Think Outside the Box. If your organization is the “box,” think about going outside your organization to obtain audit evidence. Two recent Maricopa County audits included successes that could not have been achieved without information obtained from local and national vendors.

During our 2005 Countywide Travel Audit (see the ALGA website for Audits to Go - 2005 Milwaukee Conference) and a special request review, we found that obtaining the cooperation of your vendor can provide the audit evidence you need to take a typical “inadequate documentation” finding to a validated case of fraud or a hard dollar recovery.

A Control That “Kind of” Works. Maricopa County has hundreds of “fuel only” purchase cards (Pcards) that are controlled by restricting them to purveyors of automobile fuel (via a merchant category code). Unfortunately, if the gasoline vendor is also a convenience store, hundreds of non-fuel items are also available for purchase. In addition, many vendors report transactions at the summary level, supplying generic descriptions such as “retail purchase,” and leaving an inadequate audit trail.

So, with the information available through the county, we were faced with testing transactions through a labor-intensive, manual review of paper receipts. Instead, we decided to ask our vendors to help us out. We selected three vendors with a significant local presence and asked for transaction detail not reflected in the data we had in our files. One vendor was willing to work with us.

Help the Vendor Help You. We were always aware that our helpful vendor was going out of the way to get us our data. Being persistent, patient, and polite was a big part of establishing a good relationship with the vendor. Another practice that facilitated the process for both the vendor and our staff was limiting the number of transactions we asked the vendor to research. One way we were able to do this was by isolating “high-risk” transactions.

We found that the merchant category codes mentioned earlier were divided into two types of fuel purchases – those transacted “at the pump,” and those completed inside the store. Since the only thing available at the pumps was fuel, we were interested in purchases made inside the store. We were then able to risk off 80-90 percent of our fuel card transactions and concentrate our efforts on the real risk for this particular audit test. (A word of caution here - vendors choose their own merchant category codes, and you must validate they are being used correctly.)

Locating the Best Contact – Be Persistent. We did not get the information we were after on the first - or even the fifth - phone call. We spoke with vendor personnel from several different departments - including the vendor’s Internal Audit Department. We found that the function that was both willing and able to provide the information we needed was called “Loss Prevention.” Loss Prevention is frequently staffed by individuals with a law enforcement background and the function has an interest in assisting you in preventing and detecting fraud. We provided a list of transactions for specific vendor locations and Loss Prevention pulled transaction detail from individual store files. In this case, all transactions we tested were valid (which is good!). Positive findings are still findings, and they allow us to be an “assurance” function for management.

A Picture Is Worth A Thousand Words. In the same travel audit, we isolated other “high-risk” fuel transactions and asked our vendor to supply us with a different type of audit evidence. The purchases were considered “high-risk” because they were transacted on days the employees were not working.

We sorted these transactions by location and, with the assistance of Loss Prevention, determined which vendor locations had video surveillance cameras at the fuel pumps. The vendor went to the trouble of determining the time of the transaction (we had only the date), and supplied us with a surveillance feed from 11 different cameras. The vendor even e-mailed us the video in digital format! We did not have to leave the office.

As a result of our vendor’s video, we were able to definitively show a county Pcard being used to fuel an employee’s personal car. This type of evidence is indisputable.

Obtaining Vendor Evidence: An Alternative Approach. During a special request review of P card activity at a county department, we were asked to validate that Pcard purchases - spanning three years - were made for legitimate county business. The purchases had not had any level of approval, and the Pcard holders did not maintain receipts. As before, no transaction detail was available within the county.

We found that several vendors were willing to work with us; however, they did not have transaction detail as readily available as in the case of our travel audit. Additionally, the transactions we were researching were much too old for any video record.

Most vendors were able to provide us with a duplicate receipt for the transactions we requested. For some vendors, we had to go through specific store locations to get duplicate receipts. However, we found the most efficient department with which to research transactions was the vendor’s Corporate Office Electronic Journaling Department.

We also found the vendors to be generally cooperative when we had to dig deeper; for example, descriptions on receipts were not always self-evident (who knew that a Brushed Twill 80X was a set of curtains?)

We did not always succeed; in some instances, the vendor was not able to provide a duplicate receipt. Detail for seasonal and discontinued products were sometimes not maintained in vendor systems, or contained generic item descriptions such as “seasonal.”

However, by working through our vendors, we were able to identify over $12,000 in fraudulent personal purchases made with a county Pcard. We would have been unable to validate this information without the assistance of our vendors.

Lessons Learned. Be prepared for both successes and failures. It can be challenging to audit through your vendors; however, the results you obtain can make the investment in time and resources worthwhile. Remember: