Audit of Acquisition Cards, Travel and Hospitality

September 2016

PDF Version (168 Kb, 27 Pages)

 

Table of contents

Acronyms

BMO

Bank of Montreal

BMU

Business Management Unit

CCM

Cost Centre Manager

CFO

Chief Financial Officer

CS

Corporate Services

DTEC

Departmental Travel Expense Card

FAA

Financial Administration Act

IDTC

Individual Designated Travel Card

NACC

National Acquisition Card Coordinator

NTCC

National Travel Card Coordinator

PPV

Pre-Payment and Post-Payment Verification

RTCC

Regional Travel Card Coordinator

SSC

Specimen Signature Card

TB

Treasury Board

 

 

Executive Summary

Background

The Audit and Assurance Services Branch of Indigenous and Northern Affairs Canada ("INAC" or "the Department") identified the Audit of Acquisition Cards, Travel and Hospitality through a mid-year update to the Department's 2015-16 to 2017-18 Risk-Based Audit Plan (RBAP), approved by the Deputy Minister on December 10, 2015. The audit was added to the RBAP on the basis that departmental expenditures on acquisition cards, travel and hospitality are subject to strict policy requirements, and are by their nature, subject to government and public scrutiny.

Audit Objective and Scope

The objective of this audit was to provide assurance over the adequacy and effectiveness of the management controls supporting the use and management of acquisition cards, travel cards, travel, and hospitality expenses, including compliance with applicable legislation, policies, procedures and guidelines.

The scope of the audit examined the efficiency and effectiveness of the management controls in place to support the Department's use and management of acquisition cards, travel cards, travel and hospitality expenses.

Testing covered the period from April 2014 to December 2015Footnote 1 and focused on the extent to which there was compliance with central agency and INAC policies and directives in the following areas: (i) card issuance and control; (ii) pre-approval of expenditures; (iii) eligibility of expenditures; (iv) approval and payment of invoices/claims; and, (v) monitoring and compliance.

Statement of Conformance

This audit conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program.

Positive Observations

The audit found several areas where strong practices were in place. Specifically, the audit noted that in most cases appropriate departmental policies and procedures have been established and are periodically updated. Furthermore, for the most part, roles and responsibilities associated with the management of acquisition cards, travel, and hospitality were clear.

The audit also noted that there is good awareness across the department of relevant central agency and Departmental requirements and there is broad-based effort to comply with those requirements. This is true even in light of fairly new requirements set forth by Treasury Board related to travel and hospitality, and a new government-wide travel system (HRG). This appears to stem from clear messaging and a reinforcement of the importance of compliance and efficiency from senior management – both in the regions and at Headquarters.

The audit also noted that in instances where an individual was unclear about how to interpret a particular policy or directive, or questioned the eligibility of an expense, they would seek guidance from a peer or other individual within INAC that was generally considered an "expert." This has contributed to the forming of a culture of sharing of tips, insights, and experiences within the Department related to the use of acquisition cards, travel cards, the new travel system, and hospitality.

Conclusion

The audit found that INAC's system of internal controls supporting the management of acquisition cards, travel cards, travel, and hospitality expenses, including compliance with applicable legislation, policies, procedures and guidelines are in place, appropriately designed and generally effective. While the audit results indicated that management controls appeared adequate and effective, the audit yielded a number of opportunities to further improve these controls. These opportunities for improvement have been captured in the form of audit recommendations in this report.

Recommendations

The audit team identified areas where management control practices and processes could be improved, resulting in the following five recommendations:

  1. The Chief Financial Officer should update roles and responsibilities to further support a practical, risk-based and integrated approach to monitoring and quality assurance.  This would include formalizing INAC-wide expectations related to the:
    • Consistent, integrated and risk-based review of transactions for compliance with central agency and INAC requirements; and,
    • Development and distribution of management reporting to support a mechanism to continuously inform ongoing compliance monitoring, escalation of anomalies/issues, identification of training needs, and future policy/guideline development. 
  2. The Chief Financial Officer should take steps to provide additional guidance on the usage of Acquisition Cards as a purchasing and payment mechanism to better account for risk factors and the range of business environments that exist across the Department. This would include the development of brief examples/case studies that reinforce acceptable and unacceptable uses for acquisition cards. It may also include developing:
    • Guidance around situations warranting exceptions and related documentation requirements; and
    • Expectations regarding the rigor to be demonstrated to ensure compliance with the Contracting Policy
    This review should also examine roles and responsibilities for compliance with the Treasury Board Directive on Acquisition Cards to ensure they are adequately described and communicated.
  3. The Chief Financial Officer should review card issuance and maintenance responsibilities and related processes to better ensure that:
    • National and regional Card Coordinator's responsibilities support effective risk management and are supported by independent oversight;  
    • Appropriate training and authority are assigned before the acquisition card is provided to the cardholder; and
    • A consistent process exists across the department to ensure the cancellation of cards in a timely manner.
  4. The Chief Financial Officer should clarify INAC's requirements for the nature and extent of documentation provided to support approval of acquisition card purchases. These requirements should reflect consideration of risks and involve an updating of roles and responsibilities. This recommendation includes confirming requirements for:
    • Appropriate Section 32 and expenditure initiation authority for acquisition aard purchases that are consistent with the authorities described in the Financial Administration Act; and
    • Timely, complete and appropriate Section 34 approval of all acquisition card purchases as part of the monthly reconciliation process for acquisition card statements.
  5. The Chief Financial Officer should consider expanding the current policies on travel and travel cards, to provide guidance and pertinent training tailored to INAC's unique operational environment and objectives. Supported by relevant training, such expanded policies and/or guidance could also serve to support consistent expectations for the management of travel expenses and the use of travel cards, including the requirements for, and support of management reporting using data from existing systems.

Management Response

Management is in agreement with the findings, has accepted the recommendations included in the report, and has developed a management action plan to address them. The management action plan has been integrated in this report.

 

 

1. Background

The Audit and Assurance Services Branch of Indigenous and Northern Affairs Canada ("INAC" or "the Department") identified the Audit of Acquisition Cards, Travel and Hospitality through the mid-year update to the Department's 2015-16 to 2017-18 Risk-Based Audit Plan (RBAP), approved by the Deputy Minister on December 10, 2015. The audit was identified as a high priority and added to the RBAP on the basis that departmental expenditures on AC, travel and hospitality are subject to strict policy requirements, and are by their nature, subject to government and publi scrutiny.

On January 1, 2011 Treasury Board (TB) announced the implementation of a new Directive on Travel, Hospitality, Conferences and Event Expenditures, which was subsequently amended on August 1, 2013. This directive is a key financial management policy instrument that requires departments to have oversight mechanisms, accountabilities and controls in place to ensure that expenditures related to travel, hospitality, conferences and events are managed in an effective, efficient and economical manner. At INAC, there are two main types of charge cards used as a method of payment for certain goods and services: acquisition cards and travel cards.

1.1 Acquisition Cards

Acquisition cards are charge cards that are intended to be used by departments and agencies as a method of procuring and paying for day-to-day expense items for standard maintenance, repair and operational goods and services under $10,000.Footnote 2 They are intended to simplify the process of procuring and paying for goods and services, thereby generating savings in procurement and expenditure processing.

Although the use of an acquisition card is not mandatory, it is strongly encouraged when the purchase is within delegated transaction authority and it is efficient, economical and operationally feasible. At INAC, procurement using an acquisition card is subject to the requirements of INAC's Policy on Acquisition Cards, in addition to those set forth by the Government of Canada.

1.2 Travel Cards

Travel cards provide a convenient and practical method to pay for authorized government travel expenses. Travel cards are to be used to the maximum extent practical when it is efficient, economical and feasible to do so. At INAC, two types of travel cards are used: the Individual Designated Travel Card (IDTC), and the Departmental Travel Expense Card (DTEC).

The IDTC is the recommended method of payment to be used by individual employees and designated personnel to incur authorized government travel expenses, including accommodations, car rental, and other travel expenses. In limited, pre-approved instances, hospitality expenditures may be incurred while on travel status.

While the DTEC is assigned to an individual, its intended use is for group travel. DTECs balances are paid by the Department, and are typically used in connection with various events (e.g. meetings, hearings, negotiations, etc). As such, DTECs are largely concentrated and maintained in sectors where such events tend to occur.

1.3 Hospitality

Hospitality expenditures include the provision of meals, beverages or other refreshments to non-federal governmental persons at events, including conference and meetings, which are necessary for the effective conduct of government business and for courtesy, diplomacy or protocol purposes.Footnote 3 In some circumstances and within restrictions defined in the TB Directive, hospitality can be provided to federal government persons.

1.4 Summary of Expenditures

The following tables summarize departmental expenditures for the audit scope period based on the data provided by the CFO Sector.

Expenses by Line Item (not including tax) April 2014 to December 2015
Travel - including public servant and non-public servant travel $37,309,942
Hospitality $729,994
 
Expenditures by type of Card (including tax) April 2014 to December 2015
Acquisition Cards $16,860,199
Individual Designated Travel Cards (IDTC) $4,528,923
Departmental Travel Expense Card (DTEC) $2,981,817
 

 

2. Audit Objective and Scope

2.1 Audit Objective

The objective of this audit was to provide assurance over the adequacy and effectiveness of the management controls supporting the use and management of acquisition cards, travel cards, travel, and hospitality expenses, including compliance with applicable legislation, policies, procedures and guidelines.

2.2 Audit Scope

The scope of the audit examined the efficiency and effectiveness of the management controls in place to support the Department's use and management of acquisition cards, travel cards, travel and hospitality expenses.

Testing covered the period from April 2014 to December 2015 and focused on the extent to which there was compliance with central agency and INAC policies and directives in the following areas: (i) card issuance and control; (ii) pre-approval of expenditures; (iii) eligibility of expenditures; (iv) approval and payment of invoices/claims; and, (v) monitoring and compliance.

 
 

 

3. Approach and Methodology

The audit was conducted in accordance with the requirements of the TB Policy on Internal Audit and followed the Internal Auditing Standards for the Government of Canada. The audit examined sufficient and relevant evidence and obtained sufficient information to provide a reasonable level of assurance in support of the audit conclusion.

The planning phase of the audit involved various procedures, including a review of preliminary documentation including Government of Canada and INAC directives, guidelines, policies, related to the management of AC, travel and hospitality expenses (e.g. Financial Administration Act, TB Directive on Travel, Hospitality, Conferences and Event Expenditures, TB Directive on Acquisition Cards, INAC Account Verification Framework) and conducting interviews with management. Based on this information, a risk assessment was completed to determine the scope of the audit. Refer to Appendix A for the detailed list of audit criteria developed for this audit.

Based on the audit criteria, a detailed audit program including an assessment method for conducting transactional testing was developed, which drove the activities undertaken in the conduct phase. The conduct phase of this audit was performed at INAC headquarters and the audit activities that were undertaken included the following:

In order to provide assurance over the adequacy and effectiveness of management controls, the audit team engaged a variety of techniques including the direct testing of transactions and other controls, interviews and document review. The audit team conducted fieldwork at INAC headquarters and conducted interviews with regional personnel via teleconference.

In selecting sample transactions for testing, considerations for each expenditure stream considered a number of risk factors in order to target specific transactions (i.e. the transactions appeared to exhibit characteristics that suggested a potential for non-compliance or irregularity). Further, other factors such as high volumes and the desire for a balance representation of the population across the Department were considered. A summary of the transaction universe and sample sizes selected for testing for this audit is as follows:

Transaction Testing:
  Universe Sample Size
Acquisition Card transactions 40,643 100
Travel – Total number of trips 25,716 36
Hospitality transactions (including purchases using Acquisition Cards) 6,171 34
 
Acquisition Card/IDTC Issuance and Control Testing:
  Universe Sample Size
Acquisition Cards:
Issuance 49 5
Cardholder Log Maintenance 289 289
Credit Limit Increase 4 2
Cancellation 120 10
Individual Designated Travel Cards (IDTCs):
Credit Limit Increase 7 7
Cancellation 180 10
 

 

4. Conclusion

The audit found that INAC's system of internal controls supporting the management of acquisition cards, travel cards, travel, and hospitality expenses, including compliance with applicable legislation, policies, procedures and guidelines are in place, appropriately designed and generally effective. While the audit results indicated that management controls appeared adequate and effective, the audit yielded a number of opportunities to further improve these controls. These opportunities for improvement have been captured in the form of audit recommendations in this report.

 

 

5. Findings and Recommendations

This section presents the findings and recommendations from the Audit of Acquisition Cards, Travel and Hospitality. Based on a combination of the evidence gathered through the examination of documentation, analysis and interviews, each audit criterion was assessed by the audit team and conclusion for each audit criterion was determined. Where differences between the audit criteria and the observed practice were found, the risk of the gap was evaluated and used to develop a conclusion and to document recommendations for improvement initiatives.

5.1 Positive Observations

The audit found several areas where strong practices were in place. Specifically, the audit noted that in most cases appropriate departmental policies and procedures have been established and are periodically updated. Furthermore, for the most part, roles and responsibilities associated with the management of acquisition cards, travel, and hospitality were clear.

The audit also noted that there is good awareness across the department of relevant central agency and Departmental requirements and there is broad-based effort to comply with those requirements. This is true even in light of fairly new requirements set forth by TBS related to travel and hospitality, and a new government-wide travel system (HRG). This appears to stem from clear messaging and a reinforcement of the importance of compliance and efficiency from senior management – both in the regions and at Headquarters (HQ).

The audit also noted that in instances where an individual was unclear about how to interpret a particular policy or directive, or questioned the eligibility of an expense, they would seek guidance from a peer or other individual within INAC that was generally considered an "expert." This has contributed to the forming of a culture of sharing of tips, insights, and experiences within the Department related to the use of acquisition cards, travel cards, the new travel system, and hospitality.

5.2 Monitoring and Quality Assurance Framework

The audit expected to identify evidence of an effective and efficient monitoring and quality assurance framework including each of the three areas of audit scope (acquisition card transactions, and travel and hospitality expenditures). While there were some specific opportunities identified to improve monitoring in connection with the use of acquisition card (see Section 5.3), the audit identified evidence of adequately designed monitoring and quality assurance activities. Based on the results of document review, process mapping and interviews, the audit team identified details of existing monitoring and quality assurance responsibilities and activities. A summary of these activities for each area of scope is briefly described below.

Acquisition Card Transactions – Monitoring and Quality Assurance

At the national level, we identified that the National Acquisition Card Coordinator (NACC) was responsible to monitor the use of acquisition cards and the overall management of acquisition cards. At the transactional level, we found that monitoring activities were designed to occur at key steps in the process and the responsibilities for this monitoring supported effective segregation of duties. Monitoring of transactions included a requirement for the cardholder to complete a timely review and reconciliation of monthly acquisition card statements to supporting documentation and to follow-up on any identified anomalies/disputes.  These reconciliations are subject to further independent review, including S.34 certification, by the appropriate Cost Centre Manager (CCM). Quality Assurance activities included a requirement that Business Management Units (BMUs) within sectors or Corporate Services (CS) within regions review monthly Acquisition card statements and verify the S.34 certification. Another key Quality Assurance (QA) activity is the Department's Pre-Payment and Post-Payment Verification (PPV) process which is consistent with the TB Directive on Account verification. PPV is comprised of the Accounting Hubs within CFO Sector performing detailed assessments of compliance on a sample of acquisition card transactions, following-up and reporting on the results of these assessments. 

Travel Expenditures – Monitoring and Quality Assurance

Monitoring controls related to travel expenditures includes the independent review and challenge of sector/regional travel plans prior to approval by senior management. In addition to IT controls that support consistency and complianceFootnote 4 at the individual trip level, we found that monitoring activities were designed to take place at various milestones and that responsibilities for monitoring were appropriately segregated. Prior to booking trips, estimates are reviewed for reasonableness by the CCM before providing their S.32 certification. Following the trip, the CCM then reviews the claim and related receipts before providing S.34 certification. Quality assurance includes a requirement that the Accounting Hubs complete an initial review of travel claims and follow-up with the traveler on any questionable items. Similar to acquisition card transactions, the Accounting Hubs also perform a PPV which involves a detailed assessment of compliance, follow-up and reporting. 

Hospitality Expenditures – Monitoring and Quality Assurance

Consistent with the level of scrutiny and specific central agency requirements associated with hospitality, the audit team also identified a number of monitoring and quality assurance activities pertaining to hospitality. At the approval stage this includes appropriate S.32 certification (based on threshold levels for hospitality and associated event expenses) based on the CCM's review of estimates for individual events. The CCM also provides S.34 based on their review of supporting documentation. As all hospitality is considered "high risk", the Accounting Hub also performs 100% Pre-Payment VerificationFootnote 5 on hospitality paid directly by INAC (i.e. not using an acquisition card) to ensure full compliance. Hospitality purchases made by using an AC are subject to Post-Payment Verification as with any other acquisition card purchase. For the period of the audit, approximately 85% of hospitality expenditures were made using an acquisition card.

While the design of the specific controls described above was generally considered as adequate, there were some gaps in the overall design of the monitoring and QA framework. Further, interviews and audit testing also revealed weaknesses in the effectiveness of certain activities within the framework. Specifically, the audit identified issues related to the following:

  1. Consistency of Due Diligence applied to Monitoring – We expected to observe consistency in the nature and extent of due diligence applied through monitoring activities across the Department. The audit identified a lack of consistency in the application of these activities, particularly among those conducted by BMU/CS, across the Department. For example, the extent to which a specific BMU or CS played an active verification role varied considerably across sectors and regions. This identified lack of consistency in the extent of due diligence increases the likelihood that monitoring activities will not successfully detect potential instances of non-compliance or other anomalies.
  2. Risk-based Approach – We expected to observe risk-based analysis of acquisition card use, travel and hospitality expenditures that would support the effective and efficient identification, investigation and reporting of trends, anomalies and potential non-compliance. In addition to the risk-based PPV approach provided by the Accounting Hubs, it was noted that all acquisition card transactions  are subject to a high-level review by the NACC as well. This resulted in two different sets of requests for verification of acquisition card transactions with two different sets of review procedures that could result in duplicated efforts and/or confusion on the part of the cardholder. Further, we did not identify evidence that follow-up reporting or escalation was designed to highlight issues/concerns based on the associated risk. Without a risk-based approach there is greater likelihood that monitoring activities will be inefficient and/or ineffective. 
  3. Integration and Feedback – We expected to identify evidence that the various stakeholders involved in monitoring were taking steps to coordinate their activities with a view to avoiding duplication and promoting efficient communications and management reporting. We also expected to identify a mechanism or process to help ensure that results of monitoring and QA were tracked, analyzed and effectively communicated for purposes of supporting continuous improvement (i.e. inform policy/procedures/controls, training programs, escalation, future monitoring activities, et al).  

However, the audit did not yield evidence of coordination (e.g. between the NACC, the PPV approach, BMUs/CSs and CCMs) nor evidence of a feedback mechanism or protocols that would link monitoring/QA results to continuous improvement opportunities. A siloed approach to monitoring along with the lack of an effective feedback loop means that INAC is likely missing opportunities to optimize and improve the management of acquisition cards, travel and hospitality

Recommendation:

1. The Chief Financial Officer should update roles and responsibilities to further support a practical, risk-based and integrated approach to monitoring and quality assurance. This would include formalizing INAC-wide expectations related to the:

  • Consistent, integrated and risk-based review of transactions for compliance with central agency and INAC requirements; and, 
  • Development and distribution of management reporting to support a mechanism to continuously inform ongoing compliance monitoring, escalation of anomalies/issues, identification of training needs, and future policy/guideline development. 

5.3 Use of Acquisition Cards

The audit expected to identify controls that would effectively prevent and detect instances of potential non-compliance with TB or INAC requirements related to acquisition card. Based on the audit testing results from a sample of acquisition card transactions, the audit team identified a number of instances where acquisition cards were used to purchase goods/services, that per the TB Directive on Acquisition Cards and/or INAC Acquisition Cards Policy, should have been paid for using a different method. While all of these instances supported a business need, these purchases were related to specifically excluded and/or restricted items for acquisition cards including services requiring written terms and conditions, IT hardware/software, fleet maintenance, and printing services greater than $1,000. There were also examples of acquisition card purchases that do not appear to fall within the general restriction of being "for standard maintenance, repair and operational goods and services of low risk…" as specified in the INAC Acquisition Cards Policy. Examples of these purchases include those related to treaty-related payments, aircraft charters and security services.

As per the Acquisition Cards Procedure Guide, the "…cardholder is responsible for determining whether the acquisition card is the appropriate procurement vehicle to obtain the item.Footnote 6" Irrespective of that responsibility, these payments were not identified as potentially non-compliant through the monitoring reviews conducted by the CCM and the NACC.

The audit testing also revealed inadequate documentation to evidence compliance with requirements set out in the INAC Acquisition Card Procedure Guide. These other requirements include:

  • Mandatory standing offers – requirement to consult with the PWGSC list of mandatory standing offers related to commodities such as furniture;
  • Other standing offers – consideration of standing offers beyond the mandatory ones noted above; and
  • Quotes -  requirement that purchases should involve requesting multiple quotes from potential suppliers when feasible and economical to do so.

Variations in these practices identified in the sample of acquisition card transactions tested during the audit ranged from one extreme (i.e. no documentation evidencing consideration of the requirement) to another (i.e. a rigorous and formally documented approval process involving standard forms/checklists requiring that the cardholder document details of how compliance with Acquisition Cards Policy was considered as part of the S.32 pre-approval). The variations in practices and the use of acquisition cards for ineligible purchases subjects INAC to the risk of incurring unnecessary costs and/or non-compliance with central agencies' expectations.

Audit interviews and other follow-up indicated that practices surrounding the use of acquisition cards differ across cost centres based on historical practices and the business activities associated with that cost centre, region and/or sector. The audit identified that effective feedback from monitoring acquisition card purchases and value-added training would help increase awareness of the appropriate use of acquisition cards and ensure consistent consideration of other requirements (e.g. use of standing offers or requesting quotes). 

Recommendation:

2. The Chief Financial Officer should take steps to provide additional guidance on the usage of acquisition cards as a purchasing and payment mechanism to better account for risk factors and the range of business environments that exist across the Department. This would include the development of brief examples/case studies that reinforce acceptable and unacceptable uses for acquisition cards. It may also include developing:

  • Guidance around situations warranting exceptions and related documentation requirements; and
  • Expectations regarding the rigor to be demonstrated to ensure compliance with the Contracting Policy

This review should also examine roles and responsibilities for compliance with the Treasury Board Directive on Acquisition Cards to ensure they are adequately described and communicated.

5.4 Management of Acquisition Cards and Travel Cards - Card Issuance Control and Cancellation

The audit expected to observe that controls have been established, and are being adhered to, for the issuance, control and maintenance, and the timely cancellation of acquisition card and travel cards (IDTCs and DTECs), and that clear roles and responsibilities for control processes and practices have been established.

The audit found that roles and responsibilities related to the overall management of AC and travel cards are clearly set out in various departmental policies and procedure guides. Specifically, those related to acquisition cards are set out in INAC's Acquisition Card Policy and Acquisition Card Procedure Guide, and those related to IDTCs are set out in INAC's IDTC Policy. All these documents are available to staff through the department's intranet site.

The majority of the processes related to acquisition cards and IDTCs are largely overseen or undertaken by the NACC and National Travel Card Coordinator (NTCC) respectively. There are also Regional Travel Card Coordinators (RTCC) – one in each regional office and one at HQ – that supports the NTCC.

Issuance

With respect to card issuance, the CCM of the applicant must approve the request prior to its issuance. For acquisition cards this is done by completing an Employee Account Request form, and for IDTCs this is done electronically through the HRG system. All new acquisition cards are sent by BMO directly to the NACC, who ensures that the applicant has taken the mandatory acquisition card training and signs a Cardholder Acknowledgement of Acquisition Responsibilities form prior to delivering it to the applicant. New IDTCs are sent directly by BMO to the applicant, either to their home or work address (as specified by the applicant).

INAC's Acquisition Card Policy states that the cards may only be issued to departmental personnel who hold S.32 delegated authority. This delegated authority is to be granted through a specimen signature card (SSC), which is to be established and signed by the CCM and the applicant prior to the issuance of the card. However, audit testing revealed that acquisition cards are being issued prior to the formal delegation of S.32 authority in the form of a signed SSC. Of the five acquisition card applications tested, SSCs were available for four of them, however, three of the four available SSCs were signed after the activation date of the card. Upon further inquiry, the audit noted that the card issuance practices do not include determining whether an SSC has been signed prior to issuing the card, rather only whether the mandatory training has been completed by the applicant.

As discussed in Section 5.5 of this report, the audit raises concerns related to the practical application of delegating S.32 authority to cardholders, who are mostly administrative assistants to CCMs. However, as the departmental policy currently reads, the practice of issuing a card to an applicant without a SSC that delegates S.32 authority to the applicant is a breach of the Policy.

Control and Maintenance

With respect to card control and maintenance, the NACC and the NTCC are responsible to maintain a log of active acquisition card and travel card cardholders. Furthermore, any requested changes to the characteristics of a card (such as credit limit increases) are made and/or processed by the NACC and NTCC (or RTCC), respectively upon receipt of the appropriate approval. Any requested changes to a travel card are required to be approved by the cardholder's CCM and requires a rationale for the change. Any requested changes to increase the default limit for acquisition cards are to be additionally approved by the Departmental Acquisition Card Coordinator.

To request a change to an acquisition card, the cardholder will submit an Action Request to Modify form with the requested change to the NACC. The NACC then logs on to the BMO system and makes the requested change.

To request a change to an IDTC, the cardholder submits an IDTC Change form with the requested change to the NTCC. The NTCC then faxes the IDTC Change form to BMO who makes the requested change.

The audit included testing of credit limit increases and a review of the acquisition cardholders log for accuracy. Results of this testing indicated that controls appear to be effective as no significant concerns or irregularities were identified.

However, the audit did note that the role of the NACC provides a significant level of authority within BMO's system for acquisition cards, with access to open, close, or alter the characteristics of any acquisition card in the department. This role is also solely responsible for maintaining the acquisition card cardholders log. As such, there is no independent validation to ensure an accurate list of active acquisition cards is maintained, or to monitor changes made to active cards. It is important to note that the audit testing did not reveal any evidence of irregularities that could be attributed to this concentration of responsibilities, as supporting documentation was identified for tested items. Regardless, CFO Sector may want to consider distributing some of the responsibilities of the NACC to other resources and/or to implement additional monitoring activities over changes to active cards in support of defined segregation of duties.

Cancellation

With respect to cancellation, as set out in the Acquisition Card Policy, it is the responsibility of the cardholder's CCM to notify the NACC when a cardholder is leaving their position, and to ensure that the card is returned to the NACC (or destroyed if the cardholder was a regional employee). The NACC is then responsible for deactivating the card through the BMO system.

For IDTCs, if a cardholder leaves the Department, then their card must be cancelled by filling out an IDTC Change form, which is completed by a RTCC or the NTCC, and the card is to be destroyed by the employee. The RTCC or the NTCC is then responsible for faxing the completed IDTC Change form to the credit card company to deactivate and cancel the card.

Although the roles and responsibilities associated with cancelling acquisition cards and IDTCs are documented, the audit found that the respective card coordinators are not always notified in a timely manner about the departure of a cardholder or the change in the role of the cardholder, and the need to cancel their card. For employees who leave the department, the processes associated with employee departures vary across the regions (a uniform departure clearance process was evidenced at HQ), and may or may not include determining whether the employee was a cardholder, and notifying the respective card coordinator in a timely manner. If regional processes do not include these steps, there is a risk that the card could be lost, stolen, or used inappropriately. As such, all regional departure clearance processes should consider whether the employee was a cardholder and, if so, timely communication of the departure should be made to the respective card coordinator.

Recommendation:

3. The Chief Financial Officer should review card issuance and maintenance responsibilities and related processes to better ensure that:

  • National and regional Card Coordinator's responsibilities support effective risk management and are supported by independent oversight;  
  • Appropriate training and authority are assigned before the Acquisition Card is provided to the cardholder; and
  • A consistent process exists across the department to ensure the cancellation of cards in a timely manner.

5.5 Pre-approval and Reconciliation of Acquisition Card Purchases

Pre-ApprovalFootnote 7 of acquisition card Purchases – S.32 of the FAA

The audit expected acquisition card cardholders to have and exercise their commitment authority in accordance with INAC requirements and otherwise as provided by Section 32 of the Financial Administration Act (FAA). Commitment authority is intended to ensure that there is a sufficient unencumbered balance available in cost centre budgets before entering into acquisition card transactions. When the acquisition card cardholder is a Level 6 employee (below the level of manager), the cost centre manager (CCM) delegates their commitment authority to the cardholder as per INAC Acquisition Card Procedure Guide. This delegation is permitted under INAC's Delegation of Financial Authority and may be delivered on a transaction-by-transaction basis, as part of a blanket approval of specific purchases, or via a Specimen Signature Card (SSC). However, as discussed in Section 5.4, the expectation as set out in the INAC Acquisition Card Policy is to have an SSC in place for the acquisition card cardholder.

The testing revealed a wide range of practices regarding the documentation for Section 32 approval by CCMs and diligence in demonstrating appropriate pre-approval of acquisition card purchases. In some examples, the transaction was supported by an e-mail from, or formal document signed by, the CCM which clearly evidenced an explicit approval to proceed with the acquisition card purchase. Within this range were examples where proposed purchases were evaluated against a number of considerations such as whether a standing offer was to be leveraged. In the majority of instances within the sample of tested transactions, however, the S.32 commitment authorization was solely based on the acquisition card cardholder having an approved Specimen Signature Card (SSC) in place (as required by INAC Acquisition Card Procedure Guide). In these examples, it was not clear if the CCM had any visibility and/or role in pre-approving the acquisition card purchases nor was it clear if/how the cardholder ensured there was sufficient unencumbered balance in the CCM budget.

The INAC Acquisition Card Procedure Guide states that CCM's are responsible to delegate S.32 to cardholders via an approved SSC. While there are specific requirements for S.32 approval by the CCM for specific types of purchase, such as training and hospitality, there are no specific expectations as to the Department's pre-approval documentation requirements for other types of purchases. To the extent that acquistion cards are expected to be used only for day-to-day purchases of goods and services of low risk and dollar valuesFootnote 8, the existence of an approved SSC appears to be a reasonable approach to supporting S.32 authorization. However, as noted in Section 5.3 of this report, acquisition card purchases routinely include transactions whereby explicit pre-approval at the CCM level would be expected (based on risk) and, in some cases required.  Evidence of various pre-approval authorization practices suggest that some cost centres have adopted explicit pre-approval requirements for certain purchases, particularly those considered higher risk and/or dollar value, while others have not.

The inconsistency of practices increases the risk that management's intended controls will not be fully effective and/or efficient as the same purchase may be subject to significantly different scrutiny and pre-approval mechanisms depending on the cost centre making the purchase.

Reconciliation of Acquisition Card Purchases – S.34 of the FAA

As required in INAC's Acquisition Card Policy and Acquisition Card Procedure Guide, we expected to see clear expectations and responsibilities for the monthly reconciliation of acquisition card statements. This reconciliation is to be supported by credit card receipts and is key to enabling requisite S.34 approval under the S.34 of the FAA. This approval evidences that the CCM has certified the eligibility of the acquisition card purchase for payment. Once reconciled and signed under S.34, the statements and related receipts are forwarded to the BMU/CS for verification and forwarded to the Accounting Hub when selected as part of the PPV process. Based on our testing of a sample of 100 acquisition card transactions, the audit team identified a number of instances where evidence of S.34 approval did not demonstrate compliance with requirements. Most of these exceptions were the result of an inability to provide any documentation evidencing S.34 approval for the transaction. As acquisition card transactions are pre-paid by the INAC, the lack of S.34 did not prevent the payment from being made. Any weaknesses in S.34 approval of acquisition card transactions increases the risk of unsupported or inappropriate purchases, particularly considering audit observations on the inconsistencies around the Section 32 pre-approval process as described earlier in this section.   

Testing also revealed instances where evidence supporting the actual receipt of goods was not always provided or otherwise unclear. While there were some examples of purchases that were adequately supported by packing labels/slips or similar evidence to demonstrate the delivery of goods to an employee of the associated cost centre at their place of work, this was not seen to be a consistent practice.  Inadequate documentation to demonstrate the delivery of goods to the appropriate person and address increases the risk of purchases being made that are not strictly for business purposes, especially in light of a trend toward the increased use of online purchases. 

Recommendation:

4. The Chief Financial Officer should clarify INAC's requirements for the nature and extent of documentation provided in support approval of acquisition card purchases.  These requirements should reflect consideration of risks and involve an updating of roles and responsibilities. This recommendation includes confirming requirements associated with demonstrating both of:

  • Appropriate Section 32 commitment and expenditure initiation authority for Acquisition Card purchases that are consistent with the authorities described in the Financial Administration Act (FAA); and
  • Timely, complete and appropriate Section 34 approval of all acquisition card purchases as part of the monthly reconciliation process for acquisition card statements.

5.6 Management of Travel and Hospitality Expenses

Travel

The audit expected to observe that all travel and hospitality expenditures are authorized in advance to ensure compliance with the provisions of the TB Directive on Travel, Hospitality, Conferences and Event Expenditures (THCEE). Accordingly, the directive requires these activities be managed in an effective, efficient and economical manner, demonstrates value for money, and in instances where travel is required, it is supported with appropriate justification.

Travel Planning – Pre-Approval and Verification of Appropriate Expenditures

Throughout the Department, travel plans are used as a method of pre-approving travel by senior management in compliance with the TB Directive on THCEE. These travel plans are routinely developed on a quarterly basis and amended as appropriate. In conducting audit testing, travel claims were found to be in high compliance with respect to the level of documentation to support (i) appropriate pre-approval of the authorization to travel (FAA Section 32) in the form of a signed travel plan by the appropriate senior official with delegated authority, (ii) the accuracy of the trip claims to the expense reports, and (iii) evidence of expenditure approval (FAA Section 34). While the audit observed general compliance in the pre-authorization and expenditure approval of travel expenses, enquiries made during the audit revealed that travel plans were not being leveraged to support operational requirements.

Management of Travel Expenditures

In order to support active management of travel expenditures, there is a potential opportunity for the Department to further leverage the reporting capabilities housed in the HRG system in support of the management of travel expenditures by the various CCMs, regions and sectors. Senior management in the regions and sectors have also expressed a desire for enhanced reporting to support their decision-making with travel expenses. While there is no clear departmental expectation to do so, in discussions with the Financial Systems team in CFO Sector, it was indicated there may be synergies achieved by using this information to support the management of travel activities and expenditures.

Departmental Travel Guidance

At INAC, references to travel guidance and related information are made available to employees through posted intranet links to relevant TB and National Joint Council directives and guidelines. Although the department does not have a specific travel policy, the audit has identified some strong regional practices whereby the development of standing operating procedures, process flow-charts, and tools and tips supplement the travel guidance provided in the TB directives and guidelines.

In keeping with the spirit of the Directive, there is an opportunity for the Department to enhance the challenge function on the rationale for the purposes of the travel. Specifically, while the Department has incorporated trip data elements into their respective travel plans (e.g. objective, category, public-servant or non-public servant etc.) as per the TB Directive on THCEE, the rationale to justify why virtual presence or other remote meeting solutions were not considered had limited evidence of appropriate justification. This was noted in both the travel plans and through the HRG travel system, a Government of Canada Shared Travel Service online booking tool, which does not allow for detailed descriptive text.

Hospitality

The audit expected to observe that all hospitality expenditures are pre-approved at the appropriate level, are supported with documentation, are reviewed for eligibility and conformance to policy requirements, and are certified by the appropriate CCM, pursuant to S.34 of the FAA.

In general, the audit found that hospitality expenditures were well managed and that expected controls were in place and were largely adhered to.

Recommendation:

5. The Chief Financial Officer should consider expanding the current policies on travel and travel cards, to provide guidance tailored to INAC's unique operational environment and objectives. Supported by relevant training, such expanded policies and/or guidance could also serve to support consistent expectations for the management of travel expenses and the use of travel cards, including the requirements for, and support of management reporting using data from existing systems.

 

 

6. Management Action Plan

Recommendations Management Response / Actions Responsible Manager (Title) Planned Implementation Date

1. The Chief Financial Officer should update roles and responsibilities to further support a practical, risk-based and integrated approach to monitoring and quality assurance.  This would include formalizing INAC-wide expectations related to the:

  • Consistent, integrated and risk-based review of transactions for compliance with central agency and INAC requirements; and
  • Development and distribution of management reporting to support a mechanism to continuously inform ongoing compliance monitoring, escalation of anomalies/issues, identification of training needs, and future policy/guideline development. 
A) The Chief Financial Officer (CFO) Sector will review and update the roles and responsibilities of all the parties involved in the monitoring and quality assurance of the acquisition cards and the travel cards. Chief Financial Officer A) By January 2017
B) The CFO Sector will develop a mechanism to ensure that any anomalies/issues that are identified in the monitoring and quality assurance of the cards be brought to the attention of the CFO in a timely manner. The issues identified will be taken into account in the acquisition card and travel card training and communication materiel (such as communication to all staff via INAC Express), as well as in future monitoring activities and improvement opportunities. B) By February 2017
C) The CFO Sector will define the scope of the monitoring/manual review to be done by the National Coordinators so that this work is risk-based (rather than reviewing each transaction). C) By March 2017
D) The CFO Sector will explore with the acquisition service providers (BMO and VISA Desjardins) the possibility of expanding the use of automated procedures so that anomalies be detected and flagged to the Department as the first line review. D) By March 2017

2. The Chief Financial Officer should take steps to provide additional guidance on the usage of Acquisition Cards as a purchasing and payment mechanism to better account for risk factors and the range of business environments that exist across the Department. This would include the development of brief examples/case studies that reinforce acceptable and unacceptable uses for acquisition cards. It may also include developing:

  • Guidance around situations warranting exceptions and related documentation requirements; and
  • Expectations regarding the rigor to be demonstrated to ensure compliance with the Contracting Policy

This review should also examine roles and responsibilities for compliance with the Treasury Board Directive on Acquisition Cards to ensure they are adequately described and communicated.

A) The CFO Sector will review and update the Department's Policy on Acquisition Cards and the Acquisition Card Procedure Guidelines. The revised documents will include: (i) a description of the roles and responsibilities of the parties involved; (ii) brief examples and questions and answers that reinforce acceptable and unacceptable uses for acquisitions cards; (iii) clear expectations regarding the supporting documentation that is required (for purchase, for payment, for post-payment reconciliation process) in order to ensure compliance with the TBS Directive on Acquisition Cards. Chief Financial Officer A) By January 2017
B) The CFO Sector will consult regions/sectors on the revised documents. B) By Feb. 2017
C) The revised documents will be submitted to the Operations Committee for approval. C) By March 2017
D) The approved documents will be communicated to all staff. D) By March 2017

3. The Chief Financial Officer should review card issuance and maintenance responsibilities and related processes to better ensure that:

  • National and regional Card Coordinator's responsibilities support effective risk management and are supported by independent oversight;  
  • Appropriate training and authority are assigned before the acquisition card is provided to the cardholder; and
  • A consistent process exists across the department to ensure the cancellation of cards in a timely manner.
A) The CFO Sector will review the training that is mandatory for new cardholders. Chief Financial Officer A) By March 2017
B) The CFO Sector will develop a refresher session for cardholders, to be taken on a yearly basis in order to maintain card responsibilities. The refresher session will be offered on a quarterly basis starting in April 2017. B) By March 2017
C) The CFO Sector will develop a protocol to follow before an acquisition card is issued to a cardholder. C) By March 2017
D) The CFO Sector, in consultation with Human Resources, will develop a consistent process across INAC to ensure the cancellation of cards in a timely manner. This will include a review of all regional departure clearance processes. D) By March 2017
E) The CFO Sector will conduct a yearly independent review of the card issuance and maintenance responsibilities of the National Coordinators. E) Starting in May 2017
F) The CFO will distribute twice a year the list of acquisition cardholders to the Sectors/Regions for validation. F) Starting in January 2017

4. The Chief Financial Officer should clarify and confirm INAC's requirements for the nature and extent of documentation provided to support approval of acquisition card purchases. These requirements should reflect consideration of risks and involve an updating of roles and responsibilities. This recommendation includes confirming requirements for:

  • Appropriate Section 32 and expenditure initiation authority for acquisition card purchases that are consistent with the authorities described in the Financial Administration Act (FAA); and
  • Timely, complete and appropriate Section 34 approval of all acquisition card purchases as part of the post payment reconciliation process for acquisition card statements.
Recommendation is addressed in Management Response 2 A). Chief Financial Officer By January 2017
5. The Chief Financial Officer should consider expanding the current policies on travel and travel cards, to provide guidance tailored to INAC's unique operational environment and objectives. Supported by relevant training, such expanded policies and/or guidance could also serve to support consistent expectations for the management of travel expenses and the use of travel cards, including the requirements for, and support of management reporting using data from existing systems. A) The CFO Sector will review current policies to assess whether expanded policy guidance on travel and travel cards is required. Chief Financial Officer A) November 2016
B) If changes are made to the policy, relevant training materials will be adapted to incorporate any expanded policy content. The CFO Sector will review current management reporting for travel purposes to identify potential enhancements to support decision-making. B) January 2017 (only if olicy changes are required
 

 

Appendix A: Audit Criteria

To ensure an appropriate level of assurance to meet the audit objective, the following audit criteria were developed, in alignment with the requirements of the TB Directive on Acquisition Cards and the TB Directive on Travel, Hospitality, Conferences and Event Expenditures:

Audit Criteria and Control Objectives

1. Management Control Framework for ACards, Travel and Hospitality

1.1 Travel and hospitality related activities are governed by adequate policies and procedures.

1.2 Mechanisms to support personnel in fulfilling their travel and hospitality responsibilities and complying with related requirements are in place.

1.3 The issuance and control of ACards and/or Travel Cards is governed by adequate polices and procedures.

1.4 Mechanisms to support personnel in fulfilling their responsibilities and complying with related requirements to A-cards and Travel cards are in place.

2. Compliance of Acquisition Card, Travel and Hospitality Expenditures

2.1 Acquisition card, travel, and hospitality expenditures are effectively authorized in advance in accordance with INAC policies and authority framework.

2.2 Travel and hospitality expenditures or purchases made with travel and acquisition cards are eligible, supported and conform to established policies and directives.

2.3 Acquisition card, travel, and hospitality expenditures are incurred with due regard to the economical objectives of the programs.

3. Monitoring and Reporting of ACards, Travel and Hospitality Programs

3.1 Monitoring, quality assurance and reporting activities and practices are adequate to ensure controls are continuously operating as intended to manage key risks and ensure compliance to policies and procedures.

3.2 Responses to issues identified through monitoring are timely and/or risk based.

3.3 Cards are being used when required or appropriate.

 

 

Appendix B: Relevant Policies, Directives, and Guidance

The following authoritative sources were examined and used as a basis for this audit:

  1. TB Directive on Travel, Hospitality, Conference and Event Expenditures
  2. TB Directive on Acquisition Cards
  3. Financial Administration Act
  4. INAC Acquisition Card Policy
  5. INAC Departmental Events Guideline – Travel, Hospitality, Conferences and Events
  6. INAC Account Verification Framework
  7. INAC Financial Delegation of Authority
 
 
Date modified: