Rethink the Audit Process

Compliance hurdles. Recurring audit findings. Costly manual audit processes. These types of challenges detract from the benefits of Commercial Card usage. Fortunately, there are things you can do to reduce the issues and strengthen your auditing approach. To gain another expert’s insights, Recharged Education’s Lynn Larson spoke with Doug Hindsley of Card Integrity, a global procurement card expense management service company. Read on to see his perspectives on common P-Card policy infractions, how to address chronic problems, frequently overlooked audit criteria, the drawbacks of manual audits, and more.

Related Resources

• Program pitfall: Manually auditing 100% of transactions each month

• Purchasing Card auditing

Don't forget to subscribe to the blog (no charge) to receive educational content!

Common Policy Infractions

Q: What type of violation or policy infraction do you see most often?

A: Purchasing from the wrong supplier or using the wrong process (e.g., not using the designated e-procurement portal to ensure negotiated pricing is obtained). Most organizations have preferred suppliers that purchasing has worked hard to cultivate. There is potential for huge dollar savings that can also increase the growth potential for the card program. If cardholders do not use the preferred suppliers, while this is not fraud, there can be a high cost. Many organizations lack the time and resources to monitor hundreds or thousands of micro-buyers with P-Cards to identify who is using the wrong suppliers and/or process for their purchases.

Addressing Chronic Problems

Q: What advice would you (or do you) give to organizations that have the same types of recurring issues each month?

A: It is all about communication. First, determine whether your published policies or procedures are outdated, thereby causing the issues. If not, when the same issue occurs time after time, it signals a need for change in the communication process. Talking to the cardholder or cardholder’s manager may not be enough. I recommend quantifying and summarizing the issues, based on the data, then distributing the findings to the various department heads. Instead of showing all the various issues at a transaction level, a summary can prioritize findings by department and compare one department to another. Seeing how each department stacks up to each other will help foster change.

Secondly, a program manager can focus on the impact brought on by recurring issues and why the change is needed. Often, communication focuses more on why cardholders can’t do something. However, the cardholder and/or manager may not understand the reason behind the issue or they may think the reason is unimportant. It can be helpful to translate an issue into something important to the offending department (e.g., budget, audit write up, canceling cards, etc.).

Considerations Regarding the Audit Process

Q: What are some examples of audit criteria that organizations commonly overlook but should include?

A: Everyone seems to focus on fraud. While this is critical, having additional checks and balances will increase confidence in the program. Some other aspects to check for include duplicate payments (between a card transaction and other payment, such as an employee reimbursement), debarred suppliers, internal spend, and procurement-related findings (e.g., service contracts on file).

Q: Besides process cost, what are some drawbacks of doing manual audits, especially manually auditing all transactions every month/cycle?

A: Most organizations have limited resources for this activity. Plus, a manual review/audit can have negligible findings, giving a false sense of comfort. We have found that companies with a 100% manual review process have employees (e.g., auditors or others) page through paper or imaged receipts for all the transactions. For each receipt, it is very difficult for anyone to look for multiple things that might signal fraud or a policy infraction. Scientific studies show that the average person can only recall about seven things in their mind at any given time. Even the most diligent of auditors may reach a point where the mind starts slipping into ‘is there any receipt attached or not’ type of review. Virtually no real thought has time to transpire from manual review. More effective reviews examine the tougher questions:

• What does the merchant sell and should we have bought it?

• Was it purchased following the correct procedures?

• Does the receipt need supporting documentation for review?

The advantage of the manual review is the presumed reduction of false positives. The people doing the 100% manual review know the exceptions during the first pass. Some possible caveats include:

• Manual receipt review is brain-numbing work, as indicated above.

• The reviewers/auditors overlook transactions due to the volume.

• Some transactions are assumed okay since the reviewer/auditor knows the cardholder (potential conflict).

• An organization loses internal knowledge when the receipt review people leave or retire.

There is inefficiency in that the company looks at 100% of the transactions to find the 1% they claim need follow up.

About Auditing Solutions

Q: What is an advantage of using a third-party auditing service/solution?

A: A company like Card Integrity reviews 100% of the transactions to find the 5% requiring the customer’s review. When we look at the data, we apply upwards of 200 types of alerts on each transaction. We also compare transactions to each other, identify patterns for cardholders, review category and supplier adoption—something that realistically cannot be done manually. Our service pulls out the items that need the customer’s judgement, specifically pointing out what might be in question on the transaction. The customer then only looks at a much smaller subset of data with targeted reasons why they are looking at it. The time saved can be applied to better program communication and program growth.

Q: Organizations with smaller card programs might think third-party auditing technology/services are beyond their reach. What do you think? Is there a certain transaction volume that typically yields a quick ROI?

A: The smallest programs we work with have about 100 cards and, yes, there is value. At that size program, the value comes from not having to worry about only one person doing the audit. Normally, the same person who is reviewing the program is the one in charge of expansion. Reducing the workload on the audit allows for program growth or enhanced communication to build confidence.