P-card/CC Loss and Controls

A corporate card is the most convenient fraud tool ever handed to an employee, and most companies audit them about as often as they replace the smoke detector batteries (when it starts chirping because there is an issue). 

Here are the numbers that should change that. The typical organization loses 5% of its revenue to fraud every single year. The latest ACFE study tallied more than $3.1 billion in losses across roughly 1,900 cases, with a median hit of $145,000 and an average of $1.7 million per case. Asset misappropriation, which is where card abuse and expense fraud live, shows up in 89% of all cases. Zoom out further and 76% of US organizations reported attempted or actual payments fraud in the past year alone. 

Now the part that matters most for cards. The median fraud runs 12 months before anyone catches it. Caught inside six months it costs about $40,000. Left to run past five years it blows past $1.1 million. That gap is the entire argument for routine auditing, because every month nobody looks is a month the loss compounds. 

A P-card is a standing line of credit with one person’s judgment as the only control. Personal buys dressed up as business, inflated expense reports, transactions split to slip under approval limits, ghost vendors paid on plastic. And the worst offenders sit at the top (another reason Internal Audit should report to the Board), because fraud by owners and executives carries a median loss more than nine times that of regular employees, and those are exactly the people with the highest limits and the least oversight. And 84% of fraudsters show a behavioral red flag before they are caught, but only if someone is actually watching. Here is why they usually are not. More than half of all fraud cases trace back to weak internal controls or someone overriding them. 

Tips catch 43% of fraud, more than any audit does, which sounds reassuring until you realize it means most companies find fraud by accident, not by design. Small organizations get hit hardest, where check and payment tampering runs nearly four times more often than at large firms. By sector, the highest median losses land in mining at $550,000, wholesale trade at $361,000, and manufacturing at $267,000, while banking and government rack up the most cases (no one should be surprised by this). No industry is exempt. 

The fix is not complicated and it is not annual. Sample card transactions every cycle, match receipts to charges, flag the splits and the round numbers and the weekend purchases, and rotate who runs the review so it cannot be gamed. So here is the gut check. When did anyone last read your card statements line by line? If the honest answer is that you trust your people, you do not have a control. 

Reach out if you want to discuss.