Advisory Alert – Preventing Corporate Card Fraud

By Advisory Practice Lead Robert Wagner and Consulting Manager Jon Tatum

As you are dreaming about the fantastic trips you will be taking with the reward points from your new corporate credit card program, do not forget to implement internal controls around the cards’ usage and payment.

In the July 11, 2017 “CFO Journal” section of the Wall Street Journal, reporter Rheaa Rao writes that, according to a survey by Strategic Treasurer, 20% of finance departments will be investing more in company-backed credit cards this year.

The trend is not new, but the use of payment cards is surging.  The benefits cited include eliminating paperwork, reducing financial stress on employees, speeding up payments, and of course, accruing reward points to either the employees or to the owner.

We are big supporters of all types of digital and streamlined payment processing systems now being used, and more are on the way.  However, we have also seen a disturbing trend in various forms of misappropriation of funds through corporate credit card programs.  All too often, companies with well-defined procedures and internal controls for traditional purchasing and disbursement systems completely ignore those issues when implementing credit card programs.  Under a traditional process, the purchase of a new network server would require a requisition approval, a purchase order, matching of a receiver to the purchase order, sign-off on an invoice, and a final review by the check signer.  In a credit card environment, the purchase could be made with a phone call to the vendor, followed by delivery of the new server, and later, payment of the credit card statement when due, with virtually no review by management.  Is the transaction efficient?  Yes.  Is there a gaping hole in controls when employees learn that significant purchases can be made with little oversight by management?  Also, yes.

Here are 7 procedures to implement to help mitigate the misuse of corporate purchasing cards.

  • Implement and train employees on the proper usage of the card

We have seen instances where companies failed to implement any policies prohibiting the use of corporate credit cards for personal expenses, and as a result, employees who misused the card could not be terminated or disciplined.

At a bare minimum, we recommend specific policies on the proper use of the card and the consequences for misusing it. Employees who have been trained on the proper use of the corporate card should sign-off that they understand and agree to abide by the corporate card policy and that they have received a card.

  • Issue cards judiciously

Be thoughtful about who should receive a card. The best way to do this is to create a policy defining who should have cards.  For example, cards could be issued to those employees who travel more than ten times each year, who purchase office and kitchen supplies, who manage employee professional certification renewals each month, and who purchase certain assets such as shop supplies or online software to support the business.

Also pay attention to the type of card issued. Be sure only credit cards and not debit cards are issued, and do not issue cards with PINs that allow for cash advances.

  • Maintain your standard controls for large purchases

Many companies are now using corporate cards for larger purchases of raw materials, professional services, and capital equipment. For these purchases, we recommend following your normal procedures for requisitions and purchase order or AFE approvals, then having the final approver provide the authorization for use of the card.  This ensures the purchase was properly authorized and approved before it was ordered.

  • The owner or a senior executive should review the credit card statement every month

Our number one recommendation is for the owner or a senior executive of the company who does not record entries into the accounting system to review and approve the credit card statement each month. The reviewer should download the statements himself, ask questions, and request to see supporting documents or approvals for all unusual charges.  Asking questions and seeking explanations and backup documents will keep everyone aware that credit card charges are monitored and reviewed.

In our experience, failure to review the credit card statement or relying on a review by a clerical staff with no authority to question higher ranking employees is a recipe for disaster.  Once employees figure out that no one is going to seriously question their purchases, you can be assured some will take advantage of the lack of oversight.

  • Do not provide accounting personnel with a corporate card

Because accounting personnel are typically highly trusted and often manage office supplies and other small dollar purchases, it seems like an obvious convenience to provide them with a corporate card to take care of these purchases. However, just as you would typically not give accounting personnel the ability to sign checks, you should also not allow them to make purchases on the corporate credit card unless you also implement the recommendation above regarding senior level review of card statements.

We have seen repeated examples of smaller organizations experiencing material fraud in their organizations because a trusted controller or accounting manager had a corporate card, was the only person with access to the credit statements, and could cover his tracks in the accounting records with no oversight from the owner or senior management.

  • Use controls provided by the card issuers

Under most card programs, there are a variety of controls that can be placed on the cards such as credit limits, retail store blocking, and blocking of specific vendors such as Amazon. We highly recommend developing policies that tie roles and responsibilities to specific controls on cards to achieve proper controls and to ensure employees are treated fairly.

  • Manage your program

For your control system over credit cards to be effective, you must manage the program. Make the effort to periodically remind and reinforce the policies and procedures regarding use of the cards.  Be sure your procedures for canceling cards of terminated employees are effective.  Periodically review credit limits and other controls to be sure they have not been relaxed.  Review the list of card holders to be sure that instances of changing responsibilities have not caused certain employees to no longer need their cards.  In short, do not put the program on autopilot.

Payment technology is developing rapidly, with a significant opportunity to drive down the cost of processing procurement and disbursement transactions. Organizations that embrace these technologies must stay vigilant to maintain a strong system of internal controls over company assets.