Auditing Business Processes Part 1

Revenue Cycle

The revenue cycle is a recurring set of business activities and related information processing operations associated with providing goods and services to customers and collecting cash in payment for those sales.
The basic activities in the revenue cycle are:
- Order entry: soliciting and processing customer activities
- Filling customer orders and shipping merchandise
- Invoicing customers and maintaining customer accounts
- Collections: the cashier handles remittances and deposits them in the bank; accounts receivable personnel credits customer accounts for the payments received
The sales department receives order information from customers and prepares a sales order form, which includes customer name, account number, item description, quantities, unit prices, taxes, shipping info, discounts, and freight terms.
The credit department provides transaction authorization by approving the customer for a credit sale and returns and allowances.
The shipping department receives information from the sales department, reconciles documents with stock release papers, and prepares a bill of lading to accompany the shipment.

Threats and Controls in Revenue Cycle

Threat 1: Sales to customers with poor credit
- Control: Having an independent credit approval function and maintaining good customer accounting
Threat 2: Shipping errors
- Control: Reconciling shipping notices with picking tickets, using bar-code scanners, and data entry application controls
Threat 3: Theft of inventory
- Control: Securing inventory location, documenting transfers, releasing only with valid shipping orders, and having good accountability for picking and shipping
Threat 4: Failure to bill customers
- Control: Separating shipping and billing, pre-numbering shipping documents, and reconciling sales documents
Threat 5: Billing errors
- Control: Reconciling picking tickets and bills of lading with sales orders, using data entry edit controls, and maintaining price lists
Threat 6: Theft of cash
- Control: Segregating duties, using lockboxes for receipts, electronic fund transfer (EFT) for disbursements, mailing customer statements, using cash registers, and depositing cash daily
Threat 7: Posting errors in updating accounts receivable
- Control: Using editing and batch totals
Threat 8: Loss of data
- Control: Performing regular backups, storing one copy off-site, and implementing logical and physical access controls
Threat 9: Poor performance
- Control: Using sales and profitability analyses, accounts receivable aging, and cash budgets to track operations

Expenditure Cycle

The expenditure cycle is a recurring set of business activities and related data processing operations associated with the purchase of and payment for goods and services.
The basic activities in the expenditure cycle are:
- Requesting the purchase of needed goods
- Ordering goods to be purchased
- Receiving ordered goods
- Approving vendor invoices for payment
- Paying for goods purchased
Inventory control monitors inventory and authorizes restocking with a purchase requisition.
Purchasing acts on the purchase requisition and prepares a purchase order.
The receiving staff counts and inspects goods, and receiving prepares a receiving report.

Threats and Controls in Expenditure Cycle

Threat 1: Stock-outs
- Control: Implementing an inventory control system, accurate perpetual inventory, and vendor performance analysis
Threat 2: Requesting goods not needed
- Control: Reviewing and approving by supervisors, using pre-numbered requisition forms, and restricting access to blank purchase orders
Threat 3: Purchasing goods at inflated prices
- Control: Using competitive bidding, proper supervision, approved purchase orders, and price list consultations
Threat 4: Purchasing goods of inferior quality
- Control: Using experienced buyers, reviewing purchase orders, and incorporating an approved vendor list into formal procedures
Threat 5: Purchasing from unauthorized vendors
- Control: Using pre-numbered purchase orders, restricting access to approved vendor lists, and having procedures in place for changes to the list
Threat 6: Kickbacks paid to buyers to influence their decisions
- Control: Implementing a clear conflict of interest policy, disclosing financial interest policy for purchasing agents, and performing vendor audits
Threat 7: Receiving unordered goods
- Control: Receiving department rejecting goods without an approved purchase order
Threat 8: Errors in counting goods received
- Control: Using "blind" P.O. copies, providing incentives for counting goods, and securing inventory storage locations
Threat 9: Theft of inventory
- Control: Securing inventory storage locations, making transfers with proper approval and documentation, and performing periodic physical counts and reconciliations
Threat 10: Errors in vendor invoices
- Control: Verifying invoice accuracy and comparing to P.O.s and receiving report data
Threat 11: Paying for goods not received
- Control: Requiring a voucher package and original invoice for payment
Threat 12: Failure to take available purchase discounts
- Control: Filing approved invoices by due date, tracking invoices, and using a cash budget to plan for cash needs
Threat 13: Paying same invoice twice
- Control: Approving invoices only with a full voucher package, paying invoices, canceling paid ones, and not paying invoices marked "Duplicate" or "Copy"
Threat 14: Recording and posting errors for purchases and payments
- Control: Implementing data entry controls and periodically reconciling subsidiary ledger with general ledger control account
Threat 15: Misappropriation of cash by paying fictitious vendors and altering checks
- Control: Restricting access to cash, blank checks, and check signing machine, using check protection, pre-numbered checks, and imprinted amounts on checks
Threat 16: Theft associated with Electronic Fund Transfer (EFT) use
- Control: Implementing access controls, encrypting transmissions, timestamping and numbering transmissions, and monitoring EFT activity
Threat 17: Loss of data
- Control: Using file labels, backing up data files regularly, and implementing access controls

Financial Reporting Control Considerations

Segregation of duties is essential to prevent fraud and ensure accurate financial reporting.
Internal controls should be designed to prevent and detect errors and fraud.
Monitoring performance and controlling access to accounting software and digital records can help detect errors and prevent fraud.
Controlling the controls involves periodic internal audits and monitoring to ensure employees comply with internal controls and report exceptions and problems.