This Web page has been archived on the Web.

2007 May Report of the Auditor General of Canada

Main Points

What we examined

Acquisition cards are essentially credit cards that enable departments to purchase and pay for goods and services. The designated travel card is a credit card that government employees use for expenses such as hotels, car rental, and meals while they are travelling on business. We examined the acquisition and travel card programs in National Defence, Fisheries and Oceans Canada, and Health Canada, the three departments that together account for about half of the total acquisition card use and a large portion of the travel card use in the government. We also looked at the roles that the Treasury Board Secretariat (TBS) and Public Works and Government Services Canada (PWGSC) play in providing overall direction and guidance for these programs.

Why it's important

Acquisition and travel cards can be a convenient and efficient way for the federal government to obtain and pay for goods and services, if it properly manages the associated risks. The use of acquisition and travel cards by federal government departments is growing, and many departments are encouraging their use to pay for goods and services and travel-related expenditures. Between 1999 and the end of 2005, acquisition card spending increased from more than $350 million to more than $600 million, and travel card spending from about $170 million to approximately $200 million.

Periodically some misuse of acquisition or travel cards does occur in the government, receiving significant publicity and raising doubt about the adequacy of the controls in place. It is important that parliamentarians and Canadians be assured that public resources are not misused or abused by those who have access to convenient methods of paying for goods and services.

What we found

• We identified no losses or abuse in our audit sample of acquisition card transactions. A framework of controls is in place to reduce the risks that acquisition cards are used improperly or without authorization. The control framework relies on post-payment verification and certification under section 34 of the Financial Administration Act (FAA) as the key control over the risks associated with the cards. However, it and other key controls and safeguards required by the FAA are not applied rigorously by departments. Lapses in the control and review of transactions leave departments exposed to risk.
• The use of acquisition cards has evolved and increased considerably since 1998, when the current Treasury Board policy came into effect. For example, at National Defence and Fisheries and Oceans Canada, cards are now being used for very high-dollar purchases, and some cards have high credit limits—one as high as $1.5 million. Departments are encouraging their employees to make even more use of the cards. Departments differ in how they interpret the policy and how they use the cards, while the Treasury Board Secretariat has not updated the policy to take into account the changes in practice.
• In both National Defence and Fisheries and Oceans Canada, acquisition cards are sometimes in the names of vessels or organizational units, rather than in the names of specific individuals. While this use is not consistent with the present Treasury Board policy, departments have said it has operational merit. Although their position might be reasonable, they have not received the Treasury Board's formal approval to use the cards in this way.
• The control framework for designated travel cards is adequate, given that the primary risk to the government is that it assumes the cardholder's personal liability only after 90 days from the original statement date, and the government can manage the risk of default by using salary-offset provisions. However, the Treasury Board Secretariat and Public Works and Government Services Canada have not updated the travel card policies and procedures to reflect the provisions in the contract with the current service provider, stating that it is the government and not the cardholder that is responsible for unpaid balances after 90 days.

The departments have responded. The departments are in general agreement with our recommendations. Their detailed responses follow each recommendation throughout the chapter.

Introduction

What are acquisition cards, and how are they managed?

1.1 Acquisition cards are credit cards that enable departments to purchase and pay for goods and services. They were initially approved for use in government departments and agencies in 1991 and are now offered through contracts with two Canadian banks. The Bank of Montreal (BMO) provides MasterCard credit card services, and the Canadian Imperial Bank of Commerce (CIBC) provides Visa credit card services. Departments can use either or both of these acquisition card services, depending on their operational needs.

1.2 The contracts with the service providers offer a rebate program, payable directly to the departments. Rebates are based on variables such as the level of expenditures on the cards and how quickly departments pay the balance owing.

1.3 Since their introduction, the use of acquisition cards has increased significantly. The acquisition card program started in 1991, and by 1992 there were approximately 2,000 cards in use. In 1996, the period examined in our first audit on acquisition cards, the government had approximately 20,000 cards, and transactions were valued at about $170 million. As of December 2005, approximately 35,600 cards were in use, with transactions exceeding $600 million (Exhibit 1.1).

1.4 Until 1 September 2006, the Treasury Board Secretariat (TBS) was responsible for contracts with the service providers, policy, and oversight of the operations of the acquisition card program. After this date, Public Works and Government Services Canada (PWGSC) assumed responsibility for contracts with the service providers and program oversight. The Treasury Board is still responsible for government-wide policy regarding acquisition cards.

1.5 Departments are responsible for establishing specific departmental policies and procedures to ensure the economical and efficient use of acquisition cards, and for designating a departmental coordinator. Each departmental coordinator is responsible for the following:

• authorizing and issuing acquisition cards,
• monitoring program design to ensure reliable controls exist over the use of cards, and
• managing their department's card programs.

Finally, departments are also responsible for carrying out reviews and audits to determine whether cards are being used according to Treasury Board policy.

What are travel cards, and how are they managed?

1.6 The "designated travel card" is a credit card that individual government employees use to pay expenses such as hotel, car rental, and meals while they are travelling on business. Employees are responsible for paying their own travel card balances and are reimbursed for these business expenses, once they complete a travel claim. Staff who arrange travel for each responsibility centre also use the "designated-responsibility-centre travel card" to pay airfares and travel agency fees.

1.7 Through a subcontract with Accenture, American Express (AMEX) is the travel card service provider. The government earns rebates, based primarily on the total expenditures relating to both the designated travel cards and the designated-responsibility-centre travel cards.

1.8 In 2005 government employees used designated travel cards to make approximately $200 million in purchases; this was an increase from about $170 million in 1999.

1.9 PWGSC has overall responsibility for managing the travel card program. Departments are responsible for authorizing, issuing, monitoring, and cancelling the use of travel cards. Both employees and the department play an important role in managing the travel card program. If an employee fails to pay the outstanding card balance after 90 days, the liability for this outstanding balance is transferred to the government. In such cases, the department must then recover the money from the employee.

Focus of the audit

1.10 The audit focused on three departments: Fisheries and Oceans Canada, Health Canada, and National Defence. These three departments are among the largest users of travel cards and account for about half of the government's expenditures on acquisition cards.

1.11 We looked at whether the management control framework over the use of the acquisition cards and designated travel cards (travel cards) is appropriate and whether the government is aware of the extent of the intended benefits realized from these programs. We did not include as part of this audit the management of the designated-responsibility-centre travel cards that are used by responsibility centres to pay for airfares and travel agency fees.

1.12 Our audit focused on the processes for managing the card programs in the three departments—not on the merits of individual expenditures. We also assessed the roles of the Treasury Board Secretariat and Public Works and Government Services Canada in providing overall direction and guidance on these programs.

1.13 More details on the audit objectives, scope, approach, and criteria are in About the Audit at the end of this chapter.

Observations and Recommendations

Policies and procedures

1.14 Appropriate policies from the Treasury Board are critical to delivering any program. No less important are appropriate procedures and guidelines at the departmental or operational level. This is particularly true for acquisition and travel card purchasing, where spending power is placed directly in the hands of thousands of government employees with numerous operational needs.

Government-wide policies need to be updated

1.15 In 1998, the Treasury Board revised its Policy on Acquisition Cards. This policy emphasized the need for additional controls at the departmental level for improved monitoring and analysis, and for the use of information supplied by the service providers in an electronic format. The Treasury Board Secretariat also issued the Acquisition Cards Program—Best Practices Guide in 1998 and the Acquisition Cards Program—Management Guide in 1999. These documents contain useful information on the history, use, and benefits of acquisition cards. They also describe the acquisition card control framework, recommend practices for acquisition card use, and highlight internal controls that will assist managers in monitoring acquisition card activities.

1.16 There have been no updates to the Treasury Board Policy on Acquisition Cards or either of the guides since they were issued. We note that the Treasury Board Secretariat's Acquisition Cards Program—Best Practices Guide refers to a future version of the guide that would cover topics such as best practices and provide advice on types of purchases, card limits, and delegated financial authorities. With the changing environment in the use of acquisition cards, namely the increase in the number of cardholders, increase in total dollars spent on the cards, and the use of the cards for high-dollar transactions, it is important that control processes and guidance not become outdated. This could possibly expose the government to additional risks. The Treasury Board is currently updating its Policy on Acquisition Cards.

1.17 At the departmental level, we found that the three departments examined had generally developed and issued specific acquisition card policies and directives consistent with the policy established by the Treasury Board. However, the departmental policies of both Fisheries and Oceans Canada and National Defence permit acquisition cards to be issued in the name of an operational unit or a vessel, rather than in the name of individuals. We found that such cards in fact exist. Although we can understand that these "corporate" cards provide flexibility, the current service-provider contracts make no specific reference to such cards, and the Treasury Board Policy on Acquisition Cards states that only the "person whose name appears on the card" can use it.

1.18 We also found that the Health Canada acquisition card policy did not explicitly restrict cardholders from approving their own acquisition card expenditures and that such situations were, in fact, occurring. This policy and practice is, in our opinion, not consistent with the fundamental control principle that there be a division of duties between those executing a transaction and those approving the subsequent expenditures. As this audit was being completed, Health Canada was in the process of revising its departmental acquisition card policy to eliminate this practice.

1.19 Recommendation. The Treasury Board Secretariat should update the policy with respect to acquisition cards including whether "corporate" acquisition cards should be permitted.

The Treasury Board Secretariat's response. The Treasury Board Secretariat agrees with the recommendation. As part of the renewal of Treasury Board's financial management policies, the Directive on Acquisition Cards is being updated. The revised directive will not permit the issuance of acquisition cards in the name of an organization or asset, such as a vessel, as it would have an impact on the government's ability to monitor and control the usage of the card as well as on the merchant's ability to accept the card as payment. Forecasted completion for the updated directive is 31 March 2008.

The existing policy on travel cards does not reflect the terms of the current contract with the service provider

1.20 The Treasury Board Policy on Using Travellers Cheques, Travel Cards and Travel Accounts, which is scheduled to be replaced with a Treasury Board directive on travel cards, governs the use of travel cards within the government. Public Works and Government Services Canada (PWGSC) has overall responsibility for managing the travel card program. In this respect, PWGSC has regular communications with AMEX and departments regarding the use of the designated travel card.

1.21 The Treasury Board policy came into effect on 1 January 1998, and was amended in March 2000. We found that it does not reflect the terms of the current contract between the government and Accenture, with AMEX as the subcontractor. The contract states that full payment for unpaid balances on travel cards will be made by the government after 90 days, whereas the policy leaves payment responsibility with the cardholder.

1.22 At the time of our audit, we found that only Fisheries and Oceans Canada had a travel card policy in place. Both Health Canada and National Defence indicated that they had draft travel card policies, which were being finalized.

1.23 We noted that all three departments had effectively communicated information to travel cardholders about the issue of transferring the payment responsibility from the employee to the government, as stated in the latest contract with Accenture.

1.24 Recommendation. The Treasury Board Secretariat should complete and issue its directive on travel cards.

The Treasury Board Secretariat's response. The Treasury Board Secretariat agrees with the recommendation. As part of the renewal of Treasury Board's financial management policies, the Directive on Travel Cards and Travellers Cheques is being updated. Forecasted completion for the updated directive is 31 March 2008.

1.25 Recommendation. Public Works and Government Services Canada should provide departments and agencies with operational guidelines pertaining to the provisions of the contract with the travel card service provider, including guidelines pertaining to the responsibility of the government for unpaid travel card balances.

Public Works and Government Services Canada's response. Public Works and Government Services Canada agrees with this recommendation and will provide departments and agencies with operational guidelines pertaining to the provisions of the contract with the travel card service provider.

Training practices for departmental coordinators and quality assurance personnel are lacking

1.26 Training is a fundamental requirement to effectively implement policies and procedures. We expected that there would be training practices in place to ensure that those responsible for the use, processing, and oversight of acquisition and travel cards would be fully aware of their roles and responsibilities.

1.27 There is an absence of formal training for both the departmental and regional-level card coordinators in all three departments. Interviews with departmental card coordinators indicated that they had no specific training for their roles and responsibilities with the acquisition card program. We found evidence of informal on-the-job training being provided.

1.28 In the three departments, we found no evidence of formal training for those persons responsible for the quality assurance of account verification of acquisition card transactions. Those responsible for quality assurance require a good knowledge of the documentation and financial system information associated with acquisition cards and financial processes.

1.29 Travel cards pose a lower level of risk, as the agreement between the cardholder and the government is clear and concise. In addition, the unpaid balances become a liability to the government only after 90 days. Further, with the salary-offset provisions, the government has limited exposure to losses. For these reasons, we did not expect that formal training would be provided to travel cardholders, but rather that their roles and responsibilities would be effectively communicated.

1.30 Good communication with cardholders. The results of our examination indicated that all three departments have good communication initiatives to ensure that the roles and responsibilities of cardholders for both acquisition and travel cards are documented and communicated. These initiatives include intranet references, policies, and procedures on the use of acquisition and travel cards; internal publications; and cardholder acknowledgement forms.

1.31 Recommendation. Fisheries and Oceans Canada, Health Canada, and National Defence should formalize training for regional and departmental coordinators and quality assurance personnel to ensure that information about all issues related to acquisition and travel card management within a department is understood by those personnel, and that the information is disseminated to program managers.

Fisheries and Oceans Canada's response. Fisheries and Oceans Canada agrees. Over the next 12 months, the Department will implement a training program for card coordinators and quality assurance personnel, and will improve the departmental coordination of card management and of the quality assurance function. In addition, the Department will take the necessary steps to inform card coordinators of the availability on the website of training material and tools accessible to them.

Health Canada's response. Health Canada agrees that training should be available for these groups and will explore alternatives for the delivery of training in respect of departmental coordinators, including the possible provision of this training through central agencies or the Canada School of Public Service.

National Defence's response. National Defence agrees. The Department is developing a range of training packages for all personnel involved in the use of acquisition and travel cards. It is expected that the formal training program will be implemented through regional coordinators over the course of 2007.

Verification and monitoring of card transactions

Centralized payment of acquisition card transactions requires modifications to key controls

1.32 Control frameworks are tools that help management in overseeing operations. An effective control framework incorporates controls that are appropriate for the benefits and risks of a given activity.

1.33 The control framework for acquisition cards uses controls to both prevent and detect problems, to reduce the risks that cards are not properly authorized or used, and to ensure that all corrective actions needed are taken. Key controls for acquisition cards are primarily based on the Financial Administration Act (FAA) and associated Treasury Board policies. The FAA requires that fundamental controls for procuring and paying goods and services be respected.

1.34 Under a traditional invoice the processes of procuring, paying, and verifying a purchase involve applying sections 32, 33, and 34 of the FAA. These three sections require the following:

• that funds be available and committed for the purchase (section 32);
• that no payment for a purchase be made unless it has been properly requisitioned (section 33); and
• that these goods or services be performed, supplied, or rendered, and the price be as stated in the contract—verification—and that the person with delegated financial authority signs that the verification has been completed—certification—(section 34).

All three steps usually take place when a purchase is formally requisitioned and approved before being made and before the invoice is paid. However, with acquisition card purchases in departments that use central billing, the money is paid before all these controls can be implemented.

1.35 Each of the three departments covered by this audit has a central billing process in place to pay acquisition card statements. With central billing, each department receives a consolidated statement from the service provider that incorporates all the cardholder statements across the organization. This combined statement enables each department to make one monthly payment to the service provider. Furthermore, this practice enables a department to make payments quickly (usually within four days) to maximize any rebates available. Being able to act promptly is advantageous, as the size of the rebates to a department is determined by the volume of transactions and the speed with which that department pays its service provider.

1.36 When using acquisition cards in a centralized billing process, departmental staff need to modify the key controls so that they can expedite payments and

• avoid interest charges,
• maximize rebates, and
• allow cardholders the flexibility to make purchases without requiring an excessive number of pre-approvals.

Therefore, departmental staff need to replace the traditional means of applying FAA controls with the exercise of careful control in authorizing and issuing acquisition cards, selecting the credit limit for each card, and applying the Treasury Board Policy on Account Verification.

1.37 The Treasury Board Policy on Account Verification outlines circumstances that allow account verifying and certifying to occur after the payment is made. The quality assurance requirements for the Policy state that those with payment authority must provide assurance that the process of verifying and certifying the purchase is adequate and is being properly and conscientiously followed. When this is the case, the Policy permits departments to apply the account verification required by section 34 after the central bill is paid, as long as the departments are satisfied that their preventive and detective controls are strict enough to reduce or eliminate errors in the payment of acquisition card transactions.

The quality of the verification and certification processes over acquisition card transactions varies

1.38 As part of our audit, we randomly selected 165 acquisition card transactions from the three departments during the 2005 calendar year. We tested whether these transactions had been properly verified and certified and that all were properly supported with invoices. We also tested whether there was proper authorization and approval of the acquisition card and whether cardholders acknowledged their roles and responsibilities (through completed acknowledgement forms).

1.39 Our testing found that all three departments were able to provide appropriate supporting documentation for each transaction. With respect to acknowledgement forms completed by the cardholders, Health Canada could not provide these forms in 38 percent of the cases, and similarly Fisheries and Oceans Canada was unable to provide the forms in 13 percent of the cases. In 99 percent of the cases, National Defence was able to provide these forms.

1.40 We found that the quality of verification and certification work varied widely among the three departments and within each department, as well. Specifically, the results of our testing indicated that the control framework is in place; however, it is not being applied consistently. The results of our examination indicate that the account verification and/or certification process (required by section 34) is not performed in a rigorous manner (Exhibit 1.2). We noted the following problems:

• transactions that had been approved for payment were not subsequently verified and certified;
• transactions were verified and certified by individuals that did not have the delegated authority; and
• transactions were verified and certified by the cardholders who made the transactions, rather than by another authorized individual.

1.41 Among the transactions without appropriate section 34 certification and/or verification, our testing revealed that at Health Canada, all of the transactions involved cardholders who had section 34 authority and who had approved their own card transactions. In our opinion, this practice is not consistent with the fundamental control principle that there be a division of duties between those executing and those approving the transactions. For National Defence, among the transactions without appropriate section 34 certification and/or verification, our testing identified 15 transactions where there was a signature under section 34. However, the department could not produce the signature cards to confirm that the person who was making the certification under section 34 had the delegated authority.

1.42 Our audit also found concerns with the quality assurance aspects of the section 34 verification and certification process, the establishment of credit limits, the card cancellation practices, and inventory control. Specifically, we found the following:

• The quality assurance work was inconsistent among the different departments. In addition, we found that the number of transactions that quality assurance staff reviewed, the nature of their review, the number of staff assigned to the reviews, and the timeliness of the reviews were different within the various regions of the three departments.
• Although Fisheries and Oceans Canada had established guidelines to assist in determining credit limits for acquisition cards, we found that, in some cases, the guidelines were not followed or credit limits were much greater than the expenditure pattern of the cardholder. In addition, we noted that only one of the four regions that we had visited had implemented a plan for a regular review of credit limits to ensure that the limits were in line with Fisheries and Oceans' guidelines. At National Defence, we also noted that there were no established guidelines with respect to credit limits for acquisition cards, that some of the cards had credit limits much greater than the expenditure pattern of the cardholder, and that there was no regular review of these credit limits to ensure they were appropriate for the circumstances.
• The procedures established for cancelling acquisition cards held by employees who had left a department were inconsistently applied in the three departments. For example, at Fisheries and Oceans Canada we found one case where seven employees continued to use the acquisition card of a former employee for government expenses, for one month before the card was cancelled. In addition, at National Defence we found a variation in procedures between military and civilian cardholders. We found strong procedures governing the cancellation of cards held by military personnel; however, departmental coordinators could not assure us that cards for civilian personnel were cancelled in a timely manner.
• When purchases met a department's threshold for being recognized as inventory items, they were not being consistently recorded in the departmental inventory management systems. Specifically, at National Defence we found that four of eight items were not recorded in the inventory management system, although we were able to physically locate all eight items.

1.43 Our audit also found that the acquisition card had been used for the payment of some very large transactions such as refuelling costs. Departments stated that such transactions fell within their delegated payment authority for acquisition card purchases and provided convenience in meeting operational needs. However, we found that these transactions represented a large percentage of the dollar value of transactions undertaken at Fisheries and Oceans Canada and National Defence (Exhibit 1.3).

1.44 As previously outlined, the control framework for acquisition cards effectively relies only on post-payment verification to ensure the appropriate payment of goods and services. As a result we identified high-dollar-value transactions as possibly being subject to a higher degree of risk of error. Therefore, we performed additional audit work on 21 of these transactions.

1.45 The results of our examination of these high-dollar-value transactions also identified failures to properly apply the post-payment verification controls. Specifically, the results of our testing indicated that six of these transactions did not have appropriate section 34 approval. It is our opinion that these high-dollar-value transactions are larger than the typical transactions that the Treasury Board Secretariat (TBS) had in mind when it developed the acquisition card program. For this reason, departments using the acquisition card for these transactions, need to ensure that they consider the inherent risk associated with these transactions and rigorously apply the post-payment verification procedures. The TBS must also ensure, as previously stated, that its policies and procedures are updated to address new risks that might occur with acquisition cards. These additional risks might include the use of acquisition cards for high-dollar-value transactions and the use of some very high credit limits on these cards—one in particular with a limit of $1.5 million. This update would include establishing any limitations or controls over such transactions that are considered necessary to protect the interests of the government as a whole.

1.46 Finally, while the randomly selected and high-dollar-value transactions of our audit did not identify any transactions that resulted in losses or abuse, we also examined the entire database of 2005 transactions for the three departments. Using data mining and analysis software, we identified some questionable transactions, considering the names of the vendors and the nature of the transactions. We performed additional analysis and enquiry of a number of these transactions. In all cases, we found that the post-payment verification controls of the department, combined with monitoring practices of the service provider and the department, had resulted in the timely resolution of any situations that could have subjected the government to a loss of funds.

1.47 We are aware that a risk of misuse exists in any program or payment method and that it is impossible for any control framework to be 100 percent accurate. However, the results of our examination of the controls for verifying and monitoring acquisition card transactions indicate that creating new or more controls is not the most essential step. Rather, it is essential to have departments apply their full attention and diligence to the task of ensuring that existing controls work as intended.

1.48 Recommendation. Fisheries and Oceans Canada, Health Canada, and National Defence should ensure that, on a timely basis, all acquisition card transactions are properly verified and certified, according to section 34 of the Financial Administration Act and as stated in the Treasury Board Policy on Account Verification.

Fisheries and Oceans Canada's response. Fisheries and Oceans Canada agrees. Since the period covered by the scope of the audit, the Department has required that the cardholder's supervisor or manager, who has the appropriate delegated signing authority, sign section 34 of the Acquisition Card Register. This practice will be monitored regionally.

Health Canada's response. All Health Canada acquisition card transactions are properly verified and certified in accordance with section 34; however, Health Canada will strengthen its acquisition card policy to not permit cardholders to verify and certify, under section 34, transactions that the acquisition cardholders have processed.

National Defence's response. National Defence agrees. The Department has increased the level of post-payment compliance reviews to reinforce the importance of section 34 FAA verification and certification. This point is being emphasized as part of the formal training packages currently under development.

Controls over monitoring travel card transactions and delinquencies vary

1.49 Departments are responsible for authorizing, issuing, monitoring, and cancelling the use of travel cards and settling delinquent accounts. Employees are responsible for paying travel card balances and are reimbursed for business travel expenses, once they have completed a travel claim.

1.50 One risk for the government could arise if the employee uses a travel card for non-business purposes and fails to pay the card account balance on time. This means that the government then becomes liable for the account balance. Another risk could arise if the government has reimbursed travel expenses to an employee, who then fails to pay the travel card account balance. The government can control both of these risks by monitoring travel cards closely to identify delinquent (overdue) accounts. We expected that departments would closely monitor the use of cards on a regular and timely basis to reduce these potential risks associated with travel cards, while taking into consideration the ability of the departments to manage the risk of default by using salary-offset provisions.

1.51 We reviewed departments' processes for monitoring transactions incurred on travel cards, and for following up on overdue accounts and recovering any amounts owing where necessary. We found that all three departments managed collection risk by monitoring accounts as they approached the point of default by the cardholder, including reviewing travel card transactions, notifying employees and their managers of the outstanding amounts, and requiring cardholders to pay any outstanding balances. However, on the travel card accounts that were not overdue, departments did not monitor or verify transactions on a regular basis to ensure that they represented only business expenses.

1.52 The three departments also took corrective action at different times. We found that Fisheries and Oceans Canada monitored delinquent accounts and took corrective action when accounts became 60 days overdue. The Department did the following:

• it contacted delinquent cardholders at the 60-day mark,
• it informed their respective managers of the status of accounts, and
• it requested the employees to pay the balance.

Health Canada and National Defence effectively monitored delinquent accounts only when they became 90 days overdue. We note that, according to the subcontract with the service provider, after 90 days, the government has already become liable for the amount owing on the account. For Health Canada, we found that the number of delinquent accounts was minimal. This was not the case for National Defence, and therefore more active monitoring is required at that department to reduce the risk of liability to the government. This may also help reduce the amount of collection work that might be needed later on.

1.53 Recommendation. National Defence, taking into account the risk of default, should more actively monitor its overdue travel card accounts.

National Defence's response. National Defence agrees. The Department is taking steps to increase the early review of delinquent designated travel cards centrally and through regional travel card coordinators. We will be proactive in determining the cause for delinquency and suspending cards at risk for default as they are identified.

Information for managing card programs

1.54 Departments periodically receive information on their card programs from service providers, central agencies, and internal sources such as internal audit or quality assurance reports. This information could range from the specifics of individual transactions to audits or reviews of the card programs. We expected that the departments would use this information, in a timely fashion, to assist in managing their acquisition and travel card programs and to ensure that they would achieve the intended benefits from these cards.

Management information for monitoring acquisition card usage is exception-based

1.55 As part of the contractual relationship between each department and its acquisition card service providers, the department has access to information or reports from the service providers, either electronically or in paper form, about its own spending on acquisition cards. We found evidence that card coordinators reviewed these reports when they were provided in paper form. However, our interviews with staff indicated that the full range of information in the reports that are electronically available are not regularly accessed and reviewed.

1.56 In all three departments we examined, we were informed that reporting to senior management was primarily done only as an exception and occurred only when

• serious issues had arisen,
• senior management requested information, or
• internal audit or reviews were reported.

1.57 In both Fisheries and Oceans Canada and Health Canada, we found little evidence of regular reporting to senior management on the acquisition card programs. However, we noted that Health Canada and National Defence had recently undertaken to work with the service providers to provide key information on how the acquisition card program is operating. In addition, at National Defence, we noted that the Department had created a "watch list" to monitor specific transactions—the results of which led to a 2004 internal audit on acquisition cards.

1.58 Direct communication with the departmental card coordinator also appears to happen on the basis of exceptions. For example, when regional card coordinators identified issues, they did not always bring these issues to the attention of the departmental coordinator. Instead, they frequently reported the issues through their chain-of-command in the region. This practice can restrict the opportunity for program management to quickly become aware of significant issues and to ensure that relevant information is disseminated across the department.

Management information for monitoring travel card usage is appropriate

1.59 With respect to travel cards, American Express (AMEX) provides the departments with access to online activity reports. One report is issued per individual cardholder, which includes the number of days that a cardholder has had an account balance. Since the main risk for departments and the government with travel cards is the cardholder's late payment of the account balances, this information in the activity report is sufficient to manage that risk. In addition, Public Works and Government Services Canada (PWGSC) oversees travel card usage, delinquent accounts, aging reports, and various other types of information on a government-wide basis.

Internal audit and reviews are performed

1.60 Another source of information that management uses for monitoring purposes is internal audit reports. In all three departments we examined, internal audit had performed audits on the use of acquisition cards; these were useful to management in evaluating the performance of their acquisition card program. In 2004, internal audit at both Fisheries and Oceans Canada and Health Canada reported on acquisition cards. For Health Canada, a quality assurance review for the National Capital Region was reported in March 2006. Management action plans for these two departments have been developed to address concerns raised in these audits and reviews. At National Defence, the Chief of Review Services (CRS) performed some work on acquisition cards in 2004. However, at the time of our audit, the CRS internal audit report and action plan had still not been finalized.

1.61 With respect to travel cards, the Audit and Evaluation Directorate at Fisheries and Oceans Canada conducted an audit in 2004 on the use of the travel card program. Neither of the other two departments has performed audits of travel cards, although both have performed audits of travel expenditures.

Information on efficiencies achieved is not fully quantified

1.62 Although there are no recent studies substantiating efficiencies achieved using acquisition cards, in 1998 the government issued a report that identified the acquisition card as the least costly payment method for processing purchases. The 1998 report does not provide a comprehensive analysis of the efficiencies achieved; however, the departments indicated to us that they feel they are in fact achieving efficiencies through the use of the cards. Some examples are as follows:

• Each of the departments we examined had from 140,000 to 391,000 transactions in 2005. Although this amounted to a total of about 750,000 acquisition card transactions, each department would have made only one payment per month to its respective service providers for the consolidated credit card statement received. Without the acquisition and travel cards, a payment would have to be made for almost every transaction, and thus there would be an increase in transactional costs.
• A rebate incentive is provided to the government based on the dollar value of acquisition and travel card expenditures incurred. In 2005, the rebates on the acquisition and travel cards provided to the government were in excess of $5 million.

1.63 Another compelling reason for using cards is the transactional information the acquisition and travel cards enable the government to gather and analyze. For example, this information helps the government and departments identify preferred vendors and can be of great use in negotiating with suppliers to achieve volume discounts and other efficiencies.

1.64 There are also benefits to government employees in using travel cards while on travel status. These include both the convenience of obtaining cash advances to pay for travel costs and various insurance coverages.

1.65 Although increased use of the acquisition cards is being encouraged in the departments we examined, they need to take into consideration that vendors may begin to incorporate the incremental cost of accepting payment by way of an acquisition card (merchant fee) into the price charged to the government. If this is the case, especially for high-dollar-value transactions, payment by way of an acquisition card could become more costly than using the traditional vendor invoice process.

1.66 As a result, while there is anecdotal evidence of various efficiencies through the use of card programs, it is not possible to definitely conclude that the government has achieved its intended benefits from these programs. As the government expands the use of these programs for higher-dollar-value payments or for more payments in general, a more thorough analysis, comparing the benefits of these programs with the incremental costs of managing and monitoring them, is required. This analysis will make it possible to determine if the government is achieving the benefits in excess of the incremental costs of the programs.

1.67 Recommendation. The Treasury Board Secretariat and Public Works and Government Services Canada should monitor developments regarding the evolving practices of acquisition and travel card programs to identify the benefits versus the incremental costs.

The Treasury Board Secretariat's and Public Works and Government Services Canada's response. The Treasury Board Secretariat (TBS) and Public Works and Government Services Canada (PWGSC) agree with the recommendation. Consistent with our business practices, the TBS and PWGSC monitor current and evolving practices related to the acquisition and travel card programs through regular discussions with financial institutions, industry leaders, and other jurisdictions; attendance at conferences and workshops; and review of current periodicals and articles. The TBS also plans to update the Report on Review of the Cost of Various Methods of Payment, which was originally issued in January 1998, to identify the costs related to the Government of Canada payment methodologies, including acquisition cards. The update of this report will provide departments with common information from which to develop their business cases and identify which payment options will result in the best benefits and savings to them. Forecasted completion of this update is 31 March 2009.

Sharing of best practices

Use of best practices by departments can be increased

1.68 As part of our audit, we researched best practices in relation to the control and monitoring of acquisition card transactions and outstanding travel card balances, and we identified four best practices. Two of these best practices are applicable to both travel and acquisition cards (data mining, restriction of card use), while two (quality assurance and central billing) are mainly pertinent to acquisition cards.

1.69 While the best practices for central billing and post-payment verification noted below are being used by many departments, data mining and restriction of card use are not frequently used. The use of these additional best practices can provide management with ongoing assurance that the programs are operating as expected.

1.70 Data mining. This is an analytic process that involves searching large volumes of data for trends and patterns and unusual transactions. It is accomplished by evaluating a population of card transactions or account balances and bringing anomalies between different pieces of information to management's attention. For example, parameters can be set to automatically identify trends or patterns, such as transactions done with questionable vendors, split transactions, or transactions of unusual amounts or relationships. Data mining is a tool that internal audit and management can easily implement to identify emerging problems of fraud, waste, or abuse. It can also provide statistics about purchases for management purposes, by product, and/or by vendor.

1.71 Quality Assurance. This is a practice that allows management to re-examine monthly transactions and to monitor compliance with policies and procedures. The Treasury Board Policy on Account Verification establishes the requirement for departments to carry out post-payment verification and quality assurance activities.

1.72 Restricting the use of cards. This offers numerous opportunities to control the use of cards. This tool allows management to limit, based on a risk assessment, the vendors or the types of transactions that can be processed on a given card. This provides better control over the card and possibly fewer problematic transactions.

1.73 Central billing practice. This allows a department to issue one payment for an entire volume of purchases to the respective card service providers. Departments are now able to download all transactional data from the service providers directly into their departmental financial systems on a regular (often daily) basis. This allows departmental staff to review or validate the transactions on a more immediate basis. This process, when combined with a rigorous post-payment verification process, allows departments to make one payment to the service providers in a controlled and immediate fashion, thus maximizing rebates. The Treasury Board Secretariat highlighted the practice of central billing as one of the best practices followed by all three departments. However, we understand that centralized billing has not yet been implemented throughout the government. We also understand that the centralized billing practice could be used by departments for their designated-responsibility-centre travel card accounts. This could help to ensure timely payments, maximize rebates, and avoid interest charges.

1.74 Departmental coordinators also indicated to us that they feel it would be useful to share best practices with their colleagues from other departments. Methods of disseminating information among managers and users in departments could include, for example, symposia and a shared Internet site containing information, emails, or newsletters. The Interdepartmental Travel Users Working Group has developed a system for sharing best practices in the use of travel cards. It is important that a similar method be developed for sharing best management practices for acquisition cards to increase the use of the advantages offered by these programs, improve the application of control procedures throughout the government, and minimize each department's risk of incurring problematic transactions.

1.75 Recommendation. Departments should make better use of best practices, such as data mining, quality assurance, restricted use, and central billing in managing and monitoring their acquisition card transactions and outstanding travel card balances.

Fisheries and Oceans Canada's response. Fisheries and Oceans Canada agrees. The Department has already developed and implemented best practices related to central billing and quality assurance. The Department's outstanding travel card balances are closely monitored, and delinquent accounts are minimal.

The Department is open to participating in any forums, including interdepartmental sessions to improve on its practices. In 2007–08, the Department will gather additional information on best practices related to data mining and restricted use, and implement these practices, where practical.

Health Canada's response. Health Canada will continue to make use of best practices, where possible.

National Defence's response. National Defence agrees. The Department will continue to expand the use of best practices by building on the monthly reports already in place for the Senior Full- Time Financial Officer. This will include enhancing the level of real-time transaction information available to cardholders through increased access to the online portals for data mining. In conjunction with the implementation of revised standing offers for common goods and services, regional coordinators will also be provided with more information on their authority to restrict card use, where appropriate, to particular commodities and potentially to particular vendors.

1.76 Recommendation. The Treasury Board Secretariat and Public Works and Government Services Canada should establish a forum for sharing best practices for acquisition cards across government.

The Treasury Board Secretariat's and Public Works and Government Services Canada's response. The Treasury Board Secretariat (TBS) and Public Works and Government Services Canada (PWGSC) agree with the recommendation. The TBS and PWGSC recognize the importance of sharing best practices and will examine ways to share and communicate leading practices for acquisition cards across the government. For example, PWGSC held its banking colloquium on 5 March 2007, which included a workshop on best practices related to acquisition card programs. An update of PWGSC's Receiver General Manual, set for 31 March 2008, will contain a chapter on acquisition cards that will include leading practices.

Conclusion

1.77 The travel card program in the three departments that we examined has a control framework in place, which addresses the risks associated with that program. The acquisition card program in the three departments we examined has a control framework in place that relies significantly on post-payment verification and certification to ensure the proper authorization of card transactions. The results of our audit of a sample of acquisition card transactions did not identify any losses or abuse. However, the control frameworks over acquisition cards were not applied in a rigorous manner. It is important that departments strengthen their control over the use of acquisition cards by dealing with the weaknesses—particularly the inconsistent application of verification and certification (as specified in section 34 of the Financial Administration Act), which we noted in this audit. Fixing them will become more crucial, given that departments are interested in using the acquisition cards to a greater extent. As the use of cards increases, so do the risks that must be managed.

1.78 There is anecdotal evidence that efficiencies have been achieved. Nevertheless, in the absence of a comprehensive analysis of incremental costs and benefits, it is not possible to conclude that the government knows whether it has achieved the intended benefits from these programs.

About the Audit

Objective

The objective of this audit was to determine whether the government has an appropriate management control framework over the use of acquisition and designated travel cards and if the government knows whether it is achieving the intended benefits from these programs.

Scope and approach

In our audit, we compared departmental policies, procedures, and practices to determine if they were clear, consistent with the Treasury Board policies, and communicated properly to the parties who are involved in managing and using the cards, so that they are fully aware of their roles and responsibilities.

We assessed, through the use of review and enquiry, whether departments have received, processed, and disseminated information about the use of the cards in a timely manner.

We examined the database of transactions for each of the three departments and tested transactions to determine

• whether departmental systems of control were in place, which would ensure probity and prudence in the use of cards;
• how departments were applying key sections of the Financial Administration Act; and
• how departments were undertaking ongoing monitoring.

We identified the following high-value transactions:

• 23 transactions over $100,000 for Fisheries and Oceans Canada,
• 1 transaction over $8,000 for Health Canada, and
• 7 transactions over $100,000 for National Defence.

Of these high-value transactions, we examined a total of 21:

• 13 transactions from Fisheries and Oceans Canada,
• 1 transaction from Health Canada, and
• 7 transactions from National Defence.

From the remainder of the population of transactions, we randomly selected non-proportional stratified samples. For all three departments, we selected samples in such a way that large-dollar transactions would be proportionally over-represented. All proportions that we are reporting are therefore appropriately weighted to reflect an accurate estimate of findings for the entire population. We selected samples sizes in such a way as to give confidence intervals that would be less than 10 percent at a 90 percent level of confidence. This means that, for this chapter, the margin of sampling error is plus or minus 10 percent, valid 18 times out of 20.

Our audit covered transactions during the period from 1 January 2005 to 31 December 2005.

The departments included in the audit were

• Fisheries and Oceans Canada,
• Health Canada, and
• National Defence.

We also examined the role played by the Treasury Board Secretariat and Public Works and Government Services Canada in these programs.

Criteria

We expected that the Treasury Board Secretariat and Public Works and Government Services Canada would have

• established directives and guidance and best practices on credit cards and expenditure management;
• exercised oversight of the use and management of those cards; and
• ensured that the government was receiving the financial benefits and reporting requirements from the card companies, according to the applicable agreements.

We expected that departments would have

• established policies and procedures that were clear and consistent with the Treasury Board policies;
• developed communication and training practices to ensure that parties involved in managing and using the cards are fully aware of their roles and responsibilities;
• implemented systems of control to ensure probity and prudence in using their cards and that the system of control was functioning as intended;
• received, processed, and disseminated information related to the use of cards in a timely manner to allow for proper management of the cards;
• established regular monitoring practices for the cards, including reviews and audits that would be performed in a timely and complete manner; and
• taken advantage of all financial benefits associated with the cards.

Audit work completed

The audit work for this chapter was substantially completed by 29 September 2006.

Audit Team

Assistant Auditor General: Douglas G. Timmins
Principal: Clyde MacLellan
Lead Director: John Apt
Director: Gaetan Poitras

Daniel Bourgeois
Milan Duvnjak
Yin-Mei Kwok
Albert Melanson
Véronique Pilote
Mohamed Robleh
Tony Shaw
Kari Swarbrick
Reine Vilon

For information, please contact Communications at 613-995-3708 or
1-888-761-5953 (toll-free).

Definitions:

Delegated financial authority—Occurs when government authorizes a specific individual to initiate or approve financial transactions, within established limits. (Return)

Quality assurance of account verification of acquisition card transactions—A practice that allows management to re-examine monthly transactions and to monitor compliance. During this re-examination some transactions and related documents are checked to make certain that the person with delegated authority has signed that the goods or services were provided and that the right price was paid. (Return)

Account verification and certification—Occurs when a person reviews a transaction to ensure that the goods or services were provided and that the price for the goods or services was the same as promised or expected (verification). Then a person with delegated financial authority signs the document to confirm that a review has been performed (certification). Together, both of these actions complete the requirement called "section 34 certification and verification." (Return)