By: Brian Nicholson, CPA, and Grant Davis, CPA
As regulatory requirements continue to evolve, maintaining a robust Purchasing Card (P-Card) program is more critical than ever. Across state and local governments, a growing emphasis on P-Card oversight serves as a timely reminder for all governmental bodies to tighten internal controls, improve transparency, and mitigate the risk of fraud and misuse.
Whether you are currently refining your internal policies or preparing for upcoming audit requirements, this update outlines actionable best practices to ensure your organization remains compliant and efficient.
Best Practices for Internal Controls & Reviews
Compliance goes beyond checking boxes; it is about building a culture of accountability. We recommend focusing on these areas to strengthen your internal control environment:
- Solidify Your Internal Policies and ProceduresÂ
Your policies and procedures should clearly document:
- Roles and responsibilities (Purchasing Card Administrator (PCA), Supervisors, and Liaisons) to ensure proper segregation of duties.
- Criteria for card issuance (e.g., permanent employees only, formal supervisor approval).
- Procedures for emergency use and reporting suspected misuse.
- Tighten Transactional Oversight
Regular, proactive monitoring is your best defense against fraud and noncompliance.
- Continuous Review:Â Implement monthly reviews of transactions to identify prohibited purchases such as cash advances, gift cards, or payments for professional services.
- Limit Management:Â Routinely audit your Single Transaction Limits (STL) and ensure any temporary increases are documented, approved, and promptly returned to original levels.
- MCC Block Management:Â Verify that your Merchant Category Code (MCC) blocks are active and current. If a blocked MCC is unblocked for a legitimate business necessity, ensure that approval is documented in writing.
- Optimize Documentation and Retention
Stress-free compliance starts with organized records. Ensure your system of record (whether ERP-based or manual) consistently captures:
- Receipts and detailed transaction descriptions.
- Management sign-offs with dates.
- Clear links between the cardholder and their assigned approver.
Essential Program Governance and Compliance
State auditors and regulatory agencies increasingly mandate or expect strict program governance. To stay aligned with compliance shifts and mitigate audit risks, public entities should consider incorporating these practices:Â
- Agency-Specific Manuals:Â Develop and implement a detailed P-Card policy manual. This document should serve as the cornerstone of your program, detailing responsibilities, prohibited transactions, and spending limits.
- Mandatory Training and Testing:Â Require that all P-Card holders and those with oversight responsibilities complete certified training and testing before cards are issued or supervisory roles assigned.
- Annual Independent Reviews:Â Conduct an annual compliance review by an independent third party to evaluate your internal controls, policy adherence, and documentation processes.
- Clear Oversight and Penalties: Establish clear protocols for policy violations. Non-compliance or egregious violations can lead to severe operational consequences, including the suspension of your P-Card program, reduced procurement certification, or diversion of P-Card rebates.
How We Can Help
Navigating these requirements can be complex, but you don’t have to do it alone. If you are preparing for your annual compliance review or need assistance in drafting or auditing your internal P-Card policies, our team is ready to support you. We help organizations interpret state guidelines, evaluate internal controls, and implement corrective action plans to keep your program running smoothly, maintain audit readiness, and provide advisory and attestation services to support compliance.
Let us ensure your P-Card program remains an efficient tool for your operations while maintaining the highest standards of financial integrity. Please reach out to our team to discuss your specific compliance needs or schedule a review.
