Audit of Acquisition Cards

On this page

• Executive summary
• Statement of conformance
• 1. Introduction
• 2. Audit details
• 3. Audit results
• 4. Management response
• Appendix A: line of enquiry, accompanying audit criteria and overall results
• Appendix B: audit methodology—sampling technique and description of sample

Executive summary

Audit objective

This audit:

• assessed the design, adequacy and effectiveness of the management control framework for the acquisition card program at the Treasury Board of Canada Secretariat (TBS)
• verifies compliance with the Treasury Board Directive on Payments and the department’s internal policies and procedures related to the use of acquisition cards

The audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

The audit scope included transactions between April 2017 and August 2020, which involved a separate examination for the five-month period when TBS’s Business Continuity Plan (BCP) was in place from March to August 2020.

Main observations

The audit team observed the following:

• although policy instruments and internal controls over the use of acquisition cards are in place for the use of acquisition cards, improvements are required
• testing of a sample of acquisition card transactions shows a significant number of errors and missing or illegible documentation, indicating a need to improve the management and the recording of acquisition card transactions
• the acquisition card process has limited ongoing oversight, monitoring and follow-up

During the audit examination process and throughout the analysis of testing results, the audit team communicated regularly with the auditee to provide early feedback on findings. The department has taken early action to address some of these issues, including issuing instructions on authorizing and overseeing the use of acquisition cards.

Conclusion

Some improvements are required to demonstrate appropriate use of acquisition cards in accordance with Treasury Board policy instruments and departmental guidelines. There is opportunity to:

• increase the accuracy of information
• improve the quality of documentation
• strengthen the oversight of the acquisition card process

Statement of conformance

The Internal Audit and Evaluation Bureau has completed the Audit of Acquisition Cards at TBS. This audit conforms to the International Standards for the Professional Practices of Internal Auditing, as supported by the results of TBS’s quality assurance and improvement program.

1. Introduction

1.1 Description of the audit environment

Acquisition cards provide government departments with a convenient, simplified and practical way to procure and pay for low-dollar-value goods and services while ensuring effective financial controls. They also offer the potential for savings in procurement and expenditure processing costs.

The use of acquisition cards is governed by the Treasury Board Directive on Payments, Appendix B: Standard on Acquisition Card Payments. The Financial Management Directorate, Corporate Services Sector (CSS), is responsible for managing and overseeing the departmental acquisition card program at TBS.

At the time of this audit, the Bank of Montreal (BMO) was the acquisition card service provider for the Government of Canada. Once a month, federal government departments issue a direct payment to BMO that covers all purchases made by cardholders for the department.

1.2 Overview of acquisition card usage at TBS

As at March 31, 2020, TBS had 152 active acquisition cards, including departmental and individual cardholder accounts. Acquisition card purchases represent less than 3% of the department’s total expenditures for goods and services. The usual standard credit limit on an individual’s credit card is set at $25,000 per month, with a spending maximum amount of $10,000 per day and per transaction. Tables 1 and 2 provide details on the number of transactions and amount of spending that occurred using acquisition cards during the periods examined by this audit.

Data source: TBS’s financial management system. All GST and HST payments were excluded.

Acquisition cards are used for the purchase of low-dollar-value goods and services. Table 2 shows the most common items purchased in fiscal year 2018–19 (the most recent fiscal year examined outside the COVID‑19 pandemic period) and during the BCP period of March to August 2020.

Data source: TBS’s financial management system

2. Audit details

2.1 Authority

The Audit of Acquisition Cards was included in TBS’s 2019-2020 Integrated Audit and Evaluation Plan.

2.2 Objectives and scope

An audit of acquisition cards was identified as a priority engagement during the 2019–20 risk-based audit planning exercise. The risk profile of the acquisition card program was assessed by TBS’s Internal Audit and Evaluation Bureau as very high due in part to the decision to close the low-dollar-value contracting program^{Footnote 1} in favour of using the existing acquisition card program. In addition, the acquisition card program at TBS had not been audited since fiscal year 2010–11.

The primary objective of this audit was to:

• assess the design, adequacy and effectiveness of the management control framework for TBS’s acquisition card program
• verify compliance with the Treasury Board Directive on Payments and the department’s internal guidelines, directives and procedures related to the use of acquisition cards

For this objective, the audit scope spanned from April 1, 2017, to March 15, 2020, for testing, review and data analytics.

A second audit objective was to assess the acquisition card program and its responsiveness to address stakeholder needs during the period when TBS activated its BCP from March 16, 2020, to its deactivation on August 21, 2020. For this objective, the audit scope spanned this period for testing, review and data analytics.

The examination work for both objectives was performed by the audit team between March and December 2020.

2.3. Line of enquiry and methodology

An audit plan was written with a two-part line of enquiry and supporting criteria so that information could be systematically gathered, tested, analyzed and concluded upon. The criteria and the auditors’ overall conclusions, with an impact statement for each, appear in Appendix A.

The auditors reviewed documentation, interviewed key stakeholders and tested a sample of acquisition card transactions. Further description of the audit work completed by the auditors to support this overall conclusion is in Appendix B.

3. Audit results

The audit team expected to find processes in place that demonstrate the following:

• acquisition card purchases comply with applicable policy, directives and guidelines
• transactions are appropriately authorized

Acquisition card transaction testing focused on section 32 and section 34 of Financial Administration Act (FAA) approvals.^{Footnote 2} Auditors examined key pieces of information (such as amount, date, fund centre, signature and name of fund centre manager) for accuracy and compliance.

3.1. Overall results

Overall, the audit team concludes that the department is not fully managing the use of its acquisition cards in accordance with Treasury Board policy instruments and its own departmental guidelines and directives. Although processes and practices are in place that respect guidelines and monitor the acquisition card process, the level of error and missing documentation is significant. Improvements are required to ensure a more consistent and effective application of guidelines to:

• improve accuracy and consistency of documentation practices
• strengthen oversight of the acquisition card process

There was an additional audit objective to assess the acquisition card program and its responsiveness to address stakeholder needs during the BCP period. Despite disruptions to established business processes during this time, there were minimal changes to the existing acquisition card program and its controls. A testing of a sample of transactions from this period resulted in findings similar to those of the pre-pandemic period. Interviews conducted with a number of cardholders and fund centre managers identified no issues related to responsiveness of the acquisition card program during this period.

The audit team presented observations, findings and results near the completion of the audit’s examination phase to the management of CSS, the sector responsible for managing the acquisition card program. CSS has already begun to take immediate action to address some of the issues raised in this report, notably, reiterating instructions to acquisition cardholders regarding:

• requirements for managing approvals of section 32 and section 34 of the FAA
• what is to be included in cardholders’ monthly packages of supporting documentation

As well, CSS had already noted that improvements were required for its monitoring activities and, during this audit, updated its Account Verification Framework (AVF). The framework was approved during the reporting phase of this audit.^{Footnote 3} There are also plans to improve the tools available to acquisition card users and managers.

Table 3 shows a high-level summary of the findings of the audit examination process.

3.2 Observations, impacts and root causes

Based on evidence from interviews, document review and testing of transactions, the audit team summarized results into three areas that, in the auditors’ opinion, may be contributing factors or root causes for the results.

3.2.1. Guidance

The audit team observed that the department’s guidance for acquisition cardholders and fund centre managers may, in some circumstances, be insufficient in terms of content and clarity.

Sufficiency of guidance

The audit team confirmed through interviews which policies, directives and guidelines are employed by TBS staff to guide their work. The audit team also asked for descriptions of the process followed to use and manage purchases made with acquisition cards. Although auditors did locate some documents that outline roles or responsibilities, what was available was incomplete or outdated; therefore, they were not a reliable source of information for users.

Clarity of guidance

The auditors referred to the department’s guidance and documentation on file for each transaction pulled for the sample to assess whether the purchases fell within the description of acceptable items. For 9% of the transactions tested in the pre-pandemic period, the auditors were not able to determine their eligibility under existing guidelines.

The auditors did not observe the same issues for the BCP period but did notice an increase in information technology (IT) purchases without documented approval from the department’s IT group in CSS (see Table 2). The audit team noted that additional guidance was provided to management to respond to the sudden shift to a remote working environment, but it was not clear during this time period as to which type of IT purchases were permitted using acquisition cards and what authorizations were required before purchases were made.

The lack of clarity in guidance is further illustrated with the auditors’ testing of FAA section 32 approvals, where there were a notable number of errors and missing documentation. The government-wide Guidelines to Delegating and Applying Spending and Financial Authorities state that section 32 approval should be provided via verbal or written approval before all purchases that are valued at an amount determined by the department, based on risk tolerance. The department’s guideline states that FAA section 32 is required; however, it does not expressly state whether approval needs to be written, which leaves room for interpretation. The audit team subsequently confirmed with CSS that written FAA section 32 approval is required; therefore, any transaction that had missing FAA section 32 documentation was deemed an error by the auditors.

Relevance and flexibility of guidance

Current guidelines and directives provide flexibility for card users to decide what may be purchased with acquisition cards. The TBS Procedure on Acquisition Cards Management has a list of what acquisition cards may not be used for. However, detailed information on what constitutes a business expense is not provided, which allows for interpretation by the cardholder and fund centre manager.

This situation was amplified with the pandemic, which necessitated changes in the use of acquisition cards where what constituted an approved purchase was not clear. When TBS employees transitioned and adjusted to working from home, the urgent need to purchase and deliver supplies and equipment to residences put pressure on TBS as a whole and on the acquisition card process. This pressure was evidenced by spending patterns during the BCP period, which notably included more purchases of lower-priced items such as peripheral equipment for computers and subscription-based software.

To respond to changes in requirements due to the pandemic, the Office of the Chief Human Resources Officer and the Office of the Comptroller General provided guidance to Government of Canada departments (“Remote Work and Employee Equipment Reimbursement”). As a department, TBS provided its own department-specific guidance to sectors through emails and dedicated pages on the TBS InfoSite. Nonetheless, results of interviews indicate there was some confusion or uncertainty about using acquisition cards for IT equipment during this period.

Recommendation 1

The Assistant Secretary, CSS, should review and amend the department’s guidance and directives for using acquisition cards and overseeing their use to include:

• specific instructions on what constitutes an acceptable business-related purchase that may be made with an acquisition card
• clear instructions on the authorization and processes required to accurately record and approve purchases in order to demonstrate oversight and stewardship of funds
• mandatory information management procedures to support documentation and its appropriate storage

3.2.2 Training

One means to ensure compliance with policy, directives and guidelines is training and communication. There is limited mandatory training in place for acquisition cardholders and fund centre managers that is specific to using acquisition cards and overseeing their use. An insufficient level of training may lead to inconsistencies and errors if TBS employees are not fully informed of necessary processes and parameters for using acquisition cards.

Limited training and ongoing opportunities to cardholders and fund centre managers to review and update their knowledge may contribute to the inconsistencies and errors noted in the audit.

For cardholders, there are three compulsory training sessions that must be completed before they receive an acquisition card. In addition, there is regular optional training on processes for inputting or reconciling acquisition card purchases in the departmental financial system that cardholders may attend.

There is compulsory training for fund centre managers on financial delegations, but there is no mandatory training specific to acquisition cards.

Interviews with a number of cardholders and fund centre managers indicated that they believe they had sufficient training. Nonetheless, audit results show inconsistency among employees in purchase practices, including how to code in the general ledger and where to document evidence of purchases and their approval.

Recommendation 2

The Assistant Secretary, CSS, should review and amend the department’s ongoing communication and training opportunities to strengthen knowledge and understanding of responsibilities.

3.2.3 Oversight and monitoring

A third set of observations relates to the limited frequency and depth of activities to review, oversee, monitor and follow up on acquisition card transactions. This infrequency of activities may lead to missed opportunities to identify issues and errors, rectify their occurrences, and avoid repetition of the error.

Oversight and monitoring activities

As part of its own oversight function, CSS, in line with its Account Verification Framework (AVF), conducts a quarterly sample of low-risk transactions, including acquisition cards, which account for 10% of AVF work. In 2018–19 and 2019–20, 43 acquisition card transactions on average were pulled for each quarter. Given the volume of transactions over the course of a fiscal year and the error rate shown in the audit team’s transaction testing, the error rate identified as part of AVF may not provide an accurate reflection of errors and issues with acquisition card transactions.

The audit team noted that an updated AVF, effective as of 2020–21, was in the process of being approved during the course of the audit.^{Footnote 5}

AVF reports did not show evidence of follow-up on errors or escalation of findings. If there is a decision to monitor and review acquisition cards, communication of findings and rectification of errors or issues should be carried out.

Quality of oversight and monitoring by cardholders and fund centre managers

Users of acquisition cards and those who oversee the acquisition card process are responsible for the quality and accuracy of the transactions and recording of information. The audit team saw evidence that this work was performed and that documentation was being stored, but testing results revealed issues with accuracy and consistency.

An example of this circumstance was evident with the quality of FAA section 34 documentation in the pre-pandemic period. Section 34 documents were scanned and saved in the department’s information holdings by cardholders, following their approval by fund centre managers. However, these documents were consistently illegible, hampering effective oversight and monitoring of evidence of section 34 approval.

The auditors noted that the poor quality of scanned documentation may be due to the colour of the ink of the original document (blue). But with the arrival of the pandemic and the acceptance of electronic signatures, the issue regarding clarity of scanning disappeared.

Recommendation 3

The Assistant Secretary, CSS, should review TBS’s activities for reviewing, monitoring and following up on processes used for acquisition cards, and make changes where necessary, commensurate with risk.

3.3 Conclusion

Although the number of purchases made with acquisition cards is low compared with the rest of the department’s spending, they are expenditures and assets of the Crown and must be accounted for in a way that respects legislative and Treasury Board policy instruments. A well-controlled system is an important method to demonstrate good stewardship of public funds.

Overall, audit results point to a need to clarify and strengthen guidance, improve accuracy and information management, and increase monitoring. These changes will help ensure that acquisition card purchases are in line with the expectations of the department and respect Government of Canada policy instruments.

4. Management response

Recommendation 1

The Assistant Secretary, CSS, should review and amend the department’s guidance and directives for using acquisition cards and overseeing their use to include:

• specific instructions on what constitutes an acceptable business-related purchase that may be made with an acquisition card
• clear instructions on the authorization and processes required to accurately record and approve purchases in order to demonstrate oversight and stewardship of funds
• mandatory information management procedures to support documentation and its appropriate storage

Recommendation 2

The Assistant Secretary, CSS, should review and amend the department’s ongoing communication and training opportunities to strengthen knowledge and understanding of responsibilities.

Recommendation 3

The Assistant Secretary, CSS, should review TBS’s activities for reviewing, monitoring and following up on processes used for acquisition cards, and make changes where necessary, commensurate with risk.

Appendix A: line of enquiry, accompanying audit criteria and overall results

The audit has one line of enquiry: to determine whether TBS has an effective management control framework that governs the departmental acquisition card program. The line of enquiry is divided into two time periods, and there are differing criteria to reflect the risks and circumstances of each period.

Appendix B: audit methodology—sampling technique and description of sample

The audit approach and methodology were risk-based and conform to the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing. These standards require that the audit be planned and performed in a way to obtain reasonable assurance that the audit objectives were achieved.

The methodology selected to complete the audit work was as follows:

1. Interviews: 19 interviews were undertaken with key stakeholders (for example, CSS), cardholders and fund centre managers.
2. Documentation review: 60 documents (excluding transaction testing) were collected, reviewed and analyzed.
3. Sampling: 150 acquisition card transactions were selected and tested.
   • In line with its sampling strategy, the audit team applied a Bayesian inference to select a stratified random sample of 150 acquisition card transactions for testing.
     • The audit team could not locate any documentation for 15 of the 150 transactions selected. The results presented in this report are based on the remaining 135 transactions.
   • The purpose of the testing was twofold: to examine the accuracy of internal controls, and to estimate the proportion of the population that would have transactions with errors.

Details of the sample are as follows: