Auditing Business Processes Part 1

Revenue Cycle

• The revenue cycle is a recurring set of business activities and related information processing operations associated with providing goods and services to customers and collecting cash in payment for those sales.
• The basic activities in the revenue cycle are:
  • Order entry: soliciting and processing customer activities
  • Filling customer orders and shipping merchandise
  • Invoicing customers and maintaining customer accounts
  • Collections: the cashier handles remittances and deposits them in the bank; accounts receivable personnel credits customer accounts for the payments received
• The sales department receives order information from customers and prepares a sales order form, which includes customer name, account number, item description, quantities, unit prices, taxes, shipping info, discounts, and freight terms.
• The credit department provides transaction authorization by approving the customer for a credit sale and returns and allowances.
• The shipping department receives information from the sales department, reconciles documents with stock release papers, and prepares a bill of lading to accompany the shipment.

Threats and Controls in Revenue Cycle

• Threat 1: Sales to customers with poor credit
  • Control: Having an independent credit approval function and maintaining good customer accounting
• Threat 2: Shipping errors
  • Control: Reconciling shipping notices with picking tickets, using bar-code scanners, and data entry application controls
• Threat 3: Theft of inventory
  • Control: Securing inventory location, documenting transfers, releasing only with valid shipping orders, and having good accountability for picking and shipping
• Threat 4: Failure to bill customers
  • Control: Separating shipping and billing, pre-numbering shipping documents, and reconciling sales documents
• Threat 5: Billing errors
  • Control: Reconciling picking tickets and bills of lading with sales orders, using data entry edit controls, and maintaining price lists
• Threat 6: Theft of cash
  • Control: Segregating duties, using lockboxes for receipts, electronic fund transfer (EFT) for disbursements, mailing customer statements, using cash registers, and depositing cash daily
• Threat 7: Posting errors in updating accounts receivable
  • Control: Using editing and batch totals
• Threat 8: Loss of data
  • Control: Performing regular backups, storing one copy off-site, and implementing logical and physical access controls
• Threat 9: Poor performance
  • Control: Using sales and profitability analyses, accounts receivable aging, and cash budgets to track operations

Expenditure Cycle

• The expenditure cycle is a recurring set of business activities and related data processing operations associated with the purchase of and payment for goods and services.
• The basic activities in the expenditure cycle are:
  • Requesting the purchase of needed goods
  • Ordering goods to be purchased
  • Receiving ordered goods
  • Approving vendor invoices for payment
  • Paying for goods purchased
• Inventory control monitors inventory and authorizes restocking with a purchase requisition.
• Purchasing acts on the purchase requisition and prepares a purchase order.
• The receiving staff counts and inspects goods, and receiving prepares a receiving report.

Threats and Controls in Expenditure Cycle

• Threat 1: Stock-outs
  • Control: Implementing an inventory control system, accurate perpetual inventory, and vendor performance analysis
• Threat 2: Requesting goods not needed
  • Control: Reviewing and approving by supervisors, using pre-numbered requisition forms, and restricting access to blank purchase orders
• Threat 3: Purchasing goods at inflated prices
  • Control: Using competitive bidding, proper supervision, approved purchase orders, and price list consultations
• Threat 4: Purchasing goods of inferior quality
  • Control: Using experienced buyers, reviewing purchase orders, and incorporating an approved vendor list into formal procedures
• Threat 5: Purchasing from unauthorized vendors
  • Control: Using pre-numbered purchase orders, restricting access to approved vendor lists, and having procedures in place for changes to the list
• Threat 6: Kickbacks paid to buyers to influence their decisions
  • Control: Implementing a clear conflict of interest policy, disclosing financial interest policy for purchasing agents, and performing vendor audits
• Threat 7: Receiving unordered goods
  • Control: Receiving department rejecting goods without an approved purchase order
• Threat 8: Errors in counting goods received
  • Control: Using "blind" P.O. copies, providing incentives for counting goods, and securing inventory storage locations
• Threat 9: Theft of inventory
  • Control: Securing inventory storage locations, making transfers with proper approval and documentation, and performing periodic physical counts and reconciliations
• Threat 10: Errors in vendor invoices
  • Control: Verifying invoice accuracy and comparing to P.O.s and receiving report data
• Threat 11: Paying for goods not received
  • Control: Requiring a voucher package and original invoice for payment
• Threat 12: Failure to take available purchase discounts
  • Control: Filing approved invoices by due date, tracking invoices, and using a cash budget to plan for cash needs
• Threat 13: Paying same invoice twice
  • Control: Approving invoices only with a full voucher package, paying invoices, canceling paid ones, and not paying invoices marked "Duplicate" or "Copy"
• Threat 14: Recording and posting errors for purchases and payments
  • Control: Implementing data entry controls and periodically reconciling subsidiary ledger with general ledger control account
• Threat 15: Misappropriation of cash by paying fictitious vendors and altering checks
  • Control: Restricting access to cash, blank checks, and check signing machine, using check protection, pre-numbered checks, and imprinted amounts on checks
• Threat 16: Theft associated with Electronic Fund Transfer (EFT) use
  • Control: Implementing access controls, encrypting transmissions, timestamping and numbering transmissions, and monitoring EFT activity
• Threat 17: Loss of data
  • Control: Using file labels, backing up data files regularly, and implementing access controls

Financial Reporting Control Considerations

• Segregation of duties is essential to prevent fraud and ensure accurate financial reporting.
• Internal controls should be designed to prevent and detect errors and fraud.
• Monitoring performance and controlling access to accounting software and digital records can help detect errors and prevent fraud.
• Controlling the controls involves periodic internal audits and monitoring to ensure employees comply with internal controls and report exceptions and problems.