PROCUREMENT AND ACCOUNTS PAYABLE CONTROLS

REVIEW AUDIT WORK PROGRAM

PROJECT TEAM (LIST MEMBERS)

Project Timing Date Comments

Planning

Fieldwork

Report Issuance (Local)

Report Issuance (Worldwide)

Audit Objectives Initial Achieved/Except

Ensure that accounts payable and procurement activities and related

controls are valid, properly authorized and mitigate the risk of loss.

Assess whether accounts payable and procurement are executed in

accordance with organizational policies and procedures.

Status Project Work Step Index Initial/Comments

Planning

Planning meeting: audit team

• Conduct a planning meeting to discuss the scope,
approach and timing.
• Determine the appropriate auditee contact.

Obtain enough understanding of the audit area:

• Determine if an internal audit of this area has
previously been done. Utilize any previous work products for
the training and development of the current plan.
• Obtain and review the policies and procedures for
accounts payable (AP) and procurement activities.
• Use self-assessment material, if appropriate, to have
the auditee evaluate their own control environment prior to
the audit.

Work with the auditee on the scope, approach and timing of the
audit, and a detailed document request.

Identify key contacts for audit areas.

1 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

Obtain and document an understanding of the overall operating

organization structure. Consider the following areas:
• Personnel: Organization charts, total number of
personnel, divisions, job descriptions, etc.
• Transactions: The volume/value of various transaction
types processed.
• Systems: Application modules, interfaces, tracking
systems and related management reporting.
• “Customers”: Who are the key external and internal
customers for the process?

Review any known best practices for the accounts payable

process area and incorporate them into the audit work and
audit report, if appropriate.

Fieldwork

Conduct an entrance meeting reestablishing an understanding

of the scope and timing of the review.
• Establish a schedule for status meetings and open-
communication protocols.
• Ask management sponsor about any known
scheduling conflicts such as meetings, vacation and
planned absences that may affect the committed client
personnel.

Obtain the following documents:

• An organizational chart for purchasing and AP
• AP policies and procedures, including vendor master
file setup and maintenance, invoice entry, expense
reimbursement, and payment
• Purchasing policies and procedures, including pricing
and approval (negotiating, purchase contracts [where
applicable] and updates)
• A signature authorization list (checks and invoice
approval)
• AP aging
• An AP detailed trial balance
• AP check registers
• Vendor master file electronic downloads
• System access levels for purchasing, AP and
disbursements (writing checks, signing checks, and wire
transfer access and password administration)
• Access to vendor statements, vendor contracts and
associated approved price lists

Selection and Evaluation of Vendors

2 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

Review current vendor selection and evaluation policies and

procedures.

Interview material managers, purchase planners and sales

managers.
• Understand whether a preferred or “approved” vendor
list is used.
• Understand the difference between transactions
involving direct and indirect materials.
• Gain an understanding of the relationship and
communication between the material managers and the
individual divisional purchasing departments.
• Understand how each manager’s role/responsibilities
link to the purchase requisition (PR)/purchase order (PO)
process.
• Understand and evaluate the performance measures
used to monitor the vendor bidding process.

Review current vendor bidding policies and procedures.

Interview individuals involved in the vendor bid process.

• Identify the allocation of the segregation of duties:
execution of a transaction, custody of assets,
authorization/approvals and recording/system of records.

Map the process for vendor bid processing and evaluate the
current controls in place.
• Determine if multiple bidding is utilized from several
providers, including the RFP (request-for-proposal),
selection criterion for evaluation and inquiry of any possible
conflicts of interest with vendors.

Document the results.

Approvals for PRs/POs

Obtain a copy of the organization’s current signature authority

matrix. Ensure that the matrix is up to date for authorized
personnel, title/position vs. authority, dollar/volume limits and
override procedures (and related downstream
controls/subsequent reporting or escalation to higher-limit
personnel).

Obtain current divisional purchasing department policies and

procedures for the organization or selected divisions under
review.

Processing for POs

Interview individuals within the purchasing department to gain

an understanding of the following:

3 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

• Current PR and PO processing steps

• Change order processing (e.g., customer changes,
engineering changes)

Purchasing Proper Process

• Determine the adequacy of information fields on the
PO.
• Perform cutoff testing to determine if purchasing is
issuing unnecessary POs.
• Determine if purchasing processes transactions
without a required and authorized PO.

Observe and document (via flow charts) payment processing.

The following tasks should be established:
• Determine the process for PR.
• Determine if AP systems are fully integrated with
interfacing applications. Review current systems utilized,
including AP, purchasing and receiving.
• Determine how purchases are priced, how often prices
are monitored for changes, and how freight and sales and
use tax is accounted, recorded and booked.
• Determine the process for PO and non-PO invoices.
• Determine if receiving matches the number of goods
received to the PO and the evidence of performance
(initials, etc.).
 Note: Receiving should be conducting a blind count
and then entering it into the system without knowledge
of the PO quantity.
• Determine if receiving receives goods that do not have
an existing PO.
• Determine the frequency of goods received for which a
PO needs to be generated (to comply with policies and
procedures).
• Utilize manual and system controls to avoid duplicate
payments.
• Determine vendor setup and maintenance procedures,
including obtaining a tax ID number for 1099 purposes.
• Determine the process for identifying and applying
credits.
• Determine if internal controls are in place throughout
the process.
• Evaluate whether the proper segregation of duties
exists for transaction processing, including
authorization/approval, execution, custody of assets and
recording of transaction/access to update/modify/delete/add
(vendor information).
• Determine if invoices are properly authorized and

4 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

approved on a timely basis and are matched with proper

POs.
• Determine if check stocks are appropriately secured.

Payment Processing

Transaction Testing: Discuss the sample size and approach

with the IA manager prior to commencing testing.
• 10 service invoices
• 10 overhead (non-PO) invoices
• 20 materials invoices
• 10 fixed asset invoices
Vendor Selection: (10 service invoices)
• Adequate documentation of the competitive bidding
process exists.
• The proper number of bids were sought out per policy.
• The reason for selection is stated.
• The selection is in the same price range as other bids.
PO Processing: (10 service invoices, 20 materials invoices
and 10 fixed asset invoices)
• Ensure that only “approved” vendors are used to
purchase goods within the company. If “nonapproved”
vendors are used to purchase company materials, ensure
that adequate documentation exists to approve such
transactions.
• Ensure that the PO is accurately completed with a
description of items compared between the PR and PO.
• Ensure that the purchase is properly authorized.
Confirm the existence of properly approved PRs and POs.
• Ensure timely placement of the purchase order with the
number of days elapsed between PR and the placement of
POs.
• Ensure completeness and that all items tested from the
PR were in fact ordered.
• Ensure that vendor selection is accurate between the
PR and PO.
• Ensure that pricing between the PR and the PO is
accurate.
Payment processing: (10 service invoices, 10 overhead [non-
P.O.] invoices, 20 materials invoices and 10 fixed asset
invoices)
• Ensure that the payment is properly authorized per
internal policy (verify the signature).
• Ensure that the appropriate number of signatures is
present on checks over certain limits.

5 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

• Ensure that taxes are appropriately paid.

• Ensure that proper supporting documentation is
present (e.g., three-way matching).
• Determine the timeliness of vendor payment
processing.
• Ensure that early payment discounts were taken
advantage of and if not, determine the reason why.
• Stratify and review vouchers to understand the
department’s current workload.
• Understand and evaluate any performance measures
used to monitor the accounts payable process.
Testing will be performed to facilitate the following:
• Enhance our understanding of the “nuts and bolts” of
the process.
• Test our understanding of key controls.
• Assess if key controls were operating consistently.
Test all transactions selected for the following, if not specifically
noted in “Transaction Testing” above (inherent financial
statement assertions):
• Authorization
• Validation
• Accuracy
• Proper process
• Completeness
• Timeliness

Analyze the return-to-vendor (RTV) process. Test for the

following items:
• The outstanding quantity
• The outstanding length of time
• Processes in place to track outstanding goods

Identify metrics used by management to monitor/manage the

entire process.
• Test the accuracy of metrics as deemed necessary.
• Assess the need for additional/different metrics.

Orders Placed Outside of Purchasing

Determine if materials and services can/are purchased outside

of purchasing and are reimbursed through expense reports,
petty cash or p-cards.
Petty Cash: Determine if petty cash is used. If so, sample 10
petty cash voucher requests to determine the following:

6 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

• Obtain a copy of petty cash policies and procedures

and test compliance with these procedures.
• Attach receipts to each request.
• Authorize the request properly per internal policy.
• Ensure that the proper signature is present.
Expense Reports: Sample 20 expense reports to determine
the following:
• How is expense reporting is done?
• How are reports processed?
• How are employees reimbursed?
• How are travel expenses being audited?
• Is payment properly authorized per internal policy?
• Are receipts attached to the request?
• What is the reason for the expense nature, amount,
etc.?
• Is the expense report coded for the GL and department
code?
Purchasing Cards: Sample 10 p-cards to determine the
following:
• Payment processes
• Approval levels and authorization limits (e.g., dollar
amount per month)
• P-card users and their appropriateness
• Computer-aided audit tools (CAAT) trends
• The overall effectiveness and efficiency of procurement
card use
• Procurement card controls

Determine whether monthly vendor statements are kept on file.

If so, select 20 credits and determine whether they have been
researched and applied appropriately and in accordance with
company policy.

Review aging reports for credit memos and inquire about

unusual items. Obtain an electronic download and stratify to
identify recurring vendors or other trends.

Select 10 purchase contracts and ensure that the prices in the

system are current.

Obtain and review five recent bank statements and

reconciliations over the past 12 months. Inquire about old
outstanding items and unusual items. Determine the procedure
for reporting unclaimed property.

7 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

Review the AP aging for unusual items and timeliness. Test as

needed.

From the electronic vendor master file, determine if duplicate

vendors are in the system.

Interview individuals within the accounts payable department to

determine the process for vendor payment.
• Gain an understanding of how goods/materials are
received into the existing systems. Evaluate the differences.
• Understand the AP department structure (e.g., invoices
are processed by AP reps according to alphabet or work
cells).
• Understand the coordination efforts between the AP
department and the divisional purchasing departments for
vendor payments to occur.

Based upon the interviews, map the payment process from

receipt of goods within the company’s systems to the
submission of vendor payments.

Document the results of the interviews and follow up on any

identified issues.

Discuss the results with the AP contact and provide any

process improvement recommendations.

System Access

Review system access controls that are applicable to all

reviewed procurement processes (e.g., purchasing/accounts
payable user passwords, batch totals, etc.)

Ensure that controls are in place to mitigate system integrity

risk.

Document the results.

Final Reporting

Reporting: Draft
• Prepare a preliminary draft of the audit report using the
standard format. Ensure that the appropriate auditee
reviews the draft and that any action items have been
discussed with the auditee.

Reporting: Issuing Draft

• Issue the preliminary report to management. At this
point, management/the auditee should agree upon the
timing for implementing any action items identified and
agreed upon in the report. The responsibility for

8 Source: www.knowledgeleader.com
 Status Project Work Step Index Initial/Comments

implementation should also be assigned.

Validate the accuracy of all audit report content. Evaluate

current practices by benchmarking the organization’s practices
against known best practices. Document these evaluations in
the Best Practice section of the report.

Other Administrative

Compile test work and key support data into a work paper
binder. A binder index of key information should be included.

A copy of the final report should be included in the work paper

binder.

Discuss job scheduling, timing and related opportunities for

improvement with the internal audit manager, as necessary.

Follow up on client/satisfaction surveys (if utilized).

Submit the report to the internal audit report database.

File work papers in the internal audit file room.

9 Source: www.knowledgeleader.com