By Doug Potter
INTERNAL CONTROLS
Many financial managers express a great deal of interest and concern over accounts payable internal controls. The primary reason for this interest has to do with the nature of accounts payable. Since accounts payable processing controls the disbursement of funds outside of the organization, this is a likely place for fraud and duplicity. To help prevent this, it is incumbent on management to institute a good system of internal controls within accounts payable. Internal controls help lower the chance of errors—both inadvertent and intentional. When properly put in place, internal controls can help ensure the accurate and timely functioning of all the accounts payable processes.
CONTROL OBJECTIVES
The internal controls cited here constitute a comprehensive list of controls, generally applicable to most accounts payable departments. However, their blanket application does not necessarily ensure a controlled environment. Auditors typically look for a framework of related controls to support predefined control objectives. For accounts payable processing these control objectives usually include assertions that
· Payments are authorized.
· Disbursement activity is being properly recorded in the right accounting period.
· Either goods have been purchased or services have been rendered corresponding to the invoice received or payment made.
· Account payable processing allows all payments and accounting to take place in a timely manner.
The auditor will attempt to prove or disprove specific control objectives, by identifying particular controls and control procedures that exist. Performing this work requires someone skilled in computer-based auditing. This is a person that understands how to interpret the procedures and programmed system controls that exist in the organization and that understands how to interpret the framework of controls that can reasonably support defined control objectives.
SYSTEM ACCESS AND SEGREGATION OF DUTIES
The security mechanisms of the accounts payable system should restrict system users such that only those that need access to accounts payable functions have that access. It is generally not appropriate to grant everyone in the accounts payable department access to every function. For example, if department managers approve vouchers on-line, then it is imperative that the accounts payable invoice entry operator not have access to this approval function. This would allow the operator to both enter the accounting records and approve them for payment.
Besides voucher approval, other system functions that can be segregated from invoice entry include
· Adding, deleting, and changing vendor master file information.
· Preparing and printing cash disbursements.
However, the separation of these functions from invoice entry is generally not critical and, to a large extent, situation dependent. In small and medium-sized businesses, such strict separation may not be cost-effective. For example, invoice entry operators may need the ability to add and modify vendor master file information to process specific invoices.
System access and segregation of duties should also restrict all vendor and accounts payable file maintenance to authorized individuals in the accounts pay-able department. With respect to information systems support, this generally means that the application programming staff should not have access to the "live" data in the accounts payable system. System access controls should force them to work only with "test" versions of accounts payable data. This restriction be-comes more important in larger organizations in which the departmental functions of information systems and accounts payable are rigidly separated and the dollar amounts at risk are quite significant.
VOUCHER AND INVOICE ENTRY CONTROLS
A well-controlled accounts payable environment will have a variety of controls protecting different areas of the voucher processing cycle. In many cases these include controls for
· Data accuracy and on-line editing.
· Other voucher editing controls.
· Matching, purchasing control, and departmental approval.
· Duplicate invoice checking.
· Sequential document control.
Data Accuracy and On-Line Editing. An important set of internal controls involves those procedures and system checks that help ensure the accuracy of the invoice and voucher information entering the system. Most of these controls are edits of key voucher fields, including
· Vendor number.
· Voucher amount.
· General ledger account numbers.
· Purchase order information.
· Invoice and accounting dates.
In the case of most of these edits, the system will validate each entered field against corresponding master file information. Date fields are checked differently, however. Usually the system tests them for reasonableness. One way to do this is to see if the transaction's date is near the date already entered in the batch header for that batch of transactions.
Other Voucher Editing Controls. Batch controls can reconcile both the number of invoices and their aggregate dollar amount to the accumulated total of the detailed transactions. These procedures help ensure the accuracy of the amounts entered. Reconciling the number of transactions helps provide some assurance that invoices are not being lost through part of their processing—a factor that was often more of a threat in older, batch systems than in modern on-line systems.
In a manual accounts payable system, the accountant would check every vendor invoice for correct addition of the invoice line items. This is required only if there is no automated invoice and purchase order matching. For example, if the accounts payable department enters only the total invoice amount, a separate verification of the invoice total may be worthwhile, particularly if the invoice is manually prepared. In automated matching the invoice detail must tie to the total invoice amount or the system suspends the invoice. If the only line item information being entered off the invoice is the quantities, then the system should recalculate (and verify) the invoice total using unit cost information from the purchase order.
Older accounts payable systems used a checkdigit in the vendor number or in the general ledger account number to verify the accuracy of these fields as they were entered. This is a characteristic left over from the older batch environments. Such procedures were necessary in environments that relied on keypunch operators and stand-alone data entry machines to enter information off-line. It is not necessary to use checkdigits in a modern environment because access to the vendor master file, or general ledger chart of accounts, is available for data validation.
Matching, Purchasing Control, and Departmental Approval. Matching vouchers to receiving information and purchase order information is itself a control. It helps ensure that item quantities and amounts were initiated through an authorized source—the purchase order—and that goods were properly received before payment is issued. In most cases, this involves a three-way match of quantities between the purchase order, packing slip, and invoice, and a two-way match between the amounts on the purchase order and the invoice. When a requisition is involved, the matching process may even be extended to include it in the match up of items and quantities.
When exceptions occur and an invoice cannot be matched for immediate processing, the system suspends the invoice. Following this, the accountant must take appropriate action to follow-up and resolve the cause of this. Perhaps the purchase order has not yet been entered into the system or possibly the vendor has changed his prices without notifying purchasing. Procedures for follow-up and resolution of these exceptions are necessary internal controls for several reasons. First, they help control and authorize deviations from original vendor price agreements, and second, they can ensure timely processing and accounting of vendor invoices.
Voucher Approval. The control procedure which ultimately ensures that all invoices are approved is the final review and approval by a responsible department manager. The system may provide built-in controls requiring certain such approvals based on the voucher's amount. For example, these may require that a financial executive provide the second approval on all vouchers over $10,000. To complete the control over the approval process, the system must not allow further voucher processing unless these approvals are obtained. Of course, certain necessary access controls also apply here. Unauthorized people, such as accounts payable accountants, cannot change a voucher's approval requirements, make himself an approver, or log on using the approving manager's ID.
Duplicate Invoice Checking. Vendors commonly send more than one invoice when payment is not promptly received. Most accounts payable departments employ two different means to stop duplicate invoices from being paid more than once.
The first control is automated, built-in system functionality. Here, the sys-tem tests each new invoice against the accounts payable master file to determine whether the vendor has an invoice already on file with that particular number. If not, it must then check the history file to determine whether an invoice with this number has already been paid. If the new invoice passes these tests, the system will accept it.
Matching constitutes a second control preventing duplicate invoices because each purchase order can be matched only once. When a duplicate invoice arrives, it is rejected because the purchase order has already been matched. This control provides a helpful back-up control to the first one. In environments in which matching does not occur (for example, if purchase orders are not used) duplicate invoice checking becomes a necessity.
Sequential Voucher Numbering. For businesses that use paper vouchers and voucher packets, sequentially numbered voucher forms can be an important control feature. Using a list of vouchers sorted by voucher number, someone can look at a file of completed vouchers (sorted by vendor) and verify that each voucher packet is present. Obviously this becomes important when clerical staff frequently pull vouchers from the file and there is a question as to the file's completeness.
In a modern environment sequential voucher numbering is not as important. Here the automated system takes care of storing the history information for each voucher and the focus for controlling the integrity of this history shifts to more general controls addressing computer file access, storage, and recovery.
Next Month's topic: Cash Disbursement Controls