JPMorgan has issued a report titled “Auditing and Compliance Strategies for a Solid Purchasing Card Program” in which some of the nation’s leading companies and universities share real-world best practices for better detecting and controlling purchasing card misuse and out-of-policy spending.
As organisations continue to rank purchasing card compliance as a top business priority, dozens of JPMorgan commercial card customers offered insights on effective steps they have taken to improve procurement practices and safeguard against purchasing card fraud.
Those surveyed included Arizona State University, Chevron Corporation, ConocoPhillips, George Washington University, International Paper, Monsanto Company, Sears Holdings Corporation, ServiceMaster, Starbucks, University of Illinois, University of Maine System, University of North Texas, University of Pennsylvania and Yale University.
“In today’s highly regulated environment where the main focus is on compliance and auditing controls, a purchasing card program provides the foundation and visibility tools to better manage corporate spending. By following the best practices and innovative strategies shared by some of JPMorgan’s purchasing card customers, organisations are better positioned to launch an effective card program, improve compliance and auditing processes and practices, and further accelerate efficiency,” says Rich Erario, managing director, Commercial Card and Electronic Procurement, Invoicing and Payables, JPMorgan.
Technology is key to helping card administrators more effectively pinpoint potential card misuse and guide the back-end auditing process. Best-in-class systems enable administrators to block unauthorised purchase categories, monitor corporate compliance, modify spending limits and cancel cards. The card administrators at Starbucks use an online reporting tool on a daily basis to oversee spending in real-time.
Education and a clear understanding of cardholder roles and responsibilities are vital to any programme. Once an application is received, companies should consider having card applicants participate in some form of training course before they receive their card. Best-in-class companies keep education at the forefront and train early and often. Chevron Corporation employees are required to take a training course every two years to continue using the card. Monsanto requires that its cardholders take a computer-based training course and receive a score of at least 100% in order to apply for their card. Upon completion of the course, users receive a ‘digital diploma’ or certificate that then must be submitted along with their application.
Best-in-class organisations enhance their auditing practices by looking beyond traditional controls such as cardholder spending limits and restricted Merchant Category Codes. Organizations should consider conducting audits on purchases that are made in the evening or on weekends. Purchases that are shipped to an individual’s home as opposed to campus or a business address should also be investigated. Other items that could be red-flagged are personal technology purchases such as computers, cell phones, PDAs and items acquired using PayPal or through sites like eBay.
To mitigate improper card use and help support Sarbanes-Oxley requirements, best-in-class organizations also perform ongoing peer reviews of purchasing practices well in advance of regularly scheduled audits. International Paper’s purchasing card practices are audited every other year by internal audit. In anticipation of these audits, cursory peer reviews are conducted annually at each location. Divisions also perform monthly transactional reviews. The purchasing card program at Monsanto is audited at least twice a year, once by an internal team and once by an external firm. Card administrators prepare for these audits by conducting approximately 8 random audits per month and reviewing at least 40% of spend.