Adequacy of design of control 2096



  • I’m currently working as a SOX internal auditor and noted that management has the following control ‘The Accountant will ensure that all sales invoices are supported with signed contract/ customer purchase order’. The procedure is that the Accountant will issue the sales invoice only upon receiving either a signed contract/ customer purchase order. Once the sales invoice is issued, revenue will be recognised automatically by the accounting system.
    Using the knowledge which I gather from my past external SOX audit experience in the Big-4, I concluded that this control design was inadequate as there is no independent review of sales invoices raised by the Accountant. It does not make sense to have the Accountant ‘check’ her own work. However, I noted from my discussion with my Company’s external auditor (another Big-4 firm) that they are able to accept this control. Their test simply involves selecting samples of sales invoices and checking that they are indeed supporting with saigned contract/ customer purchase order. Their view is that having an independent reviewer will be better, but without it, the control design is still fine. My past experience tells me that this is just a procedure and not a control per se.
    Now I am very much confuse as to why there seems to be a different audit approach across the Big-4 accounting firm. Could anyone enlighten me on what should be the correct assessment :?:



  • I’m currently working as a SOX internal auditor and noted that management has the following control ‘The Accountant will ensure that all sales invoices are supported with signed contract/ customer purchase order’. The procedure is that the Accountant will issue the sales invoice only upon receiving either a signed contract/ customer purchase order. Once the sales invoice is issued, revenue will be recognised automatically by the accounting system.
    Using the knowledge which I gather from my past external SOX audit experience in the Big-4, I concluded that this control design was inadequate as there is no independent review of sales invoices raised by the Accountant. It does not make sense to have the Accountant ‘check’ her own work. However, I noted from my discussion with my Company’s external auditor (another Big-4 firm) that they are able to accept this control. Their test simply involves selecting samples of sales invoices and checking that they are indeed supporting with saigned contract/ customer purchase order. Their view is that having an independent reviewer will be better, but without it, the control design is still fine. My past experience tells me that this is just a procedure and not a control per se.
    Now I am very much confuse as to why there seems to be a different audit approach across the Big-4 accounting firm. Could anyone enlighten me on what should be the correct assessment :?:
    As worded this IMHO is a process and not a control.
    For it to be a control I would expect to see something like ‘The Accountant MATCHES the invoice to the order (AND DESPATCH NOTE) and evidences this by…’
    Matching to the order only seems weak as this does not demonstrate that the goods/services were provided.
    You also have an automated control around posting from the system which is fine.



  • When presented with a potential inadequate control, particularly over design, I always ask the auditor to tell me what the risk is to the financial statements. So in this scenario what risk do you believe this control is not mitigating and would that lead to a material misstatement? I could guess at a few but that would prove fruitless without understanding the cradle to grave process and associated controls/risks.



  • What is the control objective?
    Perhaps the objective is to ensure that the order is valid and that terms and conditions have been agreed (so as to ensure appropriate revenue recognition).
    Do they have another control that details the double checks?



  • Hi EMM, the control objective is to ensure that invoices sent to customers are accurate and valid. Apparently they do not have another control which details the matching.
    Denis, you are right. To be exact, it is deferred revenue that is recognised upon raising of these invoices which are sent to customers. I should not use the word sales invoices, ‘deposit invoices’ will be the more accurate word to use. There is a different control for revenue recognition.
    WrightLot, for this company, the exposure here is that accounts receivables and deferred income may be inaccurate and invalid as errors made by the accountant may not be picked up during review of her own work. The mitigation control will be review of aged debtor listing as these balances will throw out as long outstanding (if the error is overstatement) or unusual debit balances (if the error is understatement) in deferred income schedule which are reviewed by the FC.


Log in to reply