Procurement Card Fraud

A lot of organisations, including Deloitte, use Procurement Cards (P-Cards, charge cards or company Credit Cards) (“P-Cards”) to allow quick and easy purchases of goods and services outside of the typical procurement process. The advantages of using P-Cards are that they reduce invoice processing costs (especially for low value items) and they facilitate controlled expenditure. However, why is it that time and time again organisations suffer from fraud and inappropriate procurement practices? These organisations typically have reasonable controls, mature internal audit and procurement functions and clear policies in place - so why is fraud still occurring? Often the fraud occurs because:

• the controls, reporting and follow up wasn’t set up proactively to provide alerts in a timely manner;
• management review of transactions has become lax; and
• generally, New Zealanders are very trusting.

How often does P-Card fraud occur?

Most people think that P-Card fraud can’t happen to them or that it doesn’t occur that frequently. However, this is not the case!  We are regularly instructed to investigate suspected cases of P-Card fraud.

Why is P-Card fraud or abuse an issue or cause for concern?

Some of the recurring issues that we commonly identify whilst conducting fraud detection data analytics and investigations of P-Cards for our clients are:

• Personal expenditure and fraud. Examples of using the P-Cards for personal expenditure range from withdrawing cash for personal expenditure, buying groceries or filling up their personal cars with fuel even though the company has fuel cards etc. In a recent engagement whereby we carried our data analytics for a client, this personal expenditure was not proactively reimbursed by employees until the data analytics results were followed up by the organisation.
• Double dipping.  ‘Double dipping’ is where an individual pays for the expense with their P-Card, but also claims for the expense through an expense claim.

• Excessive and inappropriate expenditure. Often when we conduct data analytics for our clients, it highlights excessive or inappropriate expenditure that was prevalent by certain individuals and/or certain teams. In a recent engagement, our data analytics identified inappropriate expenditure that equated to 1 coffee every day for every employee that had a P-Card! This was despite the organisation recently investing in top-of-the-line coffee machines at significant cost. We have also identified a number of occasions where P-Cards were used for inappropriate entertainment (e.g. strip clubs) by employees that were not picked up in the standard approval processes.

• Circumvention of company procurement policies. Examples we have seen whereby employees have circumvented the procurement process include buying iPads, iPhones, airline tickets and computer monitors because they didn’t want the paperwork and delay of going through the official procurement process. In a recent example where this was identified, the organisation was missing out on significant cost savings from not leveraging mature procurement processes that were already in place. In addition, by allowing this activity to occur, the organisation was at risk of employees abusing the P-Card and using it to purchase Phones, iPads etc for personal use.
• Tax issues. We frequently see examples of managers approving 100% of transactions without reviewing the transactions appropriately and ensuring the transaction is supported by a GST invoice. A consequence of this is that the company might be at risk of claiming the GST for expenses without the relevant GST invoices as required by law.

P-Card fraud and abuse frequently results in the loss of employment as well as civil and criminal action, which requires additional resource.  However, the discovery of fraud often has a significant impact beyond the direct financial cost of the fraud.  As highlighted in our article “Why fraud hurts”, the discovery of fraud also negatively affects the victim organisation’s culture and the perpetrator’s innocent colleagues, as well as damaging the reputations of management and in some cases the board.

What can I do to protect my organisation from P-Card fraud or abuse?

There are number of potential approaches that you could consider implementing to improve your organisation’s controls over P-Card use and give you peace of mind:

• Ensure that the tone at the top matches the culture throughout the organisation. A negative culture or tone at the top makes it much easier for individuals to rationalise negative behaviour because “everyone is doing it”. Our article "Tone at the top: and your fraud levels"provides more information about why this is so important to deter fraud from occurring at your organisation.
• Run regular sessions that refresh and reiterate P-Card policies for managers and employees who approve and use P-cards. Just because your employees signed the policy document when they first obtained the P-Card, doesn’t mean they remember them or won’t plead ignorance if pulled up on inappropriate spending.

• Ensure limits (single purchase, daily and monthly limits) on the cards are in line and commensurate with the role of each employee. Don’t automatically accept a monthly limit of $25,000 on all P-cards just because that’s what the standard amount is.
• Restrict P-Cards to pre-agreed Merchant Category Codes (“MCC”) to ensure cards cannot be spent outside of their intended purpose. If the person is not expected to entertain clients, restrict purchases from restaurants for example.

• Ensure internal reviews of the standard reports are occurring and are being followed up in a timely manner by someone independent of the cardholder. Many systems provide in-built dashboard reporting functionality allowing the reviewer to identify areas of potential concern. Additionally, as a bonus, it doesn’t take long for word to spread that management is monitoring and following up non-compliant expenditure - further deterring inappropriate behaviour.

How can I get comfort that P-Card fraud or abuse hasn’t already happened or isn’t currently occurring?

Data analytics is a powerful and cost effective method for systematically analysing all of your P-Card transactional data (rather than a sample based approach) to identify anomalies, fraud, cost recovery opportunities and/or non-compliance of your organisation’s P-Cards policies. This will allow you to effectively and efficiently narrow down particular non-compliant transactions, individuals or managers effectively and follow up accordingly.

If you have concerns about the P-Card expenditure in your organisation, please do not hesitate to contact David Seath or Lorinda Kelly.