Accounts Receivable Controls

Controls over accounts receivable really begin with the initial creation of a customer invoice, since you
must minimize several issues during the creation of accounts receivable before you can have a
comprehensive set of controls over this key asset. Controls then span the proper maintenance of
accounts receivable, and their elimination through either payments from customers or the generation
of credit memos. The key controls to consider are:

Require credit approval prior to shipment. You will have problems collecting accounts
receivable if an order is shipped to a customer with a bad credit rating. Therefore, require the signed
approval of the credit department on all sales orders over a certain dollar amount.

Verify contract terms. If there are unusual payment terms, verify them before creating an
invoice. Otherwise, accounts receivable will contain invoices that customers refuse to pay.

Proofread invoices. If an invoice for a large-dollar amount contains an error, the customer may
hold up payment until you send a revised invoice. Consider requiring the proofreading of larger
invoices to mitigate this problem.

Authorize credit memos. People who have access to incoming customer payments could
intercept incoming cash and then create a credit memo to cover their tracks. One step in the
prevention of this problem is to require the formal approval of a manager for credit memos, which are
then verified at a later date by the internal audit staff. Do not take this control to extremes and
require approval for extremely small credit memos - allow the accounting staff to create small ones
without approval, just to clean up small remaining account balances.

Restrict access to the billing software. As just noted, someone could intercept incoming
payments from customers and hide the theft with a credit memo. You should password-protect access
to the billing software to prevent the illicit generation of credit memos.

Segregate duties. As just noted, no one should be able to handle incoming customer payments
and create credit memos, or else they will be able to take the money and cover their tracks with credit
memos. Therefore, assign these tasks to different people.

Review accounts receivable journal entries. Accounts receivable transactions almost always go
through a sales journal in the accounting software that generates its own accounting entries.
Therefore, there should almost never be a manual journal entry in the accounts receivable account.
You should investigate these entries carefully.

Audit invoice packets. After invoices are completed, there should be a packet on file that
contains the sales order, credit authorization, bill of lading, and an invoice copy. The internal audit
staff should review a selection of these packets to verify that the billing clerk properly reviewed all of
the supporting paperwork and correctly generated an invoice.

Match billings to shipping log. It is possible that items will be shipped without a corresponding
invoice, or vice versa. To detect these situations, have the internal audit staff compare billings to the
shipping log, and investigate any differences.

Audit the application of cash receipts. The accounting staff may incorrectly apply cash receipts
to open invoices, perhaps not even applying them to the accounts of the correct customers. Have the
internal audit staff periodically trace a selection of cash receipts to customer invoices to verify proper
cash application.
These items constitute the basic accounts receivable controls. A company with a specialized
receivables system may need to implement additional controls, or may not need some of the items
listed here.

Accounts Payable Controls

Accounts payable controls are used to mitigate the risk of losses in the payables function. Payables
controls are aggregated into three general categories, which are verifying the obligation of the
business to pay, entering the payables data into the computer system, and paying suppliers.

The controls are as follows:

Obligation to Pay Controls
The verification of obligation to pay can be accomplished through one of several possible controls.
They are:

Invoice approval. The person in a position to authorize payment signifies his or her approval of
a supplier invoice. However, this is actually a relatively weak control if the approver only sees the
supplier invoice, since there is no way to tell if the goods or services were received, or if the prices
being charged were what the company originally agreed to. The approver may also want to know
which general ledger account will be charged. Consequently, it is better to have the payables staff first
assemble the supplier invoice, authorizing purchase order, and receiving documentation into a packet,
and then stamp the invoice with a signature block that includes the account number to be charged,
and then have the approver review it. This approach gives reviewers a very complete set of
information to work with.

Purchase order approval. The purchasing department issues a purchase order for every
purchase made. By doing so, the purchasing staff is, in essence, approving all expenditures before
they have been made, which may prevent some expenditures from ever occurring. Since this control
entails a considerable amount of work by the purchasing staff, they will likely ask employees to
request items on a formal purchase requisition form.

Complete a three-way match. The payables staff matches the supplier invoice to the related
purchase order and proof of receipt before authorizing payment. This approach supersedes the need
for individual invoice approval, since approval is based on the purchase order instead. It is also better
than approving only based on the purchase order, since it also verifies receipt of the goods. However,
it is also painfully slow and can break down if there is missing paperwork.

Manual duplicate payment search.A computerized payables system conducts an automatic

search for duplicate invoice numbers. This is a much more difficult endeavor in an entirely manual
accounting system. In this case, the payables clerk can search through the vendor file and unpaid
invoices file to see if an invoice just received from a supplier has already been paid. In many
situations, the volume of incoming supplier invoices makes this so difficult that the payable staff
abandons any attempt to identify duplicate invoices, and simply accepts that it will occasionally pay for
such items.
Data Entry Controls
There are several ways to ensure that all supplier invoices have been entered in the accounts payable
system, though these controls have varying degrees of success. The controls are:

Record after approval. This control forces the accounts payable staff to verify the approval of
every invoice before entering it into the system.

Record prior to approval. This control places greater priority on paying suppliers than it does
on obtaining authorizations to pay, since every invoice received is recorded in the payables system at
once. This control works best where purchase orders have already been used to authorize a purchase.

Adopt an invoice numbering guideline. Perhaps the largest problem in the area of payables
data entry is duplicate payments. This would not appear to be a problem, since most companies use
accounting software that automatically detects duplicate invoices and prevents duplicate payments.
However, there can be inconsistency in how invoice numbers are recorded. For example, do you record
invoice number 0000078234 with the leading zeros or without them? If the same invoice is presented
to the payables staff twice, and it is recorded as 0000078234 one time and 78234 the next time, the
system will not flag them as being duplicate invoices. The same problem arises with dashes in an
invoice number; an invoice number of 1234-999 could be recorded as 1234-999 or as 1234999.

Match to budget in financial statements. If a supplier invoice was incorrectly charged to the
wrong department, it is possible that a department manager perusing the financial statements would
detect a disparity between the amount charged and the budget, and so would bring the issue to the
attention of the accounting department.
Payment Controls
The bulk of the controls noted below pertain to payment by check, since that is still the predominant
form of payment. The controls are:

Split check printing and signing. One person should prepare checks, and a different person
should sign them. By doing so, there is a cross-check on the issuance of cash.

Store all checks in a locked location. Unused check stock should always be stored in a locked
location. Otherwise, checks can be stolen and fraudulently filled out and cashed. This means that any
signature plates or stamps should also be stored in a locked location.

Track the sequence of check numbers used. Maintain a log in which are listed the range of
check numbers used during a check run. This is useful for determining if any checks in storage might
be missing. This log should not be kept with the stored checks, since someone could steal the log at
the same time they steal checks.

Require manual check signing. A company can require that all checks be signed. This is
actually a relatively weak control, since few check signers delve into why checks are being issued, and
rarely question the amounts paid. If a company chooses to use a signature plate or stamp instead,
then it is much more important to have a strong purchase order system; the purchasing staff becomes
the de facto approvers of invoices by issuing purchase orders earlier in the payables process flow.

Require an additional check signer. If the amount of a check exceeds a certain amount,
require a second check signer. This control supposedly gives multiple senior-level people the chance to
stop making a payment. In reality, it is more likely to only introduce another step into the payment
process without really strengthening the control environment.

Inventory Internal Controls

A company's investment in inventory is usually a large one, and it may be comprised of a large
number of merchandise items that can be readily stolen and resold. If the inventory contains mostly
raw materials, keeping track of it is essential for ensuring that the production processes using it will
not run short of materials.
This means that you need to implement an array of controls, either to prevent theft or to ensure that
the manufacturing operation does not run short of inputs. We will describe below a number of the key
controls you should consider for your inventory investment.
Key internal controls for your inventory are:

Fence and lock the warehouse. The single most important inventory control is simply locking
down the warehouse. This means that you construct a fence around the inventory, lock the gate, and
only allow authorized personnel into the warehouse.

Organize the inventory. It may not seem like a control to simply organize the inventory in the
warehouse, but if you cannot find it, you cannot control it. Thus, a fundamental basis for inventory
internal control is to number all locations, identify each inventory item, and track these items by
location.

Count all incoming inventory. Do not just take the word of the supplier that the quantity
stated on the delivery is the correct one. Count the inventory before recording it as received. This
keeps errors from being introduced into the inventory records.

Inspect incoming inventory. Verify that all incoming inventory is of the correct type and is not
damaged. All items that fail inspection should be returned at once, and the accounts payable staff
notified that the returned items should not be paid for.

Tag all inventory. Every scrap of inventory in the warehouse should be identified with a tag,
which states the part number, description, unit of measure, and quantity. Otherwise, inventory items
are bound to be mis-identified.

Segregate customer-owned inventory. If there is inventory on-site that customers own, the
warehouse staff will likely count it as though it is owned by the company, so have a procedure in place
for labeling these items as customer-owned when they arrive, and segregate them in a separate part
of the warehouse.

Standardize record keeping for inventory picking. When an item is picked from the shelf in the
warehouse, for use either in the production area or for sale to customers, have a standard procedure
for recording the picks as soon as they leave the warehouse (which is easier if there is a warehouse
fence, and inventory can only pass through a single controlled gate).

Sign for all inventory removed from the warehouse. If inventory items are being removed from
the warehouse for reasons outside of the normal picking process, have the person removing the
inventory sign for the removal, so that there is a record of who is responsible.

Audit the bill of materials. The bill of materials is a record of the parts used to construct a
product. The bill of materials is used to pick items from stock, so if the bill is incorrect, pickers will pull
incorrect amounts from the warehouse. This calls for a periodic audit of every bill, as well as
password-only access to the bill of material records in the computer system.

Trace extra requisitions and returns. If the production staff asks for extra issuances of parts,
or returns excess amounts to the warehouse, then there is an error in the picking records (possibly in
the bill of materials, as just noted).

Conduct a periodic obsolete inventory review. The warehouse can eventually become choked
with obsolete inventory that cannot be used, which requires high storage costs and also interferes with
the components that are needed in production. Form a materials review board that periodically combs
through the inventory records to determine which items should be sold off or otherwise eliminated.

Conduct cycle counts. Have the warehouse staff conduct small, frequent counts of a small
portion of the inventory, and investigate and correct any errors they find. This gradually improves the
inventory record accuracy.

Investigate negative-balance inventory records. If the accounting records show that there is
negative inventory on hand, then there is obviously a transactional flaw that caused the negative
balance. This is a prime target for a detailed investigation.

Record scrap transactions. Do not just throw scrap in a scrap bin when it occurs. If you do, the
accounting system still thinks the scrapped item is in stock, and so will overstate the amount of
inventory. Instead, create a procedure to track scrap on a regular basis.
A number of problems may still arise with inventory record accuracy despite these controls, so be
prepared to add more controls if the problems are persistent.

Payroll Internal Controls

General Payroll Controls
Consider using a selection of the following controls for nearly all payroll systems, irrespective of how
timekeeping information is accumulated or how employees are paid:

Audit. Have either internal or external auditors conduct a periodic audit of the payroll function
to verify whether payroll payments are being calculated correctly, employees being paid are still
working for the company, time records are being accumulated properly, and so forth.

Change authorizations. Only allow a change to an employees marital status, withholding

allowances, or deductions if the employee has submitted a written and signed request for the company

to do so. Otherwise, there is no proof that the employee wanted a change to be made. The same
control applies for any pay rate changes requested by a manager.

Change tracking log. If you are processing payroll in-house with a computerized payroll
module, activate the change tracking log and make sure that access to it is only available through a
password-protected interface. This log will track all changes made to the payroll system, which is very
useful for tracking down erroneous or fraudulent entries.

Error-checking reports. Some types of payroll errors can be spotted by running reports that
only show items that fall outside of the normal distribution of payroll results. These may not all
indicate certain errors, but the probability of underlying errors is higher for the reported items. The
payroll manager or a third party not involved in payroll activities should run and review these reports.

Expense trend lines. Look for fluctuations in payroll-related expenses in the financial
statements, and then investigate the reasons for the fluctuations.

Issue payment report to supervisors. Send a list of payments to employees to each

department supervisor, with a request to review it for correct payment amounts and unfamiliar names.
They may identify payments being made to employees who no longer work for the company.

Restrict access to records. Lock up employee files and payroll records at all times when they
are not in use, to prevent unauthorized access. Use password protection if these records are stored on
line. This precaution is not just to keep someone from accessing the records of another employee, but
also to prevent unauthorized changes to records (such as a pay rate).

Separation of duties. Have one person prepare the payroll, another authorize it, and another
create payments, thereby reducing the risk of fraud unless multiple people collude in doing so. In
smaller companies where there are not enough personnel for a proper separation of duties, at least
insist on having someone review and authorize the payroll before payments are sent to employees.
Payroll Calculation Controls
The following list of possible controls address such issues as missing timesheets, incorrect time
worked, and incorrect pay calculations. They are:

Automated timekeeping systems. Depending on the circumstances, consider installing a

computerized time clock. These clocks have a number of built-in controls, such as only allowing
employees to clock in or out for their designated shifts, not allowing overtime without a supervisory

override, and (for biometric clocks) eliminating the risk of buddy punching. Also, you should send any
exception reports generated by these clocks to supervisors for review.

Calculation verification. If you are manually calculating payroll, then have a second person
verify all calculations, including hours worked, pay rates used, tax deductions, and withholdings. A
second person is more likely to conduct a careful examination than the person who originated the
calculations.

Hours worked verification. Always have a supervisor approve hours worked by employees, to
prevent employees from charging more time than they actually worked.

Match payroll register to supporting documents. The payroll register shows gross wages,
deductions, and net pay, and so is a good summary document from which to trace back to the
supporting documents for verification purposes.

Match timecards to employee list. There is a considerable risk that an employee will not turn in
a timesheet in a timely manner, and so will not be paid. To avoid this problem, print a list of active
employees at the beginning of payroll processing, and check off the names on the list when you
receive their timesheets.

Overtime worked verification. Even if you do not require supervisors to approve the hours
worked by employees, at least have supervisors approve overtime hours worked. There is a pay
premium associated with these hours, so the cost to the company is higher, as is the temptation for
employees to claim them.

Pay change approval. Consider requiring not just one approval signature for an employee pay
change, but two signatures one by the employees supervisor, and another by the next-higher level
of supervisor. Doing so reduces the risk of collusion in altering pay rates.
Check Payment Controls
When you pay employees with checks, several controls are needed to mitigate the risks of fraud and
various errors. Key controls are:

Update signature authorizations. When check signers leave the company, remove them from
the authorized check signer list and forward this information to the bank. Otherwise, they could still
sign company checks.

Hand checks to employees. Where possible, hand checks directly to employees. Doing so
prevents a type of fraud where a payroll clerk creates a check for a ghost employee, and pockets the
check. If this is too inefficient a control, consider distributing checks manually on an occasional basis.

Lock up undistributed paychecks. If you are issuing paychecks directly to employees and
someone is not present, then lock up their check in a secure location. Such a check might otherwise
be stolen and cashed.

Match addresses. If the company mails checks to its employees, match the addresses on the
checks to employee addresses. If more than one check is going to the same address, it may be
because a payroll clerk is routing illicit payments for fake employees to his or her address.

Payroll checking account. You should pay employees from a separate checking account, and
fund this account only in the amount of the checks paid out. Doing so prevents someone from
fraudulently increasing the amount on an existing paycheck or creating an entirely new one, since the
funds in the account will not be sufficient to pay for the altered check.
You may find that several controls buttress each other, so that there are overlapping effects resulting
from multiple controls. In these cases, you may be able to safely eliminate a few controls, knowing
that other controls will still mitigate the risk of loss.