Agenda Item
1. Purchasing Card Audit ~ Updated 9.4.2025
Summary: Presented by: Mr. Joel B. Thibodeaux, Executive Director of Internal Audits & Compliance, Chief of Staff Division
Contact: Mr. Joel B. Thibodeaux, Executive Director of Internal Audits & Compliance, Chief of Staff Division, 678.676.0740
Title
Purchasing Card Audit
Dekalb County School District
Subtitle
MONTH
Date DAY, 2025
[insert document title, industry, or service line] Forvis Mazars
[Date]
Dr. Devon Horton, Superintendent
DeKalb County School District
1701 Mountain Industrial Blvd.
Stone Mountain, GA 30083
We have performed the procedures in the Scope of Services and Approach section of this report, which were agreed to by
the management of Dekalb County School District (DCSD) pursuant to our contract dated January 13, 2025, solely to
assist with assessing the design of DCSD controls over its purchasing card processes.
The engagement was performed in accordance with consulting standards established by the American Institute of
Certified Public Accountants (AICPA). We were not engaged to, and did not, conduct a financial statement audit or an
examination, the objective of which would be the expression of an opinion on the financial statements or any elements,
accounts, or items thereof as part of this engagement. Accordingly, we do not express such an opinion.
Our engagement did not include a detailed examination of all transactions and was not designed, and cannot be relied
upon, to discover all errors, irregularities, or illegal acts, including fraud or defalcations, that may exist. Had we performed
additional procedures, other findings of significance may have been reported to you. The sufficiency of the procedures is
solely the responsibility of the parties specified in this report. Consequently, we make no representation regarding the
sufficiency of the procedures described in the Scope of Services and Approach section of this report for the purpose for
which this report has been requested or for any other purpose.
This report summarizes the scope of the engagement, the procedures performed, and the results of our procedures.
Our report is intended for use only by DCSD Management and the School Board with respect to the procedures
performed by us. This report is not intended to be, and should not be, used by anyone other than the specified parties
unless express written consent is obtained from Forvis Mazars, LLP.
<to be added by word processing
Firm signature>
Contents
Executive Summary ........................................................................................................................................ 1
Definitions of Ratings...................................................................................................................................... 2
Background of the Purchasing Card Program .............................................................................................. 3
Objective, Scope, and Approach .................................................................................................................... 3
Assessment Summary .................................................................................................................................... 4
Findings, Recommendations, & Management Response ............................................................................. 5
Executive Summary
Background:
The Dekalb County School District (DCSD) launched a purchasing card (P-card) program designed to enhance the
efficiency of procurement, receiving, and payment processes for low-value transactions. Forvis Mazars LLP (Forvis
Mazars) conducted a review of this program to evaluate adherence to established policies and procedures, assess the
effectiveness of internal controls, and offer recommendations for further improvement.
Our review considered purchasing card policies and procedures, issuance, security, and usage for transactions occurring
from July 1, 2023, to September 30, 2024, on a sample basis. As part of our procedures, we obtained and read relevant
policies, interviewed staff involved in the process to identify key controls, tested those controls for operating effectiveness,
and provided recommendations for improvement.
Our review identified instances of noncompliance with policies and procedures and control failures. These instances have
been discussed with management, and they have a plan in place for remediation. Some examples for improvement
include:
• The policy and procedures should be updated to clearly outline the chief financial officer’s approval authority and
define purchasing limits for the school board and superintendent.
• Management should define and establish a consistent process for deactivating and suspending cards.
• Management should work with the issuing bank to put controls in place to limit daily ($5,000) and monthly
($20,000) spending.
• Management should work with the issuing bank to put controls in place to limit card use to approved vendors.
2F
Internal Audit Forvis Mazars 1
Definitions of Ratings
Control Ratings
• Key – A key control is an action your organization takes to detect and prevent errors or fraud in its financial
statements or operational effectiveness. It is expected that departments have their processes and controls
documented. Your department should already have key financial review and follow-up activities in place.
• Non-key – Non-key controls are considered secondary or back up controls.
Risk Ratings
• High – Reasonable possibility that if unaddressed could lead to a material weakness and / or a material
misstatement or misuse of assets.
• Moderate – Reasonable possibility that if unaddressed could lead to an immaterial misstatement, misuse of
assets and a deficiency that may require the attention of those charged with governance.
• Low – Remote possibility that if unaddressed could lead to an immaterial misstatement or misuse of assets.
Current Status Ratings
• At Risk – Reasonable possibility that if unaddressed could lead to a material weakness and/or a material
misstatement or misuse of assets.
• Needs Improvement – Reasonable possibility that if unaddressed could lead to an immaterial misstatement,
misuse of assets and a deficiency that may require the attention of those charged with governance.
• Satisfactory – Remote possibility that if unaddressed could lead to an immaterial misstatement or misuse of
assets. Objective, Scope, and Approach
Background of the Purchasing Card Program
DCSD implemented a purchasing card program to streamline the procurement, receiving, and payment processing of low-
value purchases. The program uses the Bank of America VISA Card, through the State of Georgia contract, for payment
processing and program administration. There are two types of cards: one for instructional/office supplies and equipment,
and one for staff travel expenditures, except for the Superintendent, who has a card that can do both.
With the district-wide approval of the Chief Financial Officer and their department head, designated DCSD officials are
authorized to be issued a purchasing card. Issuance occurs during a purchasing card program orientation meeting with
the Purchasing Card Administrator or the Procurement Manager, after the cardholder signs the purchasing card
agreement and verifies the information on the card is accurate. Purchasing cardholders are assigned individual
transaction, daily, and monthly spending limits. Outside of the DCSD Board of Education and Superintendent, the limits
are $5,000 per day per swipe and $20,000 per month. These limits are programmed into each card. Various items and
merchants are programmatically restricted from VISA purchasing card use.
Objective, Scope, and Approach
Objective
Assist DCSD with assessing its purchasing card program for compliance with policies and procedures, and operating
effectiveness of controls, and provide recommendations for improvement.
Scope
The scope included transactions occurring from July 1, 2023, to September 30, 2024, covering the following purchasing
card program activities:
• Purchasing Card Policy and Procedure
• Purchasing Card Issuance
• Purchasing Card Security
• Purchasing Card Usage
Approach
Our approach included the following procedures:
• Obtain and read any existing policies and procedures
• Identify and interview process owners to obtain an understanding of the process and related activities
• Document our understanding and validate it with the process owners
• Conduct walkthroughs of the process and activities
• Assess the process for compliance with policies and procedures
• Select samples
• Assess the operating effectiveness of controls
• Summarize results
Assessment Summary
The following table summarizes our findings. It lists the activity, control, and various ratings based on the definition of
ratings listed above.
Activities Control Control Risk Current Status
Rating Rating Rating
Purchase Card Policy DCSD has established policies and Key High Needs
procedures to effectively oversee Improvement
the purchase card process.
Purchase Card DCSD issued purchasing cards in Key High Satisfactory
Issuance accordance with the policy and
procedure.
Purchase Card Purchasing cardholders must be Key High Satisfactory
Issuance approved by their Department Head
before being issued a purchasing
card.
Purchase Card Purchasing cardholders must Key High Satisfactory
Issuance complete training and sign the
purchase card agreement.
Purchase Card Purchasing cards belonging to Key High Satisfactory
Security former DCSD employees are first
assigned a ‘null’ status and
subsequently deactivated. A
reconciliation process is then
performed to ensure consistency
across all related records, including
invoices, purchase card amounts,
and expense summary reports.
Purchase Card Purchasing cards are assigned a Key Moderate Satisfactory
Security “null” status to suspend the ability to
make purchases for a certain
amount of time as a form of
security.
Purchase Card Use According to policy, all purchasing Key High Needs
card holders are restricted to a daily Improvement
limit of $5,000 per day per swipe.
Purchase Card Use According to policy, all purchasing Key High Needs
cardholders are restricted to a Improvement
monthly limit of $20,000.
Purchase Card Use Purchasing cardholders are limited Key High Needs
to specific types of purchases Improvement
based on the Merchant Category
Codes (MCC) assigned to their card
type.
Findings, Recommendations, & Management Response
Finding Recommendation Management Response
The Purchasing Card policy DCSD policies and procedures
lacks clarity regarding the should be updated to clearly outline
CFO’s approval of designated the chief financial officer’s approval
officials authorized to receive authority and define purchasing
a purchasing card and does limits for the school board and
not clearly articulate the superintendent.
purchasing limit of the School
Board and the
Superintendent.
The statuses of deactivated DCSD should define and establish a
or suspended purchasing consistent process for deactivating
cards are unclear and not and suspending cards and should
explicitly defined in the incorporate this process into the
policy. policy.
Due to insufficient processing DCSD should work with the issuing
controls implemented by the bank to put controls in place to limit
bank, purchasing cardholders daily ($5,000) and monthly
were able to exceed the ($20,000) spending.
$5,000 daily transaction limit
and $20,000 monthly limit
outlined in the established
policy. This lapse indicates a
breakdown in the
enforcement of policy
thresholds and may expose
the organization to financial
and compliance risks
Due to insufficient processing DCSD should work with the issuing
controls implemented by the bank to put controls in place to limit
bank, purchasing cardholders card use to approved vendors.
were able to make prohibited Additionally, the district should
transactions, as defined by implement ongoing monitoring of
the Merchant Category Code cardholder transactions to verify
compliance with assigned profile
(MCC) restrictions associated parameters and take corrective
with their cardholder profiles. action when deviations occur.