VIRTUALCAL.COM - austria travel guide

Looking beyond compliance: A routine travel-expense audit leads to a dilemma; enforce corporate policy or second-guess it - Ask Experts

Norman Marks

JOE HAS BEEN THE MANAGER of internal auditing at Sample Corp., a global manufacturing company, for several years. He likes to start off his new audit seniors with a project they will be comfortable with, so they can orient themselves quickly to Sample and its way of doing business. Joe reflected on the background of his latest new senior, Terry, who had worked for several years with the well-respected audit department of a large financial services company. "Travel and entertainment expense is a good place for him to start," Joe thought. "It is an area that he will be comfortable with and does not rely on an understanding of our manufacturing operations. He can learn about that later."

Joe expected the audit to be routine and uncontroversial. However, when Joe met with Terry to conduct an interim review of the audit, Terry showed him a well-constructed finding that Terry said was significant and would result in an adverse opinion on the audit overall:

FAILURE TO ADHERE TO CORPORATE TRAVEL POLICIES BY SENIOR EXECUTIVES: During our audit, we tested a representative sample of approved travel and expense reimbursements. We examined 120 payments and found that 15 percent had exceptions, including:

* Employees who, with the approval of their department manager, had booked their own travel on the Internet, bypassing the corporate travel department.

* Employees who, with the approval of their department manager, had used another travel agency to book international travel. The department manager had written a letter, which was provided to the internal audit department, indicating that the travel agency was a "consolidator" that specialized in international travel. By purchasing tickets in bulk, the consolidator was able to offer the company fares at lower costs than those available through corporate travel.

Corporate Policy 131 requires all travel to be booked by the corporate travel department, and there is no provision in the policy for exceptions. The manager of the corporate travel department was not aware of these policy violations. He reports that the use of the Internet or other travel agencies to purchase travel limits the ability of the department to obtain advantageous contracts with travel providers.

We recommend that the managers and staff involved be reminded of the requirements of Corporate Policy 131, and that further failure to adhere to policy be reported to senior management for corrective action.

Joe has a problem. He knows from talking to senior management that there is concern throughout the company that the corporate travel department is not obtaining the best fares and that better rates are frequently found by shopping on the airlines' Web sites. Should Joe, as the internal auditor, work to enforce the company policy? Or, as a member of management, should Joe second-guess the expert who had been hired to run corporate travel? Three internal auditors address Joe's dilemma.

JAMES E. CARTER

Vice President Internal Audit Norfolk Southern Corp.

Joe must take the position of management and seek a solution to the more important issue, minimizing travel costs. Terry's determination that 15 percent of employees book their own travel arrangements - with the approval of their manager - presumably to obtain better service or a lower price, screams for attention. The core recommendation in Terry's report should have been a thorough audit of corporate travel, as management of these costs appears to be lacking. The fact that employees are violating Corporate Policy 131 does not appear to be the important issue, as the policy seems too narrow. Surely, the company-negotiated price cannot always be the lowest. Joe should have Terry develop data to evaluate the cost of current travel arrangements versus other alternatives.

This is an awkward situation for Joe, as it is internal auditing's job to add value by proactively helping to detect and correct such deficiencies. Joe was aware of this issue but took no action. It also appears senior management was aware of this issue, but also took no action. Perhaps, Joe should have used one of the department managers' letters to facilitate a meeting of the corporate travel manager, the department managers, and internal auditing to discuss, analyze, and resolve this issue. That might still be a viable alternative. Joe must ensure that facts and circumstances are carefully gathered and documented to fully understand the issue, and what better starting place than at such a meeting? Issues to discuss at the meeting include:

* Why, if the corporate travel manager understands the savings to be realized from volume rates, hasn't he or she aggressively pursued this opportunity?

* What process, if any, was there to capture and analyze all business travel arrangements?

* Why did the corporate travel manager fail to realize so many employees were circumventing the travel policy?

* How can this process be improved? Changing the core recommendation of the report and initiating the meeting will give Joe an opportunity to be proactive. Perhaps the employees and senior management don't fully understand the value of the discounts that the expert has negotiated, and a simple awareness effort will eliminate the negative perceptions. One thing is for sure: You will rarely win a difference of opinion argument with a subject matter expert, so let solid data do the talking.

MIKE JACKA

Regional Auditing Manager Farmers' Insurance Group

Why is it that when you combine two elements -- an easy audit and a new auditor - things never go as you expect? Probably because audits are easy only when people quit working hard on them, and new auditors ask the questions to which everyone else thinks they already know the answers.

As is so often the case when an audit takes an unexpected turn, there is much work left to do. The auditor has done a compliance audit and, in the process, may have stumbled across a much more fundamental problem. The ultimate question here -- and in any audit -- is "Why?" Why do 15 percent of the employees go outside the prescribed procedures? Why do their managers agree and approve this move? And, why hasn't corporate travel seen this and responded to the needs of its customers?

There is no doubt that the auditor should do additional work to find the answers. The auditor should examine expenses to determine if Internet bookings and the other travel agency were cheaper than corporate travel. If not, the auditor should dig deeper to determine if there is some other benefit -- for example, ease of use -- that is causing people to go outside procedure.

If the other options are cheaper, discussions should be held with corporate travel to determine if they are aware of this situation and what they plan to do in response. Further, the "advantageous agreements" should be reviewed to verify that the greatest cost savings are being achieved. Finally, the internal auditors should determine if corporate travel is looking at the employees as customers. At first blush, it appears that they may have lost sight of their purpose, which raises the question: Did they ever understand their purpose? By focusing on an old expense paradigm or on procedures, the travel department may have lost sight of the need to find cheap rates in a way that benefits the employees as well as the company.

Unless the department is happy with its compliance audit, there is a lot of work left to do. If all that is reported is that 15 percent of people are not following a possibly outdated procedure, then the audit department has done next to nothing for its customers. The only way this audit can be of any value is to make sure it is an operational audit.

Ultimately, the decision of whether an audit should focus on compliance or operational issues comes down to what is expected of the audit department. If audits have always focused on compliance and all the audit committee wants is compliance, then trying to move into the operational arena may be tough. But an audit like this might represent a perfect opportunity to show that auditing can provide much more value.

Senior management has concerns about the corporate travel department. Internal auditing, with some additional work, may now have the facts to help back up that concern or prove that everything is fine. In either case, the confidence this small audit might give management can result in large dividends for the department.

SCOTT DELANTY

Director of Internal Audit

Computer Sciences Corp.

Sometimes, exceptions to policy indicate more a need to update a policy than to punish the violator. In this case, airline tickets purchased from someplace other than the specified travel provider should be infrequent, but allowed with prior approval. Recent upheavals in travel practices and pricing are requiring travel policies to be updated, including provisions for situations where the travel provider does not offer the lowest price.

The policy should require the employee to contact the travel provider to see if the provider can match or beat the lower price, which providers usually can do. If the provider cannot match the price, the employee should contact the internal travel department for approval to purchase the lower fare. When expense report audits indicate lack of travel department approval, internal auditing should alert the travel department.

The travel department must be part of the approval and purchase process for several reasons. A company needs to track employee whereabouts in case of emergency. Also, the department reviews routes and carriers for safety and reliability, and uses route volumes for negotiating with preferred carriers. Notification of lower fares improves the department's ability to negotiate with its travel provider and carriers. Finally, a lower fare may in fact not be lower than the company's net cost after negotiated volume discounts, especially where volume thresholds are at stake. Internal auditing, with its own travel experience, can add value for travelers and the travel department by helping to improve both policy and practice.

If you have a case that you'd like a panel of experts to review in the magazine, send it to Norman Marks, Solectron Corp., 890 Yosemite Drive, Bldg. 14, Milpitas, CA 95035, USA; e-mail: NormanMarks@ca.slr.com

Please e-mail your Comments or suggestions about this column to editor@theiia.org.

VIRTUALCAL.COM - austria travel guide

Menu