Acquisition Cards - March 2012

Appendix A – Audit criteria

Audit criteria were developed in consideration of the risks identified during the planning phase of the audit and were based on guidance from the Committee of Sponsoring Organizations (COSO) Entity Level Control Framework, the TBS Core Management Controls: A Guide for Internal Auditors, and the TBS Directive on Acquisition Cards (Oct. 2009). All criteria were approved by Internal Audit Branch management.

The following high level audit criteria were developed during the planning phase of the audit and included relevant criteria to address specific risks identified in the planning phase.

High Level Criteria Results
Management Control Framework
1.0 The use of acquisition cards is in accordance with the TBS Directive on Acquisition Cards Partially met
2.0 Responsibilities are documented and communicated in accordance with the TBS Directive on Acquisition Cards Partially met
Risk Management Practices
3.0 Separate controls and procedures are established over acquisition cards issued in the name of organizational assets, taking into account unique risks associated with the organizational asset, as applicable. Met
4.0 A risk assessment process exists for the proper recording of acquisition card transactions including identified controls to mitigate risks. Met
Controls for Compliance with Policies and Procedures
5.0 Acquisition card ongoing use and processes are in accordance with departmental policy and the TBS Directive on Acquisition Cards. Partially met
6.0 Sections 32 and 34 of the FAA are appropriately adhered to with respect to acquisition card transactions. Partially met
Compliance by Cardholders with TBS Directive
7.0 Acquisition card purchases, payments, and reconciliations are appropriate and authorized in accordance with the TBS Directive on Acquisition Cards and the FAA. Partially met
User Awareness of requirements of TBS Directive Requirements and User Training
8.0 Departmental training activities and other guiding documentation are clear and appropriately communicated to all personnel involved in the use of acquisition cards by the authorized group/branch. Met
Monitoring Activities
9.0 Acquisition card monitoring activities are adequate and conducted regularly, and purchase transactions are made in accordance with departmental and TB requirements. Met
Date modified: