Audit Report on the Department of Transportation’s Controls over the Use of Purchasing Cards

EXECUTIVE SUMMARY

The objective of this audit was to determine whether the Department of Transportation (DOT) has adequate controls over its use of purchasing cards (P-cards).  New York City government P-cards are agency-issued credit cards that facilitate quick processing of micro-purchases (up to and including $20,000) and enable invoice payments at a reduced administrative cost.  P-cards allow agencies to obtain goods and services in a timely and efficient manner, eliminate many small dollar value invoices from the accounts payable process, and ensure that vendors are paid promptly.

Agencies and cardholders must comply with the requirements outlined in the Purchasing Card Policies and Guidelines (Citywide Guidelines) issued by the Department of Citywide Administrative Services (DCAS), and Comptroller’s Memorandum #01-1, Guidelines for the Use of Procurement/Purchasing Cards, issued by the New York City Comptroller.

DOT is the City agency responsible for the condition and operation of approximately 6,000 miles of streets, highways and public plazas, 789 bridges and the nine boats in the Staten Island Ferry program.  As of May 2015, DOT had 105 P-card holders.  In addition to the Citywide P-card rules, DOT has its own P-card policies and procedures.  For the period covering January 2014 (when the City transitioned to U.S. Bank as its new P-card vendor) through May 2015, DOT’s P-Card purchases totaled $6.16 million.

Audit Findings and Conclusions

The audit found that DOT has inadequate controls over the use of P-cards.  Although supporting documentation was present for most of the sampled P-card transactions, we found that DOT’s P-card request forms and approved user agreements (which define the conditions for card usage) were not consistently maintained, requests for changes to transaction and monthly limits were not consistently documented, and required approvals were not consistently obtained and/or maintained.  In addition, we found deficiencies such as improperly completed P-card checklists, transaction logs that were not approved, limited evidence of split purchase reviews, and late submission of P-card packages.  Furthermore, there was a lack of segregation of duties between the purchaser and receiver of P-card purchases and there were inadequate controls over the inventory of equipment purchased with the P-cards.

Audit Recommendations

Based on the audit we make 15 recommendations, including:

• DOT should ensure that properly approved P-card Request Forms and user agreements are maintained.

• DOT should ensure that all transaction limit changes, including those greater than $10,000, are properly documented and approved on the required forms and that the forms are maintained.

• DOT should ensure that the transaction logs are properly approved by the cardholders’ approver/manager.

• DOT should ensure that cardholders’ approvers strengthen their monitoring of the P-card transactions and ensure that checklists are properly completed and required steps performed before certifying the transaction packages.

• DOT should ensure that a review of transactions is conducted to identify possible split purchases and that an adequate inquiry into these purchases is performed and documented.

• DOT should ensure the timely submission of payment packages by cardholders.

• DOT should ensure that the functions of ordering and receiving goods and services are adequately segregated.

• DOT should ensure that all inventory items are tagged, recorded, and accounted for and that periodic reconciliations are done for all inventoried items purchased with P-cards.

Agency Response

In its response, DOT disagreed with the findings and recommendations, stating that no corrective action is required for eight of the 15 recommendations and that no further corrective action is required for four.  DOT stated that it will consider implementing or has implemented the remaining three recommendations.

Overall, DOT disagreed with the audit’s findings and presented a number of arguments in support of its contention that the audit’s assessment is inaccurate.  However, the arguments that DOT presents reflect a lack of understanding of internal controls, the standards by which we conduct our audits, and the audit’s objective.

Throughout its response, DOT appears to argue that the fact that the agency has procedures governing the P-card program is an indication that its internal controls are adequate.  However, having a set of procedures in and of itself is not indicative of an adequate system of controls; those procedures must also be followed on a consistent basis.  According to Generally Accepted Government Auditing Standards (GAGAS) Section 6.21, failure to do so constitutes an operational deficiency.  DOT’s apparent unwillingness to recognize this important distinction is of concern to us and raises doubts as to its ability to correct the deficiencies identified in this report.

DOT also argues that the audit did not adhere to certain aspects of GAGAS.  However, DOT’s arguments are based on a misunderstanding of GAGAS and, at times, the audit findings themselves.  For example, DOT states in its response that “the cause of some audit findings were not always properly identified and/or included, which is required by GAGAS as an element of a finding.”  DOT incorrectly references GAGAS Section 6.76 to support its claim.  However, rather than supporting DOT’s contention, Section 6.76 merely explains the concept of “cause” when it is included as an element of a finding.  In fact, rather than supporting DOT’s position, GAGAS Section 6.73 expressly states that the finding elements identified in an audit depend on the objectives of that audit and that, depending on the audit objectives, the development of certain elements (such as the cause) may not be necessary.

DOT also contends that the auditors did not properly consider or present information that was provided during the course of the audit.  However, that is not the case.  Rather than failing to consider all the information we received, the auditors did in fact carefully review and consider everything DOT provided.  However, we do not agree with DOT that some of the information it presented constituted sufficient evidence to cause us to alter our findings.  In accordance with GAGAS, we relied on sufficient, appropriate evidence to form our judgments.  The fact that our view of the evidence differs from that of DOT does not reflect a failure to adhere to GAGAS, but instead reflects the independent exercise of our judgment, as is required by GAGAS.

In summary, after carefully considering DOT’s response, we found its arguments to be without merit and find no basis to alter our audit findings.

The full text of DOT’s response is included as an addendum to this report.