Question

Background

Spyglass is the 10th largest company in the security services industry.  Spyglass is a publicly traded company. The company's current annual revenues are $150 million.  Elvis McGraw became the company's Chief Executive Officer (CEO) eight years ago.  Mr. McGraw is a "hands-on" executive who was eventually given the additional title of Chairman of the Board. Branch operations are conducted in all states east of the Mississippi.  

The company’s philosophy is primarily one of decentralization.  However, corporate accounting, accounts payable and payroll systems represent exceptions to this overall philosophy since they are centralized at the corporate office in Chicago, Illinois.  Spyglass's annual purchase volume approximates $40 million. Forty-five thousand (45,000) checks are processed annually. The accounts payable function handles all cash payments.

Even though Mr. McGraw considers internal auditors "bean counters," an internal audit function was finally established a year ago.  Given Mr. McGraw’s doubts about internal audit, the department is working very hard to build credibility.  Initially the CAE decided to perform financial audits and then expand into more complex audit engagements.

Internal auditing recently completed an audit engagement covering accounts payable.  The information gathered during the audit is summarized below.  

Information Gathered During Audit

1.   Purchasing at the branch level is not standardized and thus may or may not involve a formal purchase order. Approximately 20% of the invoices processed do not have a purchase order and receiving report. These invoices are processed based on an authorized approver list.   

2.   A local software company recently installed a new automated accounts payable system at Spyglass. Although the installation was based on a standard software package, it was modified extensively under the direction of an outside consultant.  

3.  Turnover among Spyglass employees, including those in the accounting department, has been excessive.  This condition, however, is not unusual in Spyglass's industry.  The company has employed each of the five accounts payable clerks for fourteen to nineteen months.  

4. There is a job rotation process in place whereby each clerk is assigned to a different function every 12 months.   

5.  Accounts payable clerks can only access the purchasing level requiring the lowest authority in the software package.  The application audit log showed seventeen rejected access attempts to add a new vendor over a two-day period.  During this time period, the accounts payable supervisor, who normally performs this function, was on vacation.  The person(s) trying to execute the transaction to add a new vendor was already logged into the application.  The invalid access attempts are included on a security report sent daily to the accounts payable supervisor.  

6.  The wages of one of the accounts payable clerks are being garnished as a result of a federal government collection action involving a student loan.  During her employment interview, the applicant told the HR interviewer that she had no debts.  This clerk has been responsible for processing employee expense checks and cash account transfers.

7.  The accounts payable supervisor assigns vendor codes whenever an accounts payable clerk needs a check and no-account number code has been previously established for that vendor. If time permits the supervisor may do some checking, but mostly he relies on the approval appearing on the invoice as the basis for issuing the number. Purchasing has no responsibility for assigning vendor codes or providing information to accounts payable to set up a vendor code.

8.  When the system was first established, each “active” vendor was assigned a code number, regardless of whether there was a balance due that vendor.  One quarter of all vendors currently have zero balances due. Review of the vendor master files shows that many records are incomplete (e.g., missing phone numbers, missing or incomplete addresses, etc.).

9.  For vendors with whom business is being conducted on a one-time basis, without any expectation of a continuing business relationship, vendor codes are not added to the vendor master. A special procedure in the new application is used to create a vendor number to process the invoice for payment.    

10. The accounts payable clerks establish batch control totals prior to processing.  Each clerk subsequently compares his/her batch totals with computer-generated totals after processing.

11. After checks are signed, the checks are returned to the accounts payable clerks for distribution to payees (assuming no request for “direct deposit”).

12. Any reconciliations of monthly statements from vendors are done by corporate accounting.

13. There are written policies but virtually no written procedures for the accounts payable department.

Required

Based on the information gathered in the audit, write a memorandum to the CEO commenting on the various deficiencies.  This memorandum is considered critical to the success of future audits.  With respect to each deficiency, indicate whether material errors could occur; if so, state the nature of the error; if not, state why. To the extent possible, for each deficiency, suggest corrective actions. Do not assume all observations are deficiencies.  If possible, try to group deficiencies into logical categories.

      

Answer 1

Deficiency Current Control Procurement Manual:- authorized Process approver list Access Controls 1. SOD Conflict 2. Monthly reconciliation Payment Process 1. Cash Transfer for expense claims 2. Checks handling by the clerks Spyglass Deficiencies observed during Internal Audit Financial Risk Impact Corrective Action 1. Fake purchases and payment thereto. 8 Mill USD 1. Automatic control to be established for PO creation and approval as per 2. SOD conflicts where approver himself is the user (20% of 8 defined release strategy within ERP system department Dollars) 2. No purchase to be processed for payment which is not supported by authorized PO. 3. Authority matrix to be established based on user type and transaction value. 1. Segregation of duties voilation may result in explotation 8 Mill USD 1. Account payable department should not have access to purchasing level of rights (20% of 8 department even that of basic. 2. Accounts department conducts reconciliation giving | Dollars) 2. Monthly reconciliation shall be done by the accounts payable department them access to vendor communications. It should not be instead of accounts department. promoted as the same can resukt in to collusion between the two. Cash embezzlement / bogus expense posting for cash 11. Cash transfers should be eliminated and only accounts transfer policy to be claims implemented to ensure all payments are done via authorized persons to the authorized receiver. 2. Considering employee history of Spyglass, it is not recommended to process checks which is currently signed and returned to the clerks for distribution. Instead electronic transfer should be used as default payment method. Checks should be used based on vendor requests. 1. Incorrect data update in masters 1. Vendor information shall be shared by purchasing department with the 2. Same vendor with different codes accounts payable department, which in turn to be scrutinized for each case and 3. One-time vendor with no vendor records and with no then only master should be created by the payable supervisor PO creation can be used as a tool for committing fraud. 2. It should be ensured to have complete records in vendor master to identify duplicate vendor codes, which can be a trigger of fraud. Mobile number, tax codes, address etc. should be marked as mandatory. 3. All payment shall be transferred via one process only. Even one-time vendors' records shall be maintained, and vendor should be blocked as soon as transaction completes. 1. Employees unaware of what is expected as illegitimate Standard Operating Procedures shall be maintained and circulated by the action as per company policy Spyglass. 2. Employee unaware of what is right course of action and how to process a particular scenario Payable Masters 1. No intervention of Purchase department 2. Incomplete records 3. No records maintenance of one-time vendors SOPs No SOP defined