9.20 Financial Compliance Purchasing Card (PCard) Violations

Procedure Information

Purpose and Summary

Financial Compliance performs a sample review of Purchasing Card (PCard) transactions on a regular basis as an internal control and to provide an added level of assurance to units and departments that its cardholders and purchases are within university policy for allowable expenditures on the PCard. 

The purpose of this procedure is to provide guidance on self-reporting violations and card violations issued by the Financial Compliance unit to ensure that violations are documented and handled in a consistent approach.

Source

Arizona Board of Regents Policy, including but not limited to 6-711 Internal Control Responsibilities.

Scope

This policy applies to all university locations and units, including all university extensions, satellite locations, and off-site campus units, both domestic and international.

Definitions

1. Cardholder/Responsible Cardholder: The individual responsible for the card as reported in UAccess Financials and UAccess Analytics.
2. Liaisons: The designee acting as the PCard department primary contact for PCard Administration and Financial Compliance. This title is provided to an employee through an agreement processed by Accounts Payable.
3. Notification of Financial Compliance PCard Violation Letter: Formal notice of a violation or misuse initiated by the Financial Compliance unit and issued to the cardholder, department card responsible cardholder, or responsible user.
4. Purchasing Card (PCard): A university credit card for traditional small dollar purchases that is used wherever Visa is accepted. All transactions made using the PCard must benefit and support the university's mission of education, research and public service and align with university policy for allowable expenditures.
5. Responsible User: The individuals who initiates a physical swipe of the card or authorizes an online purchase that expense on the account associated with the PCard. This person may be different than the responsible cardholder for a Department Card.
6. Self-Report Violation (SRV): An online request initiated by the responsible user to report a violation of PCard policy which is then routed to Accounts Payable for review and approval.

Policy

1. The department is responsible for submitting an SRV upon internal findings of a non-compliant transaction and request or complete corrective actions at the time of completion.
2. Upon receipt of the notification of PCard Violation email from Accounts Payable - Financial Compliance, the cardholder must take corrective action and respond to the email withing five business days.
3. If the violation requires reimbursement to the university, this must be completed within 5 business days from date of the violation, unless payroll deduction is requested. 

Compliance and Responsibilities

The following is a general outline of the responsibilities of the individuals and areas involved with PCard violations:

Department (includes Liaisons, Business Office personnel, Cardholders, Reconcilers, Approvers and Users)

• Ensures all the PCard users review the Financial Services Policies Manual and complete the Purchase Card Training.
• Processes an SRV as soon as the transaction is identified as non-compliant. This includes reimbursement when applicable.
• Responds to the Notification of Financial Compliance PCard email.

Financial Compliance

• Processes SRV forms and tracks the number of violations.
• Initiates the Notification of Financial Compliance PCard Violation Letter upon transaction review and identification of a violation of university, ABOR, state and/or federal policies.
• Communicates and provides training to departments on allowable purchases within the Financial Services Manual.
• Suspends or cancels cards for activities including, but not limited to, pyramiding, card sharing, exceeding limits, and failing to reconcile.
• May enact additional requirements including, but not limited to, trainings and exams for departments, cardholders, liaisons, and/or reconcilers.
• Reissues compromised cards, suspends or cancels PCards, and issues violations related to university, ABOR, and state policies. 

Procedures

General

1. Upon finding a transaction as being noncompliant, either by the department or by Financial Compliance, the violation will be processed and completed. See information in the sections below related to the violation types.
2. The Cardholder or Responsible Cardholder may be personally liable for unallowable PCard charges and may be required to reimburse the university for transactions that violate any applicable laws, rules, or policies, such as personal purchases.
3. Regardless of how the violation is issued, Self-Reporting Violation (SRV) or Notification of Violation, they are tracked and accumulated in total. Generally, after three violations, the card will be suspended or cancelled. The number of violations, the explanation provided for the violation and the length of time between violations will all be considered before cancelling or suspending a PCard. Financial Compliance and senior leadership collaborate and evaluate all violations, and the necessary actions required.

Self-Reporting a PCard Violation

4. Upon identification of the unallowable transaction by the department, business office or cardholder, the responsible user completes a Self-Reporting Violation in Travel and Expense.
5. The request ID must be referenced on the Purchasing Card Document (PCDO) within UAccess Financials
6. A first violation instance may not result in additional communication from Financial Compliance.
7. A second violation of the same type or multiples of different types will result in further communication to the department and/or may also result in suspension or cancellation of the PCard.
8. A third violation will likely result in the PCard being suspended or cancelled.

Notification of Financial Compliance PCard Violation Email

8. When a transaction is identified as an unallowable expenditure through a central administration Financial Compliance review, a Notice of Financial Compliance PCard Violation email is sent to the appropriate department(s).
9. The PCard will be automatically suspended for three months unless the department requests that card to be closed.
10. The card may be closed if there are multiple transactions within one violations by the same cardholder/individual the card. 

Notice of PCard Suspension or Cancellation:

11. Financial Compliance may consider suspension or cancellation of a PCard based on review of the card activity based on the following:

    1. Severity of misuse (Personal purchases, unallowable purchases, etc.),
    2. Number of violations and explanation provided,
    3. Length of time between violations, and/or
    4. Circumstances of the violation. 

    A third violation may result in PCard cancellation of use.

12. If a Notice of Suspension is issued, prior to reinstatement, all or any combination of the following conditions may be required:
    1. Retake the PCard training.
    2. Register and complete a training session with Financial Compliance
    3. All supporting documentation has been received and reviewed by Financial Compliance.

Reimbursing the University for Unallowable Purchases

13. For a violation requiring a reimbursement to the university, the business office may either:
    1. Collect payment from the cardholder/responsible user and follow cash handling procedures and add the Cash Receipt number to the PCard Document. Refer to Policy 8.10 Cash Receiving for information on preparing a cash receipt and depositing reimbursement.
    2. For transactions over $100 or business offices outside main campus, the cardholder or responsible user may select Payroll Deduction when completing the SRV in Travel and Expense or mail Accounts Payable at FNSV-Accounts-Payable@arizona.edu, CC'ing the employee incurring the deductions with the following details:
       1. Employee's full name
       2. Employee ID number
       3. PCard Document number
       4. Amount to be collected
    3. Initiate a foundation transfer, if funds are available.

Frequently Asked Questions

1. What is the difference between Self-Reporting Violations and the Notice of Violations issued by Financial Compliance?
   Departments using the SRV request are identifying that an unallowable transaction has occurred at the time of reconciliation/approval, whether inadvertently or intentional. Identifying non-compliance while reconciling transactions prevents suspension of card usage and ensures continuity of business activities. A Notification of Financial Compliance PCard Violation Letter represents an unallowable expense identified by Financial Compliance during a post transaction review resulting in immediate suspension of the card for three months. 
   
   Examples of non-compliance include, but not limited to:
   1. Unallowable expenditure/purchase,
   2. Foreign software purchase,
   3. Pyramiding,
   4. Excessive Auto Approvals,
   5. Sharing an individual's card with another employee. 
       
2. Who is responsible for reimbursement when the PCard has been misused?
   The responsible cardholder or department card user is required to reimburse the university for unallowable expenses.
    
3. Does the university have the authority to withhold my wages for unallowable expenditures on the PCard?
   1. Yes, the cardholder authorizes the university to deduct from the employee’s wages via the PCard Application process. This allows Accounts Payable to process a deduction over four pay periods for the university to be reimbursed to include the item purchased, any interest incurred, or attorney’s fees if applicable.
   2. Department cards are the responsibility of the responsible card holder and Accounts Payable will work directly with the business office to identify any payroll deductions required to repay the university. 
4. How are PCard violations tracked, documented, and accumulated?
   PCard violations are tracked using the employee number and NetID. If an employee transfers to another department or has a gap in employment, prior violations still count toward their cumulative total, which is limited to three. Cardholders or users initiate SRVs, and the Financial Compliance Team issues notifications for non-compliance violations.
   
   The Accounts Payable Financial Compliance unit tracks all SRVs and Notifications of Violations, regardless of type or how they were reported. For a first violation, no further communication is required; however, second and third violations trigger an email notification. When evaluating potential suspension or cancellation of a card, the team considers the number of violations, the explanations provided, and the time between violations. A PCard may be permanently closed after three violations.
    
5. Can my PCard be suspended or cancelled after a first or second violation? 
   Yes, Financial Compliance may consider suspension or cancellation of the PCard after review of the transaction details and depending on the severity and circumstances of the violation.
    
6. How does the cardholder or responsible user repay the university for an unallowable transaction?
   Please see Reimbursing the University for Unallowable Purchases above. 
    
7. What happens if a cardholder or department disagrees with the Notice of Violation issues?
   The business office or cardholders should reply to original email and provide an explanation as to why the department disagrees with the notification and include any additional supporting documentation to justify the expense, if applicable

Related Information

PCard Self-Reporting Violation (SRV)
PCard Start to Finish Guide
Guidelines for PCard Documentation
Misuse of University Assets
State of Arizona Accounting Manual - PCard