Why P-Card / T&E audits can be a good "first" data analysis project?

For those of you who don't follow me on Twitter, (i.e. - the whole world, less 91 people), you may have missed Cal State's recent audit released on December 3 that documented that more than $150,000 in "Improper and Wasteful Expenses" were paid to a very "senior official" in the California State University system. Subsequently it has been reported by Fox 40 that the official is David Ernst, who is currently CIO of the University of California System, according to this release from June 2008. At least, until the UC Union has their way.

Given the tremendous budget challenges throughout California, including the 32% tuition hike that has been national news for most of the last month, this is a most unfortunate time for the incident to come to light. Imagine explaining this hire to the press, given the current budget climate. Reputation risk, for both Cal State and the University of California Systems, far exceeds the amount of these "Improper and Wasteful Expenses".

But there are other, numerous reasons to begin a data analysis and anti-fraud program with P-Card / T&E. More obvious answers are that the data is consistent regardless of organization or industry, that the datasets are normally simple, and that policies are generally easy to interpret. Less obvious answers are that T&E controls provided by banks, such as Merchant Category Codes and Card Limits are useful, but incomplete without comparing to enterprise data like employee leave or termination dates that can be done with modern data analysis software.

My belief is that T&E are a great place to begin a data analysis program, because they may be red flags for other transactions that should be reviewed. I learned this on a project more than 10 years ago, when I was leading an investigation of T&E fraud for an IT Director at a Fortune 500 firm. Through data analysis, we had uncovered a scheme where that Director had stolen more than $50,000, through a pattern of submitting multiple charges for a business trip. One of the team members suggested that we should look at other transactions that the fraudster had approved, and that's when everything hit the fan.

It turns out that T&E fraud at this Company wasn't enough to support the Director's spending habits, so the individual had also established a fictitious vendor scheme that netted more than $1 million in fraudulent disbursements. The investigative team discovered the second, larger fraud by reviewing all other transactions that the fraudster had approved.

So whatever the reason, if you're not using data analysis to review the entire population of P-Card and T&E spend, we recommend you consider it. And if you are reviewing the entire population of transactions, we recommend you do it more frequently. Given that the above expenses were not identified until more than four years after the "Improper and Wasteful Spending" began, and more than 18 months after the official left CSU, this will be a much more expensive and messy incident to resolve.

Stay tuned. Given the current environment, this should be an interesting one.

Joe Oringel

Visual Risk IQ

Charlotte NC, USA

Can I have a Waverunner with that?

Public sector abuse of P-Cards continues to be rampant.  The Dallas Independent School District, Knox County TN, Wake County NC, and more recently in Georgia, as reported in the Atlanta Journal Constitution.   In this recent Georgia case, an administrator for Georgia Tech used her P-Card to make nearly 3,000 fraudulent purchases totaling more than $300,000.  

The Georgia Tech administrator, Donna Gamble, has pled guilty to 22 counts of mail fraud and theft, and will be sentenced later this month in Federal Court.  Among her unauthorized purchases with federal grant monies included a Waverunner personal watercraft and lawn tractors.

Public and private sector organizations are replacing expensive purchase orders and procurement processes with P-Cards, as the cost per transactions is very favorable.  Aberdeen Research shows that P-Card purchases often cost less than 1/3 the amount of more traditional purchase order and invoice purchases.  Yet these P-Card purchases introduce more risk, and all types of organizations are challenged by how to best control and monitor credit card spend.  

Supervisory review, transaction review by a central p-card administrator, and limiting card usage at certain merchants and merchant types are all controls that organizations use to ensure charges are authorized and in compliance with preferred vendor agreements.   But the news headlines suggest strongly that these controls are not sufficient.

Stay tuned in coming weeks as we look to chronicle other organizations that have implemented continuous controls monitoring for frequent, in-depth, and efficient transaction review.

Joe Oringel
Visual Risk IQ
Charlotte NC, USA

Procurement Card Fraud at the Dallas Independent School Board - Could this happen to you?

Though my Blogger account seemingly allows nearly unlimited storage, there may not be sufficient space to chronicle the P-Card Fraud at the Dallas Independent School District (ISD) and the resulting costs to the local taxpayers. The ISD suffered considerable hard-dollar costs and reputation damage that was reported during 2007 by the Dallas Morning News, and this week's audit report from Deloitte provides more details.

Yesterday's news included a report that the ISD may have to return $8 million to the Federal Government because the P-Card fraud caused the ISD to violate federal grant guidelines for education spending. Continuous monitoring doesn't sound nearly so expensive anymore.

For more complete coverage of the ISD P-Card fraud, see any or all of the following links:

May 2007 Story in Dallas Morning News

Forensic Report from Navigant Consulting regarding P-Card abuse at the Dallas ISD

This week's coverage summarizes the Deloitte audit report, which includes numerous control weaknesses and significant deficiencies.

"Weaknesses and Significant Deficiencies" cited by Deloitte & Touche:

• District policies that "do not exist, are ineffective or not consistently applied"

• Poor staff training

• Lack of oversight from superiors

• Failure to comply with grant requirements from the federal government

• Inability to reconcile some financial accounts

• "Significant" adjustments to district ledgers

• Poor record-keeping and accounting for debts, capital assets, payroll and personnel

Stay tuned - each time I think story is over, another interesting tidbit appears.

Joe Oringel
Visual Risk IQ
Charlotte NC, USA