In the early 2000s, Georgia Tech searched for a more cost-effective procurement process which led to the adoption of purchasing cards (p-cards). Georgia Tech significantly lowered transaction costs, and as a result, the p-card program grew tenfold within a decade.
However, the newfound time and cost savings achieved by empowering employees to make direct purchases presented unforeseen risks. Numerous state agencies, as well as Georgia Tech, were plagued with large scale incidents of fraud involving p-cards, such as employees purchasing gifts and paying off personal loans. A state audit uncovered inadequate monitoring of internal controls to identify and prevent misuse of p-cards by state employees.
Georgia Tech sought to address these issues by hiring temporary staff to help with the manual analysis of transactions. They quickly found that using additional staff working overtime to analyze spreadsheets was still not sufficient to examine every transaction of 2,400 p-cards.
The Georgia Tech team chose CaseWare IDEA® for data analysis and CaseWare™ Monitor for continuous monitoring to deliver faster results and reduce ramp-up time. Easy to learn and use, CaseWare’s solutions did not require staff with programming language experience, only knowledge of the p-card process. Georgia Tech is currently working to automate the analysis of 100% of their 180,000 yearly p-card transactions. Purchasing card analytics are used to identify split charges to circumvent card limits as well as examine Level III transaction data details to highlight unauthorized card activities. With more than $70 million spent annually on p-cards, they are able to monitor multiple data sources at the same time, to detect cards used by terminated employees and duplicate payments between p-card merchants and accounts payable vendors. The automated analytics also look for inappropriate fuel purchases and address matches between merchants and employees.
The Georgia Tech internal audit team is achieving true independent assurance of p-cards. By examining Level III data from their card provider they are able to get line item details independent of the p-card holders’ statements. This also allows Georgia Tech to have a larger window of opportunity to report non-compliant charges, which greatly increases the likelihood of receiving reimbursements.
Georgia Tech will continue to expand the continuous monitoring platform to Financial Aid and Grants and Contracts.
The real value of using data analytics is that it allows you to see fraud schemes that would be impossible to detect manually.
Phil Hurd, CISSP, CISA
Chief Audit Executive, Georgia Institute of Technology