AUDITING THE

EXPENDITURE CYCLE
AUDITING IN CIS ENVIRONMENT
EXPENDITURE CYCLE ACTIVITIES AND
TECHNOLOGIES
This section examines alternative information technologies
used to support expenditure cycle activities. The first of
these is a basic batch purchases and cash disbursements
system. Second, we review the operational features of an
integrated real-time system. The final example depicts a
payroll system that uses real-time processing and which is
integrated into a Human Resources (HR) system database
technology.
PURCHASES AND CASH DISBURSEMENT PROCEDURES
USING BATCH-PROCESSING TECH.
Data-Processing Department (Step 1)
Purchasing Department
- The purchasing agent reviews the POs for correctness and distributes them. One
copy for the vendor, a blind copy sent to the receiving department, one copy
goes to accounts payable and one is filed in the purchasing department. The
above-mentioned procedure allows the purchasing agent to verify the purchase
transaction before placing the order to reduce the risk of placing unnecessary
orders with vendors.

Receiving Department
- When the goods arrive from vendors, the receiving clerk prepares a receiving
report.
PURCHASES AND CASH DISBURSEMENT PROCEDURES
USING BATCH-PROCESSING TECH.
Data-Processing Department (Step 2)
Accounts Payable
- Upon receiving supplier’s invoice, the AP clerk reconciles it with supporting
documents. The clerk then prepares a cash disbursement voucher and sends one
copy to data processing. A second copy, along with the supporting documents are,
is filed in the open voucher file.

Data-Processing Department (Step 3)

Cash Disbursement
- Cash disbursements clerk reconciles the transaction listing with checks, signs them,
and mails them to the suppliers. Upon receipt of the check copies the AP clerk
matches them with the supporting AP documents and transfers all documents to the
closed AP file. This step concludes the expenditure cycle process.
INTEGRATED PURCHASES AND DISBURSEMENTS
SYSTEM

In advanced technology systems, computer programs perform many labor

intensive clerical tasks, which is a cheaper option and far less prone to
error. Although the traditional department structure still exists in advanced
technology environments, personnel responsibilities are refocused on
financial analysis and exception-based problem solving, rather than on
day-to-day clerical tasks. . As a result, these departments are smaller and
more efficient than their low technology counterparts.
Computer Operations
The system performs the following tasks automatically:
• The purchases program reads the purchase requisition file for items that need to be
replenished. The requisitions are then sorted by vendor and matched against the valid
vendor file for vendor address and contact information.
• Hard-copy POs are prepared and sent to the vendors.
• A record of each purchase is added to the open PO file.
• A digital transaction listing of POs is created, which is downloaded by the purchasing
agent, reviewed, and filed in the department.

Receiving Department
When the goods arrive, the receiving clerk accesses a blind copy of the open PO file in real
time by entering the PO number taken from the packing slip. The following tasks are performed
automatically by the system.
• A record is added to the receiving report file.
• Quantities of items received are matched against the open PO record, and the PO is closed
by
placing the receiving report number in the PO closed flag.
• The inventory subsidiary records are updated to reflect the receipt of the inventory items.
• The general ledger inventory control account is updated
Accounts Payable Department
When the AP clerk receives the supplier’s invoice, the clerk accesses the system and
adds a record to the vendor invoice file. The clerk then files the hard-copy invoice in
the department. The following tasks are performed automatically by the system.
• Using the PO number as a common attribute, the system links the vendor invoice
to the associated PO and receiving report records.
• The system reconciles the supporting documents and creates a virtual AP packet
to authorize payment.
• The system displays the virtual AP packet on the AP clerk’s computer screen for
review. The virtual AP packet allows the AP clerk to perform a 3-way-match by
browsing the supporting documents and modifying them if necessary to reconcile
quantity or price discrepancies that may exist.
• Assuming no discrepancies that demand the AP clerk’s intervention, the system
automatically approves payment and places a payment date in the vendor invoice
DUE DATE field.
Cash Disbursement Procedures
Each day, the DUE DATE fields of the vendor invoice records are scanned for items
due to be paid. The following procedures are performed on items that are due.
• Checks are automatically printed, signed, and distributed to the mail room for
mailing to vendors. Checks above a preset materiality threshold will receive
additional signatures (not shown) prior to being mailed. EDI vendors receive
payment electronically (not shown).
• The payments are automatically recorded in the check register file.
• Vendor invoices are closed by placing the check number in the CLOSED field.
• The general ledger AP control and cash accounts are updated.
• Reports detailing these transactions are transmitted digitally to the AP and cash
disbursements departments for management review and filing.
 Overview of Payroll Procedures
Although payroll processing is theoretically a special-case expenditure
system, it consists of complex procedures that distinguish it in practice
from general purchases and cash disbursements system described
previously.
• Payroll procedures differ among classes of employees.
• Payroll checks writing has unique risks and requires special controls to
prevent and detect fraud.
• Payroll activities, however, are discrete rather than continuous. Large
numbers of disbursements to employees occur weekly, biweekly, or
monthly. Managing this peak-load problem requires special procedures.
Reengineering the Payroll System
For moderate-sized and large organizations, payroll processing is often integrated
within the human resource management (HRM) system. The HRM system captures
and processes a wide range of personnel-related data, including employee
benefits, labor resource planning, employee relations, employee skills, personnel
actions, as well as payroll. HRM systems must support real-time access to personnel
files for purposes of direct inquires and recording changes in employee status as
they occur.

Personnel
The personnel department makes changes to the employee file in real time via
terminals. These changes include additions of new employees, deletions of
terminated employees, changes in dependents, changes in withholding, and
changes in job status (pay rate).
Cost accounting
The cost accounting department enters job cost data (real time or daily) to
create the labor usage file.
Timekeeping
Upon receipt of the approved time cards from the supervisor at the end of the
week, the timekeeping department creates the current attendance file.

Data Processing
The following tasks are performed in a batch process:
• Labor costs are distributed to various WIP, overhead, and expense accounts.
• An online labor distribution summary file is created.
• An online payroll register is created from the attendance file and the employee file.
• The employee records file is updated.
• Payroll checks are prepared and signed. They are sent to the treasurer for review
and reconciliation with the payroll register. The paychecks are then distributed to the
employees.
• The disbursement voucher file is updated and a check is prepared for the funds
transfer to the payroll imprest account. The check and a hard copy of the
disbursement voucher go to cash disbursements.
• At the end of processing, the system retrieves the labor distribution summary file
and the disbursements voucher file and updates the general ledger file.
 EXPENDITURE CYCLE AUDIT OBJECTIVES,
CONTROLS, AND TESTS OF CONTROLS
Chapter 1 introduced the concept of audit objectives derived from
general management assertions about financial statement
presentation. The assertions are existence or occurrence,
completeness, accuracy, rights and obligations, valuation or
allocation, and presentation and disclosure. Achieving these audit
objectives requires designing audit procedures to gather evidence
that either corroborates or refutes management assertions. This often
involves a combination of tests of controls and substantive tests of
details.
Input Controls
Input controls are designed to ensure that transactions are valid, accurate,
and complete. Control techniques vary considerably between batch and
real-time systems.
Data Validation Controls
Testing Validation Controls
Batch Controls
Testing Batch Controls
Purchases Authorization Controls
Testing Purchases Authorization Controls
Employee Authorization
Testing Employee Authorization Procedures
 PROCESS CONTROLS
Process controls include computerized procedures for updating files and
restricting access to data. Depending on the level of computer
technology in place, process controls may also include physical controls
associated with manual activities.
Sequence Check Control - The order of the transaction records in the
batch is critical to correct and complete processing.
Liability Validation Control - The process involves reconciling supporting
documents including the PO, receiving report, and supplier’s invoice.
Testing File Update Control - Tests of file update controls
provide the auditor with evidence relating to the management assertions
of existence, completeness, rights and obligations, and accuracy.
 ACCESS CONTROLS

Access controls prevent and detect unauthorized and illegal access to

the firm’s assets. Inventories and cash are the physical assets of the
expenditure cycle. Traditional techniques used to limit access to these
assets include the following:

Warehouse security, such as fences, alarms, and guards.

Moving assets promptly from the receiving dock to the warehouse.
Paying employees by check rather than cash.
 TESTING ACCESS CONTROLS
Access control lies at the heart of accounting information integrity. In the
absence of adequate controls, supplier invoices can be deleted,
added, or falsified. Individual payroll account balances can be erased.

Since payments to false vendors carry such potential for material loss,
the auditor is concerned about the integrity of the valid vendor file. The
auditor should therefore assess the adequacy of access controls
protecting the file that includes:
Password controls
Restricting access to authorized managers
Using data encryption
 PHYSICAL CONTROLS
Physical controls include manual activities and human actions to initiate
computer procedures to safeguard the assets of the organization. The relevant
physical controls for the purchases and payroll systems are as follows:
Purchases System Controls
a. Segregation of inventory control from the warehouse
b. Segregation of the general ledger and accounts payable from cash
disbursements
c. Supervision of receiving department.
d. Reconciliation of supporting documents.

Payroll System Controls

a. Verification of time cards
b. Supervision
c. Paymaster.
 TESTING PHYSICAL CONTROLS
Inadequate segregation of duties and lack of supervision can result in fraud and
errors that can cause financial statements to be materially misstated. The
exposure issues here are similar to the access control issues discussed earlier.

The auditor’s review of organizational structure should disclose the more

egregious examples of incompatible tasks, such as one individual opening and
approving timecards, authorizing employee payments, and receiving and
distributing the paychecks.

The auditor should also determine whether the organization has an effective
policy for dealing with such issues.
 OUTPUT CONTROLS
Output controls are designed to ensure that information is not lost, misdirected, or
corrupted and that system processes function as intended. For example, daily
summaries of cash disbursements to vendors and inventory receipts should go to
managers to report the status of their operations.

Output control can also be designed to identify operational and internal control
problems. For example, an exception report derived from the Suppliers
Invoice (accounts payable) file listing past-due liabilities can identify discounts lost
and help management assess the operational performance of the AP process.
 OUTPUT CONTROLS
Another important element of output control is the maintenance of an audit trail.
Details of transaction processing produced at intermediate points can provide an
audit trail that reflects activity through every stage of operations. The following
are examples of audit trail output controls.

Accounts Payable Change Report

Transaction Logs
Transaction Listing
Log of Automatic Transactions
Unique Transaction Identifiers
Error Listing
 TESTING OUTPUT CONTROLS
The absence of adequate output controls has adverse implications for
operational efficiency and financial reporting. Evidence gathered through tests of
output controls relates to the completeness and accuracy assertions.

Testing output controls involves reviewing summary reports for accuracy,

completeness, timeliness, and relevance to the decision that they are intended to
support. In addition, the auditor should trace sample transactions through audit
trail reports, including transaction listings, error logs, and logs of resubmitted
records.
SUBSTANTIVE TESTS OF EXPENDITURE CYCLE
ACCOUNTS
This deals with the substantive tests that an auditor may
perform to achieve audit objectives related to the
expenditure cycle. The strategy used in determining
the nature, timing, and extent of substantive tests
derives from the auditor’s assessment of inherent risk,
unmitigated control risk, materiality considerations,
and the need to conduct the audit in an efficient
manner.
 EXPENDITURE CYCLE RISKS AND AUDIT
CONCERNS
External auditors are concerned primarily with the potential for
understatement of liabilities and related expenses. Reported balances
usually consist of items that have been reviewed, validated, and
acknowledged by management. Substantive tests of expenditure cycle
accounts are therefore directed toward gathering evidence of
understatement and omission of material items rather than their
overstatement.
 EXPENDITURE CYCLE RISKS AND AUDIT
CONCERNS
In resolving these concerns, the auditor will seek evidence by
performing a combi nation of tests of internal controls and substantive
tests;
Testing both general controls
Various application control-testing techniques
Specific tests related to the expenditure cycle

In addition to tests of controls, for this chapter, the auditor must perform
substantive tests to achieve audit objectives.
 WHAT IS SUBSTANTIVE TEST?
A substantive test involves involve extracting data from accounting
files for analysis. To do this task, the auditor needs to understand the systems
and controls that produced the data as well as the physical characteristics
of the files that contain them.

Salient Points
The auditor must verify that he or she is working with the correct version
of the file to be analyzed.
ACL can read most sequential files and relational database tables
directly
 TESTING THE ACCURACY AND COMPLETENESS
ASSERTIONS

The audit procedures described in this section provide evidence relating to

management assertions of accuracy and completeness. Analytical
procedures can identify relationships between accounts and risks that are
not otherwise apparent. In the case of the expenditure cycle, an analytical
review can provide the auditor with an overall perspective for trends in AP
and related expenses. analytical procedures may indicate trends, even in
adequately controlled organizations, that lead the auditor to extend
substantive tests.
REVIEW DISBURSEMENT VOUCHERS FOR UNUSUAL
TRENDS AND EXCEPTIONS

A useful audit procedure for identifying potential audit risks involves

scanning data files for unusual transactions and account balances.
 REVIEWING FOR ACCURATE INVOICE PRICES

Comparing prices on supplier invoices to original PO prices provides

evidence for testing the management assertion of accuracy. Significant
discrepancies between expected prices and the prices actually charged
may be due to clerical errors, failure to review supporting documents before
authorizing payment, or AP personnel exceeding their authority in dealing
with price discrepancies. Traditionally, auditors verify pricing accuracy by
comparing invoice prices with the POs on a sample basis only. ACL allows
the auditor to compare the prices charged on every invoice in the file for
the period under review.
 PURCHASE-ORDER FILE

COMBINED PO/DISBURSEMENT FILE

 TESTING THE COMPLETENESS, EXISTENCE, AND
RIGHTS AND OBLIGATIONS ASSERTIONS

Inventories received from valid suppliers in response to authorized POs

constitute liabilities. In most systems, however, the trigger that causes the
liability to be recognized and recorded as an AP is the receipt of the
supplier’s invoice, which often lags the receipt of the merchandise.
Normally, the time lag between liability realization and recognition does not
impact financial reporting. Items of inventory received at the end of the
audit period, whose related invoice is not received until early into the
following period, may not be included as an AP. Management should have
procedures for identifying invoices received in a subsequent period that
relate to the audit period.
 SEARCHING FOR UNRECORDED LIABILITIES

In here, only the Receiving Report file needs to be reorganized since the
Disbursement Voucher file was previously sorted on this key. In this case,
create an output file that consists only of unmatched records from the
primary file.
 REVIEW FOR DUPLICATE CHECKS TO VENDORS
Corporate losses from multiple payments to vendors for the same
merchandise and the basis for that is Malfunctioning computer programs,
data entry errors, and the failure of authorization controls that results for
duplicate payments. They are the result of dishonest vendors who attempt
to circumvent internal controls by sending two supplier invoices with
different invoice numbers for the same purchase.
 AUDITING PAYROLL AND RELATED ACCOUNTS
Testing accrued payroll and related accounts for completeness and
accuracy consist primarily of analytical procedures and reviews of cash
disbursements made in the following period. The auditor should test the
mathematical accuracy of payroll summaries and trace totals to the payroll
records and to the general ledger accounts.

Substantive tests of details, may include the following:

Verifying the accuracy of employee paycheck amounts by comparing
them with the pay rates stated on employee action forms
Searching for duplicate paychecks to employees
Reviewing the personableness of overtime hours listed on time and
attendance files.
THANK YOU!