Recommendation on Internal Control for Purchases, Payables, and Payments - Essay Example

Recommendation of Internal Control for Purchases, Payables, and Payments Auditing ID: 200204942 Bachelor of Business Administration- Accounting November 22, 2009 Table of Contents Executive Summary 3 Overview of Internal Audit and Internal Control 4 Internal Control Objectives 5 Internal Control Procedures on Acquisitions/Purchases 6 Internal Control Procedures on Payables 10 Internal Control Procedures on Payments 12 Conclusion 13 Works Cited 15 Chen Name of Professor Auditing December 2, 2009 Recommendation of Internal Control for Purchases, Payables, and Payments Executive Summary This paper aims to gain sufficient understanding on internal control objectives in relation to the purchase, payable and payment system of a company. It will also attempt to analyze and evaluate the adequacy of and the compliance with internal control procedures being implemented. Aside from examining the viability of these existing controls, this paper will discuss the strengths and weaknesses of the procedures adopted by the company. Furthermore, it intends to recommend an enhancement in the control system of purchases, payables and payments to address the weaknesses in internal control. Overview of Internal Audit and Internal Control Internal Auditing is defined as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization to accomplish its objectives by evolving a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The internal audit activity evaluates the adequacy and effectiveness of controls that encompass the organization's governance, operations, and information systems (Arens, Loebbecke, Lemon, & Splettstoesser, 2006). Internal audit reviews include the reliability and integrity of financial and operational information, effectiveness and efficiency of operations, safeguarding of assets, and compliance with laws, regulations, and contracts. These reviews ascertain the extent to which operating and program goals and objectives have been established and whether they conform to the requirements of the organization. It also examines the extent to which results are consistent with established goals and objectives and whether operations and programs are implemented or performed as intended. One of the primary responsibilities of internal auditing is the assessment of internal control system of a company. The French Institute of Chartered Accountants defines internal control "as a set of security measures which contribute to the control of a company. Its aim is to ensure, on the other hand, the security and safeguard of assets and the quality of information, on the other hand, the application of instructions given by the Senior management, and to encourage improvements in performances. It is evidenced through the organisation, methods, and procedures for each of the company's activities, so as to ensure the continuity of that company." There are two identified types of controls, Preventive and Defective Controls. Preventive controls are intended to foil errors or irregularities from happening. It is a positive control that helps avert losses. On the other hand, detective controls are devised to identify or uncover inaccuracy and irregularities after they have occurred. Both of these controls play an important role to an effective control system. Preventive controls are essential because they are proactive and emphasize quality. However, detective controls play a critical role in providing evidence that the preventive controls are working and thwarts losses. Internal Control Objectives There are seven pre-defined internal control objectives, namely, authorization, completeness, accuracy, validity, physical safeguards & security, error handling, and segregation of duties. 1) Accountability, authorization and approval- the main objective of this control is to ensure that all transactions are properly approved by authorized personnel in accordance with company policy. 2) Completeness- the aim of this control is to make sure that all legitimate transactions have not been omitted from all accounting records. 3) Accuracy- the purpose of this control is to warrant that all approved transactions are correct and consistent with the data that originated the transaction. 4) Validity- the intent of this control is to guarantee that all recorded transactions are valid, lawful and fairly represent the economic events that really occurred and that it had been executed in accordance with management's general authorization. 5) Physical Safeguards and Security- the reason for this control is to provide safety measures of physical assets and information system through controlled access and restriction to authorized personnel only. 6) Error Handling- the objective of this control is to guarantee that timely corrective actions are undertaken to any mistakes detected at any stage of processing and that these errors are reported to the appropriate level of management. 7) Segregation of Duties- this control aims to ensure that designated tasks among different employees are segregated to trim down the risks of inappropriate action. Responsibility for authorizing, recording and handling of transactions are distributed. Analysis on Internal Control Procedures for Purchases/Acquisitions Our company is a private corporation with its head office located in Vancouver. It has three branches: Vancouver, Calgary and Toronto. Vancouver has four departments which includes the following: investment banking, international investment, financial consultation and administration & accounting. Calgary and Toronto has only three divisions because the accounting section is centralized. Each branch has three managers except for Vancouver which has four. Office supplies, equipments and other inventory items are purchased locally. Sometimes the head office purchases the supplies and had it distributed to its branches. In the event of low supply in inventory, the administrator will prepare a purchase order (PO) and send it to the local manager for approval. The manager then, endorses his approval on the PO or conveys the same through email. However, the manager has a ceiling approval of only $1,000.00 per PO. If the PO exceeds the limit, the manager will endorse the PO to the head office for the director's approval. Prior to the preparation of PO, the administrator should make sure that requests for supplies are valid or reasonable to circumvent procurement of supplies for personal use. The administrator also needs to ensure that the employee requesting for a certain supply or equipment is authorized to use the same. For example, the receptionist should not be allowed to request for Purchase Order Forms since it is not her duty to prepare such forms and it is in direct contravention to the company's internal control objective on segregation of duties. To adhere to the internal control objective of accuracy, the purchase order should not only be signed by the administrator but also by the requesting employee to warrant that there would not be an over requisitioning of supplies by the administrator. Aside from that, the purchase order should be supported by a requisition slip signed by the employee requesting for such items. This will ensure the validity of the transaction. In times of urgent need, the administrator prepares two purchase orders so that the amount would not reach $1,000.00 and he won't have to send the documents to the Vancouver branch for the director's approval. When the local manager asked about this procedure, the administrator explains that he wants to save time since there is not enough supply left. To avoid this from happening in the future the receptionist should immediately coordinate with the administrator for any lacking supply in the inventory. Supporting documents for purchase orders should be complete to justify the said application especially if it is a request for the replacement or repair of office equipments. For example, if the request is for the replacement/installation of the computer hardware/software it should be supported by a certification from the information technology (IT) maintenance service provider. The administrator places his order to the lowest bidder. He does this by sending canvass sheets to the prospective suppliers. The supplier with the lowest price will get the orders. This is a very strong internal control measure placed by the management to ensure that the purchaser has a fair basis in placing an order and it was not done to personal for his or her own personal advantage. Furthermore, the management does not allow the administrator (or any of its employees) to receive any gifts, gratuities, or favours from the suppliers (or any client). This is to guarantee that decisions or working attitude of its employees is not partial to any of its clients. This will also hinder bribery and other malicious conduct that may lead to the economic downfall of the company. Although proper procedures are followed in the acquisition of supplies, there might be some confusion in the accountability, authorization, and approval of the acquisitions. It must be noted that there are two or three managers for each unit. Each of these managers can approve requisition request of other departments especially in times where the other manager is out of the office or on leave. This practice may lead to unnecessary or fraudulent purchases and improper charging of expenses to other departments. Each manager should only be allowed to approve requisitions within his department, where he is accountable for all the transactions that take place. The manager is also accountable for approval sent though email, although it is allowed, it should be carefully examined to avoid hoax transactions from occurring. Passwords should not be given out and should be changed from time to time. This is also an internal control activity which should be observed to safeguard information system. After obtaining approval, the administrator sends the purchase order to the supplier, the supplier then delivers the inventories to the receptionist. The receptionist is the only one responsible for the recording of the inventory. She is also in charge of the releasing of supplies. This is a safety measure to secure assets of the company. This is a very strong point of the company since the purchaser or the administrator has no access to the goods being delivered. The assurance that the inventories are safeguarded is very high. The downside of it is that, whenever the receptionist has to take a leave of absence, the administrator takes her place. The administrators could very well make bogus purchases in connivance with the supplier and do it during the absence of the receptionist. Although the management is taking cost reduction measures, they should be prudent in implementing such policy to avoid the incurrence of losses. The receptionist also verifies that the goods purchased have been received, with the accounting manager every month but the administrator's lack of review of invoices for accuracy by comparing charges to purchase orders may lead to some risks like delivery of supplies not in the purchase order or non-delivery of items included in the purchase order. To prevent this from happening, the receptionist should check the items in the invoice against the items delivered by the supplier. She/he should also then, check the items listed in the invoice against the items listed in the purchase order. She/he should then inform the supplier for any errors or mistake by committed. Although, segregation of duties on the requisitioning of supplies is practiced by the company, wherein the administrator purchases and makes payment, the manager approves the requests, and the receptionist receives the ordered inventories, I still recommend that the purchaser or administrator should not be responsible for the payments of the purchases he made. Sometimes, whenever there are local purchases, the disbursing officer forwards or sends the cheques to the administrator for payment to the local supplier. He could very well connive with the supplier and make fraudulent purchases and ask for a certain percentage of that acquisition. It would be better if the accounting department will always be the one to deliver or send the cheques to the supplier/s. The flow should be like this, the concerned personnel requesting for a particular item should sign along with the administrator the purchase order prepared by the latter. The PO and it supporting documents shall then be forwarded by the administrator to the local manager for approval. After approval, the administrator will then send it to the supplier. In return, the supplier shall then deliver the supplies to the receptionist. Upon receipt, the receptionist then checks the delivered supplies/invoices against the items listed in the purchase order. She/he then sends the invoices and purchase orders to the accounting department for payment. This way, segregation of duties is highly distinct and will avert illegitimate transactions from happening. Analysis on Internal Control Procedures for Payables Purchase orders that were previously approved by the manager for acquisition are forwarded back to him, along with the invoice, for approval on the booking of accounts payable. Even though, there is no violation on the redundancy of such activity, it will affect the timely recording of such transaction, which may lead to delayed payments and incurrence of penalty charges. It is imperative that preferential attention be given to instances that may further delay the completion of the transaction. Since the purchase order was already approved by the local manager it entails that the payable arising from such order is also approved by him. Omission of this internal control procedure (accountability, authorization & approval) will not have a negative chain reaction in the company. After approval of the accounts payable the documents are mailed to the administration and accounting department in Vancouver for booking. I think this routine is a direct contravention on the internal control objective on accuracy for the obvious reason that the transaction originated in another unit but booked in the head office. This will have an impact on the financial statements of each branch, although it will not affect the consolidated financial reports. It is therefore recommended that booking should be done on the requisitioning branch so that proper booking will be observed. Because the documents are mailed, there is the probability that documents may be misrouted, misplaced or not delivered on time. It is possible that not all accounts payable are recorded in the company's books in effect, the internal control objective of completeness is not observed in this process. To check that all accounts payable were recorded, it is advisable that confirmation letters be sent to the suppliers concerned. The substantive procedure of sending confirmation letters to the creditors should be done on monthly basis and then tallied against the creditor's ledger balances. During month-ends and year-ends, the accounting department should make sure that all accrued liabilities are all accounted for and compare it to the previous years' accruals to make sure that reporting of such amount in the financial statements is reasonably done. A big discrepancy in the prior period's accrued liabilities should be given special attention because there might already be over acquisition of supplies or overstatement of invoice. Over acquisition of supplies might be the effect of the over usage of the staff or employees of the items for their own personal use, on the other hand, overstatement of invoice may be the result of an unintentional error by the supplier or an irregularity done by one of the employees. Internal Control Procedures on Payments All of the company's bills are paid in the head office through the administration and accounting department. Due to this set up, most of the accounts become past due and incurs penalty charges. The internal control of validity in this set-up is not exercised. Although the transaction has undergone approval from the authorized personnel, it doesn't mean that incurrence of charges on delayed payments is also allowed. To moderate the chances of this scenario from happening again I would recommend two things; First, that each branch should have its accounting department that will be responsible for the payment of its bills. This would not only address the problem on past due accounts but it will also help in the monitoring of the accounts payable of each branch. The internal control objective of completeness will also be observed in this practice since, each of these accounting departments will make sure that all credit purchases are booked as accounts payable and paid on time. In the event that there is negligence on the part of the employee, who is tasked to make the payments, which would result to incurrence of penalty charges, he or she must shoulder the charges. This would implement the internal control objective of accountability. Each employee is accountable for his/her own actions. Second, if the company is saving on manpower costs and wishes to practice a centralized payment system, they should ensure that there is proper segregation of duties. Only one person should be assigned to handle payment of each branch. This would not only ensure that transactions are properly monitored but it would also help in the accuracy of booking of expenses. Mix-up of transaction will also be avoided. Expenses of Calgary or Toronto branch will not be charged to Vancouver and vice versa. This will ensure that the financial statements of each branch fairly represent the economic activities involved in their respective local offices. Such procedure is in conformity to the internal objective of validity. Just like in my first recommendation, each employee will be held responsible for the outcome of his/her work. This accountability will not only address the internal control objective of accountability, authorization and approval but it will also help the company safeguard its assets. Payments for penalties will no longer form part of the company's expenses. This would also be beneficial to the organization because each staff will perform better in his or her job assignments. Conclusion Although management is mainly responsible in identifying risks in the operations of their company and they are also in charge of devising, executing and examining the internal control measures in place, everyone plays an important role to have an effective yet efficient internal control system. Effective and efficient in the sense that implementation of such procedure will not delay the processing of transactions. Furthermore, it should be cost effective. Whenever and auditor recommends improving a control within a department by hiring additional employees to have an adequate segregation of duties, the main reaction would be, it is too expensive. But the management has to consider the cost it would incur the company because of the missing control. One of the frequent mistakes of the management is that they put too much trust in their employees that they feel controls are not necessary. Although most of the employees are upright and dependable, the management has to remain objective in the instigation of its control. They have to remember that humans are prone to temptation especially in times of need. Each employee should be cautious in their job, they should not cut short the procedures for their own convenience and in the process circumvent the internal control system set by the company. They should always remember that whatever loss the management will incur due to their negligence or incompetence will directly or indirectly affect them. Aside from being vigilant of their own jobs, the employees should also be watchful of their co-workers. For example, if one employee is too lax on his job and lets the other worker do some of his job, he/she should be wary because that person may be doing it for his own personal advantage. It should be noted that we are given different jobs in the company to ensure that there is proper segregation of duties; therefore, we should not let other people do our jobs. In the event that one of the employees will discover irregularities within the department, they should report it to the management so that it will be acted upon immediately and will prevent further damage to the company's economic position. Placing an internal control system should be coupled by a strong teamwork of the management and all the staff and employees. Even the janitor or messenger is part of the internal control system. We might think that the janitor has no access to any files or information system that could breach the company's internal control system but at the end of the day when all of the employees have left, the janitor alone will have access to anything that he could get his hands on; even our garbage cans may contain information that is vital to the company. It should be noted that it was David who killed Goliath. Works Cited Arens, Alvin A., et al. Auditing and Other Assurance Services. Canada: Pearson Education Canada, Inc., 2006. "Internal Control Systems: Reference Framework." The Institute of Internal Auditors. 2009. Institute of Internal Auditors. 2 Dec. 2009. "Internal Controls: The Key to Good Business Practices." VirginiaTech. 2009. Virginia Technology. 29 Nov. 2009. "Understanding Internal Controls (PDF)". University of California. 1 Dec. 2009. Module 8 Summary. 2009. Certified General Accountant. 30 Nov. 2009 Read More