Criteria or specific requirement: Management is responsible for establishing and maintaining effective internal controls for the proper administration of University corporate credit cards.
Condition and context: During the audit of fiscal year 2022 financial statements, it was noted that usage agreements for all cardholders were either not obtained or not maintained. It was also noted that review of credit card purchases was not adequate for proper management oversight. Although the Purchasing department required all receipts and supporting documentation for credit card purchases as part of the submission of expense reports, no supervisory review of the validity and/or necessity of purchases was performed.
Cause: No process was in place for direct supervisory review of credit card purchases, nor was there a process to follow up on cardholder user agreements that were not obtained upon issuance of a corporate credit card.
Effect: Without appropriate administration over the corporate credit card program, the University is at greater risk of misappropriation and fraud that would not be detected in a timely manner.
Recommendation: We recommend that the University implement procedures to obtain user agreements from every corporate cardholder and perform adequate reviews of credit card purchases in a timely manner.
Views of responsible officials and planned corrective actions: Management concurs with the above finding and, accordingly, has prepared updated credit card policy and procedures for consideration by the University leadership and the University's Board of Regents in alignment with best practices for credit card usage.
118.