The Procurement Card Analytics Before the Deadline
Northline University's internal audit is reviewing procurement-card use in its facilities department. Analytics on 9,200 transactions identified 47 purchases between $4,750 and $4,999-just below the $5,000 manager-approval threshold-and 12 pairs of purchases from the same vendor within three days that together exceed $5,000. One vendor's address matches a facilities coordinator's home address. The data came from an extract prepared by a student intern who has not documented the query or reconciled the record count to the general ledger. The audit director promises the audit committee preliminary results in three weeks because 'the chair wants a scalp.' The engagement team has one experienced auditor and one first-year auditor; the experienced auditor is on leave for the first week. Management has not been informed of the analytics. The CAE wants to expand testing to all 9,200 transactions and interview the coordinator immediately.
1. Identify the engagement planning and supervision weaknesses revealed by the scenario. What should the CAE require before the team expands testing or conducts interviews?
Read the worked answer
Planning is being driven by a deadline and a desired outcome. The audit director has promised preliminary results before the team has validated data, defined the engagement scope, or assessed risk. That is a planning failure. The objective should be to determine whether procurement-card controls are operating and whether there are indicators of misuse, not to produce a 'scalp' for the chair.
Supervision is inadequate. A first-year auditor is working without the experienced auditor for the first week, and the CAE is considering a major expansion and an immediate interview. The more sensitive the work, the more direct supervision is needed. The experienced auditor should review the analytics, approve the interview plan, and be present for any interview of a person who may be accused of wrongdoing.
The data are not yet audit evidence. A student intern's undocumented extract has not been reconciled to the general ledger, and the query logic is unknown. Expanding to all 9,200 transactions before validating the population would multiply an unverified result. The team also has not informed management, which is both a courtesy and a practical necessity for access and context.
Before expansion, require: a written engagement plan with objectives, scope, criteria, and risk assessment; validation of the data; a documented interview strategy; consultation with legal or human resources if fraud is possible; and a realistic timetable. The CAE should tell the audit committee that preliminary results will be provided only after validation, and that the three-week date may need to move. A short delay is better than an unreviewed accusation.
2. What procedures are needed to make the procurement-card analytics sufficiently reliable and to support or refute a finding? Address completeness, accuracy, and corroboration.
Read the worked answer
Completeness. Reconcile the number of transactions and the total dollars in the extract to the procurement-card system and to the general ledger. Confirm the extract covers the full period, all cardholders, and all facilities department accounts. Identify excluded transactions, cancelled cards, and manually processed purchases. Document who extracted the data, when, from which system, and using what parameters.
Accuracy. Re-perform or independently review the query logic. Confirm how 'within three days' and 'same vendor' were defined, how vendor names were normalized, and whether refunds, credits, or split transactions were handled correctly. Test the threshold logic against a sample of source records. Check whether the 47 transactions just below $5,000 are unusual compared with the normal price distribution or are simply common price points.
Corroboration. For each apparent split purchase, obtain the cardholder statement, receipts, approvals, receiving records, and vendor invoices. Confirm whether the purchases were for separate legitimate needs or were deliberately divided to avoid approval. For the vendor address match, compare the vendor master file with human resources records and the coordinator's disclosed conflicts of interest. Confirm whether the coordinator has authority over the vendor or the purchases.
Sufficiency. A finding should rest on more than pattern alone. The team should test a risk-based sample of flagged items and a control sample of unflagged items, document exceptions, and consider whether the pattern persists across cardholders or is isolated. The workpapers should allow an independent reviewer to trace every conclusion to source evidence.
3. How should the team handle the possible fraud indicators, the coordinator interview, and communication with the audit committee and management given the three-week deadline?
Read the worked answer
Treat the indicators as a possible fraud, not a proven fraud. The threshold pattern, split purchases, and address match are red flags that warrant investigation, but they do not establish intent. The team should preserve the extract, source documents, and system logs before any interview or cleanup. It should not delete or alter files.
Do not interview the coordinator immediately. A premature, accusatory interview can destroy evidence, trigger explanations that are later rehearsed, and expose the university to legal risk. The team should first interview peripheral witnesses and control owners, such as the card administrator and the coordinator's supervisor, using non-accusatory questions. If an interview of the coordinator is needed, it should be conducted by an experienced auditor with legal or human resources present, following a documented plan.
Communication. Management should be informed that internal audit is reviewing procurement-card controls and has identified anomalies requiring follow-up, without naming the coordinator or disclosing unverified conclusions. The audit committee should receive a factual status update: the review is in progress, data validation is underway, and no conclusion has been reached. The 'scalp' comment should not shape the message.
Deadline. The CAE should reset expectations. Preliminary results can be shared only after data validation and initial corroboration. If the committee needs an interim briefing, it should describe the work performed and the next steps, not speculate about guilt. The final report should distinguish control deficiencies from suspected fraud and should state what was and was not concluded.