Auditing The Expenditure Cycle: IT Auditing & Assurance, 2e, Hall & Singleton

Chapter 10:
Auditing the
Expenditure Cycle
IT Auditing & Assurance, 2e, Hall & Singleton
PURCHASES: BATCH
PROCESSING
Step 1: Data processing department inventory

control
Step 2: Data processing department P.O.
Receiving Department
Step 3: Data processing department batch

update of inventory
Purchasing Department
Accounts Payable
Step 4: Data processing department validates

vendors
CASH DISBURSEMENT:
BATCH PROCESSING
Step 5: Data processing department scans for

items due and prints checks for items received
Step 6: Cash disbursements department
reconciles checks, submits checks to
management for signature
Step 7: Accounts payable matches copies of
checks with open vouchers, closes them and
files documents
Concludes expenditure cycle
CASH DISBURSEMENT:
REENGINEEREDFULLY AUTOMATED
Data processing steps performed
automatically:
1.
2.
3.
4.
5.
6.
7.
Inventory file scanned for items and reorder points

Purchase requisition record for all items needing
replenishment
Consolidate requisitions by vendor
Retrieve vendor mailing information
P.O. prepared and sent to vendor (EDI)
Open P.O. record added for each transaction
List of P.O. sent to purchasing department
CASH DISBURSEMENT:
REENGINEERED FULLY
AUTOMATED
Goods arrive at receiving department
Quantities received entered per item
CASH DISBURSEMENT:
automatically:
1.
2.
3.
4.
5.
Quantities keyed matched to open P.O.

record
Receiving report file record added
Update inventory subsidiary records
G.L. inventory updated
Record removed from open P.O. file and
added to open A.P. file, due date
established
CASH DISBURSEMENT:
Each day, due date filed of A.P. are

scanned for items where payment is
due
CASH DISBURSEMENT:
automatically:
1.
2.
3.
4.
5.
Checks are printed, signed and distributed to

mailroom (unless EDI/EFT)
Payments are recorded in check register file
Items paid are transferred from open A.P. to closed
A.P. file
G.L.- A.P. and cash accounts are updated
Appropriate reports are transmitted to A.P. and cash
disbursements departments for review
CASH DISBURSEMENT:
Control implications
General in nature
Similar to those of Chapter 9
BATCH AUTOMATED SYSTEM

VS.
MANUAL
BATCH
Improved
inventory
control
Better cash management

Less time lag
Better purchasing time management
Reduction of paper documents
REENGINEERED SYSTEM
VS.
BATCH AUTOMATED
SYSTEM
Segregation of duties
Accounting records and access controls
PAYROLL PROCEDURES
Drawbacks to using regular A.P. and cash
disbursements systems to do payroll
General expenditure procedures that apply to all

vendors will not apply to employees
Writing checks to employees requires special
controls
General expenditure procedures are designed to
accommodate relatively smooth flow of
transactions
REENGINEERED PAYROLL
SYSTEM
Often integrated with H.R.
Differs from previous automate system
Operations departments transmit transactions to

D.P. electronically
Direct access to files are used for data storage
Many processes are now performed in real time
REENGINEERED PAYROLL
SYSTEM
Personnel
Cost accounting
Timekeeping
Data processing
1.
2.
3.
4.
5.
6.
7.
Labor costs are distributed to accounts

Online labor distribution summary
Online payroll register
Employee records are updated
Payroll checks are prepared and signed
Disbursement system generates check to fund the
payroll imprest account
G.L. updated
EXPENDITURE CYCLE AUDIT

OBJECTIVES
Input controls
Data validation controls

Testing validation controls
Batch controls
Testing batch controls
Purchases authorization controls
Testing purchases authorization controls
Employee authorization
Testing employee authorization procedures

OBJECTIVES
Process controls
File update controls
Sequence check control

Liability validation control
Valid vendor file
Testing file update controls
Access controls
Warehouse security
Moving assets promptly when received
Paying employees by check vs. cash
Risks
Employees with access to A.P. subsidiary file

Employees with access to attendance records
Employees with access to both cash and A.P. records
Employees with access to both inventory and inventory records
Testing access controls
EXPENDITURE CYCLE
AUDIT OBJECTIVES
Process controls
Physical controls
Purchase system controls
Segregation of inventory control from warehouse

Segregation of G.L. and A.P. from cash disbursements
Supervision of receiving department
Payroll System controls
Inspection of assets
Theft of assets
Reconciliation of supporting documents: P.O., receiving
report, suppliers invoice
Verification of timecards
Supervision
Paymaster
Payroll imprest account
Testing of physical controls

OBJECTIVES
Process controls
Output controls
A.P. change report

Transaction logs
Transaction listing
Logs of automatic transactions
Unique transaction identifiers
Error listing
Testing output controls
EXPENDITURE CYCLE
SUBSTANTIVE TESTS
Risks and audit concerns
Understanding data
Inventory file
Purchase order file
Purchase order line item file
Receiving report file
Disbursement voucher file
File preparation procedures
EXPENDITURE CYCLE
SUBSTANTIVE TESTS
Testing accuracy and completeness assertions
Review disbursement vouchers for unusual trends

and exceptions
Accurate invoice prices
Testing completeness, existence, rights and

obligations assertions
Searching for unrecorded liabilities

Searching for unauthorized disbursement vouchers
Review of multiple checks to vendors
Auditing payroll and related records
Additional Cybercrime Info
The following slides are not in the text!
Incident Response Mandates

Gramm-Leach-Bliley
Financial Institutions must
Establish incident response capability
Perform prompt and reasonable investigation
when sensitive customer info is accessed
Notify customers if misuse of info has or is
likely to occur
Incident Response
Requirements
ISO 17799 is international
standard for IS best
ISO 17799
practices
Security framework must contain an effective
incident response approach
In 2002, 22% companies with sales over $500
million had implemented ISO 17799
Must collect information for three purposes
Internal problem analysis

Use as evidence
Negotiation for compensation from software/service
vendors
Incident Response
Requirements
ISO 17799
Response procedures
should cover
Analysis and identification of cause of
incident
Planning and implementation of remedies
Collection of audit trails and similar evidence
Communication with those affected or
involved with recovery
Reporting the action to the appropriate
authority
Best Practices
Imaging hard drive of employees who resign

or are terminated (proactive)
Avoid patch and proceed response
Implement network forensics analysis with
tools like EnCase
Focus on insider threats
Companies face increasing cyberliability
claims stemming from security breaches
Chapter 10:
Auditing the Expenditure
Cycle
IT Auditing & Assurance, 2e, Hall & Singleton

Auditing The Expenditure Cycle: IT Auditing & Assurance, 2e, Hall & Singleton

Uploaded by

Copyright:

Available Formats

Auditing The Expenditure Cycle: IT Auditing & Assurance, 2e, Hall & Singleton

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Auditing The Expenditure Cycle: IT Auditing & Assurance, 2e, Hall & Singleton

Uploaded by

Copyright:

Available Formats

Chapter 10:

IT Auditing & Assurance, 2e, Hall & Singleton

Step 1: Data processing department inventory

Step 2: Data processing department P.O.

Step 3: Data processing department batch

Step 4: Data processing department validates

Step 5: Data processing department scans for

Inventory file scanned for items and reorder points

Goods arrive at receiving department

Quantities received entered per item

Quantities keyed matched to open P.O.

Each day, due date filed of A.P. are

Checks are printed, signed and distributed to

BATCH AUTOMATED SYSTEM

Better cash management

Accounting records and access controls

General expenditure procedures that apply to all

Operations departments transmit transactions to

Labor costs are distributed to accounts

EXPENDITURE CYCLE AUDIT

Data validation controls

EXPENDITURE CYCLE AUDIT

Sequence check control

Employees with access to A.P. subsidiary file

Testing access controls

Segregation of inventory control from warehouse

Payroll System controls

Testing of physical controls

EXPENDITURE CYCLE AUDIT

A.P. change report

Testing accuracy and completeness assertions

Review disbursement vouchers for unusual trends

Accurate invoice prices

Testing completeness, existence, rights and

Searching for unrecorded liabilities

Additional Cybercrime Info

The following slides are not in the text!

Incident Response Mandates

Internal problem analysis

Imaging hard drive of employees who resign

IT Auditing & Assurance, 2e, Hall & Singleton

You might also like