November 14, 2017
“With continuous controls monitoring, we can analyze an entire list of monthly transactions in a matter of minutes. We were able to find people that were using two purchasing cards together to circumvent our procurement process. This is something we could have not seen if we were doing this manually.”
Phillip Hurd, CISSP, CISA, Chief Audit Executive
One of the top-ranked public universities in the U.S. with alumni that includes U.S. presidents, Nobel Peace Prize winners, and CEOs of Fortune 500 companies, the Georgia Institute of Technology employs approximately 16,000 staff across its various campuses during its main sessions.
In the early 2000s, the university launched its purchasing card (P-Card) program in a bid to reduce costs related to procurement. The P-Cards significantly reduced transaction costs, leading the program to grow tenfold within a decade.
The time and cost savings from allowing employees to make purchases directly didn’t come without risks, though. The school and several other state agencies were plagued with large-scale incidents of P-Card fraud, such as employees purchasing gifts and paying off personal loans. A state audit revealed that internal controls had not been adequately monitored to identify and prevent the misuse of the cards.
To address these issues, Georgia Tech hired temporary staff to help manually analyze transactions. It quickly became apparent, however, that even with additional staff working overtime manual analysis was not sufficient to examine every transaction across 2,400 P-Cards.
Georgia Tech chose the CaseWare P-Card Monitoring Solution (now Alessa) to deliver results quickly and reduce ramp-up time. Easy to learn and use, CaseWare’s solution did not require staff to have programming language experience, only knowledge of the school’s P-Card processes.
The CaseWare P-Card Monitoring Solution also reviews multiple data sources simultaneously, detecting when a card is used by a terminated or vacationing employee, or if there has been duplicate payments between P-Card merchants and accounts payable vendors. In addition, the analytics look for inappropriate or out-of-policy purchases as well as address matches between merchants and employees.
By utilizing CaseWare’s solution, Georgia Tech quickly uncovered more than $350,000 in fraudulent purchases. Following implementation of the CaseWare P-Card Monitoring Solution, analysis of 100% of the university’s 180,000 yearly P-Card transactions—which represents more than $70 million annually—is now automated.
P-Card analytics identify split charges to circumvent card limits while also examining Level III transaction data details to reveal unauthorized card activities. Revenue is now assured, control breakdowns are resolved, and the P-Card program has achieved its compliance objectives.
Georgia Tech’s internal audit team has gained true independent assurance of the school’s P-Cards. Examining Level III data from their card provider offers line item details independent of the P-Card holders’ statements, creating a larger window of opportunity to report non-compliant charges and increasing the likelihood of receiving reimbursement.
Because of the great success Georgia Tech’s P-Card program has had, the school decided to expand the use of the continuous monitoring platform to the Financial Aid and Grants and Contracts departments.