Palo Alto auditor finds strong internal controls in purchasing card program; committee accepts report

The City of Palo Alto’s Office of the City Auditor presented a purchasing‑card (p‑card) audit to the Policy & Services Committee, reporting that most cardholders used p‑cards for legitimate city business and that internal controls are generally strong, while recommending several administrative improvements.

Kate Murdock, city auditor, and Nick Martinez, senior auditor with Baker Tilly, said the PCard program serves 42 departments and had about 254 active cardholders in January 2025. Cards carry single‑transaction limits of $10,000 and monthly limits of $15,000. The auditors reported no evidence of personal use in the transactions reviewed.

Key findings included occasional missing documentation, inconsistent post‑audit review recordkeeping, and the absence of a formal ongoing training program for cardholders and approvers. The auditors recommended establishing recurring training focused on documentation requirements, working with the vendor to add approval time stamps and automated noncompliance notifications, and formalizing consequences for nonadherence. They also recommended adopting a statistically valid random sampling process for post‑audit reviews and standardizing the p‑card limit exception process.

Auditors noted an operational observation: the federal micro‑purchase threshold is expected to rise to $15,000 in October 2025; raising the city’s single‑transaction p‑card limit to $15,000 could divert purchase orders and save staff time. Auditors estimated that increasing the limit could have saved about 940 staff hours for FY 2024 if $15,000 were the limit.

Administrative Services Department staff described their current monthly post‑audit review process and said they track and follow up on cost‑splitting incidents (instances where a single purchase is split into smaller transactions to avoid a limit). They noted follow‑up outreach typically resolves issues and that staff plan to implement escalation steps for repeat offenders.

Committee members asked for clarification about the frequency and denominator for identified cost‑splitting incidents; staff and auditors said the example in the report represented a higher‑than‑typical month and that overall occurrence across all monthly transactions appeared low. Committee members praised staff for lack of personal misuse and supported staff plans to formalize training and consequence policies.

The committee voted to accept the audit report. Chair Bienker (Veencker), Council Member Stone and Council Member Liu voted yes; the motion carried.