Summary

California State University: While Its System of Direct Vendor Payments Should Continue, Its Credit Card Program Could Benefit From Better Controls July 2000 96041 rotiduA etatS ainrofilaC S T I D U A E T A T S F O U A E R U B The first five copies of each California State Auditor report are free. Additional copies are $3 each, payable by check or money order. You can obtain reports by contacting the Bureau of State Audits at the following address: California State Auditor Bureau of State Audits 555 Capitol Mall, Suite 300 Sacramento, California 95814 (916) 445-0255 or TDD (916) 445-0255 x 216 OR This report may also be available on the World Wide Web http://www.bsa.ca.gov/bsa/ Alternate format reports available upon request. Permission is granted to reproduce reports. C S A ALIFORNIA TATE UDITOR MARY P. NOBLE STEVEN M. HENDRICKSON ACTING STATE AUDITOR CHIEF DEPUTY STATE AUDITOR July 6, 2000 96041 The Governor of California President pro Tempore of the Senate Speaker of the Assembly State Capitol Sacramento, California 95814 Dear Governor and Legislative Leaders: As required by Chapter 934, Statutes of 1996, the Bureau of State Audits presents its audit report concerning the California State University’s (CSU) system of direct payments to vendors. This report also addresses CSU’s use of state-issued credit cards. This report concludes that, with the exception of some isolated errors, CSU’s payments to vendors were appropriate, properly supported, and documented. With an error rate of less than 1 percent and errors that varied by type, we conclude that no systemic problems exist with the manner in which CSU manages its direct vendor payments. Accordingly, there is no need to return the payment process to the State Controller’s Office, where CSU estimates the cost to the State is greater than when it pays its vendors directly. In addition, although we did not identify widespread abuse of CSU’s procurement cards, we found that a lack of clear policies and insufficient monitoring and enforcement enabled cardholders sometimes to use the procurement card to make questionable and improper purchases. Respectfully submitted, MARY P. NOBLE Acting State Auditor BUREAU OF STATE AUDITS 555 Capitol Mall, Suite 300, Sacramento, California 95814 Telephone: (916) 445-0255 Fax: (916) 327-0019 CONTENTS Summary 1 Introduction 3 Chapter 1 California State University Is Managing Its Direct Vendor Payments Satisfactorily 7 Recommendation 10 Chapter 2 California State University’s Use of State-Issued Credit Cards Is Generally Reasonable but Its Internal Controls Need Improvement 11 Recommendations 24 Appendix A Vendor Payment Errors by Location and Type 27 Appendix B PRO-Card Characteristics Tested and Errors Found 29 Response to the Audit California State University 31 SUMMARY RESULTS IN BRIEF T he State Controller’s Office (controller’s office) normally handles payments to vendors on behalf of state agencies. However, a state law effective January 1, 1997, permits Audit Highlights . . . the California State University (CSU) to pay its vendors directly through December 31, 2001. CSU requested this authority so it Our review of California State could cut costs by reducing the time the controller’s office and University (CSU) revealed that CSU employees spend preparing and reviewing invoices, taking payments to vendors were appropriate, properly advantage of prompt-payment discounts, and using vendors supported, and documented. that offer better pricing. In its analysis supporting the change in Accordingly, there is no need law, CSU estimated that direct payment of vendors would save it to return the payment process approximately $1.2 million annually in better prices and to the State Controller’s Office. processing costs. Although we did not observe widespread abuse, our review The law that allows CSU to pay its vendors directly also requires of CSU’s use of state-issued credit cards also revealed that: the Bureau of State Audits to evaluate CSU’s system and report (cid:1) findings and recommendations to the Legislature no later than Not all purchases receive January 1, 2001. Our review found few problems, all of which review by an appropriate approving official. were isolated rather than systemic. We reviewed 350 payments made during 1997, 1998, and 1999 and found that overall the (cid:1) Some purchases violated payments were appropriate, properly documented, and supported. policies and some purchases were The most prevalent problem—the use of photocopied invoices questionable. rather than originals—occurred in only 8 (2 percent) of the (cid:1) 350 transactions we examined. Although we found few errors Some purchases lacked with payments made by check, we identified more problems with sufficient supporting documentation. payments made by state-issued credit cards. (cid:1) CSU’s chancellor’s CSU also gives credit cards known as PRO-Cards to certain office and campuses could improve their own employees for official purchases. It does this to streamline the practices by learning procurement process and to purchase low-value items economi- about each other’s cally. However, due to weak internal controls—specifically, a lack best practices. of clear policies and insufficient monitoring and enforcement— cardholders sometimes were able to use the credit cards to make questionable or improper purchases. Inconsistent review of credit card purchases by approving officials and accounting and purchasing staff allowed cardholders, on occasion, to purchase alcohol, flowers for other employees, and other questionable items without consequences. Additionally, there was insufficient documentation to verify that 13 percent of the PRO-Card pur- chases we reviewed were appropriate. We further observed that C A L I F O R N I A S T A T E A U D I T O R 1 some campuses have stronger internal controls for PRO-Card use than other campuses have. The CSU chancellor’s office and campuses could learn from each other’s best practices. RECOMMENDATIONS To ensure that the vendor payment system is efficiently admin- istered, the Legislature should enact legislation that allows CSU to continue to pay its vendors directly rather than requiring it to submit claim schedules to the controller’s office for review and payment. To discourage the purchase of personal or inappropriate items, the chancellor’s office and the campuses should prohibit pur- chases such as alcohol, flowers, or other items that could be used for personal benefit, unless the purchase is preapproved and the cardholder demonstrates it meets CSU’s mission. CSU approving officials should ensure that PRO-Card policies are followed and that card purchases are sufficiently supported. They should take appropriate action when staff violate policies. To improve the overall quality and consistency of internal controls over PRO-Cards, the chancellor’s office and campuses should review and consider implementing each other’s best practices. AGENCY COMMENT CSU agrees with our findings and recommendations. How- ever, CSU did not address each of the recommendations, stating only that it is certain that our recommendations will help it to administer the PRO-Card program. Therefore, we look forward to receiving its 60-day, six-month, and one-year responses to the audit to assess steps taken towards implementing our recommendations. (cid:1) 2 C A L I F O R N I A S T A T E A U D I T O R INTRODUCTION BACKGROUND T he California State University (CSU) is a 23-campus, statewide system of comprehensive and polytechnic universities that also includes the California Maritime Academy. A governing board of trustees administers this system and appoints its chancellor, who serves as the system’s chief executive officer, and the campus presidents, who act as the chief executive officers of each respective campus. The board of trustees, the chancellor, and the campus presidents develop systemwide policies. STATE LAW ALLOWS CSU TO PAY ITS VENDORS DIRECTLY The State Controller’s Office (controller’s office) generally writes checks to vendors on behalf of state agencies. The state agencies submit to the controller’s office claim schedules, which summarize payees and amounts to be paid and document agency approval for the payments. The agencies must also attach original invoices from the vendors. During a prepayment audit, the controller’s office reviews selected claim schedules submitted for payment for proper authorization signatures, sufficient appropriation balance to pay the claim, agreement of payee names and amounts with invoices, sufficient supporting documentation, and the reasonableness of the purchase. Generally, the controller’s office audits all claim schedules for more than $5,000 and approximately 10 percent of claims for less than $5,000. To reduce the time required for CSU vendors to receive payment, CSU asked the Legislature for statutory authority to write checks directly to its vendors. Instead of submitting invoices to the controller’s office for review and payment, beginning on January 1, 1997, state law allowed the CSU system to pay its vendors directly. Vendors receive payment through revolving funds under the control of each CSU campus and the chancellor’s office. The controller’s office then reimburses the revolving funds. State law requires CSU to maintain its vendor payment records for three years and to make those records available to the controller’s office for postpayment audit review. A postpayment audit is similar to the review the controller’s office performs for other state agencies before paying their vendors. C A L I F O R N I A S T A T E A U D I T O R 3 Like State Agencies, CSU Participates in the State’s Purchasing Card Program In addition to writing checks to vendors, CSU also makes pur- chases with state credit cards. The State established a purchasing card program to streamline the procurement process and enable state agencies and universities to purchase low-value items economically. CSU generally calls these procurement cards PRO- Cards. Each authorized cardholder is assigned a maximum dollar amount for single purchases and total purchases made in a 30-day billing period. The bank sends the PRO-Card statement to the employee, who reviews and verifies the purchase information. A designated approving official is also required to verify that the cardholder made the purchases for government use. A Recent Postpayment Audit Found Few Problems With Direct Payments The controller’s office conducted a postpayment audit of the vendor payments made by the chancellor’s office and campuses between January 1997 and March 1998, focusing this review on legality, correctness, completeness, and proper documentation. In its report issued in August 1999, the controller’s office identified instances of personal purchases made with state-issued credit cards, payments made without sufficient documentation for transactions, and some instances when staff failed to follow appropriate internal control procedures. Except for these areas of concern, however, the controller’s office concluded that the CSU system has an adequate system of controls. CSU generally agreed with the report findings. SCOPE AND METHODOLOGY Chapter 934, Statutes of 1996, required the Bureau of State Audits to evaluate CSU’s system of direct payments to vendors as autho- rized by the California Government Code, Section 12440.1(a) and to submit a written report of its findings and recommendations to the Legislature on or before January 1, 2001. To gain an understanding of CSU’s vendor payment system, we reviewed the laws, rules, and regulations relevant to its revolving fund accounts. In addition, we determined the procedures the controller’s office performs in its prepayment review of claims state agencies submit. 4 C A L I F O R N I A S T A T E A U D I T O R To determine the effectiveness of CSU’s system of direct payments to vendors, we selected a random sample of vendor payments made at the chancellor’s office and at six campuses between January 1, 1997, and December 31, 1999. We went to the chancellor’s office because it had four times the dollar value of transactions of the campuses that spent the most during the period. We also went to 3 of the 12 campuses that spent the most (Chico, Long Beach, and Pomona) and to 3 of the 11 campuses that spent the least (Dominguez Hills, Maritime Academy, and San Bernardino). We sampled transactions over $500. Although our sample covered 20 percent of all transac- tions during that period, it represented 94 percent of the total dollars the CSU system spent for the period. In its postpayment audit of transactions between January 1997 and March 1998, the controller’s office made 36 campus visits, reviewing some campuses more than once and others not at all. We audited whether the payments made to vendors using CSU revolving funds complied with existing rules. We reviewed each transaction for specific characteristics to verify the appropriateness of the payments. The characteristics, listed in Chapter 1, are similar to those the controller’s office reviews during its Reasons Certain Merchants Are Selected for Review prepayment audits. • We did not, however, Travel—Charges in this category are not allowed by state guidelines: compare the autho- Greatest risk of abuse rizing signature on • the claim schedule to Restaurants; caterers; food, drug, and liquor stores: Greater risk of abuse an agency signature card, nor did we • Apparel, florist, gift, and sporting goods confirm that CSU stores: Moderate risk of abuse had sufficient appro- • Auto parts, shoe stores—Generally smaller priation balances to number and dollar amount of transactions: pay its vendors, Lower risk of abuse information the • Electrical parts, industrial supplies, controller’s office government services: maintains. Not tested—Lowest risk of abuse To determine the effectiveness of the system of controls over PRO-Card purchases, we selected samples of purchases from the chancellor’s office and 12 campuses between August 24, 1998, and October 22, 1999. We categorized PRO-Card transactions into five groups based on the merchant C A L I F O R N I A S T A T E A U D I T O R 5 type and thus the potential level of risk for abuse, as displayed on page 5. These listings identify general types of vendors included in each group but are not comprehensive. Based on the number of transactions for each campus in each merchant category, we sorted the campuses with transactions in the first three groups into high- and low-volume users. We sampled the fourth group—auto parts and shoe stores—at the 12 locations that we tested for PRO-Card purchases or direct vendor payments. We also tested the fourth group at Monterey Bay. We then audited whether the purchases met the characteristics listed in Chapter 2. We found problems in more than one characteristic for some purchases. (cid:1) 6 C A L I F O R N I A S T A T E A U D I T O R CHAPTER 1 California State University Is Managing Its Direct Vendor Payments Satisfactorily CHAPTER SUMMARY A s described in the Introduction, the purpose of this audit was to evaluate the system of direct payments to vendors used by California State University (CSU). After our evaluation of the chancellor’s office and six CSU campuses, we Responsibility for conclude that CSU should continue direct vendor payments as processing payments to authorized by California Government Code, Section 12440. We CSU vendors should not reviewed 350 payments made during 1997, 1998, and 1999 and revert to the State found the payments were, overall, appropriate, properly docu- Controller’s Office. mented, and supported. Testing the payments for at least seven—and in some cases up to nine—characteristics, we found an error rate of less than 1 percent. These errors varied in type, leading us to con- clude that CSU has Characteristics Reviewed for Direct no systemic problems Vendor Payment Transactions in managing its • direct vendor pay- Agreement between purchase and source of funds. ments. The most • prevalent issue, Proper payment authorization. invoices that were • Agreement of payee name and check not originals and amount with vendor invoice. could therefore result • Agreement between payment amount and in duplicate pay- payment summary. ments, arose in only • Adequacy and validity of supporting 8 (2 percent) of the documentation. 350 transactions • Existence of original invoice or certification tested. Further, a that payment was not a duplicate. 1999 review of CSU’s • When applicable, agreement of payment payment process by with terms of contract, lease, or purchase the State Controller’s order. Office (controller’s • Reasonableness of amount paid for goods office) concluded or services received. that, generally, CSU • Taking of discount if available. has an adequate system of internal controls. Accordingly, C A L I F O R N I A S T A T E A U D I T O R 7 there is no need to return the payment process to the controller’s office, where the CSU estimates the costs to the State is greater than when it pays its vendors directly. Our Review Found Few Problems With CSU Payments In our review of 350 of CSU’s vendor transactions, we found an overall error rate of less than 1 percent. We reviewed the transac- tions for seven to nine characteristics, which are listed on page 7. We found only 23 minor problems out of a possible 2,626. These problems were scattered across six of the tested characteristics at five campuses and the chancellor’s office. No location had more than 7 errors (San Bernardino), and no one problem appeared more than eight times (invoices that were not originals). In fact, at one campus—Long Beach—we found no errors. Further, for three of the characteristics tested, we did not find errors at any location. Table 1 shows the locations reviewed along with the number of errors found in our testing of vendor payments. An expanded table showing testing results for each location, by characteristic, appears in Appendix A. TABLE 1 CSU Direct Vendor Payment Errors for 1997, 1998, 1999 Transactions Attributes Percentage Tested Tested Errors of Errors Chancellor’s Office 50 386 4 1.0 Chico 50 368 2 0.5 Dominguez Hills 50 392 3 0.8 Long Beach 50 359 0 0.0 Maritime Academy 50 382 6 1.6 Pomona 50 377 1 0.3 San Bernardino 50 362 7 1.9 Total 350 2,626 23 0.9 8 C A L I F O R N I A S T A T E A U D I T O R The Controller’s Office Review Also Found Few Errors In August 1999, the controller’s office released a report on its postpayment review of the CSU system with results similar to ours. The controller’s office concluded that CSU’s system of internal controls is generally adequate to ensure the legality and propriety of state disbursements. Although this review noted an error rate of 9 percent, many of the problems related to purchases made with CSU credit cards, an area we looked at separately from direct vendor payments. We discuss our review of credit card purchases in Chapter 2. The conclusion the controller’s office reached regarding CSU’s vendor payment process reinforces our results, which did not show any prevalent problems. Transferring the Payment Process to CSU Saves the State Money Having CSU pay its vendors directly results in substantial savings to the State. According to CSU’s analysis supporting the change in law, its handling of payments saves the personnel and mate- rial costs of preparing and sending required documentation to the controller’s office. It also reduces the costs associated with the controller’s office’s review of purchase documentation and payment of CSU vendors. CSU estimates that additional savings arise from its ability to make prompt payments and take discounts on invoices when they are offered. CSU was not usually able to take advantage of prompt-payment discounts because of the time added by submitting payment requests to the controller’s office. CSU further believes that its handling of the payment process has given it access to new vendors offering better pricing in response to more timely payment. According to its analysis supporting the change in the law, CSU estimated that it would save $1.2 million annually by paying its vendors directly. It based its estimate on the results of a two-year pilot project that began in April 1994 at three CSU campuses. Moreover, a study conducted for the chancellor’s office by a consulting firm in 1994 concluded that CSU’s submission of claims to the controller’s office for prepayment review and subsequent payment added little benefit. Coupled with the fact that neither our review nor the controller’s office review found any significant problems, returning the vendor payment process to the controller’s office would be an inefficient use of state resources. C A L I F O R N I A S T A T E A U D I T O R 9 Data submitted by the controller’s office to the Department of Finance on the number of checks issued and the cost of review- ing corresponding documentation and paying vendors for CSU provides additional evidence of savings to the State. The cost for these services decreased from $283,800 for fiscal year 1995-96, the last full fiscal year the controller’s office performed CSU prepayment review and check disbursement, to $22,700 for fiscal year 1997-98, a $261,100 cost reduction.1 RECOMMENDATION To ensure that the vendor payment system is administered efficiently, the Legislature should enact legislation allowing CSU to continue to pay its vendors directly beyond December 31, 2001. (cid:1) 1 The legislation authorizing direct vendor payments also required CSU to pay the controller’s office up to $375,000 for post-payment audits for fiscal years 1996-97 and 1997-98. The controller’s office received the full amount. It is not known if the controller’s office will continue a post-payment review or how much the review will cost. 10 C A L I F O R N I A S T A T E A U D I T O R CHAPTER 2 California State University’s Use of State-Issued Credit Cards Is Generally Reasonable but Its Internal Controls Need Improvement CHAPTER SUMMARY I n our review of state-issued credit cards at CSU chancellor’s office and 12 of its campuses, we found that internal con- trols over the use of these cards need improvement. We reviewed 1,205 purchases made with the CSU credit card (PRO-Card) from August 24, 1998, to October 22, 1999. Although we did not identify widespread abuse, a lack of clear policies and insufficient monitoring and enforcement enabled some cardholders to make questionable and improper purchases. While testing selected PRO-Card purchases for seven to eight characteristics, we found 614 errors out of a possible 8,545, an error rate of 7 percent. These errors varied in type. For example, inconsistent review of PRO-Card purchases by approving officials and accounting and purchasing staff enabled cardholders to purchase without repercussion alcohol, flowers for other employ- ees, and other questionable items. The degree to which the chancellor’s office and the 12 campuses established clear policies and monitored and enforced these policies varied. The chancellor’s office and campuses could improve their own practices by learning about each other’s best practices. CSU’S PRO-CARD PROGRAM NEEDS STRONG INTERNAL CONTROLS TO MINIMIZE ABUSE The goal of CSU’s PRO-Card program, in which credit cards are issued to authorized employees to allow them to make direct purchases, is to streamline the procurement process and facili- tate CSU’s ability to purchase low-value items economically.2 The efficiency afforded by the PRO-Card program is certainly desirable; however, CSU must establish appropriate internal controls to ensure that the cards are used properly. 2 The credit card is known as the CAL-Card among other state agencies. We issued a separate report on CAL-Card use at the seven state departments that most heavily use the program. That report, number 2000-001.3, is entitled “CAL-Card Program: It Has Merits, But It Has Not Reached Its Full Potential.” C A L I F O R N I A S T A T E A U D I T O R 11 State law gives the chief administrative officer of each CSU campus responsibility for the propriety of expenditures of state general funds, gifts, bequests, trust funds, grants, and loans. Accordingly, the chief administrative officer must oversee the implementation of the PRO-Card program, including the establish- ment of internal controls and policies. Internal accounting and administrative control systems are necessary to provide public accountability and should be designed to minimize fraud, abuse, and waste of government funds. By adopting and maintaining internal accounting and administrative controls, state entities provide reasonable assurance that they can protect state assets, provide reliable accounting data, promote operational efficiency, and enforce managerial policies. POLICIES, MONITORING, AND ENFORCEMENT VARY WIDELY AMONG CSU CAMPUSES We found not only Characteristics Reviewed for Each that the PRO-Card PRO-Card Purchase policies at the • chancellor’s office The cardholder certified that all purchases listed on the monthly statement were and each CSU campus correct and made for official CSU differ, but also the purposes. extent to which each • The approving official certified that all campus monitors or purchases listed on the monthly statement enforces its policies were correct and made for official CSU purposes. is inconsistent. Our • review of 1,205 The cardholder submitted detailed original receipts with the monthly statement. PRO-Card purchases • found an overall The cardholder gave written justification for any food or meals purchased; names of error rate of 7 per- attendees at the meeting, event, or meal; cent. We reviewed and a statement explaining how the food the purchases for or meal purchase furthered the mission of the university. seven or eight char- • acteristics. The monthly statement contained sufficient documentation to determine whether all purchases were appropriate As shown in Table 2, and reasonable. we found 614 prob- • Purchases met the business needs of the lems out of a university. potential 8,545. • Purchases complied with the policies of the Appendix B provides chancellor’s office or the campus at which greater detail of the the purchaser was employed. results at each • Purchases were reasonable and location. appropriate. 12 C A L I F O R N I A S T A T E A U D I T O R TABLE 2 PRO-Card Errors August 24, 1998 to October 22, 1999 Purchases Attributes Percentage Tested Tested Errors of Errors Chancellor’s Office 115 855 74 8.7 Chico 15 105 0 0.0 Dominguez Hills 25 175 3 1.7 Fullerton 251 1,817 167 9.2 Hayward 156 1,092 77 7.1 Long Beach 35 245 18 7.3 Maritime Academy 31 217 2 0.9 Monterey Bay 74 518 31 6.0 Northridge 90 630 8 1.3 Pomona 47 329 12 3.6 Sacramento 110 770 71 9.2 San Bernardino 109 763 59 7.7 Stanislaus 147 1,029 92 8.9 Total 1,205 8,545 614 7.2 At some campuses, the approving officials, who ensure that all cardholder purchases are for official purposes, do not consistently sign or monitor the monthly statements to indicate they have reviewed them. Moreover, the failure of many campuses to consis- tently monitor and reprimand cardholders that do not comply with PRO-Card policies allows prohibited purchases to continue. We discovered numerous purchases that did not follow campus policies, as well as instances when campuses lacked specific policies to prevent inappropriate purchases. The absence of documentation, such as justifications for food purchases at some campuses, hindered our ability to determine whether some purchases were appropriate. We also found that some PRO-Cards were used by more than one employee and non-state employees were issued PRO-Cards. Finally, most campuses did not routinely compare travel-related charges, such as conference fees, to travel reimbursement claims, opening the door for duplicate payments. C A L I F O R N I A S T A T E A U D I T O R 13 An Appropriate Approving Official Did Not Review All Purchases The approving officials’ level of review for card purchases varied greatly at the campuses we visited. Of the 1,205 purchases we Some cardholders reviewed, 97 (8 percent) lacked an approving official’s signature approved their own PRO- on the monthly statement or had the incorrect signature. In 29 Card purchases. of those instances, cardholders signed their own statements as the approving official. Two campuses allowed other individuals to approve PRO-Card statements for payment when the approving official was unavailable and the campus did not want to delay payment. Statements missing the official’s signature prompt us to question whether the purchases were properly reviewed, particularly because we were unable to verify that all employees signing in place of the approving official had received the same training on the proper use of the PRO-Card as the assigned official. Although the PRO-Card summaries at 5 of the 12 campuses we visited consistently had appropriate signatures, one campus, San Bernardino, had the highest percentage of missing or incorrect approving official signatures. Of the 109 purchases we reviewed at San Bernardino, 25 (23 percent) had either no signature or the signature of someone other than the designated official. Contributing to this high percentage is San Bernardino’s policy of allowing cardholders who are designated to approve purchase orders to also authorize their own PRO-Card purchases. This lax policy violates a critical internal control element, the separation of duties between employees purchasing items and those approving such purchases. The contract between CSU and the bank that issues PRO-Cards also requires that each cardholder be linked to an approving official. It also states that the approving official’s review and approval of purchases before payment enhances the PRO-Card’s internal controls. There is no justification for linking the authority to approve purchase orders to the authority to approve one’s own PRO-Card purchases. Additional internal controls govern purchase orders; specifically, procurement personnel review them before purchases are made. The PRO-Card does not have this additional level of control, thereby increasing the risk of inappropriate purchases. Even if a cardholder is authorized to approve purchase orders, the additional internal control an authorizing official provides is necessary, given the greater opportunities the PRO-Card affords to make personal or inappropriate charges. 14 C A L I F O R N I A S T A T E A U D I T O R At least two campuses we visited—Stanislaus and Hayward—did not properly designate an approving official for each cardholder. Stanislaus and Hayward did not ensure that approving officials held a supervisory or managerial position of a higher rank than cardholders, but rather allowed the cardholders’ peers or subor- dinates to act as approving officials. For example, the office manager in one department at Hayward acted as the approving The Stanislaus and official for that department’s executive director. Additionally, Hayward campuses do Fullerton permits cardholders to purchase items for the official not ensure that who subsequently approves the purchases even though the approving officials hold purchase could be viewed as being questionable or inappropri- positions of higher rank ate. Because there is little separation between the employee than cardholders do. purchasing the item and the person reviewing the charges, employees may feel pressured to approve a superior’s purchase instead of questioning its appropriateness. Someone Other Than the Approved Cardholder Used Some Cards We found several instances in which cardholders allowed other employees to use their PRO-Cards. Policies governing this use vary by campus. Some prohibit use of a card by someone other than the authorized cardholder; others do not address the issue. We found 31 uses by people other than the cardholder. Allowing such use is a serious breach of internal controls because it is unclear who would be accountable for any improper purchases made by these other users. Although we did not find improper purchases, it is possible that such purchases could be made. The Chancellor’s Office Issued PRO-Cards to Non-State Employees CSU must adhere to the guidelines in its contract with the bank that issues the PRO-Card. It states that the PRO-Card program is intended for university employees only. However, we found that the chancellor’s office provides PRO-Cards to employees of the California State Student Association (CSSA), a nonprofit organiza- tion that represents CSU students. Furthermore, the chancellor’s office exempts CSSA employees from certain restrictions it places on its own employees. For example, CSSA employees may charge travel expenses, including hotels and car rentals, to the PRO-Card, even though the chancellor’s office prohibits its employees from doing so. C A L I F O R N I A S T A T E A U D I T O R 15 Use of the PRO-Card by CSSA employees also raises the question of whether it is appropriate for non-state employees to use state resources. Use of the PRO-Card by CSSA employees requires that CSU employees who administer the PRO-Card program to spend time reviewing and paying the charges. Moreover, CSU may not be protected from liability issues with regard to CSSA employees because non-state employees are not covered in the contract between CSU and the bank that issues the credit cards. Some Purchases Violated Policies; Others Were Questionable Overall, we did not identify widespread personal abuses, but some purchases made with the PRO-Card violated individual campus policies, other purchases appeared unreasonable or inappropriate, and still other purchases appeared personal or did not further CSU’s educational mission. Of 1,205 PRO-Card purchases at the chancellor’s office and 12 campuses, we found 165 with these problems out of a possible 3,615 (4.6 percent). While six campuses had very few problems, we found numerous exceptions at the chancellor’s office and six remaining campuses. Some purchases had more than one problem. In some cases, officials approved payment of charges even though it was obvious that employees were circumventing campus policies that limit their charges. For example, even though Hayward One employee at the specifically prohibits splitting purchases to circumvent authorized Hayward campus charge limits, we found two instances where cardholders violated circumvented purchase that policy. In one instance, an employee was limited to purchases limits by splitting the of $1,000 or less. Nevertheless, she rented a party tent for $1,949 charge in two. and had the vendor split the cost into two separate charges for $950 and $999. Although it was obvious from both the statement and the invoice that the employee had circumvented the controls placed on her use of the PRO-Card, the approving official approved the statement for payment. Even though the tent rental appeared to be business-related, the method used to procure it violated legitimate campus controls. We found other purchases that were prohibited by campus policies and did not appear to further CSU’s educational mission. For example, we found three charges for alcoholic beverages totaling $285. Someone other than the cardholder signed one of the receipts. Other examples of both prohibited and highly question- able purchases included expenditures totaling more than $218 for flowers and plants for other state employees. The appropriate approving officials signed the statements, even though campus policies prohibit such purchases. 16 C A L I F O R N I A S T A T E A U D I T O R We also found questionable purchases that campus PRO-Card policies did not specifically address. For example, employees at Employees at the the chancellor’s office, Hayward, Long Beach, Monterey Bay, chancellor’s office and Sacramento, and Stanislaus used PRO-Cards to purchase $1,027 five campuses charged worth of flowers and plants for new employees and for other $1,027 for plants employees to offer sympathy, thanks, congratulations, and and flowers for get-well wishes. Several employees used PRO-Cards to purchase other employees. gifts. For example, an employee of the chancellor’s office pur- chased costume jewelry costing $43 from Nordstrom. The only annotation on the receipt was “gift.” The recipient was not identified, nor was there any explanation of how this gift fur- thered the educational mission of CSU. We subsequently learned that the recipient was another chancellor’s office employee. These purchases are not items for which a state agency would normally pay; public dollars should not be spent for gifts. CSU employees should purchase gifts for coworkers with their own money. Other purchases that seemed unnecessary included high-priced goods; for example, a leather cellular phone case costing $73 and two organizers totaling $353. If CSU decides it is in its best interests to provide items of this sort to its employees, it can do so less expensively. These purchases are questionable, although not specifically addressed by campus policies. Purchases of snacks, refreshments, and meals for staff meetings, training sessions, and lunches are also questionable. We found three occasions when the chancellor’s office purchased coffee and kitchen supplies for its employees. We also noted numerous instances when Fullerton employees purchased refreshments for their meetings with their PRO-Cards. Other examples included three fruit baskets purchased with an account set up for building maintenance at Stanislaus. The cardholders did not reimburse CSU for these purchases. Some PRO-Card Purchases Lacked Sufficient Supporting Documentation Insufficient documentation prevented us from determining whether a number of the purchases we reviewed were appropriate. This was true for 160 (13 percent) of the 1,205 PRO-Card purchases we reviewed. Some may have been appropriate; others may not have been business-related or in compliance with campus policy. For example, many purchases lacking documentation were for meals. If cardholders do not state the purpose of the meal and who attended, neither we nor any other independent reviewer, including the approving official, can ensure that the meal has a C A L I F O R N I A S T A T E A U D I T O R 17 legitimate business purpose. Of the 260 charges for food purchases tested at five campuses, 96 (37 percent) did not have sufficient documentation to allow reviewers to assess their legitimacy. CSU’s policy regarding meal reimbursement states that payment is limited to circumstances in which employees must conduct Half of the 150 food- official university business during the meal period. To comply related charges we with this criterion for meals or refreshments not associated with reviewed at the Hayward, business travel, the chancellor’s office and the Fullerton campus Sacramento, and require the cardholder to clearly document the meeting agenda, Stanislaus campuses were purpose, and attendees, and to explain how the purchase meets not sufficiently justified. the department’s mission and goals. The chancellor’s office requires that these justifications be approved beforehand. We tested 110 food purchases at the chancellor’s office and Fullerton and found that we could not determine the appropriateness of 21 (19 percent). The remaining three campuses where we tested these purchases—Hayward, Sacramento, and Stanislaus—do not require any justification. In half of 150 food-related items tested at these three campuses, we could not identify the business nature of the purchase, or whether it complied with campus policy, because the purpose was not clearly stated. We also found that some purchases lacked detailed receipts. For instance, documentation for 134 purchases either did not include itemized or detailed receipts, or had no receipt at all. An itemized receipt describes each item purchased and lists its price. If an itemized receipt does not clearly itemize purchases, the cardholder should provide more detail, either by annotating the receipt or by describing the items on a purchase summary, if the campus uses them. Unless campuses establish and enforce a policy stating that purchases must be adequately supported or sufficiently explained, approving officials cannot be certain if the purchase is business-related or allowed under campus policy. The Chancellor’s Office and Most Campuses Do Not Reconcile Travel-Related Charges to Travel Expense Claims PRO-Card policies at all campuses except Fullerton prohibit the charging of travel-related expenses to the PRO-Card. Despite these policies, in some instances, employees were allowed to charge travel-related costs. However, with the exception of Fullerton, which not only allows but encourages employees to use PRO-Cards for travel expenses, the chancellor’s office and many campuses do not reconcile travel-related expenses charged to the PRO-Card with the travel expense claims used to reimburse 18 C A L I F O R N I A S T A T E A U D I T O R employees. For example, many campuses allow fees for out-of-town conferences to be charged to the PRO-Card. Because employees may also list these fees on their travel expense claims as a business expense, the fees could be paid twice if campuses do not reconcile travel expense claims to PRO-Card statements. To ensure that it does not pay for travel-related expenses twice, Fullerton requires its employees to estimate their PRO-Card charges on their travel authorizations and itemize their PRO-Card charges on their travel expense claims. They must also attach documentation for all expenses to the travel expense claim. Many Employees Violate PRO-Card Policies Without Suffering Consequences We found that the campuses inconsistently reprimand employees who repeatedly violate PRO-Card policies, for example, by provid- ing insufficient documentation for purchases. In a few instances, however, a campus did suspend or confiscate PRO-Cards of employees who did not abide by its policies. Recently, Hayward Some campuses, such as initiated a policy requiring cardholders to turn in their monthly Hayward, are beginning statements for payment in a timely manner. Cardholders who to reprimand employees violate this policy twice in a six-month period will have their who repeatedly violate PRO-Card accounts suspended for one month. In February 2000, PRO-Card policies. Hayward suspended the accounts of seven cardholders for this reason. Monitoring adherence to PRO-Card policies enables campuses to reprimand employees who repeatedly violate them. Another shortcoming identified in PRO-Card transactions is the failure of many campuses to identify inappropriate purchases and ensure that staff or faculty reimburse the campus for personal purchases. For example, Fullerton did not consistently review monthly statements for personal or prohibited purchases. Shortly before we began our fieldwork at the campus, Fullerton accounting staff identified purchases totaling $541 by 12 cardholders who had charged inappropriate or personal purchases as much as 13 months earlier. One memo dated March 5, 2000, identified one employee with personal charges totaling $96, including alcohol, from his March 1999 statement. Furthermore, after we found a number of inappropriate purchases and brought them to management’s attention, Fullerton indicated its intent to collect $2,316 from 13 cardholders for personal or inappropriate purchases on statements from December 1998 through September 1999, including $920 in improper purchases we brought to its attention. These purchases included $310 one C A L I F O R N I A S T A T E A U D I T O R 19 department spent on a holiday party, $188 for a faculty member’s farewell luncheon, and two lunches one employee Fullerton plans to collect charged to the PRO-Card. We did observe that Fullerton occa- $2,316 for personal or sionally deducted unallowable travel-related expenses from inappropriate purchases cardholders’ travel expense claims, but this procedure was not made from December 1998 followed consistently. Unless personal charges and related through September 1999. reimbursements are monitored, CSU may not recover all funds due from cardholders. SOME CAMPUSES HAVE STRONGER INTERNAL CONTROLS OVER PRO-CARD USE THAN OTHERS The chancellor’s office and campuses could learn and benefit from each other’s best practices. During our review, we classified the internal controls for the PRO-Card program into three basic components: policies, monitoring, and enforcement. We then identified areas where individual campuses and the chancellor’s office successfully met the goals of each segment of the internal control structure. The policy segment consisted of the policies and procedures that the chancellor’s office and the campuses have implemented for individual cardholders and approving officials to follow. The monitoring portion consisted of the procedures that the chancellor’s office and campuses use to supervise cardholders and the purchases they make. The enforce- ment segment consisted of the policies and procedures that the chancellor’s office and campuses use to enforce all the rules and restrictions applicable to the PRO-Card. Good Policies Identify Prohibited Purchases and Define the Role of Approving Officials Every site we visited has a policy manual that outlines the policies and procedures governing the PRO-Card. Policies for the chancellor’s office and every campus list items that cannot be purchased with the PRO-Card. Campuses also identify items that cardholders can purchase only if they meet certain requirements, such as receiving prior approval. Some of the policies are more effective than others at controlling PRO-Card purchases. Generally, items that are sensitive in nature, including those items that can be for personal benefit (such as gifts or food), items that are an inappropriate use of state funds (such as alcohol), or items that can be obtained through another form of procurement (such as travel-related purchases) are listed as prohib- ited or restricted in the PRO-Card policy manuals. Numerous 20 C A L I F O R N I A S T A T E A U D I T O R campuses appropriately prohibit or restrict various items; however, not every campus does. Further, campuses should specifically prohibit splitting purchases to circumvent dollar limits because the practice is not allowed under the contract between the State and the bank that issues the PRO-Card. However, as Table 3 shows, no site that we visited expressly prohibits all of the sensitive items and splitting purchases. Express prohibitions in their policy manuals would help campuses ensure that cardholders purchase only appropriate items with the PRO-Card. TABLE 3 Practices Expressly Prohibited by PRO-Card Policies Inappropriate Splitting Subordinates as Travel Gifts Alcohol Items Food Purchases Approving Officials Chancellor’s Office (cid:2) ◗ (cid:2) Chico (cid:2) (cid:2) (cid:2) (cid:2) Dominguez Hills (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Fullerton (cid:2) (cid:2) Hayward (cid:2) (cid:2) (cid:2) ◗ (cid:2) Long Beach (cid:2) (cid:2) (cid:2) Maritime Academy (cid:2) (cid:2) ◗ (cid:2) Monterey Bay (cid:2) (cid:2) Northridge (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Pomona (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Sacramento (cid:2) (cid:2) San Bernardino (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Stanislaus (cid:2) (cid:2) (cid:2) (cid:2) (cid:2) Source: PRO-Card policy manuals for the chancellor’s office and campuses. (cid:2) Expressly prohibited. ◗ Restricted rather than expressly prohibited. In addition to including policies for cardholders, the policy manuals also include policies instructing approving officials on their responsibilities within the program. For example, the policy manuals state that the approving official is responsible for verifying that cardholder purchases adhere to applicable policies. To help ensure that a cardholder has a proper approving official, the policies should also define the qualifications of approving officials and train them in their responsibilities. For example, at C A L I F O R N I A S T A T E A U D I T O R 21 Northridge, the policy expressly prohibits a subordinate from becoming an approving official for a superior and prohibits approving officials from approving any purchase that they initiate. Therefore, approving officials cannot approve any of their own or their superiors’ purchases. Good Monitoring Practices Track Improper Activity by Cardholders and Block Inappropriate Purchases The second component of the internal control structure is monitoring. Every campus has a system that enables procure- ment personnel to review cardholder purchases. However, not every campus has an adequate system to monitor cardholders. Some campuses have implemented systems to track cardholders who submit incomplete statements or statements with improper activity, steps for reconciling travel expense claim forms to PRO-Card statements, and procedures that use the built-in controls of the PRO-Card system. San Bernardino, for example, maintains a record of cardholders that submit incomplete statements or have improper charges. San Bernardino documents The campus documents when cardholders do not adhere to violations of card use. policy, as well as when the violations occurred, and reprimands the cardholders with repeated violations. This tracking system allows San Bernardino to easily identify cardholders who misuse their card privileges and take corrective action. Using a tracking system like San Bernardino’s would allow other campuses and the chancellor’s office to identify cardholders who misuse their card privileges and to take action before problems become more serious. Fullerton is another campus with a useful policy. It reconciles travel expense claims to PRO-Card statements with travel expenses. When an employee submits a travel expense claim, Fullerton staff compare it with the employee’s PRO-Card state- ment to ensure that there are no double entries. This procedure ensures that Fullerton does not pay the employee and the vendor for the same expense. The chancellor’s office and most campuses, to varying extent, are using the built-in controls of the PRO-Card to help restrict the purchase of inappropriate items. In addition to assigning dollar limits, CSU can make use of merchant activity codes to prevent cardholders from using the PRO-Card at certain mer- chants. Every vendor’s bank assigns it a four-digit standard industry classification code. The bank that runs the PRO-Card 22 C A L I F O R N I A S T A T E A U D I T O R program has designed a special method of grouping the classifi- cation codes. First, the bank groups the codes based on common goods, services, and types of business. It then assigns a letter to each group, known as a merchant group. When authorizing cards, the chancellor’s office and campuses can assign cardholders a three-digit merchant activity code that specifies the merchant groups from which they can purchase goods or services. For example, code 000 designates that the cardholder is authorized to make purchases from vendors in all merchant groups. If a campus assigns code 397, the cardholder can purchase only from vendors in merchant group I (caterers, restaurants, and bars). Although it is likely that individuals in university advancement or fundraising roles would need to entertain potential donors at restaurants, it is less likely that an employee responsible for vehicle maintenance would have a legitimate business need to make food or drink purchases at a restaurant. Using the merchant activity codes allows the campus to block the vehicle maintenance employee from making a PRO-Card purchase at a restaurant. By utilizing merchant activity codes, the campuses and the chancellor’s office can provide greater assurance the cardholders’ purchases are appropriate. Good Enforcement Practices Show Cardholders That Improper PRO-Card Use Will Not Be Tolerated The third, and final, component of the internal control structure is enforcement. Campuses need to enforce the rules of the PRO- Card system. Every campus we visited told us that they threaten cardholders who do not adhere to policies with warnings, a reduced credit limit, and finally, confiscation of the card. Most campus policies state that excessive violations will result in revocation of the card. For example, in February 2000, Hayward suspended PRO-Cards for seven cardholders because they submit- ted late statements twice within six months. However, not all of the campuses follow through with the prescribed action. Unless The Maritime Academy is the campuses and the chancellor’s office carry out cardholder able to enforce policies by reprimands, problems will continue to exist within the program. conducting a thorough postaudit of cardholders’ The Maritime Academy effectively enforces the policies of its statements. program by conducting a thorough postaudit of its cardholders’ statements. When cardholders submit their monthly statements for payment, staff in the procurement office review the statements for appropriate signatures from the cardholder and the approving official, as well as for receipts and other documentation; they then approve the payment. Two to three months later, staff in the C A L I F O R N I A S T A T E A U D I T O R 23 procurement office review the statements again in more detail. During this second review, staff ensure that prior approval for a purchase was obtained if necessary, all receipts are itemized, and any special requirements for particular purchases were met. If the procurement office finds any problems, it documents them on a form and sends the form to the cardholder and the cardholder’s approving official. The cardholder and the approving official must both sign the form to verify receipt. This process notifies the approving official of any improper activity on a cardholder’s PRO-Card, so that the official can take appropriate action. The other campuses and chancellor’s office should conduct postaudits and take measures to ensure that they notify cardholders and approving officials of any improper activity or mistakes. RECOMMENDATIONS To ensure that the proper officials consistently review all PRO- Card purchases and supporting documentation, the chancellor’s office and each campus should take these actions: (cid:127) Design a clear approval process that takes into account the possibility that approving officials may be unavailable when monthly statements must be approved and forwarded for payment. (cid:127) Ensure that a cardholder’s subordinate or peer is not desig- nated as the approving official. (cid:127) Ensure that approving officials do not approve purchases made on their behalf, which could be viewed as personally benefiting them. To ensure that only authorized employees purchase items on the PRO-Card, the chancellor’s office and each campus should prohibit the use of PRO-Cards by anyone other than the cardholder. To prevent non-state employees from abusing state resources and creating a liability, the chancellor’s office and each campus should ensure that only state employees can receive PRO-Cards. To ensure that personal or inappropriate items are not purchased with PRO-Cards, the chancellor’s office and each campus should expressly prohibit purchases—such as alcohol, food, flowers, gifts, or other items—that could be used for personal benefit, 24 C A L I F O R N I A S T A T E A U D I T O R unless the purchase is preapproved and the cardholder demon- strates that the purchase meets the mission of the university. Food purchases for CSU employees do not meet the mission of the university unless one of the following circumstances exists: (cid:127) Official university business is being conducted with individu- als who are not CSU employees. (cid:127) All CSU employees present are on travel status. (cid:127) The food is purchased for events, such as training, where some CSU employees present are on travel status. Visiting CSU employees who are on travel status should be informed that they cannot claim reimbursement for the meal or should pay the hosting entity for meals if they intend to claim reimbursement. So that reviewing officials can determine the appropriateness of purchases, the chancellor’s office and each campus should do the following: (cid:127) Require that cardholders sufficiently describe the purpose for each purchase. (cid:127) Require as necessary an authorization form prior to the pur- chase; for example, for sensitive items such as food purchases. For food items, this form should include the meeting agenda, the purpose of the meeting, a list of attendees, and an expla- nation of how the purchase meets CSU’s mission and goals. (cid:127) Insist that cardholders include itemized receipts with their monthly PRO-Card statements and annotate receipts lacking sufficient descriptions of purchases. To avoid duplicate payments, the chancellor’s office and each campus should reconcile all travel-related expenses charged to the PRO-Card with employees’ travel expense claims. To ensure that employees follow PRO-Card policies, proper officials take appropriate action for questionable or improper purchases, and, when necessary, employees reimburse CSU for inappropriate PRO-Card charges, the chancellor’s office and each campus should take the following steps: C A L I F O R N I A S T A T E A U D I T O R 25 (cid:127) Track policy violations, including personal charges, and suspend or cancel cards when necessary. (cid:127) Monitor inappropriate charges and subsequent cardholder reimbursements. (cid:127) Create a review process to ensure that cardholders and approving officials comply with PRO-Card policies. To improve the overall quality and consistency of internal controls over PRO-Card use, the chancellor’s office and each campus should review and consider implementing each other’s best practices. We conducted this review under the authority vested in the California State Auditor by Section 8543 et seq. of the California Government Code and according to generally accepted government auditing standards. We limited our review to those areas specified in the audit scope section of this report. Respectfully submitted, MARY P. NOBLE Acting State Auditor Date: July 6, 2000 Staff: Ann K. Campbell, CFE, Audit Principal Jeffrey A. Winston, CPA Russ Hayden, CGFM Fred Bolger Kimberly J. Bootman Virginia Anderson Johnson Alan Ma Leah Northrop Chris Shoop 26 C A L I F O R N I A S T A T E A U D I T O R APPENDIX A Vendor Payment Errors by Location and Type A s described in Chapter 1, we reviewed 350 California State University (CSU) vendor payments at the chancellor’s office and six campuses for at least seven, and in some cases, up to nine, characteristics. We found only 23 problems of a possible 2,626. Table 4 shows the number of errors found for each characteristic reviewed by location tested. C A L I F O R N I A S T A T E A U D I T O R 27 28 C A L I F O R N I A S T A T E A U D I T O R TABLE 4 CSU Direct Vendor Payment Errors for 1997, 1998, 1999 Payee Payment Name Amounts Supported by Charged and Amount Match Supporting Original Contract, Lease, or Transactions Attributes to Correct Payment Match Payment Documentation Invoice Purchase Reasonable Discount Total Tested Tested Fund Authorized Invoice Summary Adequate Attached Order* Costs Taken* Errors Chancellor’s Office 50 386 0 1 0 0 0 2 0 1 0 4 Chico 50 368 0 0 0 0 1 0 0 1 0 2 Dominguez Hills 50 392 0 0 0 0 0 1 1 0 1 3 Long Beach 50 359 0 0 0 0 0 0 0 0 0 0 Maritime Academy 50 382 0 0 0 0 0 2 4 0 0 6 Pomona 50 377 0 0 0 0 0 0 0 0 1 1 San Bernardino 50 362 0 0 0 0 1 3 0 1 2 7 Total 350 2,626 0 1 0 0 2 8 5 3 4 23 * Not tested for every transaction. APPENDIX B PRO-Card Characteristics Tested and Errors Found A s described in Chapter 2, we tested 1,205 PRO-Card purchases at the chancellor’s office and 12 campuses. We reviewed the purchases for seven, and in some cases, eight, characteristics. We found 614 exceptions of a possible 8,545. Table 5 shows, by location tested, the number of errors found for each characteristic reviewed. C A L I F O R N I A S T A T E A U D I T O R 29 30 C A L I F O R N I A S T A T E A U D I T O R TABLE 5 PRO-Card Errors for the Period August 24, 1998 to October 22, 1999 No No Signature No Purchases Attributes Cardholder From Approving Detailed No Meal Insufficient Not Business Purchase Appears Total Tested Tested Signature Official Receipt Justification Documentation Related Prohibited Inappropriate Errors Chancellor’s Office 115 855 1 17 11 15 4 10 5 11 74 Chico 15 105 0 0 0 N/A 0 0 0 0 0 Dominguez Hills 25 175 0 0 1 N/A 0 1 1 0 3 Fullerton 251 1,817 5 16 36 32 34 30 12 2 167 Hayward 156 1,092 0 15 20 * 24 5 4 9 77 Long Beach 35 245 0 0 4 N/A 2 6 0 6 18 Maritime Academy 31 217 0 0 2 N/A 0 0 0 0 2 Monterey Bay 74 518 0 0 6 N/A 9 8 0 8 31 Northridge 90 630 0 2 3 N/A 3 0 0 0 8 Pomona 47 329 2 2 2 N/A 2 2 2 0 12 Sacramento 110 770 0 19 12 * 37 1 1 1 71 San Bernardino 109 763 2 25 9 N/A 11 3 8 1 59 Stanislaus 147 1,029 1 1 28 * 34 9 1 18 92 Totals 1,205 8,545 11 97 134 47 160 75 34 56 614 N/A: No meal-related purchases tested. * Campus does not require approval or justification for meal-related purchases. Agency’s comments provided as text only. The California State University Office of the Chancellor 401 Golden Shore Long Beach, Ca 90802-4210 June 15, 2000 Ms. Mary P. Noble, Acting State Auditor California State Auditor 555 Capital Mall, Suite 300 Sacramento, California 95814 Dear Ms. Noble: We have reviewed your letter dated June 9, 2000, and audit report entitled “California State University: While Its System of Direct Vendor Payments Should Continue, Its Credit Card Program Could Benefit From Better Controls.” We believe the report fairly represents the Direct Vendor Payment and credit card programs, and is consistent with our own reviews and analysis. We are pleased the report supports our position that the University should continue to pay its vendors directly. The University has, over the course of the program, placed great emphasis on ensuring the internal control structure is operating effectively, while still retaining a high level of service to our vendors. The use of credit cards by state agencies requires a marked change in the design of the internal control structures compared to the traditional procurement process. We believe we have made tremendous progress developing, implementing and upgrading the controls over credit card purchases. Although some weaknesses and errors were identified during the audit process, we are certain that your recommendations will help further mitigate risks while retaining the significant transaction cost savings offered by the procurement card program. We are determined to continue to improve the internal control processes of the Univer- sity and appreciate the courtesy and professionalism displayed by your staff during the course of this audit. With kind regards, Sincerely, (Signed by: Charles B. Reed) Charles B. Reed Chancellor C A L I F O R N I A S T A T E A U D I T O R 31 cc: Members of the Legislature Office of the Lieutenant Governor Milton Marks Commission on California State Government Organization and Economy Department of Finance Attorney General State Controller State Treasurer Legislative Analyst Senate Office of Research California Research Bureau Capitol Press 32 C A L I F O R N I A S T A T E A U D I T O R