Transportation, California Department of - Cal-Card Program

CALIFORNIA DEPARTMENT OF TRANSPORTATION Review Report CAL-CARD PROGRAM July 1, 2015, through June 30, 2017 BETTY T. YEE California State Controller December 2018 BETTY T. YEE California State Controller December 12, 2018 William E. Lewis, Assistant Director California Department of Transportation 1304 O Street Sacramento, CA 95814 Dear Mr. Lewis: We reviewed the CAL-Card program of the California Department of Transportation (Caltrans) to determine whether Caltrans complied with the terms and conditions specified in the Memorandum of Understanding between Caltrans and the State Controller’s Office (SCO) effective March 2013; has effective internal controls to ensure that purchases were legal, proper, and in accordance with Cal-Card program guidelines; and maintained adequate documentation to support CAL-Card purchases and claims submitted to SCO. The engagement review period was from July 1, 2015, through June 30, 2017. We noted that Caltrans does not:  Adequately review CAL-Card purchase orders to ensure that they are in compliance with documented process and procedures; and  Ensure that assets over $500 purchased with CAL-Cards are properly tagged, as required by Caltrans process and procedures. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by JEFFREY V. BROWNFIELD, CPA Chief, Division of Audits JVB/as Attachment California Department of Transportation CAL-Card Program Review Contents Review Report Summary ................................................................................................................................ 1 Review Authority .................................................................................................................. 1 Background ............................................................................................................................ 1 Objectives, Scope, and Methodology ................................................................................... 2 Conclusion .............................................................................................................................. 3 Follow-up on Prior Audit Findings ..................................................................................... 3 Views of Responsible Officials ............................................................................................. 3 Restricted Use ........................................................................................................................ 3 Findings and Recommendations ............................................................................................. 4 Attachment—California Department of Transportation’s Response to Draft Review Report California Department of Transportation CAL-Card Program Review Review Report Summary We reviewed the CAL-Card program of the California Department of Transportation (Caltrans) to determine whether Caltrans complied with the terms and conditions specified in the Memorandum of Understanding (MOU) between Caltrans and the State Controller’s Office (SCO) effective March 2013; has effective internal controls to ensure that purchases were legal, proper, and in accordance with Cal-Card program guidelines; and maintained adequate documentation to support CAL-Card purchases and claims submitted to SCO. The engagement review period was from July 1, 2015, through June 30, 2017. We noted that Caltrans does not:  Adequately review CAL-Card purchase orders (CPOs) to ensure that they are in compliance with documented process and procedures; and  Ensure that assets over $500 purchased with CAL-Cards are properly tagged, as required by Caltrans process and procedures. Review We conducted the review pursuant to Government Code (GC) Authority section 12410, which states, “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” In addition, GC section 12411 states, “The Controller shall suggest plans for the improvement and management of the public revenues.” Background Caltrans uses the CAL-Card program to purchase business items necessary to carry out its daily activities. On March 1, 2013, Caltrans revised an MOU with SCO regarding the CAL-Card program, which was originally established in December 1997. The MOU defines the terms that Caltrans accepts as a condition of receiving the delegated responsibility from SCO for the review and retention of CAL-Card-program purchasing documentation. Overview of the Caltrans CAL-Card Program Caltrans’ Division of Procurement and Contracts (DPAC) administers the CAL-Card program to ensure departmental compliance. It is responsible for developing written policies and procedures and control mechanisms to ensure that Caltrans remains compliant. It is primarily responsible for providing training to and ensuring that all cardholders and card managers stay current on their yearly training requirements. The Division of Accounting (DofA) assists with training as requested by DPAC. When cardholders have not met their training requirements, DPAC reduces their spending limits to $1. In addition, DPAC is responsible for monitoring activity to ensure compliance. -1- California Department of Transportation CAL-Card Program Review DPAC works with DofA to monitor activity on the CAL-Cards. DofA completes a full review of every transaction prior to payment of the card statements. It validates the signatures for requestor and approver, and matches various other items from the CPO to the invoice. Any questionable transactions are flagged and sent to DPAC for further research. DPAC will decide if the transaction is a violation of policies and procedures or if it is compliant. DPAC uses a strike system to reprimand cardholders for violations. Each strike stays on the cardholder’s record for 18 months from date of issuance, and three strikes result in the cardholder losing CAL-Card privileges for one year. Objectives, Scope, The review period was July 1, 2015, through June 30, 2017. Our review assessed the Caltrans CAL-Card program to gain a reasonable assurance and Methodology that payments are legal, proper, and have sufficient supporting documentation; and to verify that Caltrans is in compliance with the MOU between Caltrans and SCO effective March 1, 2013. Our review objectives were to determine whether Caltrans:  Complied with the terms and conditions specified in the MOU;  Has effective internal controls to ensure purchases were legal, proper, and in accordance with CAL-Card program guidelines; and  Maintained adequate documentation to support CAL-Card purchases and claims submitted to the SCO. To achieve our review objectives, we:  Reviewed Caltrans’ policies and procedures for the CAL-Card program;  Reviewed the MOU between Caltrans and SCO;  Reviewed prior audit reports by SCO and Caltrans’ Audits and Investigations;  Interviewed Caltrans management and supervisory personnel and other staff to gain an understanding of the operations and activities within their respective divisions/units; and  Reviewed a sample of claim schedules and cardholder statements of accounts to verify compliance with applicable regulations relating to CAL-Card usage, and determine whether Caltrans’ documentation and procedures are in compliance with the MOU. The population for this review was 72,623 CAL-Card transactions totaling $67,131,434. Due to the large volume of transactions, we determined that three sampling methodologies should be used to gain a fair representation of the population. We reviewed source documents as follows:  Selected 49 samples totaling $66,495 on a statistical random sample basis;  Selected 19 samples totaling $118,557 on a stratified judgmental sample basis—a sample consists of two transactions on the same day totaling over $5,000. Testing was performed to determine whether -2- California Department of Transportation CAL-Card Program Review employees split transactions to circumvent the single purchase limit of $5,000; and  Selected 114 samples totaling $ 234,246 on a judgmental basis. Conclusion Our review found instances of noncompliance with the requirements outlined in the Objectives, Scope, and Methodology section. These instances are described in the Findings and Recommendations section of this review report. Follow-up on We reviewed one prior SCO CAL-Card audit report (dated June 2016 for Prior Audit the period of July 1, 2012, through June 30, 2015), one prior Caltrans CAL-Card audit report (dated June 2015 for the period of July 1, 2012, Findings through June 30, 2014), and one Caltrans audit report (dated April 2016 for the period of October 1, 2013, through June 30, 2015) titled Final Audit Report of the California Department of Services Contract Delegation Audit, and determined whether Caltrans had performed corrective action on findings in these reports and how the previous findings would impact our current review. We determined that Caltrans implemented procedures to notify by email all card holders more frequently to remind them of the policies and procedures. However, this procedure has not corrected the problems identified by our previous audits and this review. Therefore, we adjusted our review testing to identify and re-assess management’s efforts in improving oversight of these areas. The findings identified in this review address our assessment of this follow-up. Views of We issued a draft report on June 29, 2018. William E. Lewis, Assistant Director, Caltrans, responded by letter dated July 13, 2018. Mr. Lewis Responsible agreed with the review results. Mr. Lewis’ response is included as an Officials attachment to this report. Restricted Use This report is intended solely for the information and use of Caltrans and the SCO; it is not intended to be and should not be used by anyone other than these specific parties. This restriction is not intended to limit the distribution of this review report, which is a matter of public record. Original signed by JEFFREY V. BROWNFIELD Chief, Division of Audits December 12, 2018 -3- California Department of Transportation CAL-Card Program Review Findings and Recommendations FINDING 1— During our review, we noted several instances of purchases with CPOs that were not in compliance with the policies and procedures set forth by Inadequate review of DPAC. Of the 202 transactions reviewed, 68 transactions, or 34%, were CAL-Card Purchase made prior to the approval date of the CPO. There were 54 other instances Orders wherein:  The CPO lacked an adequate description that included the benefit to the State;  Transactions appeared to be split to circumvent the single-purchase spending limits; and  Supporting documentation for training purchases lacked dates and descriptions of the training. DPAC maintains an Acquisitions Manual for all Caltrans employees to use for purchasing. The manual contains a section that is specific to making purchases using the CAL-Card. It provides for the responsibilities of the cardholder and the card manager, and establishes the necessary requirements for each purchase. DPAC Acquisitions Manual section 12.2.10.A states, “…the Cardholder’s Responsibility (14) Obtain Supervisor or CAL-Card Manager approval prior to purchase.” DPAC Acquisitions Manual section 12.2.9.B states, “The CAL-Card Manager’s Responsibilities (1) Ensure that the Cardholder has prepared and obtained supervisory approval for the CPO (STD. 65), prior to the purchase, to support each purchase.” DPAC Acquisitions Manual, section 12.3.2, CPO STD. 65 states: (A) Purchases using the CAL-Card as a payment mechanism must follow the applicable purchasing requirements as outlined in this Acquisition Manual. (C) All purchases must be for official State business and in accordance with this Acquisition Manual. Approval is necessary before making any purchase, and it must be documented in the CAL-Card procurement file....Justification should specify the benefit to the state in the body of the CPO... (D) The CPO shall be prepared prior to making the purchase. If an emergency has occurred, the CPO should be done within five working days of the transaction... DPAC Acquisitions Manual, section 12.3.1, Spending Limitations states: (A) Regular Cards: Goods and services purchased via CAL-Card must be within the Cardholder's single purchase limit and a CAL-Card Purchase Order 9CPO) STD. 65 must be used for every purchase.  Single Purchase Limit: $4,999.99 for any single purchase transaction -4- California Department of Transportation CAL-Card Program Review DPAC Acquisitions Manual, section 12.5.2, Splitting Purchases/ Exceeding the Single Purchase Limit states: (A) Public Contract Code (PCC) 10329 states that ‘No person shall willfully split a single transaction into a series of transactions for the purpose of evading the bidding requirements of this article.’ Also the Department may not split an order to circumvent the limits of its delegated purchasing authority. Periodic replenishment of consumable supplies is not considered splitting an order. (B) Orders shall not be split to circumvent competitive bidding, advertising, or the single purchase limit of the card. Examples of splitting include, but are not limited to, the following: 1. Splitting one purchase transaction into two or more card swipes because the purchase total exceeds the $5000 single purchase limit. 2. Using more than one purchasing method (i.e., Service Agreement Under $5000, Purchase Order and CAL-Card) which in total will circumvent the single purchase limit. 3. Multiple Cardholders in the same unit acquiring the same goods or services needed by the program for the same acquisition from one or more vendors. 4. Using multiple Cardholders to obtain the same goods or services needed by a program from the same vendor. 5. Acquiring the same goods or services for different locations by the Cardholder on separate transactions. 6. Cardholder making purchases of the same goods or services from different vendors for the same single transaction. 7. Cardholders in separate units procuring various aspects of an acquisition or project. 8. Cardholder splits a series of related services that would normally be combined and bid as one job cannot be split into separate tasks, steps, phases, locations, or delivery times to avoid adhering to a state law, policy or departmental procedure. 9. Equipment rental: The practice of breaking up equipment rental invoices into $2,500 (billings by post miles) constitutes splitting. These services require a contract to be written. Split equipment rental purchases will result in the finding of a prohibited purchase and intervention by the CAL-Card Branch. DPAC Acquisitions Manual, section 12.5.10, Open Training Coupons/ Vouchers states: The CAL-Card cannot be used to purchase non-descriptive training, i.e., lacking date, location of training and employee name (violates prepayment provisions of SAM §3571.1). Additionally, payment for training not provided until a later billing period is a prohibited prepayment. The card manager is responsible for reviewing and approving the cardholder’s Statement of Account (SOA) every month. In all 122 instances of non-compliance, SOAs were approved by the card manager, indicating that the CPOs and supporting documentation had been reviewed, and that the purchases and supporting documentation had been completed correctly. -5- California Department of Transportation CAL-Card Program Review DofA performs a complete review of all transactions monthly. While it ensures that the information on receipts matches the information on the CPO and that the CPO requestor and approver are different signatures, DofA does not verify that the CPO was approved prior to the purchase, or that the description is adequate. DofA only performs a cursory review of the transactions, and flags any purchases that might be in violation of the rules. The flagged items are sent to DPAC for further review. Of the 122 instances of non-compliance, only 21, or 17%, were flagged by DofA and sent to DPAC for further review. Recommendation We recommend that DPAC work with DofA to design criteria for DofA staff members to use when reviewing SOAs to ensure that CAL-Card procedures are being followed. Caltrans’ Response Caltrans agreed with the finding. FINDING 2— Caltrans does not adequately ensure that assets over $500 purchased with Caltrans lacks adequate a CAL-Card are properly tagged, as required by its processes and procedures. Of the 202 transactions that we reviewed, 25 contained one or procedures to monitor more pieces of equipment over $500 purchased using the CAL-Card. tagging of assets over DPAC was only able to confirm that one of these pieces of equipment was $500 properly tagged; for another transaction, the employee was issued a strike for improperly tagging equipment. For the other 23 transactions, it is unclear whether the purchased equipment was properly tagged or not. DPAC Acquisitions Manual, section 12.4.6, Equipment Purchases (A) states, “In accordance with SAM sections 8650-8652, all equipment costing $500 or more must be controlled, identified, tagged, and promptly recorded in the Department’s Property Database.” DPAC’s current procedures for equipment tagging place the responsibility for ensuring that items are tagged with the cardholder. DPAC is not notified when equipment is purchased. This process does not allow DPAC to monitor and ensure that equipment purchased via CAL-Card is properly tagged. As small equipment purchases (such as chain saws, grinders, etc.) are typical, these items have a higher risk of becoming a loss. Recommendation We recommend that DPAC work with cardholders, card managers, and DofA to develop an auditing strategy that allows them to ensure that assets over $500 are properly tagged and tracked in Caltrans’ property database. Caltrans’ Response Caltrans agreed with the finding. -6- California Department of Transportation CAL-Card Program Review Attachment— California Department of Transportation’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-CCP-9000