procurement tool. This means that purchases must follow contracting policies and the proper exercise of financial authorities under the Financial Administration Act (FAA). In practice, acquisition card purchases must be appropriately authorized, supported, certified by an individual with delegated authority, reviewed for payment, and recorded in a way that supports monitoring and oversight. These requirements are supported by the TB Directive on Delegation of Spending and Financial Authorities, as well as the TB Directive on the Management of Procurement, which establishes reporting and oversight expectations for acquisition card transactions.

Acquisition cards usage at Environment and Climate Change Canada (ECCC)

ECCC has used the National Bank of Canada as its acquisition card issuer since 2021. In FY 2025 to 2026, the department had over 1,440 cardholders and recorded 58,149 transactions totaling approximately $46.2 million. The top four branches by transaction value were the Science and Technology Branch ($19.7 million), Meteorological Service of Canada ($8,4 million), Canadian Wildlife Service ($7.4 million), and the Corporate Service and Finance Branch ($4.5 million).

Acquisition cards represent a key procurement and financial mechanism, subject to ongoing scrutiny and analysis as part of exercising appropriate fiscal responsibility and stewardship over public funds. Their use carries a degree of inherent risks such as errors, misuse, or fraud, as cardholders are provided with credit cards to purchase goods and services. The management and use of acquisition cards at ECCC have not been subject to internal audit or review in over 10 years, and this topic was identified as a priority through the 2025 to 2030 risk-based audit planning exercise.

1.2. About the audit

Objective: The objective of the audit was to provide assurance that controls over acquisition cards support their effective management and compliance with applicable legislation and relevant policies.

Scope and methodology: The audit focused on governance, risk management, and internal control activities for the full life cycle of acquisition cards, including activities from card issuance to ongoing use (transaction approval, processing, and recording), card suspension/cancellation, as well as cross-cutting activities like monitoring, quality assurance, and safeguarding.

The audit methodology included:

• a detailed review of supporting documentation such as Acts, policy instruments, guides, procedures, process narratives, flowcharts, and departmental communications
• interviews and walkthroughs with key stakeholders
• data analytics on the full population of 58,149 transactions between January 1, 2025, and January 31, 2026, and 1,735 (open and closed) cardholder files using bank and internal ECCC data to identify higher-risk transactions and inform the sampling approach
• tests of operating effectiveness on a representative stratified random sample of 271 transactions, complemented with targeted testing of an additional 125 higher risk or flagged transactions, and a review of supporting evidence

The audit covered the period from January 1, 2025, to January 31, 2026, and included a review of other relevant documents preceding this timeframe, as appropriate.

The detailed audit criteria can be found in Appendix A.

Statement of conformance

The audit conforms to the Global Internal Audit Standards, as supported by the results of the quality assurance and improvement program.

2. Audit findings, recommendations, and management responses

2.1. Governance and controls framework over acquisition cards

The audit expected to find a governance and control framework in place to support the effective management of acquisition cards. This included defined roles and responsibilities, policies and procedures, training, guidance and tools, as well as controls to support appropriate card issuance, use, safeguarding, and cancellation.

Governance and organization

The Chief Financial Officer (CFO) and Assistant Deputy Minister (ADM), Corporate Services and Finance Branch (CSFB), is responsible for the overall management and administration of acquisition cards. This includes ensuring that a system of internal controls is in place and operating to manage risks and support compliance with applicable policies and legislation.

The GAC Centre of Expertise, within the Procurement, Accounting and Controls Directorate, supports the CFO by coordinating the day-to-day management of acquisition cards. This includes issuing and cancelling cards, providing training and support to cardholders and managers, ensuring timely payments to the card issuer, and monitoring card use. Other CSFB functions also support the card lifecycle through account verification quality assurance, advice on GAC procurement practices, and ongoing monitoring of internal controls.

Internal controls over acquisition cards are part of ECCC's broader Internal Controls over Financial Management (ICFM) Framework, which includes acquisition cards as one of the business processes in scope. The framework uses the three lines of defense model to describe how control responsibilities are shared across the department.

In practical terms, the first line includes the individuals and functions that apply controls as part of day-to-day operations. For acquisition cards, this includes cardholders, managers and delegated individuals who are responsible for using cards appropriately, obtaining required approvals, safeguarding cards, maintaining supporting documentation, reconciling monthly transactions, and certifying transactions in accordance with delegated authorities. Certain CSFB activities may also operate as first-line controls when they involve day-to-day card administration, account verification or payment processing, such as activities performed by the GAC Centre of Expertise.

The second line includes management functions that support oversight of risk management, compliance, quality assurance and internal controls. For acquisition cards, this includes CSFB functions that assess, monitor or support the operation of controls, such as the Internal Controls team and Quality Assurance teams. These functions support management oversight but remain part of management. The third line is internal audit, which provides independent assurance on governance, risk management and controls.

Risk-informed acquisition card management

The audit found that the governance and control framework supports ongoing oversight and risk-informed management of acquisition cards. CSFB uses information from cardholder records, transaction activity, quality assurance results and monitoring activities to identify where controls, limits or cardholder access may need to be adjusted.

During the audit CSFB was implementing several control improvements, beginning in December 2025. These included reviewing the cardholder population, reducing the number of cardholders where there was no longer a demonstrated operational requirement, revising transaction and monthly limits based on planned use and operational needs, increasing the level of delegation required for requesting issuance of new cards and acquisition card certification under Section 34 to the Director level and above, and implementing updated departmental guidance and related templates.

These actions are consistent with a risk-informed approach to managing the department’s overall exposure associated with acquisition card use. The audit noted that the total monthly credit available across open acquisition cards decreased from approximately $29.9 million as of March 31, 2025, to approximately $19.0 million as of May 1, 2026, a reduction of about 36%. This reduction supports better alignment of card access and available credit with operational need and risk.

Policies, procedures, guidance and tools are in place

The audit found that ECCC has established policies, procedures, guidance and tools to support the management and use of acquisition cards. The departmental Directive on Acquisition Cards defines roles and responsibilities for the CFO, the departmental acquisition card coordinator, delegated authorities, managers and cardholders. The directive and related procedures set out requirements for card issuance, use, safeguarding, reconciliation, account verification, payment, suspension and cancellation.

Supporting guidance and tools are also available to help cardholders and managers fulfill their responsibilities. These include departmental procedures on acquisition cards, guidance on the proper use of GACs, critical supporting documentation requirements, monthly reconciliation instructions, training requirements, and access to the GAC Centre of Expertise for questions and support.

Training is available, but coverage is limited

ECCC has developed training and awareness activities to support cardholders and managers in fulfilling their acquisition card responsibilities. These include the GAC workshop for new cardholders, Green Procurement training, SAP-related training, guidance on proper GAC use, instructions for submitting GAC account packages, the acquisition card intranet page and quarterly awareness communications.

However, formal GAC training had not been completed broadly across the active cardholder population during the period reviewed. The GAC workshop is mandatory for new cardholders before card issuance but has not been required for cardholders before 2023. Based on the training records reviewed, approximately 14% of active cardholders had completed the GAC training.

This matters because many acquisition card controls rely on cardholders and managers knowing when GAC use is appropriate, what approvals and supporting documentation are required, how to safeguard the card, and how to complete reconciliation and FAA Section 34 certification requirements. Limited training coverage increases the risk that requirements are applied inconsistently.

Lifecycle controls have not been fully updated or tested

Over time, ECCC has updated policies, procedures, guidance, templates and processes related to acquisition cards. The management of acquisition cards also depends on related functions and processes, including procurement, financial delegation, account verification, human resources and employee departures.

The audit team’s walkthroughs noted examples of well-designed preventive controls across key points of the card lifecycle. Before a card is issued, application and declaration forms document the manager’s confirmation of operational need and planned use, completion of required training, and the cardholder’s acknowledgement of responsibilities and consequences for non-compliance. During card use, controls include transaction and monthly limits, restrictions on authorized and unauthorized purchases, and bank settings that block certain merchant categories, such as cash advances, travel and other restricted transaction types. When employees leave the department, CSFB’s employee departure process supports timely notification to the GAC Centre of Expertise for card return, suspension or cancellation.

However, the overall internal control documentation for acquisition card business activity has not been fully refreshed to reflect the current operating environment. This includes control narratives, process maps, flowcharts and control matrices that identify key controls, control owners, control objectives, related risks and hand-offs across the acquisition card lifecycle. As a result, there was no consolidated view that readily demonstrates how key lifecycle controls are intended to operate from card issuance to cancellation. This limits visibility over whether controls remain aligned with current requirements, systems, roles and processes.

The audit also found that the full set of acquisition card lifecycle controls has not been periodically tested to confirm whether controls operate as intended, except for controls related to the expenditure management portion of GAC transactions. These expenditure management controls are tested and monitored on an ongoing basis through the Purchases, Payments and Payables business process and account verification quality assurance activities. This creates a gap in periodic testing coverage for controls outside transaction-level expenditure management, including cardholder eligibility, operational need, card issuance, safeguarding, inactive cards, and timely cancellation.

For example, the issuance process relies on delegated managers to confirm that employees are eligible and have an operational need for an acquisition card before a request is submitted. The GAC Centre of Expertise processes card requests based on the information provided and does not independently verify all underlying eligibility requirements. As a result, if these requirements were not properly validated by the Section 34 manager at the time of request, this may not be detected through the current issuance process. Audit testing of 11 new card requests confirmed that the sampled cardholders were active ECCC employees. However, this did not provide assurance that all eligibility requirements, such as employment duration for term employees, or the operational need for each card, had been consistently assessed and documented. This illustrates the need for periodic testing of acquisition card controls beyond expenditure management quality assurance.

A review of active cardholder profiles generated through the bank platform also found that, while most cards had merchant category restrictions activated to block unauthorized purchases, 22 cards did not have all required restrictions configured. This indicates that the control is well designed, but its effectiveness depends on consistent manual configuration and periodic verification.

The audit further noted that, unlike employee departures, internal moves within the department do not automatically trigger notification to the GAC Centre of Expertise. Instead, the process relies on Section 34 managers advising the Centre when a cardholder changes position, branch, manager or cost center. As a result, internal moves may not consistently trigger a reassessment of the cardholder’s continued operational need, card limits, cost center, delegated manager or coding information. This matters because outdated cardholder information may weaken oversight of card activity. Transactions may be charged to the wrong cost center, require additional follow-up or correcting entries, and create unnecessary administrative effort. It may also reduce visibility for the appropriate manager, increasing the risk that transactions are not reviewed or addressed in a timely manner.

Periodic review, update and testing of the acquisition cards controls is important to confirm that controls remain current, clearly documented and operating as intended. This is particularly important in a shared-control environment where responsibilities are distributed across cardholders, managers, delegated individuals and CSFB functions.

2.2. Compliance with acquisition card policies and procedures

The audit expected acquisition card transactions to comply with applicable legislative and policy requirements, including authorization, certification, and appropriate use.

Cardholders and Section 34 managers requirements

Cardholders are required to use acquisition cards in accordance with Treasury Board and departmental requirements. This includes respecting transaction limits, restrictions on the types of goods and services that may be purchased, and the requirement to obtain and document appropriate pre-approval and FAA Section 32 commitment authority, where applicable, before making a purchase.

Responsibility Centre Managers are responsible for reviewing acquisition card transactions and certifying, under FAA Section 34, that the goods or services were received, the transaction is valid, and the required supporting documentation is available. Each month, cardholders are expected to reconcile their credit card statements against expenditures recorded in SAP and submit their credit card activity report, FAA Section 34 certification, National Bank of Canada statement and supporting documentation to the GAC Centre of Expertise within 20 working days of the statement date.

Departmental guidance outlines authorized and unauthorized uses of acquisition cards, including restrictions on certain types of purchases. Additional supporting documentation or approvals are required for sensitive or restricted transactions, such as awards, membership fees, hospitality, training, events, and gifts for First Nations, Inuit or Métis, and other purchases requiring specific pre-approval.

GAC Centre of Expertise verifications

As the payment authority for GAC transactions under FAA Section 33, the GAC Centre of Expertise is expected to verify that monthly GAC statements are certified by an individual with valid delegated authority. The GAC Centre of Expertise is also responsible for reviewing GAC transactions that fall under higher-risk or sensitive expenditure types, and for ensuring timely payments to the card issuer.

Testing results

The audit tested 396 acquisition card transactions, including 271 transactions selected through a representative sample and 125 targeted transactions selected based on higher-risk or flagged characteristics identified through data analysis.

Testing found that several key controls were operating as expected, as shown below.

Overall, transaction-level exceptions were limited. Audit testing identified 16 transactions where the file did not clearly demonstrate that acquisition card requirements had been fully met. These included missing invoices or supporting documentation, missing pre-approval or exception approval, purchases that were not clearly supported under departmental guidance, and purchases where additional procurement or payment-method documentation would have been expected.

These exceptions are primarily related to cardholders and Section 34 managers’ responsibilities for ensuring that purchases are appropriate, authorized and supported. The audit team reported these exceptions to the GAC Centre of Expertise for tracking and corrective action, as needed.

CSFB’s recent control improvements are expected to help reduce similar exceptions over time by strengthening cardholders and delegating managers’ compliance. Because many sampled transactions occurred before these improvements were implemented, or before they had time to take effect, their impact is not fully reflected in the audit testing results. However, the results remain relevant because they identify areas where continued attention, follow-up and monitoring are warranted.

2.3. Monitoring the use of acquisition cards

The audit expected to find that monitoring, quality assurance and reporting activities over the use of acquisition cards were in place, performed consistently, and used to support timely corrective measures and the ongoing improvement of internal controls.

ECCC monitors acquisition card transactions through a combination of expenditure management quality assurance and account verification, and GAC-specific monitoring activities. These activities are intended to confirm that transactions are valid, accurate, properly authorized and supported, and that key controls related to expenditure initiation, FAA Section 32 commitment authority, transaction authority, and FAA Section 34 certification are properly and consistently performed.

ECCC has established a risk-based Quality Assurance Plan on Expenditure Management, approved annually by the CFO. The plan identifies the risk level of different types of payments, the level of quality assurance and verification responsibilities for individuals with delegated payment authority under FAA Section 33, and the sampling approach. GAC transactions are included as one stream within this broader expenditure management quality assurance process.

The Quality Assurance Plan distinguishes between regular GAC transactions and higher-risk or sensitive transactions paid using a GAC. Regular GAC transactions over $50 and under $10,000 are subject to quarterly statistical sampling review. When a GAC is used to pay for transactions that fall under higher-risk or sensitive expenditure types, these transactions are subject to full review by the GAC Centre of Expertise.

In addition, the ECCC Guideline for Strengthening Financial Stewardship over Spending and FAA Section 34 Authorities establishes GAC-specific monitoring activities for low- and medium-risk GAC transactions. This includes monthly verification using criteria such as selected dollar patterns, potential contract splitting, and other suspicious transactions. Errors identified through these activities are expected to be included in the corrective measures process.

To support follow-up when non-compliance is identified, the guideline sets out how financial errors identified through FAA Section 33 quality assurance reviews and related monitoring activities are to be managed, monitored, reported and escalated. The process includes progressive corrective measures based on the severity and recurrence of non-compliance, such as awareness communications, targeted training, notification to line executives, management action plans, and restriction or suspension of delegated authorities where warranted.

Quality Assurance activities generally supported corrective measures

The audit found that monitoring, quarterly quality assurance and reporting activities over GAC transactions were performed during the period under scope. Results were analyzed and communicated, and errors identified through these reviews were followed up through the corrective measures process. These included awareness emails, targeted training, and escalation measures as appropriate.

The audit also found that the GAC Centre of Expertise performs monthly monitoring for potential contract splitting. Review of monitoring records confirmed that this activity was carried out throughout the period under review. Transactions identified through this process are reviewed, and where indicators of risk are noted, cardholders are contacted to obtain explanations or supporting information. Confirmed errors are tracked and followed up for corrective action.

The audit team was also informed of instances where monitoring activities led to corrective measures. For example, where transactions raised concerns, including potential contract splitting, follow up with the responsible groups was done to clarify the issue and support corrective action. In some cases, cards were suspended until cardholders completed additional training.

Established monitoring activities and recent measures taken by CSFB provide important oversight over acquisition card transactions, particularly given that acquisition card use at ECCC is material, high volume and decentralized. They also indicate that CSFB has taken steps to monitor acquisition card use, follow up on identified issues, and strengthen controls where needed. The departmental escalation process provides a structured and progressive approach for addressing non-compliance; however, its effectiveness depends on timely detection, sufficient monitoring coverage, consistent review practices, and corrective measures that remain proportionate to the nature and risk of the issue.

Opportunities to strengthen risk-based monitoring

While monitoring activities are in place, the current approach could be strengthened to provide broader risk-based visibility over acquisition card use. Current monthly monitoring includes potential contract splitting. However, audit testing identified transaction-level exceptions that were generally related to missing support, missing approvals, purchases not clearly supported under departmental guidance, or purchases where additional procurement or payment-method documentation would have been expected. These types of exceptions indicate that monitoring could be expanded and systematized to include other higher-risk transaction patterns, such as unusual merchant activity, repeated purchases from the same vendor over longer periods, trends that may indicate recurring documentation or approval issues, or purchases that may require other procurement mechanisms.

Given the breadth of ECCC’s activities and the diversity of cardholder profiles, acquisition card use carries inherent risks that go beyond standard indicators such as dollar value. Although acquisition cards are a payment method, they must still be used in accordance with applicable government and departmental directives, policies, authorities and practices.

For example, a team may use an acquisition card to purchase low-value equipment or materials that support site operations, but that may also create ongoing stewardship and life-cycle management considerations such as tracking, maintenance, servicing, replacement or disposal. A team may also use an acquisition card to purchase authorized services that could involve obligations normally addressed through a formal contractual arrangement with appropriate terms and conditions. Enhanced risk-based monitoring could help identify these types of transactions for further review and reduce the risk that related liabilities or obligations are not appropriately identified, managed or supported.

Other transaction patterns may also warrant review. For example, repeated purchases of similar supplies or equipment across laboratories or branches could indicate an opportunity for a planned procurement approach, while payments to organizations that also receive departmental transfer payments could be used as a risk indicator to identify potential overlap, duplication or procurement-method issues. These examples do not indicate non-compliance on their own; rather, they illustrate the types of inherent risks that more tailored monitoring could help identify for further review, guidance or follow-up.

The GAC Centre of Expertise has begun exploring broader transaction analyses, including by merchant and type of purchase. However, these activities were not yet part of a systematic and sustainable monitoring approach. The department has access to timely transaction information and analytical and reporting capabilities through the National Bank of Canada (NBC) platform, as well as internal ECCC data sources. These capabilities could be more fully leveraged to support risk-based monitoring, including analysis by merchant, cardholder, branch, transaction type, credit limit, and unusual spending patterns. Better use of NBC reporting, combined with internal ECCC data, would help identify trends, anomalies and potential non-compliance more efficiently and support more targeted follow-up.

Given the volume, value and decentralized nature of GAC activity, better use of available transaction data, reporting tools, analytics and, where appropriate, AI-enabled tools would help broaden monitoring coverage, prioritize higher-risk transactions for review, reduce reliance on manual review, and support timelier identification of patterns, anomalies, emerging risks and corrective action.

3. Conclusion

Overall, the audit concluded that controls over acquisition cards generally support their effective management and compliance with applicable legislation and relevant policies. ECCC has established roles and responsibilities, policies, procedures, guidance and tools, and CSFB has used available information to support risk-informed adjustments to card access, limits and related controls.

However, opportunities remain to strengthen the consistency, visibility and ongoing effectiveness of controls across the acquisition card lifecycle. Lifecycle control documentation and testing have not been fully refreshed, training coverage for existing cardholders was limited, available transaction data and reporting tools were not yet being used systematically to support broader risk-based monitoring. Audit testing also identified a limited number of some transaction files where the nature, rationale, approval or appropriateness of purchases was not clearly demonstrated.

CSFB has recently implemented measures to strengthen acquisition card management, including updates to guidance, cardholder limits, approval requirements and the cardholder population. While these measures are consistent with a risk-informed approach, their impact could not yet be fully assessed through audit testing.

Strengthening lifecycle control documentation and testing, reinforcing training, reviewing exceptions identified through audit testing, and making better use of available transaction data and reporting tools would support more consistent application of requirements, timelier identification of compliance issues, more targeted corrective action, and continued financial stewardship over acquisition card management.

4. Appendix A - Audit criteria