Introduction

1. Commonwealth credit cards (credit cards) are widely used by Australian Government agencies as a convenient and flexible approach to purchase goods and services to meet business needs. Credit card expenditure can be considerable, with some large agencies spending tens of millions of dollars. These purchases are generally low-value and routine. Depending on an agency’s particular responsibilities, common items of expenditure include airfares, accommodation, taxis and office supplies. In recent years, agencies have usually established their own credit card arrangements with a credit card provider. However, in 2012–13 agencies subject to the Financial Management and Accountability Act 1997 (FMA Act) are transitioning to a common credit card provider as the form of payment for certain airline, accommodation and car rental bookings as part of the Whole-of-Australian-Government (WoAG) Travel Services Arrangements (TSA).¹ As a result of these arrangements, the use of credit cards by agencies will continue to be extensive²; and in some agencies, the number of staff using credit cards may increase.³

2. Whether card services are provided to agencies through individual contracts or a common contract, the widespread use of credit cards can expose agencies to the risk of inappropriate or unauthorised expenditure. Agencies therefore should establish controls to ensure credit cards are used appropriately for official purposes. Such controls include limiting card access to staff with an identified business need, informing cardholders of their obligations when using credit cards, having in place a suitable card management system and having risk-based processes to check the validity of credit card expenditures. Once established, agencies need to ensure these controls remain effective.

3. Requirements relating to the use of credit cards are provided in the FMA Act and the Financial Management and Accountability Regulations 1997 (FMA Regulations).⁴ These requirements relate to the need to make efficient, effective, economical and ethical use of Commonwealth resources, ensuring all expenditure is appropriately authorised and the imposition of penalties for misuse of credit cards. Chief Executive’s Instructions (CEIs) generally provide each agency’s policy on the use and administration of credit cards. These are usually supplemented by operational guidance and procedures. The Department of Finance and Deregulation (Finance) has issued guidance on the development of CEIs, including in relation to credit cards.⁵

Audit objective, criteria and scope

1. The audit objective was to assess whether Australian Government agencies were effectively controlling the use of credit cards for official purposes.

2. The ANAO’s assessment was based on the following criteria:

• agencies have sound arrangements to control the issue and return of credit cards; and
• controls over individual purchases are sound and operating effectively.

3. The scope of the audit included the credit card controls in three agencies: the Australian Trade Commission (Austrade); the Department of the Prime Minister and Cabinet (PM&C); and Geoscience Australia (Geoscience) during 2011–12.

Overall conclusion

4. Credit cards are commonly used by Australian Government agencies and appropriate use of credit cards provides benefits in terms of convenience and flexibility for cardholders. During 2011–12 the three agencies subject to audit had over 1500 credit cards on issue and spent in excess of $15 million on generally low‑value items ranging from airfares and accommodation to office supplies. The proportion of staff with credit cards was some 80 per cent in Austrade, 37 per cent in PM&C and 10 per cent in Geoscience, reflecting the agencies’ different credit card policies.⁶ The amount and nature of credit card expenditure varied between the agencies, as would be expected given their different responsibilities.⁷

5. The three audited agencies had generally satisfactory arrangements in place to control the use of credit cards for official purposes. Card issue and return was reasonably managed, with agencies issuing credit cards to staff with an identified business requirement and imposing financial limits on cards, and cardholders properly agreeing to and acknowledging their responsibilities before being issued with a card. Cards were no longer used by staff after having left the agencies, although there were some procedural deficiencies in the cancellation of cards and in maintaining a reliable register of cards. Controls on individual purchases were generally sound and operating reasonably effectively, with prompt acquittal and review in two of the three agencies. The incidence of misuse in the sample of credit card transactions examined by the ANAO was very low, and the audited agencies’ controls were effective in identifying such misuse, with evidence of follow-up action where necessary.

6. Credit cards can be an efficient way to purchase goods and services and can assist agencies to streamline routine purchasing. Inherent in agencies’ decisions to issue staff with credit cards is an understanding that these staff will have to make judgements about the quality and cost of the goods and services they purchase. It is important that all cardholders in agencies remain cognisant of the need to obtain value for money when making purchasing decisions. Over time, different parts of an agency may develop different standards on matters of judgement and the standards of the agency may diverge from justifiable levels. For these reasons, agencies need to remain vigilant to ensure that judgements on quality and cost made by cardholders remain appropriate and consistent, in order to reduce potential financial and reputational losses.

Key findings by chapter

Issue and return of credit cards (Chapter 2)

7. A basic element in controlling credit card use is to effectively manage to whom, and the conditions under which, credit cards are made available to meet business needs. The three agencies had generally sound policies and procedures for the issue of credit cards, covering such matters as eligibility, credit limits, approval arrangements and the responsibilities of cardholders. Areas for improvement to policy and guidance material by the agencies included documenting:

• any special arrangements for the provision of credit cards to non‑employees⁸;
• arrangements for the renewal of credit cards—as distinct from the initial issue of credit cards; and
• responsibility for maintaining a register of credit cards.⁹

8. The ANAO examined a sample of 62 credit cards issued by the three agencies. The credit cards were generally issued in accordance with agency requirements. For all cards in the sample issued during 2011–12, the required agreement and acknowledgement by cardholders was obtained and was available.

9. To help ensure credit cards only remain available to staff with an identified business need, it is important to have credit cards returned when no longer needed, particularly when cardholders leave the agency. The three agencies all had appropriate policies and guidelines in this regard. Areas for improvement related to:

• improving clarity in responsibilities for the final acquittal of the credit card transactions (particularly after the cardholder has left); and
• specifying recordkeeping requirements, namely recording details of credit card cancellations in the register of credit cards.

10. The ANAO examined the credit card use of all 281 cardholders who left the three agencies in 2011–12. For these departing staff, there were no records of the cancellation of 15 credit cards (five per cent), and 25 credit cards (nine per cent) were cancelled more than 30 days after the staff member departed. There were no credit card transactions made by these staff after they left the agency.

Use of credit cards (Chapter 3)

11. The audited agencies had generally sound policies and procedures for acquittal and review of individual purchases made using credit cards. These covered the responsibilities of cardholders and reviewers in endorsing valid transactions, and dealing with unrecognised or disputed transactions.

12. The ANAO analysed¹⁰ all credit card transactions in the three agencies in 2011–12. To help assess whether credit card acquittal procedures were complied with, the ANAO examined a random sample of 927 transactions and found in two agencies there was a generally satisfactory application of agency controls relating to the timeliness of acquittal. However, in PM&C nearly 30 per cent of transactions examined were not acquitted within the agency’s required timeframe. About two‑thirds of these transactions had evidence of acquittal—typically some 30–60 days after the due date. For the remaining one-third, documentation was not available to establish the fact or date of acquittal. In February 2013, PM&C reinforced its acquittal requirements through reminders by the Chief Finance Officer to staff with outstanding acquittals; and this focus will need to be maintained to strengthen the application of these requirements in relation to credit card use.

13. Appropriate documentation was available for all of Geoscience’s transactions in the random sample. For Austrade¹¹ and PM&C, documentation was not available for around five per cent of the number of the transactions. These were mainly low value transactions. For the sample of transactions, ANAO analysis of the merchants used and available receipts showed that the goods and services purchased were reasonable in light of the agencies’ business needs and credit card policies.

14. In addition to examining a random sample of transactions, the ANAO examined 1503 transactions across the three agencies in several specific categories where the risks of misuse and/or less effective checking were potentially higher. These included transactions with unusually high expenditure for an item, unusual types of merchants, potentially duplicated charges, transactions by high spending cardholders, and transactions undertaken by members of the agencies’ executive management groups. Almost all of these transactions were satisfactorily explained. The agencies had already properly identified a number of examples of misuse—such as fraudulent use of the credit card number by a third party, double processing of charges by merchants, and in one case potential abuse by a staff member. This identification of misuse by agencies is indicative of the effectiveness of their controls. However, in a small number of cases, mainly in PM&C, sufficient documentation was not available to confirm the legitimacy of some mainly low‑value transactions.

15. One of the agencies (Austrade) had determined there was a business need for cardholders to be able to withdraw cash, for example to pay for routine travel expenses, or to make payments in countries where some service providers may not accept payment by credit card. Cash withdrawals accounted for about ten per cent of the value of credit card transactions in Austrade. Cash withdrawn in 2011–12 was approximately $900 000, with a small number of individuals withdrawing more than $20 000 during the year. The ANAO examined a sample of cash transactions and supporting documentation for Austrade cardholders who had withdrawn large amounts of cash during 2011–12.¹² For these transactions, the withdrawal of cash reflected circumstances in specific countries, and supporting documentation and processes provided reasonable oversight of the transactions. Nonetheless, given the risks and sensitivities associated with the use of cash, it is important that Austrade maintain a focus on the application of its policies and guidelines for the withdrawal and use of cash to be confident that such transactions are reasonable in the circumstances.

16. All of the audited agencies had policies providing for, and had undertaken in recent years, some form of periodic review. However, there is scope for agencies to examine the balance of review processes undertaken, particularly given their varying resource needs. There would be value in agencies adopting an appropriate range of more frequent, lower cost, targeted reviews, supported by more extensive reviews such as an internal audit. Such targeted reviews could examine unusual transactions (by nature or value), potential duplicates, or expenditure where determining appropriateness may be more subject to judgement.

Summary of agencies’ responses

17. The audited agencies’ summary responses to the audit report are provided below. Appendix 1 contains the agencies’ full responses to the audit report.

Australian Trade Commission

18. Austrade acknowledges the observations of the ANAO and will continue to identify and implement areas for improvement in the context of an upcoming change to its expense management system.

Department of the Prime Minister and Cabinet

19. The Department of the Prime Minister and Cabinet welcomes this review of the controls over credit card use. The Department went through significant changes in 2011–12. These changes included Machinery of Government changes, an internal restructure and the insourcing of accounts processing function which includes credit card administration.

20. The ANAO audit provided timely assurance over this function following these significant changes. The Department will enhance its controls in the areas highlighted by the ANAO. The Department has already implemented some of the ANAO suggestions such as adding an explicit reference to reporting obligations on disputed or fraudulent transactions to the acknowledgement form signed by new cardholders.

Geoscience Australia

21. Geoscience Australia welcomes the ANAO’s audit and the overall conclusion that Geoscience Australia is effectively managing credit card usage.

22. Geoscience Australia accepts the audit recommendations and thanks the ANAO for identifying areas where Geoscience Australia has opportunity to improve.

Footnotes

[1] Under the WoAG TSA established by the Department of Finance and Deregulation (Finance) a common credit card provider is used by agencies as the form of payment for domestic air travel (and international air travel originating in Australia), domestic accommodation and domestic car rental bookings. The only exception occurs when an agency pays its staff a travel allowance for accommodation. Refer to http://www.finance.gov.au/procurement/travel-and-related-services/faqs.html for details. Accessed 6 March 2013.

[2] Under the WoAG TSA, agencies may choose to use virtual accounts that operate in much the same way as a card‑in‑hand, but have no physical plastic card attached to it. In this situation, payments for flights, accommodation and car rentals would be made using the virtual card account number, without the need for travellers to be provided with a physical card-in-hand, or even the need to know the number of their ‘virtual’ card. The WoAG TSA provides agencies with an option to use a card-in-hand product to meet expenses such as for meals and incidentals, as well as general purchasing expenses. Agencies may also choose to enter their own credit card arrangements for non-travel expenditure.

[3] In some agencies, credit cards were previously not used to pay for travel expenditure.

[4] Key legislation relating to credit cards includes FMA Act sections 38, 44 and 60, and FMA Regulations 7–12 and 21.

[5] The Department of Finance and Deregulation, The Model CEIs, version 2, issued 26 November 2012, p. 41, available at http://www.finance.gov.au/publications/finance-circulars/2011/docs/model-ceis.pdf; accessed 6 March 2013.

[6] At the time of the audit, Geoscience did not use credit cards for the payment of travel or taxi fares.

[7] For example, a high proportion of Austrade expenditure was on travel, consistent with its overseas engagements. A high proportion of PM&C expenditure was on accommodation reflecting its responsibilities for hosting significant events and visiting delegations.

[8] For example, Austrade issued credit cards to representatives of other Commonwealth or state government agencies hosted by Austrade at overseas posts, and to a small number of long-term contractors who travel as part of Austrade business. In addition, PM&C issued a small number of credit cards to secondees and to employees in the Prime Minister’s official residences.

[9] In two agencies the list of credit cards on issue was incomplete.

[10] This included reviewing credit card data to determine total expenditure per agency and per cardholder, analysing merchants used, and types of expenditure.

[11] Austrade policy does not require travellers to obtain and retain a receipt for official travel-related expenditure for minor amounts (up to $20 per day).

[12] The ANAO examined in detail the transactions of a sample of six cardholders who withdrew between approximately $8500 and $60 000 during 2011–12.