OFFICE OF THE COUNTY AUDITOR DUPAGE COUNTY, ILLINOIS Bob Grogan, CPA, CFE County Auditor DEPARTMENT OF COMMUNITY SERVICES GIFT CARD AUDIT October 28, 2010
OFFICE OF THE DU PAGE COUNTY AUDITOR AUDIT REPORT SUMMARY WHY THE AUDITOR PERFORMED THE AUDIT The Director of Community Services Department requested a review and assessment of the internal controls related to the distribution of gift cards to FSS and DSSA clients and individuals eligible for flood-related assistance under the IDAP. WHAT THE AUDITOR FOUND Although all gift cards within the scope of the audit were accounted for, the internal controls related to the purchase, storage, use, and distribution of the gift cards were not sufficient. WHAT THE AUDITOR RECOMMENDS The gift card-related duties should be segregated. This should be achieved by the transfer of custody of the bulk gift cards to the Office of the County Treasurer. Gift card custodians should not be authorized to distribute gift cards to clients. The gift cards should be stored in a secure location within the Department. The use of the gift cards should be restricted to distribution to clients. Program supplies should not be purchased with gift cards. COMMUNITY SERVICES GIFT CARD AUDIT AUDIT FINDINGS All vendor gift cards included within the scope of the audit that were purchased for distribution were accounted for. Over 200 gift cards valued in excess of $5,000 that were purchased for distribution to individuals eligible for floodrelated assistance under IDAP were not recorded in inventory. This occurred because departmental custodial responsibility was in question at the time of the purchase. This situation prompted the Director to request this audit. Three purchases totaling $7,700 were made through checks drawn upon a third-party, not-for-profit agency, rather than through the County s accounts payable system. These actions do not fully utilize the County s accounts payable system s internal controls. Gift cards purchased with the intent of providing direct benefits to Family Self Sufficiency (FSS) clients were used to purchase supplies for the FSS Holiday Recognition Event. The purchase of supplies with gift cards under-utilized the County s accounts payable system s internal controls. Client distribution approval documentation for one $10 DSSA Jewel gift card was signed by the case manager and the supervisor more than two months after the gift card was distributed to the client. The procedures within the Community Services Department (Department) related to the FSS, IDAP, and DSSA gift card distribution lack adequate segregation of duties. The DSSA IDAP gift cards are not stored in a secure location within the Department.
OFFICE OF THE DU PAGE COUNTY AUDITOR DEPARTMENT OF COMMUNITY SERVICES GIFT CARD AUDIT BACKGROUND...1 CONCLUSIONS...2 RECOMMENDATIONS AND FINDINGS...2 Gift Card Purchases Under-utilized the Accounts Payable System s Internal Controls...2 Gift Cards Were Used for Program Supply Purchases...3 Gift Cards Were Not Logged...3 Gift Cards Were Not Adequately Safeguarded...3 DSSA Gift Card Distribution Form Was Not Prepared and Approved On a Timely Basis...4 Gift Card-Related Procedures Within the Department Lack Adequate Segregation of Duties...4 APPENDIX 1 : OBJECTIVE, SCOPE AND METHODOLOGY...5 APPENDIX 2 : DETAILED PROCEDURE RECOMMENDATIONS...6 APPENDIX 3 : AUDITEE RESPONSE...9
Page 1 BACKGROUND At the request of the Director of Community Services, the County Auditor was asked to evaluate the internal controls and procedures of the gift card program managed by the Department of Community Services (Department). The Department distributes gift cards to Family Self-Sufficiency Program (FSS) clients and individuals eligible for flood-related assistance under the Illinois Disaster Assistance Program (IDAP). The Department also distributes gift cards to basic needs clients purchased by a not-for-profit agency affiliated with DuPage County and administered by the DuPage Social Services Association (DSSA). The gift cards are issued to individuals for the purchase of food, gasoline and other basic needs such as household items. Generally, gift cards are purchased directly from local merchants such as Jewel Food Stores and Target, by a payment voucher and processed through the County s accounts payable system. The current gift card distribution procedure for the FSS and IDAP assigns a primary and secondary custodian of the gift cards to two staff members within the Department. The DSSA program is administered by the Finance Department which assigns a primary DSSA gift card custodian, while an individual in the Department of Community Services is assigned secondary DSSA gift card custodial responsibilities. With the exception of the IDAP gift cards, upon acquiring the gift cards, the Primary Custodian records all of the gift cards on a master log, divides the gift cards into smaller batches of gift cards ( working supply ), and records each working supply on a separate log sheet. The working supply is distributed to the Secondary Custodian while the reserve supply of gift cards is retained by the Primary Custodian. A new working supply with the related log is issued to the Secondary Custodian as each working supply is depleted. At the time of the audit, the IDAP gift card Primary Custodian had not logged the gift cards purchased. See Appendix 1 for audit objectives, scope, and methodology.
Page 2 CONCLUSIONS Detailed audit procedures accounted for all of the gift cards included within the scope of the audit. Exceptions were noted in the method of purchasing some FSS and IDAP gift cards. An exception was noted in the use of the FSS gift cards to acquire supplies for a Department event related to the Family Self Sufficiency Program. Internal control weaknesses were identified in the IDAP Primary Custodian s gift card logging procedures. Internal control weaknesses were identified in the custodial duties performed within the Department and the safeguarding of the IDAP and DSSA gift cards within the Department. RECOMMENDATIONS AND FINDINGS GIFT CARD PURCHASES UNDER-UTILIZED THE ACCOUNTS PAYABLE SYSTEM S INTERNAL CONTROLS It is recommended that the IDAP and FSS gift card purchases be submitted on payment vouchers and processed through the accounts payable system. Two purchases totaling $5,000 for 202 IDAP gift cards, and one purchase of $2,700 for 180 FSS gift cards were made by DSSA on behalf of IDAP and FSS. IDAP and FSS subsequently reimbursed DSSA for the full amount of the purchase, however it appeared that the use of the third-party, not-for-profit agency to purchase the cards was done to expedite and facilitate the acquisition of the gift cards. These actions resulted in under-utlizing the County s systems of internal controls related to the accounts payable process. The purchase of gift cards by the not-for-profit DSSA is not appropriate because the replenishment of gift card supplies can be anticipated and vouchers can be processed through the County s accounts payable system in advance of the need.
Page 3 GIFT CARDS WERE USED FOR PROGRAM SUPPLY PURCHASES It is recommended that procedures be established to facilitate the purchase of program supplies through a properly documented and approved process that would not cause undue personal financial burden on Department employees. Options may include DSSA making timely reimbursement on behalf of the County to an employee who has purchased the supplies. DSSA reimbursement would be made through the accounts payable system. The Department may consider establishing a business account with a local store to expedite purchases of program supplies. This business account could also be utilized for purchase of immediate client needs. FSS Holiday Recognition Event supplies are purchased with gift cards each year. The purchase in fiscal year 2008 totaled less than $100. The purchase of supplies with gift cards under-utilized the accounts payable system s internal controls. Further, this practice conflicts with the stated objective of providing gift cards for the direct benefit of the eligible clients. GIFT CARDS WERE NOT LOGGED It is recommended that a gift card log be prepared promptly when the gift cards are received in the Department. The gift cards should be identified by gift card serial number and denomination. The Primary Custodian of IDAP gift cards, had not logged 202 cards acquired for $5,000. In addition, it was noted that one DSSA gift card, valued at $50, was not logged. GIFT CARDS WERE NOT ADEQUATELY SAFEGUARDED It is recommended that the DSSA and IDAP gift card Secondary Custodian store the gift cards and the gift card logs in a locked drawer. The DSSA and IDAP gift cards, and their related logs, are not stored in a secure location within the Department. The gift cards are negotiable instruments and access to the gift cards and the related logs should be restricted.
Page 4 DSSA GIFT CARD DISTRIBUTION FORM WAS NOT PREPARED AND APPROVED ON A TIMELY BASIS The distribution of gift cards should be approved by the supervisor on a timely basis. Due to the negotiable nature of the gift cards, the DSSA gift card supply should be treated with the same consideration as cash. A physical count and reconciliation of the DSSA gift cards should be performed on a minimum monthly basis by supervisory personnel to maintain the integrity of the program. Supervisory review would ensure that all gift cards and distribution approval documentation are properly accounted for. The DSSA Secondary Custodian did not have a client distribution approval documentation to support the issuance of one $10 DSSA Jewel gift card. The distribution approval documentation was prepared and signed by the case manager and the supervisor more than two months after the gift card was issued after the exception was noted by the Auditor. GIFT CARD-RELATED PROCEDURES WITHIN THE DEPARTMENT LACK ADEQUATE SEGREGATION OF DUTIES It is recommended that the gift card secondary custodial responsibilities and gift card distribution responsibilities be segregated to different employees within the Department. It is recommended that the Department work with the County Treasurer s Office to establish and document a coordinated FSS and IDAP gift card purchase and distribution process with adequate safeguarding of the gift cards and segregation of duties. See Appendix 2 for detailed FSS and IDAP gift card procedure recommendations. A segregation of duties conflict exists in that the various custodians of the FSS, IDAP and DSSA gift cards within the Department also have authority to distribute gift cards. Respectfully submitted, Bob Grogan, CPA, CFE DuPage County Auditor
Page 5 APPENDIX 1 : OBJECTIVE, SCOPE AND METHODOLOGY OBJECTIVE The objectives of the review were to: Evaluate the records, internal controls, and physical security of the gift cards distributed by the Community Services Department (Department); Verify that the gift cards were properly recorded in the logs; and, Determine that all gift cards were properly accounted for. SCOPE METHODOLOGY The subject of the audit included the procedures related to the purchase and distribution of the gift cards acquired by the Family Self-Sufficiency Program (FSS), Illinois Disaster Assistance Program (IDAP) and DuPage Social Services Association (DSSA). The audit procedures include all batches of FSS, IDAP and DSSA gift cards that where on hand when the reconciliations were conducted on December 8, 2009. The audit procedures included interviews of Department staff and the DSSA checking account custodian to obtain an understanding of the gift card purchase, storage and distribution process. The most recent Department gift card purchases were identified through examination of the payment transactions reports. The most recent DSSA gift card purchases were provided by the custodian of the DSSA checking account. Each of the gift card supplies and the distribution records were reconciled against the purchase documentation.
Page 6 APPENDIX 2 : DETAILED PROCEDURE RECOMMENDATIONS It is recommended that the procedures related to the purchase, custody and distribution of the gift cards include the following: A County Treasurer s Office staff member should be assigned primary gift card custodian for the gift cards purchased with County funds and grant funds. The Primary Custodian should be responsible for securing the gift cards and the related records, distributing the gift cards to the designated Department staff, referred to hereafter as the Secondary Custodian, and verifying proper gift card distribution approval. The Department should purchase the gift cards directly through the accounts payable system. The Department should inform the Primary Custodian of gift card purchases and provide copies of the gift card order and payment information to the Primary Custodian. The Primary Custodian should maintain the gift card purchase documentation on file, including a copy of the gift card order and order confirmation, the payment voucher, and the invoice or receipt. The purchase documentation should show the number of gift cards purchased, the gift card denomination, and the gift card serial numbers. Upon receipt of the purchased gift cards the Primary Custodian should verify the accuracy of the order as to the number and denomination of the gift cards.
Page 7 Upon receipt of purchased gift cards, the Primary Custodian should create a Primary Log of all gift cards purchased. The Primary Custodian should log the purchased gift cards in small working supply batches of a consistent number of gift cards. The Primary Log should include: o Vendor o Program o Gift card denomination and number of gift cards o Total number of gift card batches o Purchase date, check number and check amount o Gift card number batch o Distribution/receipt date o Designated lines for Primary and Secondary Custodian initials to acknowledge distribution/receipt o A gift card matrix including columns designated for the count of the cards, the gift card serial numbers and verification of distribution of the gift card to the client Upon receipt of the purchased gift cards, the Primary Custodian should also create a Secondary Log to be provided to the Secondary Custodian along with the gift card batches. The Secondary Log should include: o Vendor o Program o Gift card denomination and number of gift cards o Total number of gift card batches in purchase o Order number, if applicable o Confirmation number, if applicable o Gift card number batch o A gift card matrix including columns designated for the count of the cards, gift card serial numbers, date of distribution to the client, client name, case manager s name, and verification of distribution of the gift card to the client The gift card batches should be distributed to the Secondary Custodian with the distribution and receipt of the batch acknowledged with the initials of both the Primary and Secondary Custodians
Page 8 When a gift card is distributed to a client, the Department Case Managers should forward the reviewed and approved client distribution documentation, which should include the gift card number, the Case Manager s signature and the client s signature to the Secondary Custodian. When the gift card batch requires replenishment, the Secondary Custodian should forward the approved, reconciled Secondary Log to the Primary Custodian, and request the next batch of gift cards, following the procedures stated above. It is recommended that all gift card batches are locked and that physical access to the gift cards is restricted to the Primary and Secondary custodians. Prior to replenishment, the Secondary Custodian will formally reconcile the gift card batches to the Secondary Log. The reconciled gift card log should be initialed and dated by a Department Supervisor.
Page 9 APPENDIX 3 : AUDITEE RESPONSE The response from the Director of Community Services is attached.