Salt Lake County Proprietary Cards and Amazon Purchases Audit
Scope
The scope of the audit was from January 1, 2023, to December 31, 2023.
Objectives
The audit objectives were to provide reasonable assurance that the internal controls in place are adequate and effective and that purchasing processes comply with all applicable fiscal ordinances, policies, and procedures. We also worked to ensure that County assets are safeguarded against the risk of fraud, waste, or abuse. Areas of audit focus included:
- Program Oversight by Contracts and Procurement
- Youth Services Proprietary Card Use
- Criminal Justice Services Proprietary Card Use
- Countywide Amazon Purchasing
Report Highlights
Inadequate Oversight and Policy Non-Compliance in County Proprietary Card Use
Contracts and Procurement was not aware of the current use of proprietary cards by two Salt Lake County agencies, and therefore was not overseeing their use. Contracts and Procurement is responsible for division oversight per Salt Lake County Countywide Policy 7036: Charge Cards/Proprietary.
Improper Gift Cards Purchases for Employees and Volunteers
During the audit period 10 agencies placed 163 orders totaling $82,119 for 1,914 gift cards. The Office of Regional Development purchased 23 gift cards totaling $882 that were distributed to employees or volunteers in violation of County policy.
Inadequate Gift Card Management, Including Excessive Inventory and Control Deficiencies
The Health Department maintained an inventory of 424 gift cards with a combined value of $4,230 on hand. Some of the gift cards had been purchased up to 15 months prior. Additionally, we randomly sampled 107 cards and found that two cards were missing, and five cards that were supposed to have been distributed were still on hand. Additionally, we noted inconsistent formatting of the gift card distribution lists provided by Health Department management. In some instances, reports included only the last four digits of the card with the recipient’s name, or the reason for issuing the gift card on the tracking sheet. One list did not contain card numbers and only had the signature (not printed names) of the recipient.
Inadequate Training and Oversight Contributes to Misuse of Amazon Business Account
The Amazon Business account is intended for County business purchases only, paid for using a County Purchasing Card (PCard). Access to the business account requires use of an active county network account and password. However, we found five non-county issued payment methods used on 41 orders totaling $4,063 across three different county agencies. Additionally, one employee used a personal email address to place 32 orders totaling $667.
Purchases Shipped to Non-County Facilities
During the audit period 64 distinct account groups made 16,490 orders that were shipped to over 600 different locations. While items were primarily sent to county-owned facilities, some shipments to non-county-owned facilities were necessary due to off-site program use or clientele services provided through agency programs. We found that 13 agencies with 393 orders totaling $28,176 had shipped to 45 off site locations, without supporting documentation justifying a valid business purpose.
