Purchase Card Controls for Public Entities

Identify the Entity’s Purchase Card Rules

Identify the entity’s jurisdiction, legal status and governing financial framework before deciding whether a purchase complied. A Commonwealth department, state agency and local council can have different powers and instructions.

For Commonwealth entities, the Public Governance, Performance and Accountability Act addresses proper resource management and internal controls in sections 15 and 16. Section 20A provides for accountable authority instructions. The Department of Finance’s guidance on those instructions distinguishes issued instructions from other internal guidance. A model instruction is a starting point for identifying the entity’s actual requirements.

Assemble the applicable instruments before testing transactions. Retain the issued instructions, financial delegations, card policy and relevant procurement or travel rules. Record the version that governed the purchase and who could approve exceptions. The detailed source-of-power assessment belongs with the entity’s financial delegations.

Extract the fields needed for the review: eligible holders, permitted expenditure, approval conditions, evidence requirements, acquittal timing and escalation responsibility. Establish the entity’s own limits and deadlines. A limit used by another agency is not evidence of this holder’s authority.

The Western Australian Auditor General’s metropolitan purchasing-card audit found unclear guidance on allowable and reasonable expenditure. Use that finding to test whether your policy answers the disputed question. For a council-specific obligation, identify the applicable Local Government (Financial Management) Regulations and council policy before advising on compliance.

Authorise Issue and Set the Cardholder’s Limits

An issue record needs to connect a named holder’s business need with the approval to give that person a card. Check the approval against the card register and the issuer’s record. A form awaiting approval does not establish completed authorisation.

Record the holder’s role, approved credit and transaction limits, permitted purposes and any merchant restrictions. Identify the officer responsible for reviewing purchases and the authority under which that officer acts. Keep the request, approval and issuer confirmation together so a later reviewer can distinguish the requested limit from the limit actually applied.

Check whether the holder received induction and accepted the applicable obligations before use. Preserve the acknowledgement and any required refresher record. Separate requesting a card, spending with it and reviewing its transactions through the entity’s authorised process. Where staffing makes separation difficult, document the alternative oversight required by the policy.

Retain Evidence for Each Purchase

Each purchase needs a record connecting its business purpose to the holder and statement line. Keep the approval where required, invoice or receipt, evidence of delivery and accounting allocation. Record enough detail to explain what the entity bought and why it paid.

Handle different evidence problems separately:

• For a missing receipt, seek a supplier copy and apply the entity’s alternative-evidence procedure. Preserve the original gap and the evidence later obtained.
• For an unfamiliar merchant description, compare the invoice, trading name and booking or order record. Ask the holder about the transaction before treating the description as evidence of personal spending.
• For an apparent personal purchase, preserve the statement and supporting documents, obtain an explanation and apply the policy’s misuse or accidental-payment procedure.
• For goods not received, check delivery records and any refund or dispute process. An invoice alone does not establish delivery.

Keep the original records intact when an explanation arrives. Add the explanation with its author and receipt details so the review shows what was known at each stage.

Reconcile and Independently Review the Transactions

Reconciliation connects each statement line to its supporting evidence and ledger allocation. Acquittal records the holder’s explanation and supporting documents. Independent review records the authorised officer’s assessment of those purchases against the entity’s rules.

The Australian National Audit Office’s credit-card management lessons address preventative controls and weaknesses in acquittal. For your review, record who checked each exception, the evidence considered and the outcome. A workflow status marked approved needs a corresponding authorised review record.

Consider this fictional duplicate-payment example. A holder buys training materials for $240 using the purchase card. The statement reference PC-041 and receipt R-118 support that payment. A separate reimbursement claim, EC-027, attaches the same receipt and also pays the holder $240.

Compare the claim with the reimbursement payment record before quantifying any loss. If both payments completed and neither was reversed, the additional payment is $240. If the claim remains unpaid, there is a duplicate claim to resolve without a second completed payment. Retain both references and ask whether the claim was an error before drawing a conclusion about intent. A broader expense fraud investigation tests false costs and the evidence supporting a loss.

Maintain an exception register for overdue acquittals and unsupported lines. Give each item a holder, statement reference, outstanding evidence, responsible reviewer and next action. Apply the entity’s escalation period and record the response. Do not remove an unresolved line merely because the statement balance has been paid.

Where the financial investigation includes large bank-statement bundles, FinTrace consolidates the supplied PDFs into a searchable ledger and a clear findings report. Findings cite the source PDF filename and page, giving the investigation team direct access to the supporting transactions.

Respond to Misuse or a Control Failure

Choose the response according to the established facts, applicable policy and legal requirements. A coding error can need correction. A duplicate payment can need recovery. An ongoing exposure can justify a limit change or suspension under the authorised process. Suspected fraud requires assessment of the applicable referral and reporting duties.

Record the decision-maker, basis and action for each response. Preserve the transaction evidence and the holder’s account, including explanations that challenge the initial suspicion. Repayment does not, by itself, resolve whether use complied or whether a reporting obligation remains.

Keep the original entry and add any correction with a traceable link. Record recoveries separately so the file shows both the original expenditure and the amount recovered. Where the review identifies a control gap, assign its correction and confirm that the changed control is operating.

Close or Change Card Access

A role change or departure calls for a review of whether the holder still needs access and whether the current limits remain authorised. Identify outstanding purchases, recurring charges, refunds and disputes before closing the record.

Send the authorised cancellation or limit-change instruction through the entity’s process. Obtain the issuer’s confirmation that it completed the action. Record card return or destruction as required by policy, and reconcile outstanding transactions without waiting for the card to disappear from an internal list.

Finish by comparing the active card register with current appointments and issuer records. Each active card needs an authorised holder, current limits and a designated reviewer. Every unresolved balance needs an owner and recorded next action. Investigate a card that remains active after its holder’s authority ends, then confirm the issuer has removed that access.