Purchasing cards exist to bypass controls. That is not a criticism — it is the design. Running a $75 lab-supply order through requisition, purchase order, receiving, and three-way match costs more than the supplies; the P-card trades all of that upstream control for speed and replaces it with after-the-fact review. The audit question is therefore never “do P-cards circumvent the procurement process” — they do, on purpose, by policy. The question is whether the compensating controls are real: whether the limits bind, the merchant blocks block, the reviews review, and the program notices when a card goes wrong. Individually, P-card transactions are trivial. Collectively, a mid-size program runs millions of dollars a year through the least-controlled payment channel the company operates — and leakage there is a dripping tap: quiet, steady, and material by year-end.
The compensation for auditors: no process is more completely testable. Every transaction arrives in one clean dataset from the card provider — merchant, category code, amount, timestamp — which means nearly the entire audit runs at full population, and the analytics suite in this guide is the engagement. We cover the program design tension, issuance and merchant controls, reconciliation discipline, the abuse catalog, the twelve-test program, the analytics that find what samples never will, and the program-administration layer where terminated employees keep spending.
This guide was rewritten in September 2026 to add what the August version left out: a starter risk and control matrix for the program, how to size and sequence the engagement, MidState Beverage’s purchasing card audit test by test, the findings that recur with wording that lands, scoping variants, and the links to the guides that cover the rest of the spend stack. The design tension, the configuration controls, the abuse catalog, the twelve-test program and the analytics suite are unchanged. The ACFE’s Occupational Fraud 2026 report puts asset misappropriation in 90 percent of its 2,402 cases with a median loss of 100,000 dollars, and a purchasing card is the most convenient instrument in the building for the small, repeated version of it.
In this guide
- The design tension the audit must respect
- Issuance, limits, and MCC blocking
- Reconciliation and review discipline
- The starter RCM: nine controls that carry a card program
- The abuse catalog
- Sizing and sequencing the engagement
- The test program
- The full-population analytics suite
- Worked example: MidState Beverage’s purchasing card audit
- The findings that recur, and wording that lands
- Scoping variants: small programs, ghost and virtual cards, public sector
- Program administration — where cards outlive their owners
- Where to go next
The design tension the audit must respect
A P-card program is a deliberate control trade, and auditing it well means pricing both sides of the trade honestly. The savings are real: low-value purchases skip the entire purchase-to-pay bureaucracy, procurement stops processing hundred-dollar POs, and AP stops matching hundred-dollar invoices. The cost is that the control structure inverts — everything preventive (approval before commitment, competitive sourcing, receiving verification) is replaced by things detective and statistical (limits, category blocks, after-the-fact review). An audit that recommends re-bureaucratizing small purchases has missed the point and will be ignored. The audit that lands is the one that tests whether the replacement controls actually operate — and whether the program’s boundary holds, because the classic drift is upward: purchases that belong in procurement (split to fit under card limits, or run as serial card charges to a favorite vendor) migrating into the uncontrolled channel. That boundary problem is the same threshold geometry we mapped in the procurement guide, one level down the spend stack.
Issuance, limits, and MCC blocking
Three preventive controls survive the trade, and they are all configuration. Issuance criteria: cards granted on documented business need with a signed cardholder agreement and completed training — not as a perk that arrives with a title. Test the population of active cards against role criteria and look at the ratio of cards to employees by department; a program where a third of the company carries a card has stopped selecting. Limits: single-transaction and monthly-cycle limits tiered to the role’s genuine need, reviewed periodically rather than ratcheting upward forever — every limit increase approved, justified, and revisited. The single-transaction limit is the program’s most important number, because it defines the boundary with procurement, and the split-transaction analytic below is the test of whether that boundary holds. MCC blocking: the card networks classify every merchant with a category code, and the program should block categories with no business use — cash advances and quasi-cash above all, plus the obvious personal categories (casinos, jewelers, and their neighbors). Two testing notes: pull the actual block list from the provider portal and inspect it as configuration (a test-of-one, per our TOD/TOE logic), and then test the workaround at population — because the standard evasion is not shopping at a blocked merchant, it is buying gift cards at an allowed one. A grocery-store MCC passes every block while converting company money into untraceable value; the analytics section hunts exactly that.
Reconciliation and review discipline
The detective backbone is a monthly cycle: the cardholder reconciles the statement — coding each charge, attaching receipts above the threshold, certifying business purpose — and an approver with actual knowledge of the cardholder’s work reviews and signs off. Both halves rot in predictable ways. Cardholder discipline decays into late reconciliations, missing receipts, and copy-paste business purposes (“supplies” × 40); measure all three at full population — days-to-reconcile, receipt-compliance rate, and purpose-text duplication — rather than sampling for them. Approver review decays into the same rubber stamp we test everywhere else: approve-all clicks, minutes-long review of hundred-line statements, and — the structural failure — self-approval or peer-approval where the routing lets a cardholder approve their own statement or two colleagues approve each other’s. Pull the approval routing table and test it as data. And check the escalation path: a reconciliation that sits unapproved for ninety days should suspend the card automatically; a program with no consequence for non-reconciliation is collecting signatures, not operating a control — the evidence-of-review standard from our evidence guide applies with full force.
The starter RCM: nine controls that carry a card program
The program trades upstream control for speed, and the matrix below is the list of controls that have to hold for the trade to be safe. Nine rows carry most programs; build them in the RCM template, mark which exist, and treat a missing row as a design finding before a single transaction is examined, because a program with no automatic suspension for unreconciled statements is a finding whether or not the reconciliation profile shows lateness.
| Control | Type | What it prevents or detects | How to test it |
|---|---|---|---|
| Cards issued only against documented business need, a signed cardholder agreement and completed training, approved by the cardholder’s manager and the program administrator | Preventive | Cards as perks; cards in roles with no spend need | Active cards against the criteria; cards-per-department ratio |
| Single-transaction and cycle limits set by role tier, with increases approved, justified and time-bound | Preventive, configuration | Procurement spend migrating into the card channel; limits ratcheting upward | Configuration against the tier policy; full population of limit increases |
| Merchant category blocks for cash, quasi-cash and personal categories, maintained by the administrator against a documented list | Preventive, configuration | Cash conversion; obvious personal spend | Block list inspected as configuration; declined-transaction log tested |
| Monthly cardholder reconciliation with receipts above threshold and a stated business purpose, and approval by a manager with knowledge of the cardholder’s work, with self and reciprocal approval blocked in routing | Detective | Personal purchases; splits; unread statements | Timeliness, receipt compliance and purpose duplication at full population; routing table tested as data |
| Automatic suspension of a card whose statement is unreconciled or unapproved past a set number of days | Corrective, configuration | Reconciliation as signature collection | Configuration inspected; suspensions in the period traced to the rule |
| Card cancellation wired to the HR termination feed with a same-day service level, and to role changes with a review | Preventive | Cards that outlive their holders | Card activity joined to terminations; cancellation dates against termination dates |
| Annual recertification by each cardholder’s manager of the card, its limits and its need, reconciled to the active-card extract | Detective | Dormancy; title drift; limits nobody remembers approving | Certified population against the extract; dormant cards against the last certification |
| Program analytics run monthly by the administrator or finance: splits, gift cards, terminated activity, velocity, recurring charges, the T&E cross-join, with hits dispositioned | Detective | Every pattern in the abuse catalog | Twelve months of analytics output and dispositions |
| Administrator segregation, provider settlement reconciled to the ledger monthly, rebate calculated and collected, and program metrics reported to an owner with authority | Entity-level | The watcher unwatched; the money loop unclosed | Administrator’s own card and approvals tested; twelve reconciliations; rebate statements against receipts |
The abuse catalog
P-card abuse comes in a small number of durable shapes, each with a data signature:
- Personal purchases — the volume leader. Signatures: weekend and holiday timestamps, merchants near home rather than work, home-delivery patterns, and categories that read like a household (streaming, groceries, school supplies in August).
- Split transactions — the single-transaction limit defeated by division: $4,900 twice at the same merchant an hour apart instead of $9,800 once. The program’s boundary with procurement, breached retail.
- Gift-card conversion — quasi-cash bought at legitimate merchants; the MCC block’s blind spot and the hardest theft to trace once converted.
- Shared cards — one card circulating through a team kills attribution: nobody spent it, everybody spent it. Signature: humanly impossible patterns — transactions in two cities in the same hour, seven-day-a-week activity.
- Dormant and orphaned cards — cards unused for months (attack surface waiting for a fraudster or a temptation) and cards still active after their holders left — the same leaver failure our IAM guide hunts in system access, wearing plastic.
- Double-dipping — the same expense charged to the P-card and claimed through T&E reimbursement; only a join across the two systems finds it.
- Subscription creep — recurring charges that outlive their users, their projects, and occasionally their vendors; nobody’s purchase, everybody’s cost.
Sizing and sequencing the engagement
A card program audit is the cheapest engagement in the spend stack per dollar of finding, because the population arrives complete from the provider and the analytics do most of the work in a day. The ranges below assume a program of a few hundred cards, one provider, an HR feed and an expense system to join to, and an auditor who can run the suite in a spreadsheet or a query tool. What stretches it is a second provider after an acquisition, receipts held on paper at sites, and a program administrator who has never produced the routing table as data. Record the analytics thresholds and the file-review selection in the sampling memo, because the review is not a sample but a selection from the hits, and a reviewer will ask why those hits.
| Phase | What happens | Hours |
|---|---|---|
| Planning and configuration | Policy, tier table, block list, routing table and cardholder list obtained; the RCM drafted; the provider extract requested for twelve months with the declined-transaction log | 20 |
| Walkthrough | One card from request to cancellation; one statement from transaction to payment; the administrator’s own activity walked | 10 to 15 |
| Data and joins | Provider transactions joined to the cardholder list, HR master with terminations, the expense system and the ledger; completeness proved against the provider settlement | 25 to 35 |
| Analytics suite | The ten analytics run on the full year; hits scored and grouped | 30 to 40 |
| Configuration and control tests | Issuance, limits, blocks, routing, suspension, cancellation, recertification tested from configuration and population | 40 to 50 |
| Hit review | Every gift-card and terminated-activity hit; the top split clusters; the double-dip matches; the recurring charges without owners | 50 to 70 |
| Reporting | Findings at program level; people-level items routed through management or the protocol; the rebate and subscription savings quantified | 30 |
| Total | 205 to 270 |
Sequence the configuration tests before the analytics, because the single-transaction limit and the block list in force are what the analytics test against; the analytics before any file review, for the reason the suite’s sequencing note gives; and the terminated-activity and gift-card hits first among the reviews, because those are the two that can become referrals and the first 48 hours protocol should start in the first week rather than the last.
The test program
| # | Test | Focus |
|---|---|---|
| 1 | Walk the card lifecycle end to end — request, issuance, transaction, reconciliation, approval, payment, cancellation — and update the RCM | All |
| 2 | Test active cards against issuance criteria: business need, signed agreement, training; compute cards-per-department ratios | Issuance |
| 3 | Inspect limit configuration against the tier policy; test the full population of limit increases in period for approval and justification | Limits |
| 4 | Inspect the MCC block list as configuration against policy; test declined-transaction logs to confirm blocks operate | MCC |
| 5 | Run split-transaction detection at full population; inspect flagged clusters and the cardholders’ explanations | Splits |
| 6 | Run the gift-card and quasi-cash merchant screen at full population; disposition every hit above a de minimis floor | Conversion |
| 7 | Measure reconciliation timeliness, receipt compliance, and purpose-text duplication at full population; verify the suspension consequence actually fires | Reconciliation |
| 8 | Test approval routing as data: self-approval, reciprocal peer approval, approve-all timing patterns | Review |
| 9 | Join card activity to HR terminations: any transaction after termination date escalates immediately; test cancellation SLA at full population | Leavers |
| 10 | Identify dormant cards (no activity 6+ months); test the recertification cycle that should have caught them | Dormancy |
| 11 | Join P-card transactions to T&E claims on amount, date, and merchant; investigate double-dip matches | Double-dipping |
| 12 | Review program administration: admin SoD, metrics reported, rebate terms understood, provider settlement reconciled to GL | Governance |
The full-population analytics suite
| Analytic | How it works | What a hit means |
|---|---|---|
| Split detector | Same card + same merchant within 24–48h, combined amount over the single-transaction limit | Limit circumvention — the boundary with procurement failing |
| Just-under clustering | Histogram of amounts against the single-transaction limit; density spike below the cliff | Population-level circumvention signature, same geometry as procurement thresholds |
| Gift-card screen | Merchant-name and MCC patterns for gift-card and prepaid products, any merchant | Cash conversion — the highest-severity hit in the suite |
| Terminated-cardholder activity | Transactions dated after HR termination, any amount | Cancellation control failed; possible active misuse — escalate |
| Weekend/holiday screen | Timestamp filter weighted by category and cardholder role | Personal-use indicator — selection criterion, not conclusion |
| Personal-merchant screen | Category and merchant-name match against a personal-spend lexicon (grocery, gaming, salons, streaming) | Personal purchases or policy drift by department |
| Velocity outliers | Transactions and spend per card vs. role-peer baseline | Shared cards, runaway subscriptions, or a card being farmed |
| Impossible-geography check | Same card, physically incompatible merchant locations within short windows | Shared card or compromised card number |
| Recurring-charge census | Same merchant + similar amount monthly; map to an active owner and business purpose | Subscription creep — usually the audit’s easiest dollar savings |
| T&E cross-join | Card transactions matched to reimbursement claims on amount/date/merchant fuzz | Double-dipping — individually small, behaviorally serious |
Sequencing note: run the suite before any cardholder file review, then spend your inspection hours only where the analytics point — the layered approach every process guide on this site uses, at its purest here because the population is complete, clean, and arrives from an independent source (the card provider, not the auditee — which, per the evidence hierarchy, is exactly the provenance you want).
Worked example: MidState Beverage’s purchasing card audit
MidState Beverage, the three-state drinks distributor used across this site, with twelve depots, about 1,400 employees and a six-person internal audit function, ran a purchasing card program of 210 cards: depot managers, maintenance and fleet staff, and head-office administrators, spending about 3.4 million dollars a year across 28,000 transactions, with a single-transaction limit of 2,500 dollars and a monthly limit of 10,000. The two acquired distributors’ cards were still on their old provider’s program. The card audit followed the travel and expense audit in the FY28 plan, which had already found that the acquired entities claimed in cash; it took 220 hours, and the analytics ran on the full year from both providers’ extracts.
| Test | What it found | Disposition |
|---|---|---|
| 1. Lifecycle walkthrough | Cards issued on a manager’s email; the agreement signed for 140 of 210; training recorded for 90. The acquired distributors’ program had no tier table and no block list of its own. | RCM redrawn with two programs |
| 2. Issuance criteria | 210 cards for 1,400 employees; 31 held by staff whose roles had no purchasing need on the tier table, 19 of them inherited from predecessors. | Finding, Medium: issuance and recertification |
| 3. Limits | Tiers configured as policy at the legacy program; 26 limit increases in the year, 14 with no justification recorded, four never reversed after the stated project ended. | Inside finding 2 |
| 4. Merchant blocks | The legacy block list matched policy; the declined log showed it operating. The acquired distributors’ cards blocked cash advances only. | Finding, Medium: the second program’s configuration |
| 5. Splits | 61 clusters of same-card, same-merchant transactions within 48 hours exceeding 2,500 dollars in aggregate, at three depots, 44 of them with the fleet maintenance vendor the accounts payable audit had already found being split around the purchase order threshold. | Finding, High: the boundary with procurement |
| 6. Gift cards | Fourteen gift-card purchases at grocery and pharmacy merchants, 2,900 dollars; nine by one depot administrator, coded as staff recognition with no recipient list. | Referred under the protocol on day four; substantiated for six of the nine; finding on the recognition policy, Medium |
| 7. Reconciliation discipline | 22 percent of statements reconciled late; receipts attached for 71 percent of charges above the threshold; the purpose text “supplies” on 38 percent of all lines; the suspension rule configured but never triggered because the reconciliation deadline had been set to 120 days. | Finding, Medium: reconciliation and the suspension rule |
| 8. Approval routing | Four cardholders, including the program administrator, routed to approve their own statements; two reciprocal pairs at depots. | Finding, High, combined with the administrator finding |
| 9. Terminated cardholders | Six cards active after their holders’ termination dates, two with transactions totaling 1,100 dollars, both by former colleagues who had the card details; cancellation lagged termination by a median of nine days. | Inside the High finding; the two transactions recovered |
| 10. Dormant cards | 38 cards with no activity in six months; no recertification had been performed since the program began. | Inside finding 2 |
| 11. Double-dipping | 27 matches between card transactions and expense claims on amount, date and merchant, 4,300 dollars, across eleven cardholders. | Finding, Low; recoveries by management |
| 12. Administration | The administrator held a card, approved his own statement, and could raise limits and change blocks alone; the provider settlement was reconciled to the ledger; the rebate had not been claimed for two years, 31,000 dollars; 41 recurring charges, twelve with no living owner, 18,000 dollars a year. | Finding, High: administrator segregation; rebate and subscriptions recovered |
The report carried eight findings, two High, four Medium and two Low, an overall rating of Needs Improvement, and one referral handled outside it. Three things generalize. The split finding was the same finding the accounts payable audit had reported about the same vendor at the purchase order threshold; the depots had moved the behavior one level down the spend stack, which is what the guide’s design-tension section predicts and what an integrated view of the spend stack catches. The administrator finding was the most uncomfortable and the most important, because nobody had ever tested the program’s own owner, and the fix was two configuration changes. And the audit paid for itself in the rebate and the orphaned subscriptions before a single control was fixed, which is the argument for putting the card program on the plan every other year.
The findings that recur, and wording that lands
Card findings have names on every line of the data and must be written about the program, with the people routed through management or the protocol; the five Cs keep the finding on the control. The two below recur in most card audits.
Split transactions at the procurement boundary. Condition: the full-year split analytic identified 61 clusters in which the same card charged the same merchant two or more times within 48 hours for an aggregate above the 2,500-dollar single-transaction limit, at three depots; 44 clusters involved one fleet maintenance vendor, and the aggregated purchases would have required a purchase order and a competitive quote under the procurement policy. Criteria: the card policy prohibits splitting a purchase to remain under the single-transaction limit; the procurement policy requires a purchase order above 2,500 dollars and three quotes above 10,000. Cause: the card provider’s split alert is not enabled, no monthly split analytic is run, and the depots’ maintenance purchases are made under time pressure from a vendor whose invoices were already being split around the purchase order threshold. Consequence: about 190,000 dollars of maintenance spend in the year bypassed the purchase order and quotation controls through the card channel, and the pricing obtained cannot be shown to be competitive. Corrective action: enable the provider’s split alert with the administrator dispositioning hits monthly, run the split analytic in the monthly program pack, and place the fleet maintenance vendor on a blanket purchase order with card purchases blocked by merchant (controller and head of procurement, by quarter end).
Administrator segregation. Condition: the program administrator holds a card, is routed to approve his own statement, and can issue cards, raise limits and change merchant blocks without a second approval; three other cardholders are routed to approve their own statements and two depot pairs approve each other’s. Criteria: the card policy requires statements to be approved by the cardholder’s manager and prohibits self-approval; the delegation of authority requires limit and block changes to be approved by the controller. Cause: the routing table is maintained by the administrator, no periodic review of it exists, and the provider portal’s dual-control setting for configuration changes has never been enabled. Consequence: the person who can change every control in the program is the one person the program does not watch, and four cardholders’ statements have never been reviewed by anyone else. Corrective action: enable the provider’s dual control for issuance, limit and block changes with the controller as second approver, correct the routing table and review it quarterly against the HR hierarchy, and cancel the administrator’s card (controller, within thirty days).
Scoping variants: small programs, ghost cards and virtual cards, public sector
Small programs of a few dozen cards are audited in a week and should be audited in full: every card, every statement for two months, the whole year’s analytics; the finding is usually the administrator, who is also the accountant, and the compensating control is the owner’s review of the provider statement with the receipts. Ghost cards and virtual cards, single-use or department-level numbers with no plastic and no cardholder, move the risk from the person to the process that generates the number: test who can generate one, what limits apply, and whether the transaction is matched to an order, because a ghost card without a matching control is an open purchase order with no receiving step. Public sector programs carry the same abuse catalog under a harsher spotlight, since card transactions are often public records and the audit committee is a council or a legislature; the analytics are the same, the reporting adds the disclosure dimension, and the gift-card screen carries more weight because a gift card bought with public money is the story a journalist writes. In every variant the two configuration tests, the limit and the block list, and the two joins, terminations and the expense system, remain the core, and the administrator remains the person the audit must remember to test.
Program administration — where cards outlive their owners
The administration layer is small and disproportionately important. The leaver chain: card cancellation must be wired to the HR termination feed with an SLA, exactly like system access — and tested the same way, at full population, because a card that outlives its holder is a liability with a credit limit. Administrator segregation: the program admin can typically issue cards, raise limits, and change MCC profiles — powers that must not combine with holding a card outside oversight or approving statements; test the admin’s own activity explicitly, because nobody else is watching the watcher. Recertification: an annual owner-level attestation that each card and its limits are still needed — the control that catches dormancy and title-drift, testable by comparing the certified population to the active-card extract, the same completeness logic as an access review. And the money loop: the provider settlement reconciled to the GL monthly, rebate terms understood and collected (programs routinely leave rebate revenue uncollected because nobody owns the calculation), and program metrics — spend, decline rate, delinquency, exception counts — reported to someone with authority to act on them.
Where to go next
The card audit is the purest expression of the analytics-first approach: a complete, independently sourced dataset, a short list of durable abuse patterns, and a suite of tests that examine every transaction. Respect the design trade, prove the safety net under the speed, test the administrator, and let the data pick the files. The rest of the spend stack has its own guides: procurement for the boundary the splits cross, the vendor master, accounts payable, travel and expense for the other card, and the integrated procure-to-pay audit for the chain as a whole; a gift-card hit that becomes a referral follows the first 48 hours protocol.
Related guides
- How to audit travel and expense — the other card, with MidState’s engagement and the double-dip join’s other half
- How to audit procurement — the threshold geometry one level up
- How to audit procure-to-pay end to end — the chain the card channel bypasses by design
- How to audit accounts payable — where the fleet maintenance vendor’s splits first appeared
- How to audit the vendor master file — who gets paid through the other channel
- The accounts payable analytics catalog — the split and threshold logic the suite borrows
- How to perform a user access review — the leaver logic, applied to plastic
- How to audit privileged access — the administrator problem in its usual setting
- Test of design vs operating effectiveness — the test-of-one for configuration controls
- Audit evidence — why the provider extract outranks the auditee’s
- The ACFE fraud tree explained — expense and billing schemes in context
- When internal audit finds fraud: the first 48 hours — the protocol the gift-card referral followed
- The fraud red flags library — the card indicators, organized for triage
- The risk and control matrix template — where the nine-control matrix lives
- The sampling memo template — documenting the hit selection
- The 5 C’s of audit findings — the form the two findings above are written in
- The finding and issue log template — tracking eight findings and two recoveries
- Data analytics guides, fieldwork and testing guides and fraud risk guides — the full collections
- A Library of Model Audit Report Examples — five annotated reports, clean to follow-up.
- Preventive, Detective and Corrective Controls — the taxonomy, fifty examples and four processes drawn in three columns.
- Internal Audit in Government: The Complete Guide — the public-sector function, from GAGAS to performance audits.
- Internal Audit in Higher Education and Nonprofits: Guide — research grants, Title IV, Clery, athletics and donors.
Leave a Reply