7   Excel Control Template
Upcoming SlideShare
Loading in...5
×
 

7 Excel Control Template

on

  • 1,075 views

 

Statistics

Views

Total Views
1,075
Views on SlideShare
1,068
Embed Views
7

Actions

Likes
0
Downloads
39
Comments
0

1 Embed 7

http://www.linkedin.com 7

Accessibility

Categories

Upload Details

Uploaded via

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

7   Excel Control Template 7 Excel Control Template Presentation Transcript

  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Sales orders are sequentially pre numbered and accounted for. A manual or system check is performed to ensure documents are not missing or duplicated or fall outside of a specified range of numbers. All rejected, suspense, or missing items are researched, corrected and re-entered on a timely basis. Sale orders have fields for all pertinent order information including: itemRevenue & Orders are recorded Order Processing descriptions, quantities, price, price adjustment mechanisms, delivery requirements, C C A M PReceivables completely and accurately. freight terms, taxes, and payment term. Key data fields must be populated to process a sales order. Any entries with invalid, missing or incomplete information are rejected for re-entry (online environment) or stored in a suspense file (batch) where they are researched, corrected and re-entered on a timely basis. Confirm by observation of sales entry process that customer The order entry system automatically validates sales order data input (e.g. customer details, product details, prices, sales taxes and sales orderRevenue & Orders are recorded name and number, prices, terms, and credit limits) against master file data. Entries Order Processing A A V A P total values are automatically determined by the system.Receivables completely and accurately. with invalid, missing or incomplete information are rejected for re-entry or stored in Test system data validation by entering erroneous data and a suspense file for follow-up. verifying that the system rejects incorrect data. A one-for-one check between the sales order source documents (i.e. customerRevenue & Orders are recorded initiated purchase order, signed contract etc.) and the sales order occurs. Any Order Processing A A E/O RO V M DReceivables completely and accurately. discrepancies are identified and re-entered. The check occurs again for re-entered data. In an automated order entry system where the customer enters sales order data via a public Website, an Extranet portal or through a Value Added Network (VAN) utilizing EDI, customers are responsible for ensuring the completeness and accuracy of sales order information. Controls are in place to ensure that EDI interfaces are maintained and are accurate.Revenue & Orders are recorded Functionality is often built into the system to allow a customer to verify the Order Processing C A A C E/O V A PReceivables completely and accurately. accuracy and completeness of their order, as well as the ability to edit their order before actual order submission. Note: If client utilizes an online order entry system that is processed through the Internet or through an EDI VAN, assessing the application controls could require the use of the Systems and Process Assurance (SPA) if the system is considered complex. Copyright © 2005 1 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform For orders that are input into a temporary file before sub-ledger updates - Batch totals are utilized before processing is complete. Input documents are grouped and a numerical total is calculated (i.e. number of documents, monetary amount, hash totals). These totals are compared to post input/update reports. All out of balance conditions are researched and re-entered on a timely basis. Periodic updates for batchRevenue & Order Processing processing are complete and Sales order information that is transmitted via EDI can be verified for completeness C A A C V A DReceivables accurate. and accuracy by setting up specific EDI transaction codes. If sales that are processed via EDI are considered significant, then a separate review of EDI controls should be performed by SPA. Likewise, if sales that are processed via a public Website or Extranet are considered significant, then a review of controls should be performed by SPA. Edit checks exist within the system that reject the input of a sales order number thatRevenue & Duplicate sales are not Order Processing was already entered. Rejects are placed into a suspense file where they are C A A C V A M PReceivables recorded. researched, reviewed and reentered (if necessary) on a timely basis. Examine sales file and verify that sales orders are Sales orders are sequentially prenumbered/ automatically numbered by the system.Revenue & Duplicate sales are not sequentially numbered. Confirm by inquiry and Order Processing Missing or duplicate sales orders are investigated and followed-up by the sales C C A M P DReceivables recorded. examination of evidence that the sales supervisor supervisor. investigates missing and duplicate sales orders.Revenue & Duplicate sales are not Computer-generated sales order confirmations are sent to customers for order Order Processing C A V A C E/O RO A M DReceivables recorded. acknowledgement at the end of each day or on the next working day. Confirm by inquiry with management that: .. sales orders exceeding a specified sales amount Sales terms and prices are Sales orders over a set threshold require approval by management before acceptance .. sales orders with special prices or conditionsRevenue & Order Processing approved by the appropriate by the system. The lack of approval creates a suspense file that is reviewed by V E/O RO A M P are reviewed and approved.Receivables level of management. management for clearance on a regular basis. Examine samples of sales orders with the above conditions and sight evidence of management review and approval. Sales terms and prices are Approval limits per management level are built into the order entry system. TheRevenue & Order Processing approved by the appropriate system will reject orders submitted if the total amount supersedes the employee V R A A PReceivables level of management. limit. Confirm by detailed inquiry with management and Sales terms and prices areRevenue & Management review and approve discounts and allowances in excess of predefined examination of a sample of sales orders showing evidence Order Processing approved by the appropriate V E/O RO A M DReceivables limits. of management approval of sales orders with discounts and level of management. allowances in excess of predefined limits. Sales to fictitious customers Verify customer information against approved customer standing data (i.e.Revenue & Order Processing (on credit) are prevented addresses, credit limits, etc.). Items that are not matched are researched, corrected A V A E/O V A M PReceivables and detected. and re-entered as necessary on a timely basis. Copyright © 2005 2 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry that orders are recorded and created only on the basis of customer purchase orders or other evidence documenting the customers initiation of the order Sales to fictitious customers Orders are recorded and created only on the basis of customer purchase orders or from authorised sources, e.g. designated purchasing officersRevenue & Order Processing (on credit) are prevented other evidence documenting the customers initiation of the order from authorised V E/O RO M P at the customer.Receivables and detected. sources, e.g. designated purchasing officers at the customer. Examine samples of sales orders and verify that they are supported by the customers purchase orders, fax, email or other documentary evidence. Sales to fictitious customersRevenue & Order Processing (on credit) are prevented Management review transaction files periodically for delinquent orders. V E/O RO M DReceivables and detected. Confirm by observation that orders that breach customers credit limits are suspended pending management review Credit limits are established as part of accepting new customers. Sale orders and and approval. Confirm by inquiry with management thatRevenue & Customers credit limits are outstanding receivables are compared to established credit limit before a new order Order Processing V E/O A M P D suspended sales orders are reviewed and approved byReceivables controlled. is processed. Orders in excess of credit limit are stored in a suspense file to be management. Examine samples of sales orders that exceed resolved on a timely basis. customers credit limits and sight evidence of management review and approval. Confirm by inquiry with management and examination of documented roles and responsibilities of a sample of key Appropriate segregation of duties should be maintained. (For example, consider staff and verify that they do not include conflicting segregation of the following functions and duties: order entry, determining credit functions, e.g. customer record maintenance, order limits, inventory custody, shipping, invoicing, returns acceptance, returns approval,Revenue & Duties are adequately processing, shipping, invoicing and cash receiving. Order Processing credit note approval, cash receipts, cash disbursements, bank reconciliations, R E/O M PReceivables segregated. approval of bank reconciliations, A/R accounting/maintenance, and G/L Examine a report of application access privileges of key maintenance functions.) Exceptions noted are investigated and resolved. If staff and verify that they do not have access to privileges management accepts incompatible duties, appropriate mitigating controls exist. that may breach segregation of duties. (This test may need to be performed by SPA/Performance Improvement). Formal authorization by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted Ability to post to the are investigated and resolved. Note: Depending on the system, authorization of userRevenue & accounting records is Order Processing access and determining segregation of duties may require use of a SPA resource. R E/O M P DReceivables restricted to authorized Access may be obtained indirectly - which can only be determined with a system users. access review. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Copyright © 2005 3 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry with management that physical and logical security measures are implemented to prevent Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & unauthorized access to the order entry database. Examine Order Processing accounting records is application. Multiple failures to log on invalidate the user ID and is reported via an R E/O A M PReceivables report of the system access permissions to the order entry prevented and detected. exception report. Management investigates and resolves all items. database and verify that access is restricted to authorised personnel. (This test may need to be performed by SPA). Confirm by observation that shipping documents are generated once the order has been picked and the status of The shipping system automatically generates work orders or inventory “pick” the picking slip is changed to "completed" on the system. documents based on feeds from the sales order system. Edit checks against the sales Examine a sample shipping document and verify that the order system ensure that these documents are complete and accurate. associated picking slips status in the system isRevenue & Distribution and Goods are completely and "completed". Check that the date and time of completion is C A A C V A M P DReceivables Delivery accurately recorded. The work orders or inventory “pick” documents are sequentially numbered and close to the date and time of the shipping document. accounted for. A manual or system check is performed to ensure that the numerical Examine order and shipping documents and verify that they sequence of these documents is maintained. All rejected, suspense, or missing items are sequentially prenumbered. Scan list of order and are researched, corrected and re-entered on a timely basis by appropriate personnel. shipping documents and follow-up missing documents with management to confirm that they are appropriately followed-up. Warehouse employees complete the work order or “pick” the items from inventory Confirm by observation of the picking and shipping process and stage the item(s) for shipping on the shipping dock. Subsequently, the shipping that products and quantities retrieved from storage are manager performs a one-for–one check between the completed work orders or compared to the customer order and/or product requisition inventory “pick” documents and the item(s). Any discrepancies are identified andRevenue & Distribution and Only goods ordered are by the picking staff and reviewed and verified by the resolved. The check occurs again. A V A E/O V M DReceivables Delivery shipped. despatch officer. Once the check is completed and approved, the work order or inventory “pick” Examine a sample of despatch notes for evidence of review document is noted as “completed” in the shipping system which generates the and verification by the despatch officer. appropriate shipping document(s). The warehouse/shipping supervisor/manager periodically verifies shipments (typesRevenue & Distribution and Only goods ordered are and quantities of goods shipped) on a test basis to verify that only ordered goods are V A E/O M DReceivables Delivery shipped. shipped and shipments are despatched promptly. Examine daily report of outstanding orders and confirm All work orders or shipment On a daily basis, a system report of all open work orders or inventory “pick” that orders that remain unshipped for more than xx days areRevenue & Distribution and of goods are input for documents is provided to the shipping department manager. All items are C C A M D reviewed and investigated by the sales and shippingReceivables Delivery processing. investigated and resolved as appropriate. managers. Review the follow-up actions and assess the appropriateness. If client utilizes a warehousing system that automates the inventory picking and All work orders or shipmentRevenue & Distribution and update of the accounting records, assessing the application controls could require of goods are input for C A A C V A PReceivables Delivery the use of Systems and Process Assurance (SPA) if the system is considered processing. complex and if inventory is considered significant. Upon transfer of the shipment to the carrier, the shipping document is noted asRevenue & Distribution and Deliveries are recorded in “released/shipped” in the shipping system. (Note all shipments are FOB shipping A A CO E/O V A PReceivables Delivery the proper period. point.) This notation includes the date and time of release. Correct postings, are made Based on the date and time of shipping, the shipping system appropriately updatesRevenue & Distribution and to cost of sales and inventory/COGS accounting records based on quantities shipped (partial shipment A A CO V A PReceivables Delivery inventory and are recorded of orders is permitted). If a partial order is shipped, the remaining items are held in in the proper period. the shipping system as an open work orders or inventory “pick” documents. Copyright © 2005 4 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Correct postings, are made On a daily basis, total shipments from the shipping system/shipping log areRevenue & Distribution and to cost of sales and reconciled to total invoiced shipments per the billing system. Discrepancies are C A A C CO V M DReceivables Delivery inventory and are recorded investigated and resolved as appropriate and the reconciliation is performed again. in the proper period. Correct postings, are madeRevenue & Distribution and to cost of sales and Feedback such as customer complaints is monitored to assess completeness, C A V A C E/O RO V M DReceivables Delivery inventory and are recorded accuracy and validity of shipments. in the proper period. For systems where shipments are input into a temporary file before sub-ledger Periodic updates for batch updates, batch totals are utilized before processing is complete. Input documentsRevenue & Distribution and processing are complete and are grouped and a numerical total is calculated (i.e. number of documents, monetary C A A C V A DReceivables Delivery accurate. amount, hash totals). These totals are compared to post input/update reports. All out of balance conditions are researched and re-entered on a timely basis. Confirm by enquiry of management and performing a walk- Periodic updates for batch through of an order to verify that the system generatesRevenue & Distribution and The system generates shipping documents directly from sales order records to processing are complete and C A V A C E/O V A M D shipping documents directly from sales order records.Receivables Delivery ensure the accuracy of information recorded on the documents. accurate. Examine the record of batch/control totals reconciliation and verify that differences are appropriately followed-up. Confirm by inquiry with management and examination of documented roles and responsibilities of a sample of key Appropriate segregation of duties should be maintained. (For example, consider staff and verify that they do not include conflicting segregation of the following functions and duties: order entry, determining credit functions, such as billing, accounts receivable, production limits, inventory custody, shipping, invoicing, returns acceptance, returns approval,Revenue & Distribution and Duties are adequately and receiving functions. credit note approval, cash receipts, cash disbursements, bank reconciliations, R E/O M PReceivables Delivery segregated. approval of bank reconciliations, A/R accounting/maintenance, and G/L Examine a report of application access privileges of key maintenance functions.) Exceptions noted are investigated and resolved. If staff and verify that they do not have access to privileges management accepts incompatible duties, appropriate mitigating controls exist. that may breach segregation of duties. (This test may need to be performed by SPA/Performance Improvement). Formal authorization by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted Ability to post to the are investigated and resolved. Note: Depending on the system, authorization of userRevenue & Distribution and accounting records is access and determining segregation of duties may require use of SPA. Access may R E/O M P DReceivables Delivery restricted to authorized be obtained indirectly – which can only be determined with a system access review. users. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Unauthorized access toRevenue & Distribution and shipping and billing Blank shipping authorisation, numerically controlled shipping documents and bills R E/O M PReceivables Delivery documents is prevented and of lading are secured stored in locked cabinets. detected. Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & Distribution and accounting records is application. Multiple failures to log on invalidate the user ID and is reported via an R E/O A M PReceivables Delivery prevented. exception report. Management investigates and resolves all items. Copyright © 2005 5 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to performRevenue & Distribution and Physical unauthorized Security guards are posted at gates, docks and entry points whenever they are open. R E/O M PReceivables Delivery access is preventedRevenue & Distribution and Physical unauthorized Shipping bays and loading docks are closed and locked when goods are not being R E/O M PReceivables Delivery access is prevented shipped or loaded. Upon approved release of a shipment from the warehouse the system automatically produces invoices with the same date. Shipping dates cannot be modified with out Examine log of invoices and verify that invoices are Sales invoice is generated approval by the appropriate levels of management. sequentially prenumbered/numbered by the system.Revenue & for every approved Invoicing C A V C CO E/O V A M P D Confirm by inquiry and examination of follow-up notes thatReceivables shipment and recorded in Invoices are sequentially pre-numbered and accounted for. A manual or system missing and duplicate invoices are investigated and the proper period. check is performed to ensure documents are not missing or duplicated or fall outside followed-up. of a specified range of numbers. All rejected, suspense, or missing items are researched, corrected and re-entered on a timely basis. Sales personnel reconcile control totals of the invoices generated for the day with the total shipments per the shipping system. A manual or system check isRevenue & Invoices generated represent Invoicing performed to ensure data is not duplicated or falls outside a specified range of C A C E/O V A M DReceivables the actual goods shipped. numbers (check can be preventive or detective) . All rejected, suspense or missing items are researched, corrected and re-entered on a timely basis. Confirm by inquiry with management that the invoicing system is integrated with related information systems. System edits exist to validate invoice data input (for example, customer name and Observe the creation of an invoice and verify that the Price, amount, and other number, pricing, amounts and other information) against approved standing data andRevenue & system uses details from correct and authorised files to Invoicing information on the invoice the sales order system. Invalid data is rejected for re-entry or stored in a suspense C A A C V A PReceivables record transaction information, such as quantities, product are correct. file where it is researched, corrected and re-entered on a timely basis to ensure codes, transaction dates, customer order details, and prices, completeness. and that it performs validation checks to ensure correctness of input data. Price, amount, and otherRevenue & The invoicing system automatically applies applicable sales or goods and services Invoicing information on the invoice A A A PReceivables taxes. are correct. Managements approval is required for invoices over specified amounts or unusual Price, amount, and other terms or discounts and allowances in excess of predefined limits. Invoicing Examine sample of invoices over specified amounts or withRevenue & Invoicing information on the invoice personnel examine the sales order for evidence of appropriate approval before input. V E/O A M P unusual prices, terms, and discounts, and verify that there isReceivables are correct. The lack of approval creates a suspense file that is reviewed by management for evidence of management review and approval. clearance on a regular basis. Price, amount, and otherRevenue & Documentation to support the customers tax-exempt status, in instances where taxes Invoicing information on the invoice V A M PReceivables are not billed are obtained and filed. are correct. Price, amount, and otherRevenue & Exception reports for invoices over a specified amount and invoices containing Invoicing information on the invoice A V A E/O V M DReceivables unusual prices, terms, and discounts are prepared and reviewed daily. are correct. A manual or system check is performed to ensure invoice numbers are notRevenue & Duplicate recording of duplicated or fall outside a specified range of numbers (check can be preventive or Invoicing C A A C V A M DReceivables invoices is prevented. detective ). All rejected, suspense or missing items are researched, corrected and re- entered on a timely basis. Copyright © 2005 6 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry with management that the invoicing system automatically generates invoices as soon as the sales The invoicing system automatically generates invoices as soon as the sales order has order has been shipped or the service has been performed.Revenue & Duplicate recording of been shipped or the service has been performed. Invoices are sequentially Examine log of invoices and verify that invoices are Invoicing C A A C V A PReceivables invoices is prevented. prenumbered / numbered by the system. Missing and duplicate invoices are reported sequentially prenumbered/numbered by the system. and investigated. Confirm by inquiry and examination of follow-up notes that missing and duplicate invoices are investigated and followed-up. For invoices that are input into a temporary file before sub-ledger updates - Batch totals are utilized before processing is complete. Input documents are grouped and a numerical total is calculated (i.e. number of documents, dollar amount, hash totals). These totals are compared to post input/update reports. All out of balance conditions are researched and re-entered on a timely basis. Periodic updates for batchRevenue & Invoice information that is transmitted via EDI can be verified for completeness and Invoicing processing are complete and C A A C V A M DReceivables accuracy by setting up specific EDI transaction codes. If invoices that are processed accurate. via EDI are considered significant, then a separate review of EDI controls should be performed by SPA. Likewise, if invoices that are processed electronically via a public Website or Extranet are considered significant, then a review of controls should be performed by SPA. The invoicing system automatically generates reports of shipments that remain Examine sample of reports of unbilled shipments and verify Periodic updates for batchRevenue & unbilled for an unreasonable length of time. Management review the unbilled that management reviews shipments that remain Invoicing processing are complete and C C A DReceivables shipments report and follow-up outstanding items with the distribution and sales uninvoiced. Assess the reasonableness of the explanations accurate. departments. for long outstanding items. Periodic updates for batchRevenue & Amounts invoiced are reconciled daily to amounts debited into accounts receivable Invoicing processing are complete and C A A C V M DReceivables sub-ledger and credited into the general ledger. accurate. Confirm by inquiry with management that the invoicing system automatically posts sales transactions into the sales Correct postings, are made and receivable ledgers, and that discrepancies between Upon approved release of a shipment from the warehouse the system automaticallyRevenue & to sales and receivables and amounts posted to sales and accounts receivables are Invoicing produces invoices. The invoicing system then appropriately updates Sale/receivable A A V A PReceivables are recorded in the proper reported and reconciled by finance personnel. Examine accounting records. period. sample discrepancies reports and verify that the discrepancies are reconciled and explained. Assess the reasonableness of the explanations. Confirm by inquiry with management and examination of documented roles and responsibilities of a sample of key Appropriate segregation of duties should be maintained. (For example, consider staff and verify that they do not include conflicting segregation of the following functions and duties: order entry, determining credit functions, such as shipping and accounts receivable limits, inventory custody, shipping, invoicing, returns acceptance, returns approval,Revenue & Duties are adequately functions. Invoicing credit note approval, cash receipts, cash disbursements, bank reconciliations, R E/O M PReceivables segregated. approval of bank reconciliations, A/R accounting/maintenance, and G/L Examine a report of application access privileges of key maintenance functions.) Exceptions noted are investigated and resolved. If staff and verify that they do not have access to privileges management accepts incompatible duties, appropriate mitigating controls exist. that may breach segregation of duties. (This test may need to be performed by SPA/Performance Improvement). Copyright © 2005 7 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Formal approval by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted are Ability to post to the investigated and resolved. Note: Depending on the system, authorization of userRevenue & accounting records is Invoicing access and determining segregation of duties may require use of SPA. Access may R E/O M P DReceivables restricted to authorized be obtained indirectly – which can only be determined with a system access review. users. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Confirm by inquiry with management that access to invoicing information is restricted to authorised staff. Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & Examine report of the system access permissions to Invoicing accounting records is application. Multiple failures to log on invalidate the user ID and is reported via an R E/O A M PReceivables invoicing information and verify that access is restricted to prevented and detected. exception report. Management investigates and resolves all items. authorised personnel. (This test may need to be performed by SPA). The company directs all cash receipts to its lockbox(es) . A summary report and Cash receipts are accurately electronic files of receipts are provided to the company on a daily basis. TotalRevenue & Cash Receipting recorded and in the proper amount of cash receipts from the summary report is recorded as cash and unapplied C A A C V A M PReceivables period. accounts receivable. The electronic files are provided to the accounts receivable clerk for application to customer accounts. Cash receipts are accurately Cash receipts are recorded upon receipt and matched to customers accounts andRevenue & Cash Receipting recorded and in the proper invoices via remittance advices. Prenumbered receipts are printed and issued to A V A E/O RO V M PReceivables period. payers on receipt of payments. Cash receipts are accuratelyRevenue & Cash Receipting recorded and in the proper Cash receipts without remittances are separately followed-up by management. A V A E/O RO V M DReceivables period. Confirm by enquiry of management that cash receipts are Cash receipts are accurately Cash receipts are deposited daily. Total cash deposits are matched to cash receipts deposited daily. Examine cash deposit slips and sightRevenue & Cash Receipting recorded and in the proper as part of the day-end process. Unmatched cash receipts are reported and C A A C V A M D evidence that total cash deposited is matched to total cashReceivables period. investigated on the next working day. received. Follow up on any discrepancies and verify that there is adequate investigation and explanation. Cash receipts are accurately Bank statements are reconciled to cash accounts. Discrepancies are researched,Revenue & Cash Receipting recorded and in the proper corrected, and adjusted as necessary on a timely basis. The reconciliations are C A V A C CO E/O V M DReceivables period. reviewed and approved by appropriate management. Cash receipts are accuratelyRevenue & Accounts receivable balances are compared to budgeted amounts, prior period Cash Receipting recorded and in the proper C A V A C V M DReceivables amounts and industry statistics in monthly management accounts. period. The electronic file of receipts into the lockbox interfaces with the accounts Cash receipts relate to salesRevenue & receivable sub-ledger and applies cash receipts to the customer accounts based on a Cash Receipting and are recorded against the C A V A C E/O V A M P DReceivables matching of customer name, customer number, invoice number etc. Unmatched cash correct customer account. receipts are investigated and manually applied. Cash receipts relate to salesRevenue & Cash receipts are applied to invoices specified in the remittance advices. If there is Cash Receipting and are recorded against the C A A C V M PReceivables no remittance advice, cash receipts are applied to the oldest invoices first. correct customer account. Copyright © 2005 8 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Examine selected monthly accounts receivable ageing reports and confirm by inquiry with management that the Cash receipts relate to sales Detailed accounts receivable aging by customer is reviewed monthly and any longRevenue & reports are reviewed. Identify unusual items, including long Cash Receipting and are recorded against the outstanding balances or other unusual balances (i.e. credit balances) are C A A C V M DReceivables outstanding and unusually large items. Examine evidence correct customer account. investigated. of follow-up by the management and verify the appropriateness of explanations. Cash posting personnel reconcile control totals of the cash receipts received for theRevenue & All cash receipts are input day (from lockbox files/reports) with the total of cash receipts applied to customer Cash Receipting C A A C V A M DReceivables for processing. accounts. All rejected, suspense or missing items are researched, corrected and re- entered on a timely basis. Confirm by enquiry of management and tracing one Cash receipts are processed and payments are automatically posted to customer transaction through the system from cash receipt to postingRevenue & All cash receipts are input Cash Receipting accounts and the general ledger immediately upon entry into the cash receiving C A A C V A P into customer accounts and the general ledger that cashReceivables for processing. application. receipts are automatically applied to customer accounts and the appropriate general ledger accounts. For systems where application of cash is input into a temporary file before sub- ledger updates, batch totals are utilized before processing is complete. Input documents are grouped and a numerical total is calculated (i.e. number of documents, dollar amount, hash totals). These totals are compared to post input/update reports. All out of balance conditions are researched and re-entered on a timely basis. Periodic updates for batchRevenue & Cash Receipting processing are complete and Automated Clearing House (ACH) information that is transmitted via EDI can be C A A C V A PReceivables accurate. verified for completeness and accuracy by setting up specific EDI transaction codes. If invoices that are processed via EDI are considered significant, then a separate review of EDI controls should be performed by SPA. Likewise, if ACH information that is processed electronically via a public Website or Extranet is considered significant, then a review of controls should be performed by SPA. Examine reports of monthly reconciliations between the Periodic updates for batch The accounts receivable sub-ledger is reconciled to the general ledger monthly. accounts receivable sub-ledger and the general ledger.Revenue & Cash Receipting processing are complete and Reconciling items are investigated and reviewed by the Finance Manager and C A A C V A M D Verify by examination of documentary evidence thatReceivables accurate. referred to the Sales Manager as appropriate. reconciling items are investigated, reviewed, and approved as appropriate. Confirm by tracing one transaction through the system that Correct postings are made The accounting system automatically creates journal entries to summarise the accounting system automatically creates journal entriesRevenue & to cash and accounts Cash Receipting transactions in the accounts receivable sub-ledger and updates these entries into the C A V A C E/O RO V A M P to summarise transactions in the accounts receivable sub-Receivables receivable in the general general ledger daily. ledger and updates these entries into the general ledger ledger daily. (This may need to be performed by SPA) Correct postings are madeRevenue & to cash and accounts Bank statements are reconciled to general ledger accounts daily/weekly. Examine bank reconciliations and verify that reconciling Cash Receipting C A V A C E/O RO V M DReceivables receivable in the general Reconciling items are investigated and reviewed by management. items are investigated and reviewed by management. ledger Correct postings are made Confirm by enquiry of management and examination of Monthly statements are sent to customers detailing their account balances andRevenue & to cash and accounts monthly customer statements. Examine statements with Cash Receipting transactions for the month. Disputes and reconciling items are recorded and reported C A V A C E/O RO V A M DReceivables receivable in the general reconciling items and verify that there is appropriate to appropriate management for follow-up. ledger management follow-up. Copyright © 2005 9 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry with management and examination of documented roles and responsibilities, and application Appropriate segregation of duties should be maintained. (For example, consider access privileges of a sample of key staff and verify that: segregation of the following functions and duties: order entry, determining credit .. Employees with access to cash are restricted from having limits, inventory custody, shipping, invoicing, returns acceptance, returns approval,Revenue & Duties are adequately access to billing and account information Cash Receipting credit note approval, cash receipts, cash disbursements, bank reconciliations, R E/O M PReceivables segregated. .. Employees responsible for receipt and deposits of cash approval of bank reconciliations, A/R accounting/maintenance, and G/L and cheques are prevented from entering postings to maintenance functions.) Exceptions noted are investigated and resolved. If ledgers, authorising write-offs or credit memos and management accepts incompatible duties, appropriate mitigating controls exist. generating invoices. (This test may need to be performed by SPA). Formal authorization by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted Ability to post to the are investigated and resolved. Note: Depending on the system, authorization of userRevenue & accounting records is Cash Receipting access and determining segregation of duties may require use of SPA. Access may R E/O M P DReceivables restricted to authorized be obtained indirectly – which can only be determined with a system access review. users. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & Cash Receipting accounting records is application. Multiple failures to log on invalidate the user ID and is reported via an R E/O A M PReceivables prevented and detected. exception report. Management investigates and resolves all items. Physical access to cash receipts is limited to the cash receipts personnel (lockedRevenue & Cash receipts are protected drawers/safes)prior to posting to the system. Incompatible functions and related Cash Receipting V R E/O M PReceivables before they are deposited. duties are subject to a regular review by management. Discrepancies and exceptions noted are promptly investigated. Confirm by inquiry with management and observation of cash receipting process that cash receipts are physically Cash receipts are physically protected by: protected by: .. use of prenumbered receipts - use of prenumbered receiptsRevenue & Cash receipts are protected .. restrictive endorsements on receipts issued Cash Receipting - restrictive endorsements on receipts issued V R E/O M PReceivables before they are deposited. .. daily deposits of cash - daily deposits of cash .. reconciliation of book receipts with prenumbered - reconciliation of book receipts with prenumbered deposits deposits - comparison of cash records with deposit slips and bank statements. .. comparison of cash records with deposit slips and bank statements. Adjustments and Approved adjustments are A one-to-one check of adjustments input into the system via a comparison betweenRevenue & Ledger input for processing post input/update reports to the adjustment source documents for completeness and C A A C V M PReceivables Maintenance completely and accurately. accuracy. Where batch totals are utilized, input documents are grouped and a numerical total Adjustments and Approved adjustments areRevenue & is calculated (i.e. number of documents, monetary amount, hash totals). These Ledger input for processing C A A C V A M DReceivables totals are compared to post input/update reports. All out of balance conditions are Maintenance completely and accurately. researched and re-entered on a timely basis. Copyright © 2005 10 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Examine file of credit memos and verify that credit memos Adjustments and Approved adjustments areRevenue & Credit memos are sequentially prenumbered and missing credit memos are are sequentially prenumbered. Identify gaps and/or Ledger input for processing C C M PReceivables investigated and reported to management. duplicates and verify that they are investigated and reported Maintenance completely and accurately. to management. CAAT may be used to perform this task. Confirm by examination of provisions and write-offs that Adjustments and Approved adjustments areRevenue & Provision amounts and write-offs are recorded and approved by appropriate they are approved by appropriate management. Follow up Ledger input for processing A V A E/O RO V M PReceivables management based on their delegated authority. on any provision or write-offs that fall outside delegated Maintenance completely and accurately. authorities and ensure that explanations are appropriate. Examine daily accounts receivables adjustments reports and A daily accounts receivables adjustments report is printed and reviewed by Adjustments and Approved adjustments are verify that they are reviewed against supportingRevenue & management on a sample basis against supporting documentation. Adjustments Ledger input for processing C A V A C E/O RO V M D documentation by management. Examine evidence thatReceivables without appropriate supporting documents are investigated and corrected as Maintenance completely and accurately. adjustments without supporting documents are investigated appropriate. and verify appropriateness of results of investigation. Postings to the revenue and Examine monthly reconciliations between accounts Adjustments andRevenue & receivable accounts in the Sub-ledgers are reconciled to the general ledger on a monthly basis. Reconciling receivable sub-ledgers and the general ledger. Assess Ledger C A A C V M DReceivables general ledger are complete items are investigated and resolved on a timely manner explanations for reconciling items to verify their Maintenance and accurate. appropriateness. Postings to the revenue and Confirm by observation that the accounting system Adjustments and The accounting system automatically identifies the customers account numberRevenue & receivable accounts in the automatically identifies the customers account number Ledger when the credit memo is created. Customers and claim details are verified against A A V A M DReceivables general ledger are complete when the credit memo is created. Verify that the customers Maintenance the credit claim upon entry. and accurate. and claim details match the credit claim memo. Postings to the revenue and Examine adjustments to customers accounts and verify that Adjustments andRevenue & receivable accounts in the The accounting system automatically posts adjustments to customers accounts once they are supported by authorised credit memos. CAAT may Ledger A V A E/O RO V A DReceivables general ledger are complete the credit memo is authorized by the accounts manager. be used to verify the match of credit memos issued and Maintenance and accurate. adjusments booked. Adjustments and Adjustment is made to the A one-to-one check of adjustments input into the system via a comparison betweenRevenue & Ledger correct accounts and in the post input/update reports to the adjustment source data for accuracy of key data C A A C CO V M DReceivables Maintenance proper period. fields including date. Confirm by inquiry with management that credit memos are automatically processed upon authorisation. To validate Credit memos are automatically processed upon authorizations. Credit memos that this inquiry, you can try to authorise a credit memo with the Adjustments and Adjustment is made to theRevenue & have not been authorised are reported in the Outstanding Credit Memo report before help of an employee that should not have this authorisation Ledger correct accounts and in the C A A C CO V A DReceivables period end processing. Open credit memos are reviewed by management as part of right/profile. Examine the Outstanding Credit Memo report Maintenance proper period. the period end procedures. and verify that open credit memos are reviewed by management before the completion of period end procedures. Adjustments and The appropriate level of management must approve all adjustments. Management’sRevenue & Ledger Adjustments are approved. review includes an examination of source documentation. Discrepancies are A V E/O V M PReceivables Maintenance resolved. Copyright © 2005 11 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry with management and examination of Segregation of duties is maintained. (For example, consider segregation of the documented roles and responsibilities of a sample of key following functions and duties: order entry, determining credit limits, inventory staff and verify that they do not include conflicting Adjustments and custody, shipping, invoicing, returns acceptance, returns approval, credit note functions such as customer maintenance, sales orderRevenue & Duties are adequately Ledger approval, cash receipts, cash disbursements, bank reconciliations, approval of bank R E/O M P processing, invoicing, distribution or cash collection.Receivables segregated. Maintenance reconciliations, A/R accounting/maintenance, and G/L maintenance functions.) Examine a report of application access privileges of key Exceptions noted are investigated and resolved. If management accepts staff and verify that they do not have access to privileges incompatible duties, appropriate mitigating controls exist. that may breach segregation of duties. (This test may need to be performed by SPA/Performance Improvement). Formal authorization by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted Ability to post to the Adjustments and are investigated and resolved. Note: Depending on the system, authorization of userRevenue & accounting records is Ledger access and determining segregation of duties may require use of SPA. Access may V R E/O M P DReceivables restricted to authorized Maintenance be obtained indirectly - which can only be determined with a system access review. users. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Adjustments and Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & Ledger accounting records is application. Multiple failures to log on invalidate the user ID and are reported via R E/O A M PReceivables Maintenance prevented and detected. an exception report. Management investigates and resolves all items. Approved changes are inputRevenue & Standing Data An appropriate official approves changes made to standing data, prior to input. Each for processing completely V E/O M PReceivables Maintenance change must be supported by sufficient documentation. and accurately. Examine records of changes and additions to customer Approved changes are input A one-to-one check of changes input into the system via a comparison between post standing data and verify that they are supported byRevenue & Standing Data for processing completely input/update reports to the change source documents for completeness and accuracy. C A A C V M D appropriate documentation. Examine documentation ofReceivables Maintenance and accurately. Discrepancies are resolved and the re-entered data is subject to the same control. changes and verify that they are reviewed and approved by appropriate management before the changes are processed. For changes in certain types of standing data and /or changes outside certain Approved changes are inputRevenue & Standing Data parameters the system produces a report of these changes and is forwarded to for processing completely A V A E/O V A M DReceivables Maintenance management for their review. Acceptance of these changes by the system is and accurately. dependent upon management review of supporting documentation and approval. Examine minutes of pricing committee meetings and verify Approved changes are input Sales prices are set by the pricing committee. Price changes are documented. PriceRevenue & Standing Data that price changes are approved and documented. Examine for processing completely changes are reported after input, and are reviewed by management to verify A V A E/O V M PReceivables Maintenance reports of price changes and verify that they are reviewed and accurately. accuracy of input. by management to verify accuracy of input. Select a sample of new customer creation forms and verify Approved changes are inputRevenue & Standing Data Credit checks are performed for all new customers. Checks include reviews of that credit checks have been performed. Examine the credit for processing completely V E/O M PReceivables Maintenance credit bureau reports. check documents to very that they are obtained from and accurately. reputable sources. Approved changes are input To ensure that data remains accurate, the standing data owners complete a regularRevenue & Standing Data for processing completely review. Any changes noted by the owners are entered via the standard standing data A A V M DReceivables Maintenance and accurately. change process. Copyright © 2005 12 of 13
  • Notes: *1. To rely on Automated controls, general computer controls must be tested. *2. Prior to evaluating and validating client controls surrounding restricted access, review PwC Audit and related Masterdata steps with respect to fraud. Information Contribution to financial statement Automated or Preventiv Processing assertions Manual e or Objectives control *1 Detective Process Sub-process Control Objectives Example Control Activities C A V R*2 A C CO E/O PD RO V A M P D Suggestion of test to perform Confirm by inquiry with management that changes to customer and price master files are reported and reviewed Where batch totals are utilized, input documents are grouped and a numerical total Periodic updates to standing against supporting documents to ensure completeness andRevenue & Standing Data is calculated (i.e. number of documents, monetary amount, hash totals). These data via batch processing C A A C V A M D accuracy of changes. Examine a sample of reports ofReceivables Maintenance totals are compared to post input/update reports. All out of balance conditions are are complete and accurate. changes to customer and price master files and match the researched and re-entered on a timely basis. changes to supporting documents to verify the completeness and accuracy of the changes. Confirm by inquiry with management and examination of documented roles and responsibilities of a sample of key staff and verify that they do not include conflicting functions such as sales entry, creating credit memos, etc. Segregation of duties is maintained between the update of standing data and the Examine a report of application access privileges of keyRevenue & Standing Data Duties are adequately maintenance of financial records (i.e. posting or approval of adjustments, R E/O M P staff and verify that they do not have access to privilegesReceivables Maintenance segregated. reconciliations, etc). Exceptions noted are investigated and resolved. If management that may breach segregation of duties. (This test may need accepts incompatible duties, appropriate mitigating controls exist. to be performed by SPA). Review log of activities performed by key staff to verify that segregation of duties have not been breached. (This review may be performed by SPA). Formal authorization by application owner is required for access to specific accounting records. Management reviews access rights periodically to ensure only authorized individuals have access and for segregation of duties. Exceptions noted Ability to post to the are investigated and resolved. Note: Depending on the system, authorization of userRevenue & Standing Data accounting records is access and determining segregation of duties may require use of SPA. Access may V R E/O M P DReceivables Maintenance restricted to authorized be obtained indirectly – which can only be determined with a system access review. users. Also, observing an approved access form does not ensure that other incompatible access for the person exists. Only by reviewing all access for a user is it possible to determine if segregation of duties is maintained. Examine a report of application access privileges of key Unauthorized access to the Access controls such as user IDs and passwords are utilized and specific to eachRevenue & Standing Data staff and match this against the list of employees to verify accounting records is application. Multiple failures to log on invalidate the user ID and is reported via an R E/O A M PReceivables Maintenance that only authorised staff are able to update master files. prevented and detected. exception report. Management investigates and resolves all items. (This test may need to be performed by SPA). Copyright © 2005 13 of 13