Read this follow up report as a PDF:
The City issues credit cards to eligible employees to simplify making purchases of $10,000 or less. Bureaus use cards to buy a variety of products and services including airline tickets, office supplies, and membership dues. In our 2021 report, we identified risks when employees began working from home during the pandemic and using City-issued credit cards outside of the usual safeguards. We found that the manual governing credit card use included requirements that were not realistic and others that were not enforced; cardholders were not required to demonstrate knowledge of credit card rules; responsibility for enforcement of the rules was unclear; and no rules governed the purchase or use of gift cards even though cardholders bought over $10,000 in gift cards over the three-month period we reviewed.
The Office of Management and Finance has addressed most of the risks. The Office implemented a new credit card policy manual and is enforcing rules it previously had not. Cardholders are now required to complete training and pass a test to demonstrate they understand the rules. The policy reflects that the Office of Management and Finance is responsible for monitoring compliance with the rules Citywide; staff are reviewing credit card transactions to identify rule violations, and when identified, have suspended and revoked cards.
The Office has addressed risks related to gift cards by prohibiting their purchase. However, the Office has still not developed a separate policy on gift cards and volunteer compensation.
Recommendations implemented
Office of Management and Finance implemented a new policy and is enforcing rules it previously had not
In our 2021 report, we found that the manual governing credit card use included requirements that were not realistic and others that were not enforced. To address this problem, we recommended the Office’s Procurement Services division update the manual to ensure rules were accurate and enforceable.
When the City transitioned to a new credit card vendor in August 2022, Procurement Services replaced the previous manual with a new one. Rules from the old manual we found were unrealistic are not in the new manual. For example, instructions for cardholders to confirm that certain vendors are Equal Employment Opportunity-certified, despite there being no realistic way to do so.
Procurement Services is also now enforcing rules it previously had not, including one that prohibited cardholders from fragmenting transactions to pay for items that exceed the maximum single-purchase limit. A Procurement Services manager said that staff now review monthly transactions for fragmenting and investigate possible instances. According to the manager, staff revoked the card of an employee who purchased two items totaling more than $10,000 separately, and the employee had to return the items.
Office of Management and Finance implemented certification testing and recertification will start next year
The old manual also said that cardholders must pass a test on the rules before getting a card, but the test did not exist. We recommended that Procurement Services implement certification and recertification testing to ensure that cardholders can demonstrate knowledge of the rules.
When the City transitioned to a new credit card vendor in August 2022, Procurement Services began requiring all new cardholders, approvers, and group accountants to complete a training and pass a quiz. Existing cardholders, approvers, and group accountants were also required to complete the training and pass the quiz, or their access was denied. A Procurement Services manager reported in May 2023 that 100 percent of test takers had passed the test. All cardholders, approvers, and group accountants will have to pass a refresher quiz when their cards expire in August 2024, and every two years after.
New policy reflects that the Office of Management and Finance is responsible for monitoring compliance Citywide
In our 2021 report, we found it was unclear if bureaus or the Office of Management and Finance had the authority and responsibility to enforce City credit card rules. We also found that although City Code gave the Office authority to test transactions for compliance, it did not have the capacity to carry out that responsibility. To address this, we recommended the Office:
- Determine the unit responsible for monitoring compliance with rules throughout the purchase cycle.
- Ensure the responsible unit has the appropriate authority to enforce the rules.
- Incorporate the responsibilities into the manual.
The Office of Management and Finance implemented the recommendations. The new credit card policy outlines bureau responsibilities for reviewing transactions to ensure expenses are approved, properly documented, and comply with rules. The policy also says that divisions within the Office are required to review transactions to test they comply with rules and that bureau-level responsibilities are performed. In addition, the policy clarified the positions within the Office and cardholders’ bureaus responsible for different elements of enforcement. For example, staff in the Office’s Accounting division have monitored transactions approved by bureaus to evaluate compliance. When they identify a rule violation and determine a card should be suspended or revoked, staff in the Office’s Procurement Services division do so. The two divisions also coordinate when they determine a revoked card can be reinstated.
Recommendation not implemented
The Office of Management and Finance has not yet developed a Citywide policy on gift cards but has prohibited their purchase
We recommended that the Office of Management and Finance develop a policy on the purchase, documentation, safeguarding, and use of gift cards since we found that cardholders purchased nearly $10,000 in gift cards over a three-month period without City policies about their purchase or use. The majority of the gift cards were used to reward people who volunteered with the City in various capacities, from completing a survey to serving on a committee. Without a policy on gift cards, which are like cash, there was a risk of loss, and employees made ad hoc decisions about how much, how often, and for which types of volunteer service to reward.
The Office of Management and Finance has not yet implemented a Citywide policy.
In May 2022, the Office’s Procurement Services staff informed cardholders, approvers, and bureau accountants they could no longer purchase gift cards with City credit cards, and any gift card purchases must be approved by the Deputy Controller. The Deputy Comptroller drafted guidance for bureaus in 2022. That prompted subsequent discussions about data security, ethics, taxation, and volunteer and employee recognition. According to a Procurement Services manager, implementing important controls would require additional resources that have not yet been provided. In June 2023, the Deputy Controller announced they are no longer approving the purchase of gift cards until they have additional staff to help develop and manage a gift card policy and process.
When the prohibition was in effect in late June, we noticed the City’s health and wellness program offered 25 gift cards to local coffee shops to encourage City employees to get to know one another. We learned the gift cards were purchased by one of the City’s healthcare vendors and it is common for both healthcare vendors to give the City funds to engage with employees around health and wellness, including incentives for employees. Gift cards provided by City contractors are outside the purview of the Deputy Comptroller, although they said they are working with the program to ensure their gift card process is documented and has adequate controls. Policies and controls for gift cards issued by the City will help ensure they are safeguarded, issued appropriately and accounted for correctly.
View the original 2021 report and recommendations
Visit our online dashboard to track the status of recommendations from other reports
Audit Team: Jenny Scott, Performance Auditor III