Audit of Acquisition Cards, Travel and Hospitality

Acquisition Card Transactions – Monitoring and Quality Assurance

At the national level, we identified that the National Acquisition Card Coordinator (NACC) was responsible to monitor the use of acquisition cards and the overall management of acquisition cards. At the transactional level, we found that monitoring activities were designed to occur at key steps in the process and the responsibilities for this monitoring supported effective segregation of duties. Monitoring of transactions included a requirement for the cardholder to complete a timely review and reconciliation of monthly acquisition card statements to supporting documentation and to follow-up on any identified anomalies/disputes. These reconciliations are subject to further independent review, including S.34 certification, by the appropriate Cost Centre Manager (CCM). Quality Assurance activities included a requirement that Business Management Units (BMUs) within sectors or Corporate Services (CS) within regions review monthly Acquisition card statements and verify the S.34 certification. Another key Quality Assurance (QA) activity is the Department's Pre-Payment and Post-Payment Verification (PPV) process which is consistent with the TB Directive on Account verification. PPV is comprised of the Accounting Hubs within CFO Sector performing detailed assessments of compliance on a sample of acquisition card transactions, following-up and reporting on the results of these assessments.

Travel Expenditures – Monitoring and Quality Assurance

Monitoring controls related to travel expenditures includes the independent review and challenge of sector/regional travel plans prior to approval by senior management. In addition to IT controls that support consistency and compliance^{Footnote 4} at the individual trip level, we found that monitoring activities were designed to take place at various milestones and that responsibilities for monitoring were appropriately segregated. Prior to booking trips, estimates are reviewed for reasonableness by the CCM before providing their S.32 certification. Following the trip, the CCM then reviews the claim and related receipts before providing S.34 certification. Quality assurance includes a requirement that the Accounting Hubs complete an initial review of travel claims and follow-up with the traveler on any questionable items. Similar to acquisition card transactions, the Accounting Hubs also perform a PPV which involves a detailed assessment of compliance, follow-up and reporting.

Hospitality Expenditures – Monitoring and Quality Assurance

Consistent with the level of scrutiny and specific central agency requirements associated with hospitality, the audit team also identified a number of monitoring and quality assurance activities pertaining to hospitality. At the approval stage this includes appropriate S.32 certification (based on threshold levels for hospitality and associated event expenses) based on the CCM's review of estimates for individual events. The CCM also provides S.34 based on their review of supporting documentation. As all hospitality is considered "high risk", the Accounting Hub also performs 100% Pre-Payment Verification^{Footnote 5} on hospitality paid directly by INAC (i.e. not using an acquisition card) to ensure full compliance. Hospitality purchases made by using an AC are subject to Post-Payment Verification as with any other acquisition card purchase. For the period of the audit, approximately 85% of hospitality expenditures were made using an acquisition card.

While the design of the specific controls described above was generally considered as adequate, there were some gaps in the overall design of the monitoring and QA framework. Further, interviews and audit testing also revealed weaknesses in the effectiveness of certain activities within the framework. Specifically, the audit identified issues related to the following:

1. Consistency of Due Diligence applied to Monitoring – We expected to observe consistency in the nature and extent of due diligence applied through monitoring activities across the Department. The audit identified a lack of consistency in the application of these activities, particularly among those conducted by BMU/CS, across the Department. For example, the extent to which a specific BMU or CS played an active verification role varied considerably across sectors and regions. This identified lack of consistency in the extent of due diligence increases the likelihood that monitoring activities will not successfully detect potential instances of non-compliance or other anomalies.
2. Risk-based Approach – We expected to observe risk-based analysis of acquisition card use, travel and hospitality expenditures that would support the effective and efficient identification, investigation and reporting of trends, anomalies and potential non-compliance. In addition to the risk-based PPV approach provided by the Accounting Hubs, it was noted that all acquisition card transactions are subject to a high-level review by the NACC as well. This resulted in two different sets of requests for verification of acquisition card transactions with two different sets of review procedures that could result in duplicated efforts and/or confusion on the part of the cardholder. Further, we did not identify evidence that follow-up reporting or escalation was designed to highlight issues/concerns based on the associated risk. Without a risk-based approach there is greater likelihood that monitoring activities will be inefficient and/or ineffective.
3. Integration and Feedback – We expected to identify evidence that the various stakeholders involved in monitoring were taking steps to coordinate their activities with a view to avoiding duplication and promoting efficient communications and management reporting. We also expected to identify a mechanism or process to help ensure that results of monitoring and QA were tracked, analyzed and effectively communicated for purposes of supporting continuous improvement (i.e. inform policy/procedures/controls, training programs, escalation, future monitoring activities, et al).

However, the audit did not yield evidence of coordination (e.g. between the NACC, the PPV approach, BMUs/CSs and CCMs) nor evidence of a feedback mechanism or protocols that would link monitoring/QA results to continuous improvement opportunities. A siloed approach to monitoring along with the lack of an effective feedback loop means that INAC is likely missing opportunities to optimize and improve the management of acquisition cards, travel and hospitality

Recommendation:

2. The Chief Financial Officer should take steps to provide additional guidance on the usage of acquisition cards as a purchasing and payment mechanism to better account for risk factors and the range of business environments that exist across the Department. This would include the development of brief examples/case studies that reinforce acceptable and unacceptable uses for acquisition cards. It may also include developing:

• Guidance around situations warranting exceptions and related documentation requirements; and
• Expectations regarding the rigor to be demonstrated to ensure compliance with the Contracting Policy

This review should also examine roles and responsibilities for compliance with the Treasury Board Directive on Acquisition Cards to ensure they are adequately described and communicated.

Issuance

With respect to card issuance, the CCM of the applicant must approve the request prior to its issuance. For acquisition cards this is done by completing an Employee Account Request form, and for IDTCs this is done electronically through the HRG system. All new acquisition cards are sent by BMO directly to the NACC, who ensures that the applicant has taken the mandatory acquisition card training and signs a Cardholder Acknowledgement of Acquisition Responsibilities form prior to delivering it to the applicant. New IDTCs are sent directly by BMO to the applicant, either to their home or work address (as specified by the applicant).

INAC's Acquisition Card Policy states that the cards may only be issued to departmental personnel who hold S.32 delegated authority. This delegated authority is to be granted through a specimen signature card (SSC), which is to be established and signed by the CCM and the applicant prior to the issuance of the card. However, audit testing revealed that acquisition cards are being issued prior to the formal delegation of S.32 authority in the form of a signed SSC. Of the five acquisition card applications tested, SSCs were available for four of them, however, three of the four available SSCs were signed after the activation date of the card. Upon further inquiry, the audit noted that the card issuance practices do not include determining whether an SSC has been signed prior to issuing the card, rather only whether the mandatory training has been completed by the applicant.

As discussed in Section 5.5 of this report, the audit raises concerns related to the practical application of delegating S.32 authority to cardholders, who are mostly administrative assistants to CCMs. However, as the departmental policy currently reads, the practice of issuing a card to an applicant without a SSC that delegates S.32 authority to the applicant is a breach of the Policy.

Control and Maintenance

With respect to card control and maintenance, the NACC and the NTCC are responsible to maintain a log of active acquisition card and travel card cardholders. Furthermore, any requested changes to the characteristics of a card (such as credit limit increases) are made and/or processed by the NACC and NTCC (or RTCC), respectively upon receipt of the appropriate approval. Any requested changes to a travel card are required to be approved by the cardholder's CCM and requires a rationale for the change. Any requested changes to increase the default limit for acquisition cards are to be additionally approved by the Departmental Acquisition Card Coordinator.

To request a change to an acquisition card, the cardholder will submit an Action Request to Modify form with the requested change to the NACC. The NACC then logs on to the BMO system and makes the requested change.

To request a change to an IDTC, the cardholder submits an IDTC Change form with the requested change to the NTCC. The NTCC then faxes the IDTC Change form to BMO who makes the requested change.

The audit included testing of credit limit increases and a review of the acquisition cardholders log for accuracy. Results of this testing indicated that controls appear to be effective as no significant concerns or irregularities were identified.

However, the audit did note that the role of the NACC provides a significant level of authority within BMO's system for acquisition cards, with access to open, close, or alter the characteristics of any acquisition card in the department. This role is also solely responsible for maintaining the acquisition card cardholders log. As such, there is no independent validation to ensure an accurate list of active acquisition cards is maintained, or to monitor changes made to active cards. It is important to note that the audit testing did not reveal any evidence of irregularities that could be attributed to this concentration of responsibilities, as supporting documentation was identified for tested items. Regardless, CFO Sector may want to consider distributing some of the responsibilities of the NACC to other resources and/or to implement additional monitoring activities over changes to active cards in support of defined segregation of duties.

Cancellation

With respect to cancellation, as set out in the Acquisition Card Policy, it is the responsibility of the cardholder's CCM to notify the NACC when a cardholder is leaving their position, and to ensure that the card is returned to the NACC (or destroyed if the cardholder was a regional employee). The NACC is then responsible for deactivating the card through the BMO system.

For IDTCs, if a cardholder leaves the Department, then their card must be cancelled by filling out an IDTC Change form, which is completed by a RTCC or the NTCC, and the card is to be destroyed by the employee. The RTCC or the NTCC is then responsible for faxing the completed IDTC Change form to the credit card company to deactivate and cancel the card.

Although the roles and responsibilities associated with cancelling acquisition cards and IDTCs are documented, the audit found that the respective card coordinators are not always notified in a timely manner about the departure of a cardholder or the change in the role of the cardholder, and the need to cancel their card. For employees who leave the department, the processes associated with employee departures vary across the regions (a uniform departure clearance process was evidenced at HQ), and may or may not include determining whether the employee was a cardholder, and notifying the respective card coordinator in a timely manner. If regional processes do not include these steps, there is a risk that the card could be lost, stolen, or used inappropriately. As such, all regional departure clearance processes should consider whether the employee was a cardholder and, if so, timely communication of the departure should be made to the respective card coordinator.

Pre-Approval^{Footnote 7} of acquisition card Purchases – S.32 of the FAA

The audit expected acquisition card cardholders to have and exercise their commitment authority in accordance with INAC requirements and otherwise as provided by Section 32 of the Financial Administration Act (FAA). Commitment authority is intended to ensure that there is a sufficient unencumbered balance available in cost centre budgets before entering into acquisition card transactions. When the acquisition card cardholder is a Level 6 employee (below the level of manager), the cost centre manager (CCM) delegates their commitment authority to the cardholder as per INAC Acquisition Card Procedure Guide. This delegation is permitted under INAC's Delegation of Financial Authority and may be delivered on a transaction-by-transaction basis, as part of a blanket approval of specific purchases, or via a Specimen Signature Card (SSC). However, as discussed in Section 5.4, the expectation as set out in the INAC Acquisition Card Policy is to have an SSC in place for the acquisition card cardholder.

The testing revealed a wide range of practices regarding the documentation for Section 32 approval by CCMs and diligence in demonstrating appropriate pre-approval of acquisition card purchases. In some examples, the transaction was supported by an e-mail from, or formal document signed by, the CCM which clearly evidenced an explicit approval to proceed with the acquisition card purchase. Within this range were examples where proposed purchases were evaluated against a number of considerations such as whether a standing offer was to be leveraged. In the majority of instances within the sample of tested transactions, however, the S.32 commitment authorization was solely based on the acquisition card cardholder having an approved Specimen Signature Card (SSC) in place (as required by INAC Acquisition Card Procedure Guide). In these examples, it was not clear if the CCM had any visibility and/or role in pre-approving the acquisition card purchases nor was it clear if/how the cardholder ensured there was sufficient unencumbered balance in the CCM budget.

The INAC Acquisition Card Procedure Guide states that CCM's are responsible to delegate S.32 to cardholders via an approved SSC. While there are specific requirements for S.32 approval by the CCM for specific types of purchase, such as training and hospitality, there are no specific expectations as to the Department's pre-approval documentation requirements for other types of purchases. To the extent that acquistion cards are expected to be used only for day-to-day purchases of goods and services of low risk and dollar values^{Footnote 8}, the existence of an approved SSC appears to be a reasonable approach to supporting S.32 authorization. However, as noted in Section 5.3 of this report, acquisition card purchases routinely include transactions whereby explicit pre-approval at the CCM level would be expected (based on risk) and, in some cases required. Evidence of various pre-approval authorization practices suggest that some cost centres have adopted explicit pre-approval requirements for certain purchases, particularly those considered higher risk and/or dollar value, while others have not.

The inconsistency of practices increases the risk that management's intended controls will not be fully effective and/or efficient as the same purchase may be subject to significantly different scrutiny and pre-approval mechanisms depending on the cost centre making the purchase.

Reconciliation of Acquisition Card Purchases – S.34 of the FAA

As required in INAC's Acquisition Card Policy and Acquisition Card Procedure Guide, we expected to see clear expectations and responsibilities for the monthly reconciliation of acquisition card statements. This reconciliation is to be supported by credit card receipts and is key to enabling requisite S.34 approval under the S.34 of the FAA. This approval evidences that the CCM has certified the eligibility of the acquisition card purchase for payment. Once reconciled and signed under S.34, the statements and related receipts are forwarded to the BMU/CS for verification and forwarded to the Accounting Hub when selected as part of the PPV process. Based on our testing of a sample of 100 acquisition card transactions, the audit team identified a number of instances where evidence of S.34 approval did not demonstrate compliance with requirements. Most of these exceptions were the result of an inability to provide any documentation evidencing S.34 approval for the transaction. As acquisition card transactions are pre-paid by the INAC, the lack of S.34 did not prevent the payment from being made. Any weaknesses in S.34 approval of acquisition card transactions increases the risk of unsupported or inappropriate purchases, particularly considering audit observations on the inconsistencies around the Section 32 pre-approval process as described earlier in this section.

Testing also revealed instances where evidence supporting the actual receipt of goods was not always provided or otherwise unclear. While there were some examples of purchases that were adequately supported by packing labels/slips or similar evidence to demonstrate the delivery of goods to an employee of the associated cost centre at their place of work, this was not seen to be a consistent practice. Inadequate documentation to demonstrate the delivery of goods to the appropriate person and address increases the risk of purchases being made that are not strictly for business purposes, especially in light of a trend toward the increased use of online purchases.

Travel

The audit expected to observe that all travel and hospitality expenditures are authorized in advance to ensure compliance with the provisions of the TB Directive on Travel, Hospitality, Conferences and Event Expenditures (THCEE). Accordingly, the directive requires these activities be managed in an effective, efficient and economical manner, demonstrates value for money, and in instances where travel is required, it is supported with appropriate justification.

Travel Planning – Pre-Approval and Verification of Appropriate Expenditures

Throughout the Department, travel plans are used as a method of pre-approving travel by senior management in compliance with the TB Directive on THCEE. These travel plans are routinely developed on a quarterly basis and amended as appropriate. In conducting audit testing, travel claims were found to be in high compliance with respect to the level of documentation to support (i) appropriate pre-approval of the authorization to travel (FAA Section 32) in the form of a signed travel plan by the appropriate senior official with delegated authority, (ii) the accuracy of the trip claims to the expense reports, and (iii) evidence of expenditure approval (FAA Section 34). While the audit observed general compliance in the pre-authorization and expenditure approval of travel expenses, enquiries made during the audit revealed that travel plans were not being leveraged to support operational requirements.

Management of Travel Expenditures

In order to support active management of travel expenditures, there is a potential opportunity for the Department to further leverage the reporting capabilities housed in the HRG system in support of the management of travel expenditures by the various CCMs, regions and sectors. Senior management in the regions and sectors have also expressed a desire for enhanced reporting to support their decision-making with travel expenses. While there is no clear departmental expectation to do so, in discussions with the Financial Systems team in CFO Sector, it was indicated there may be synergies achieved by using this information to support the management of travel activities and expenditures.

Departmental Travel Guidance

At INAC, references to travel guidance and related information are made available to employees through posted intranet links to relevant TB and National Joint Council directives and guidelines. Although the department does not have a specific travel policy, the audit has identified some strong regional practices whereby the development of standing operating procedures, process flow-charts, and tools and tips supplement the travel guidance provided in the TB directives and guidelines.

In keeping with the spirit of the Directive, there is an opportunity for the Department to enhance the challenge function on the rationale for the purposes of the travel. Specifically, while the Department has incorporated trip data elements into their respective travel plans (e.g. objective, category, public-servant or non-public servant etc.) as per the TB Directive on THCEE, the rationale to justify why virtual presence or other remote meeting solutions were not considered had limited evidence of appropriate justification. This was noted in both the travel plans and through the HRG travel system, a Government of Canada Shared Travel Service online booking tool, which does not allow for detailed descriptive text.

Hospitality

The audit expected to observe that all hospitality expenditures are pre-approved at the appropriate level, are supported with documentation, are reviewed for eligibility and conformance to policy requirements, and are certified by the appropriate CCM, pursuant to S.34 of the FAA.

In general, the audit found that hospitality expenditures were well managed and that expected controls were in place and were largely adhered to.