During a recent presentation on detecting and preventing P-Card fraud, speaker Chris Doxey, Doxey Inc., suggested that the program administrator role should be rotated every two years to prevent collusion. I support the spirit of this control, but I’m not sold on the approach. (I’ll invite Chris to comment on this blog post.)
Rotating the responsibility comes with a training cost and it can result in the lack of a P-Card expert within the organization. Instead, focus on training a designated backup.
P-Card program management is a bona fide profession. While many program managers and administrators (PMs/PAs) do not spend 100% of their time on the program, effective program management requires specialized knowledge. Hire the right person for the job—a P-Card expert (look for the CPCP credential) with the skills to:
- establish program buy-in
- articulate and implement P-Card best practices
- identify and resolve control gaps
- quantify and communicate relevant metrics
- suggest growth opportunities
The key to preventing collusion involving the PM/PA lies in other controls, such as separation of duties, enforcing accountability and process audits.
Examples of Separation of Duties
Limit access to the finance system(s), so the PM/PA cannot make payments to the card issuer or edit P-Card transaction information. Someone else should verify that internal records match the card issuer’s documentation (e.g., total spend per cardholder per cycle).
Do not allow the PM/PA to request a new card for an employee and subsequently receive the card in the mail. If it is not possible to separate these duties, ensure that someone else reviews a report from the card issuer of any new cards issued.
To detect cardholder misuse or fraud, including potential cardholder collusion with the PM/PA, managers must be held accountable for:
- monitoring cardholders’ compliance with policies and procedures (P&P)
- reviewing cardholders’ transactions on a timely basis
- reporting any suspicious purchases
As part of the auditing efforts, your internal and/or external auditors should scrutinize the PM/PA, in addition to cardholders and managers, for compliance with program P&P.
It is achievable to have effective P-Card controls and a designated—versus rotating—PM/PA.
About the Author
Blog post author Lynn Larson, CPCP, is the founder of Recharged Education. With more than 15 years of Commercial Card experience, her mission is to make industry education readily accessible to all. Learn more…