Translate
Purchase Card Controls: Risk Management and Improved Data Systems Required
Published March 28, 2024
King County authorizes designated employees to make routine purchases on county-issued credit cards, known as purchase cards (p-cards). While the County has some controls in place intended to prevent misuse of p-cards, it has not yet comprehensively assessed the risks of this program. This means there may be gaps in the controls designed to prevent and detect fraud, waste, and abuse. Additionally, King County’s data systems for tracking p-card activity are decentralized and lack standardization, limiting the County’s ability to effectively oversee the program or ensure the County is meeting its goals around equitable and sustainable purchasing. We recommend that King County assess the risks of the p-card program, implement appropriate controls for identified risks, and develop data systems to help the County mitigate risks, oversee the program, and meet its purchasing goals. In response to our audit work, the County has already begun taking steps to assess and address identified risks.
Audit Highlights
We found that while King County has put some controls in place to help prevent the misuse of purchase cards (p-cards), the Finance and Business Operations Division (FBOD) has not yet conducted a risk assessment to identify risks of misuse or to gauge the effectiveness and efficiency of its controls. For example, to detect misuse, we found the County relies on the separation of duties between the cardholder and a supervising approver, but that there are insufficient safeguards in place should that control fail.
Additionally, we found the County could strengthen controls by separating other duties, such as the cardholder and the receiver of goods and services, and by providing more scrutiny to cardholders whose credit limits are sometimes 25 times higher than the default.
Finally, we found that the County’s data systems for tracking p-card activity lack key information, standardization, and reliable historical data. This limits FBOD’s ability to effectively oversee the program or ensure the County is meeting its financial, equity, or sustainability goals.
FBOD has taken steps since 2022 to improve controls and work more with agencies to help them manage their p-card use. The p-card team stated it would like to be able to do more efficient and thorough oversight of the p-card program, but we found this would be difficult without a comprehensive risk assessment and efficient data systems. These issues leave gaps that could increase the risk of loss due to p-card misuse. During the audit, FBOD took steps to start addressing the gaps we noted.
We recommend that FBOD conduct a risk assessment of its p-card program and use the results to reassess and improve its controls and data systems. We also detail specific risk areas and data functionality that FBOD should consider as part of its risk mitigation and data strategies.
King County employees spend around $90 million per year using county issued credit cards. P-cards can be more efficient than a traditional purchase order, and the County also receives a percentage-based rebate for purchases made using p-cards (almost $2 million in 2022).
Despite their benefits, p-cards still carry the risk of fraud, waste, or abuse. The expanding use of p-cards in the past decade has correspondingly increased these risks to county finances. Internal control systems can attempt to prevent, detect, or mitigate such employee misuse. Preventing misuse and protecting the County’s resources is particularly important given the financial limitations in King County’s general fund.