IT auditing chapter 10: Auditing the expenditure cycle

Purchases Procedures Batch System: Data Processing Department Step 1

Purchase initiation:

• triggered by inventory falling to reorder point in the revenue cycle

• Purchase requisition file is created and sorted by vendor, generating purchase orders (POs)

• POs sent to purchasing department and relevant receipts

Purchases Procedures Batch System: Data Processing Department Step 2

Inventory Update:

• Batch job updates inventory subsidiary file, removed “on order” flag, closes PO file and calculates batch totals of receipts for GL update

• AP clerk reconciles invoices, prepares cash disbursements vouchers and files them

Purchases Procedures Batch System: Data Processing Department Step 3

Voucher validation and posting:

• batch job validates vouchers against vendor files, adds records to AP subsidiary files based on due dates, and prepares totals for AP posting

• daily check printing based on due dates, recorded in the cash disbursements journal

Cash Disbursement Procedures : Batch System

Cash disbursements department

• clerk reconciles transaction list with checks, signs and mails them, sending a copy of check to AP

Accounts Payable

• clerk matches document and closes file, concluding the expenditure cycle process

Payroll Procedures: Data Processing

• data processing department receives the timecards/performance forms

• a batch computer program calculates and posts payroll to employee payroll file

• system prints the paychecks, a fund transfer check, and a payroll register (sent to cash disbursement)

• at last, the system will post the disbursements to digital check register, add a record to digital payroll register file

• prepares a digital voucher record for posting to the GL control account

Payroll Procedures: Cash Disbursements

• supervisor reviews the checks, signs the and sends them to the paymaster for distribution

• fund transfer check reconciled with payroll register, signed and submitted for deposit

Input controls: Data validation

• intended to detect transcription errors before transaction data are processed

• most effective when performed as close to the source of transaction as possible

• the real'-time system works better

• validation test include missing data checks, numeric-alphabetic data checks, limit checks, range checks, etc.

Testing validation controls

• auditor may decide to rely on quality of other controls to provide assurance and reduce substantive testing

• weak system controls may prompt data editing controls (ITF)

• achieve some degree of assurance by reviewing error listings and error logs

  • substantive tests may be needed for unrecorded errors

Input controls: Batch controls

• used to manage high volumes of data through system

• initiated at data input stage and continues through all phases of data processing

Testing batch controls

involves reviewing transmittal records of batches processed and reconciling them to batch controls logs

Input controls: Purchase authorization controls

occur in the revenue cycle when goods are sold to customers

Testing purchase authorization controls

auditor needs to verify correct order quantity used when requisition is created, and that inventory record is flagged on order when requisition is prepared

Input controls: Employee authorization

• common frauds include submitting timecards on employees not employed by the firm and creating check for “ghost” employees

• someone in payroll should verify authorized employees

• when computerized, payroll program matches attendance records with personnel file

Testing employee authorization controls

• evidence needed for existence, accuracy, value, and rights

• confirm effective procedures for employee identification and authorization monitoring

• test by creating a dummy employee

• ensure integrity of authorized employee files:

  • password-controlled access

  • limited changes by authorized personnel

  • encryption for stored employees records

Process controls: File update controls

• sequence check ensures proper sorting in sequential master files

• liability validation confirms payment validity

• reconcile PO, receiving report, and vendor’s invoice

• similarity to authorized employee file for valid vendor records

Process controls: Access controls

• prevent and detect unauthorized and illegal access to firm’s assets and include warehouse security, moving assets promptly when received and paying employees by check vs. cash

Testing access controls

• provides evidence of existence, completeness, accuracy, valuation and allocation, rights and obligations and presentation and disclosure

• passport controls, restricting access to unauthorized managers, and data encryption

Process controls: Physical controls - Purchase system controls

include segregation of duties, supervision, inspection and reconciliations

• warehouse clerks should not be given responsibility for keeping inventory records

• segregation of the general ledger and account payable from cash disbursements

• supervision in receiving department

• reconciliation of supporting documents in AP department

Process controls: Physical controls - Payroll system controls

• timecard verification

• supervision

• an independent paymaster

• a special payroll imprest account

Testing Physical controls

• weak segregation of duties and supervision leads to fraud and errors affecting financial statements

• segregate inventory control from the warehouse

• keep the general ledger and accounts payable separate from cash disbursement

• auditor’s review should highlight incompatible tasks in the structure

• in automated settings, prioritize the integrity of computer programs handling tasks

Output controls

• designed to ensure information not lost, misdirected or corrupted and system processes as intended

• important element is audit trail maintenance including accounts payable change reports, transaction logs and listings, logs of automatic transactions, unique transaction identifiers and error listing

Testing output controls

• evidence relates to completeness and accuracy

• involves reviewing reports and tracing transactions

• modern systems store audit trails online as text file

• ITF system used to test output controls directly Substantive Tests of Expenditure
  Cycle Accounts

Substantive tests of expenditure cycle accounts: risks and audit concerns

• concern with potential understatement of liabilities and expenses

• substantive tests directed towards evidence of understatement and omission, efficiency, fraud, and losses due to overstatement errors