Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Procurement Cards Audit topic
No spam. Unsubscribe anytime.
Internal audit recommends tighter procurement-card controls, mandatory justifications in Workday
Summary
Buncombe County internal audit presented two audits — a special project and a procurement-card audit — and recommended added review layers, clearer coding for meeting food, risk-based sampling, more frequent training, clarified conflict-of-interest rules and mandatory justification fields in Workday.
Rob Hartman of Buncombe County's internal audit office told commissioners the office completed a special project and a dedicated procurement-card audit and identified measures intended to strengthen controls over procurement-card (P-card) use.
Hartman said four recommendations came from the special project, including identification of P-card review chains that currently allow only one reviewer. "We're asking finance to go in, identify those, and add an extra layer of review to really make sure that we have a good separation of duties," Hartman said.
The audit found routine miscoding of meeting food as office supplies. Hartman said budget staff added new account codes so food for meetings can be coded correctly and noted that change took effect with the current budget cycle: "starting on July 1, this shouldn't be an issue where we have people putting food into office supplies." He said finance has notified county staff of the new codes.
Hartman also said finance lacks the staff to review every P-card transaction and currently reviews a random monthly sample of 50 transactions. The audit recommended a risk-based sampling approach. He said turnover in procurement delayed implementation but that finance expects to move to a risk-based sample for October reviews after filling a vacant position.
On training and policy, Hartman said current P-card training is required before issuance and then only at five-year card expiration. "Best practices in the industry is typically 1 to 2 years," he said, and asked finance to reassess frequency. He said HR is drafting clarifications to the county's conflict-of-interest policy to make clearer what must be disclosed; his understanding is HR "are kind of moving forward with the idea that anything that generates taxable income would need to be disclosed."
The audit also recommended storing reimbursement documentation in Workday rather than only in finance department files so proof of reimbursements survives turnover. Hartman said finance is updating Workday so a justification field for all P-card purchases becomes mandatory and that the county would communicate the change in advance. "They're almost complete with it now. They just need to get some communication out to the county informing them of this. And then once that communication is ready to go, they'll flip the switch in Workday, and this field will become mandatory," he said.
Commissioners asked for additional detail on the conflict-of-interest clarifications and about timing of the changes. Hartman said the special project report and the P-card report were distributed to commissioners; he offered to resend copies if needed.
The presentation closed with Hartman inviting questions and indicating deadlines: identification of single-review P-card chains and added reviewer assignments by the end of the calendar year, Workday documentation and justification-field updates to be completed by year-end, and the move to risk-based sampling beginning with October reviews after the procurement vacancy is filled.
