When it comes to mitigating fraud and misuse in a card program, there’s good news: it is possible to achieve an appropriate balance between an over- and under-controlled program. Controls begin with a preventative approach, such as establishing roles and responsibilities and documenting clear policies and procedures. Next, systemic controls-such as card spend limits-are put in place to support fraud prevention. Detection plays a large role, too, and includes cardholder review of transactions, management oversight and the audit program. “And while appropriate controls should be integrated into a P”‘Card program during the design phase,” notes Lynn Larson, education manager, NAPCP, “they can also be strengthened or modified in an existing program at any time. Flexibility is key as a program grows or changes.”
The NAPCP’s Fraud Prevention and Detection report, available to NAPCP members and complimentary subscribers, notes that fraud/misuse is not the epidemic problem that some perceive. Industry research demonstrates that a large proportion of the fraud/misuse tends to occur in a small percentage of end-user organizations. So while an organization might be tempted to try to lock down every conceivable element of risk, there is a corresponding tradeoff in doing so. Over-control can prevent an organization from achieving maximum benefit from its card program.
So how does an organization find this balance between an optimally controlled card program and an overly restricted one that no one uses? Two program-management activities can help: risk analysis and audit.
Key Components of a Risk Analysis
“To increase program buy-in from management and aid the audit process,” says Larson, “P-Card program managers should document a risk analysis of the card program and update it annually or as needed.” Key components of a risk analysis include: evaluating all processes; identifying possible risks, such as a lack of separation duties and/or oversight; documenting existing controls and taking necessary actions to close any control gaps. Management should be kept apprised of any incidents, responses and modifications along the way, to prevent a perceived laxity of controls that can undermine program support and possibly lead to the diversion of procure-to-pay activity to alternate means.
Audits Involve Cross-Functional Teams
As described within the NAPCP’s report, audits should be meaningful, tailored to an organization’s unique program. There are two primary types of audits: process audits and transaction audits. Process audits are usually conducted by auditors to test the effectiveness of program controls. Transaction audits, on the other hand, tend to be conducted by a variety of employees on a regular basis, focusing on card activity to identify potential fraud and misuse.
For More Information
NAPCP members and complimentary subscribers can access the full Fraud Prevention and Detection report, as well as results of NAPCP polls related to controls and compliance, at www.napcp.org/resourcecenter. (When you become a new NAPCP member or complimentary subscriber, please watch for the confirmation e-mail from the NAPCP that includes a direct link to the free report.) In addition, hear about effective approaches to controls at the 2011 NAPCP 12th Annual Commercial Card and Payment Conference, which offers a variety of educational options on this topic-technology demonstrations, breakout sessions and roundtable discussions (www.napcp.org/2011).
About the NAPCP
The National Association of Purchasing Card Professionals (NAPCP) is a membership-based professional association committed to advancing Commercial Card and payment professionals and industry practices worldwide. The NAPCP is a respected voice in the industry, serving as an impartial resource for members at all experience levels in the public and private sectors. The NAPCP provides unmatched opportunities for continuing education and peer networking through its Annual Conference, Regional Forums, webinars, audio calls, website, newsletter and regular communication. The association sponsors research and publishes timely and relevant white papers, survey results and other documents. The NAPCP launched the Certified Purchasing Card Professional (CPCP) credential in 2006 (www.napcp.org/cpcp). Please visit www.napcp.org to learn more about Commercial Card and payment programs in general, the value of membership, current member demographics, upcoming events and benefits of becoming a partner sponsor.
We’re always on the lookout for opportunities to partner with innovators and disruptors.
Learn More