Your SlideShare is downloading. ×
0
BDO ConsultingSegregationof DutiesChecklist
August 2009BDO Consulting’s Fraud Prevention practice is pleased to present the 2009 Segregation of Duties Checklist. We h...
Table of ContentsCash Receipts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
Business Cycle     Cash Receipts      Process                     Control Considerations                                  ...
Cash Receipts continued       Process                       Control Considerations                                      Re...
Business Cycle     Procurement      Process                      Control Considerations                                   ...
Procurement continued       Process                       Control Considerations                                     Recom...
Procurement continued      Process                     Control Considerations                                     Recommen...
Business Cycle     Cash Disbursements       Process                       Control Considerations                          ...
Cash Disbursements continued      Process                      Control Considerations                                     ...
Cash Disbursements continued       Process                       Control Considerations                                   ...
Cash Disbursements continued      Process                      Control Considerations                                     ...
Business Cycle     Payroll       Process                       Control Considerations                                     ...
Payroll continued      Process                       Control Considerations                                         Recomm...
Payroll continued       Process                       Control Considerations                                    Recommenda...
Business Cycle     Inventory      Process                      Control Considerations                                     ...
Inventory continued       Process                       Control Considerations                                        Reco...
Inventory continued      Process                     Control Considerations                                     Recommenda...
Business Cycle     Fixed Assets       Process                       Control Considerations                                ...
Fixed Assets continued      Process                      Control Considerations                                      Recom...
Business Cycle     Sales         Process                     Control Considerations                                     Re...
Sales continued        Process                    Control Considerations                                        Recommenda...
Sales continued       Process                        Control Considerations                                         Recomm...
Sales continued      Process                      Control Considerations                                      Recommendati...
Business Cycle     Treasury and     Investments       Process                       Control Considerations                ...
Treasury and Investments continued      Process                      Control Considerations                               ...
Business Cycle     Loans       Process                       Control Considerations                                       ...
Loans continued      Process                      Control Considerations                                        Recommenda...
Seg dutieschecklist
Seg dutieschecklist
Seg dutieschecklist
Seg dutieschecklist
Seg dutieschecklist
Seg dutieschecklist
Upcoming SlideShare
Loading in...5
×

Seg dutieschecklist

1,004

Published on

0 Comments
1 Like
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,004
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
82
Comments
0
Likes
1
Embeds 0
No embeds

No notes for slide

Transcript of "Seg dutieschecklist"

  1. 1. BDO ConsultingSegregationof DutiesChecklist
  2. 2. August 2009BDO Consulting’s Fraud Prevention practice is pleased to present the 2009 Segregation of Duties Checklist. We have developed this tool toassist organizations in identifying fraud risks due to a lack of segregation of duties.Segregation of duties is one of the key concepts of internal controls. It is also one of the most effective internal controls in combating employee fraud.Segregation of duties contributes to an organization’s system of checks and balances. The concept of segregation of duties is to separate the followingresponsibilities in each business process: • Custody of assets • Record keeping • Authorization • ReconciliationIdeally, no individual employee should handle more than one of the above-noted functions in a process. When an organization separates these functionsamong its employees, it has implemented a strong internal control, which may deter and prevent employee fraud.When duties cannot be segregated, compensating controls should be considered. Compensating controls can be preventative, detective or monitoringcontrols that are executed by an independent, supervisory-level employee who does not have custody, record-keeping, authorization or reconciliationresponsibilities for the process. In the checklist below, we have provided examples of several such compensating controls.We appreciate this opportunity to provide guidance on segregating duties and recommended practices. We welcome the opportunity to discuss theseconcepts and our other fraud prevention services with your organization.Glenn Pomerantz Nidhi RaoPartner DirectorBDO Consulting BDO Consultinggpomerantz@bdo.com nrao@bdo.com212-885-8379 212-885-8008NotesWhen evaluating segregation of duties, an employees user access and ability to execute transactions in the system should also be considered. This checklist does not, however, provide segregation of duties for all Information Technology orsystem access controls. User access controls are only mentioned for processes and responsibilities included in the checklist.The checklist is intended solely for illustrative purposes and is not intended to constitute professional advice for any particular organization.The checklist may not be appropriate for all organizations. Please discuss this checklist with professionaladvisors or other professionals who are familiar with segregation of duties within your organization prior to implementing any of the information set forth herein.
  3. 3. Table of ContentsCash Receipts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Procurement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Cash Disbursements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Payroll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Inventory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Fixed Assets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Sales. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18Treasury and Investments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Loans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Financial Statement Close Process. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Our Investigations and Fraud Prevention Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30About BDO Consulting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31About FERF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
  4. 4. Business Cycle Cash Receipts Process Control Considerations Recommendation Examples of Compensating ControlCustomer Does the employee responsible for opening customer The employee who is responsible for the receipt of To enhance controls over the cash receipt process, payments/remittances also perform any of the cash should not have access to record or authorize the following compensating controls can be utilized:Payments following duties: transactions in the accounts receivable ledger and • A lockbox system should be implemented toReceived • Record payments customer accounts. In addition, the person receiving receive customer payments. • Record or authorize write-offs or adjustments to the cash or preparing the deposit should not be • Two employees should receive and open customer customer accounts in the accounts receivable responsible for recording cash transactions or payments, create a listing of customer payments ledger preparing the bank reconciliation. and prepare the deposit. • Reconcile the bank account(s)Customer Does the employee responsible for preparing the The employee preparing the deposit should not be To enhance controls over the cash receipt process, deposit also perform any of the following duties: responsible for recording cash transactions in the the following compensating controls can be utilized:Payments • Record payments accounts receivable ledger and customer accounts. In • A lockbox system should be implemented toReceived • Record or authorize write-offs or adjustments to addition, the bank reconciliation should be prepared receive customer payments. customer accounts in the accounts receivable by an employee who is not involved in cash receipt or • Two employees should receive and open customer ledger cash disbursement activities. payments, create a listing of customer payments • Reconcile the bank account(s) and prepare deposits. • Daily reconciliations of cash receipts to bank deposits, including lockbox receipts, should be performed. • An employee who is independent of the cash receipts and deposit process should perform a detailed review of the accounts receivable aging or trial balance. • Internal audit or an employee who is independent of the cash receipts process should periodically confirm accounts receivable balances with customers.Financial Executives Research Foundation (FERF) 1
  5. 5. Cash Receipts continued Process Control Considerations Recommendation Examples of Compensating Control Customer Is the employee responsible for initiating adjustments Adjustments and write-offs to customer accounts At month-end, an accounts receivable ledger system (e.g., sales staff requests a credit) to customer should be reviewed and approved by an employee report of adjustments or write-offs recorded to Adjustments accounts able to both record as well as authorize the who does not have responsibility for recording these customer accounts is generated for review and adjustments to the customer account? transactions. In addition, this employee should not be approval by a supervisory-level employee who does responsible for preparing the reconciliation of the not have access to record these transactions. accounts receivable subsidiary ledger to the general ledger account balance. Customer Does the employee responsible for initiating and/or Employees responsible for recording adjustments to recording adjustments to customer accounts also customer accounts should not have access to Adjustments perform any of the following duties: customer payments or prepare the deposit. • Receive customer payments • Prepare the deposits Bank Does the employee responsible for preparing bank The preparer of bank reconciliations should not have To enhance controls over the bank reconciliation reconciliations also have any of the following cash the responsibility for recording cash receipt or process, the following compensating controls can be Reconciliations receipt or disbursement responsibilities: disbursement transactions. In addition, bank utilized: • Receive cash receipts reconciliations should be reviewed and approved by • Perform a review of cash receipt and cash • Prepare cash deposits an employee other than the preparer. As a best disbursement entries in the general ledger. • Generate or print checks practice, the reviewer should be in a supervisory-level • Perform a regular analytical review of the cash • Execute or authorize wire transfers position. receipts and disbursements entries. • Sign checks • Compare cash receipts and disbursement amounts • Have access to blank check stock to budgets. • Review and approve the bank reconciliationBDO Consulting Segregation of Duties Checklist 2
  6. 6. Business Cycle Procurement Process Control Considerations Recommendation Examples of Compensating ControlPurchasing Does the employee initiating the purchase requisition Purchase requisitions should be reviewed and A supervisory-level employee independent of the also have the authority to approve the purchase approved by someone other than the employee purchasing function reviews a report of total requisition? initiating the purchase requisitions. purchases as well as purchases over a predetermined threshold amount from new vendors. This report NOTE: Purchase requisitions are an internal purchase should be generated outside of the purchasing request that is sent to the purchasing department. function (e.g., payments processed through the cash Purchase orders are documents sent to vendors by disbursement system). the purchasing departments. Generally, large companies utilize both purchase requisitions and purchase orders. In the majority of small to midsize companies, only purchase orders are used.Purchasing Are the employees responsible for initiating a Purchase orders should only be generated by purchase requisition also responsible for initiating the employees in the purchasing department. These purchase order presented to the vendor? employees should not have access to generate or authorize purchase requisitions.Purchasing Are the employees responsible for initiating the Employees responsible for authorizing purchase A system report of all purchase orders issued to purchase order also responsible for reviewing and orders should not have access to initiate these vendors should be generated and reviewed by a authorizing the purchase order? purchase orders. supervisory-level employee who is not involved in initiating purchase orders with vendors. NOTE: For large companies, this review can be limited to analytical review of purchases by vendor, product and unit cost of the product.Financial Executives Research Foundation (FERF) 3
  7. 7. Procurement continued Process Control Considerations Recommendation Examples of Compensating Control Purchasing Do the same employees who are responsible for Employees involved in the purchasing function should A system report of purchase orders issued to initiating or approving a purchase order also perform not have record-keeping responsibilities in the cash vendors should be generated and reviewed by a any of the following duties: disbursement system. Specifically, these employees supervisory-level employee who is not involved in • Modify the Vendor Master File should not be able to modify the Vendor Master File, initiating purchase orders with vendors. • Record vendor invoices in the cash disbursement record vendor invoices, receive goods, reconcile or system write-off inventory or obtain custody of inventory • Receive vendor goods physically or in the system either directly or by influencing the shipment of • Modify inventory records inventory. • Reconcile inventory records NOTE: Employees in the purchasing department should not be involved in the receiving of goods in the system. Since these employees are responsible for negotiating the vendor payment terms and placing the order with the vendor, they should not be responsible for documenting the number of goods actually received by the vendor. Purchasing Are the same employees responsible for approving Employees involved in the purchasing process should the purchase order also responsible for approving the not be responsible for approving vendor invoices. vendor invoice for payment? Instead, this approval should be restricted to the employee who initiated and authorized the purchase requisition or a person independent of the purchasing function. Receiving Do employees involved in receiving the goods from Employees who are responsible for the receipt of An employee independent of the purchasing process the vendor also perform any of the following duties: goods from vendors should not be involved in the checks the bills of lading to the receiving reports to • Involved in the purchasing process (authorization purchasing or cash disbursement process. inventory accounting. or record-keeping responsibilities) • Modify the Vendor Master File or any relevant record-keeping function • Record invoices • Record returnsBDO Consulting Segregation of Duties Checklist 4
  8. 8. Procurement continued Process Control Considerations Recommendation Examples of Compensating ControlCash Does the employee performing the three-way match Employees involved in recording vendor invoices in of purchase order, receiving document, and vendor the cash disbursement system should perform theDisbursement invoice also perform any of the following duties: three-way match of purchase order, receivingProcessing • Involved in the purchasing or receiving process document and vendor invoice. • Modify the Vendor Master File • Has record-keeping responsibilities for inventory, purchases, payables or returnsFinancial Executives Research Foundation (FERF) 5
  9. 9. Business Cycle Cash Disbursements Process Control Considerations Recommendation Examples of Compensating Control Vendor Set-up Does the employee responsible for Vendor Master The employee with responsibility for modifying the An employee independent of the accounts payable File maintenance (i.e., adding, deleting or modifying Vendor Master File should not be responsible for and disbursement process performs a review of a vendor accounts) also perform any of the following entering vendor invoices in the cash disbursement systems report outlining the Vendor Master File duties: system or have the ability to generate and authorize changes. • Record vendor invoices cash disbursements. • Approve vendor invoices NOTE: In some cash disbursement systems, the • Print checks functions of recording vendor invoices and printing • Sign checks checks cannot be segregated. In these instances, steps • Execute wire transfers should be taken to ensure that the employee • Authorize wire transfers responsible for authorizing cash disbursement payments is not involved in any other cash disbursement process. Vendor Set-up Is the vendor change report that outlines all changes The Vendor Master File change report should be made to the Vendor Master File (e.g., changes to reviewed by a supervisory-level employee who does vendor addresses or names and additions to the not have access or responsibility to perform these Vendor Master File) for a specified period of time functions. reviewed and approved by someone who does not have responsibility for modifying the Vendor Master File? Cash Do the employees responsible for approving invoices Employees responsible for authorizing vendor invoices To enhance controls over the cash disbursement and payments also have the ability to record payables? and payments should not have the responsibility for process, the following compensating controls can be Disbursements recording invoices in the cash disbursement system. utilized: • Perform a regular analytical review of the cash disbursements. • Require cash disbursement checks to have dual signatures.BDO Consulting Segregation of Duties Checklist 6
  10. 10. Cash Disbursements continued Process Control Considerations Recommendation Examples of Compensating ControlCash Do the employees responsible for recording vendor Employees responsible for printing vendor checks A positive pay system is implemented. An employee invoices have the ability to: should not have responsibility for recording who is not involved in the cash disbursement processDisbursements • Print checks disbursements. In addition, employees responsible for creates an electronic file of the printed checks from • Sign checks distribution of vendor checks should not be involved the system and forwards the file to the bank. This • Access blank check stock in the cash disbursement process. Under best employee should then receive notification of all • Execute wire transfers practices, this task should be assigned to an discrepancies between the checks presented at the • Distribute vendor checks administrative person such as the receptionist. bank and checks listed in the positive pay file. NOTE: In some cash disbursement systems, the functions of recording vendor invoices and printing vendor checks cannot be segregated. In these instances, steps should be taken to ensure that the employee responsible for authorizing cash disbursement payments (i.e., signing checks) is not involved in any other cash disbursement process.Cash If a facsimile or check signature stamp is used for The employee whose name is on the signature stamp signing checks, is the signature stamp maintained by should maintain the custody of the stamp in a secureDisbursements the employee authorized to sign checks? location.Cash Do the employees responsible for printing checks or Employees responsible for printing vendor checks who have access to blank check stock also perform should not have responsibility for creating and/orDisbursements any of the following duties: transmitting positive pay files to the bank. In addition, • Create the positive pay file they should not be responsible for addressing and • Transmit the positive pay file to the bank resolving bank notifications regarding discrepancies • Have access to bank notifications about between the positive pay file and the checks discrepancies between the positive pay file and presented at the bank. These employees should not checks presented at the bank prepare or approve the bank reconciliations. • Respond to bank notifications about discrepancies between the positive pay file and checks presented at the bank • Prepare the bank reconciliation(s) • Review and approve the bank reconciliation(s)Financial Executives Research Foundation (FERF) 7
  11. 11. Cash Disbursements continued Process Control Considerations Recommendation Examples of Compensating Control Cash Do the employees authorized to sign checks also Employees responsible for signing vendor checks perform any of the following duties: should not have access to create and transmit positive Disbursements • Create the positive pay file pay files to the bank. In addition, they should not be • Transmit the positive pay file to the bank responsible for addressing and resolving bank • Have access to bank notifications about notifications regarding discrepancies between the discrepancies between the positive pay file and positive pay file and the checks presented at the bank. checks presented at the bank These employees should also not prepare or approve • Respond to bank notifications about discrepancies the bank reconciliations. between the positive pay file and checks presented at the bank • Prepare the bank reconciliation(s) • Review and approve the bank reconciliation(s) Cash Is the employee responsible for creating, transmitting The employee responsible for the positive pay file To enhance controls over the cash disbursement and and resolving discrepancies between the positive pay should not be involved in recording vendor invoices, positive pay process, the following compensating Disbursements file and the checks presented to the bank involved in nor should they be able to generate or sign checks. controls can be utilized: any of the following duties: In addition, this employee should not have access to • The bank reconciliation is prepared by an • Record vendor invoices the blank check stock or have the ability to initiate employee independent of the cash disbursement • Create the check file wire transfers. and positive pay process. • Sign checks • An analytical review of the cash disbursements is • Maintain custody of the signature plate (if one is regularly performed. used) • A review of the budget to actual variances is • Have access to the blank check stock performed. Cash Can one employee initiate and approve (release) a Initiation and approval (release) of wire transfers wire transfer? should be segregated between two employees. Disbursements – Wire Transfers NOTE: Best practices suggest a tiered-level approval should be implemented so that wire transfers above a certain threshold are reviewed, approved and released by additional authorizers who have been granted authority in the organization to release payments over that threshold.BDO Consulting Segregation of Duties Checklist 8
  12. 12. Cash Disbursements continued Process Control Considerations Recommendation Examples of Compensating ControlCash Does the person responsible for approving (releasing) The employee responsible for approving and releasing wire transfers also perform any of the following the wire transfer payments to the vendor should notDisbursements – duties: have responsibility for modifying the Vendor MasterWire Transfers • Prepare bank reconciliations File, recording vendor invoices and journal entries, or • Review and approve the bank reconciliations be involved in the bank reconciliation process. • Record invoices in the cash disbursement system • Review and authorize journal entries in the general ledger • Modify the Vendor Master FileAccounts Payable Is the employee who is responsible for recording An employee who is independent of the cash accounts payable transactions in the cash disbursement process should reconcile transactions toReconciliation disbursement system also responsible for reconciling the general ledger. the cash disbursement sub-ledger to the general ledger?Accounts Payable Is the reconciliation of the cash disbursement sub- Account reconciliations should be reviewed and ledger to the general ledger reviewed and approved approved by someone other than the preparer of theReconciliation by someone other than the preparer of the reconciliation. reconciliation?Financial Executives Research Foundation (FERF) 9
  13. 13. Business Cycle Payroll Process Control Considerations Recommendation Examples of Compensating Control Human Resources Does the employee responsible for initiating All changes to the Employee Master File should be A system report of all changes to the Employee modifications (e.g., add/delete employees, changes to reviewed and approved by a supervisory-level Master File should be generated for review. A employee information) to the Employee Master File employee (other than the employee initiating the supervisory-level employee who does not have access also have the ability to approve or record these change) in the Human Resources department prior to modify the Employee Master File should review changes? to being recorded in the system. this report and match the changes to approved Personnel Action Forms. NOTE: Best practices suggest that no one employee should be able to record modifications to the Employee Master File. The modifications should be initiated by one employee and reviewed and authorized in the system by a separate employee. Human Resources Do the employees responsible for maintaining the Employees responsible for modifying the Employee To enhance controls over the payroll process, the Employee Master File (e.g., adding/deleting employees, Master File should not have access to the payroll following compensating controls can be utilized: changes to compensation) also perform any of the system, be involved in the payroll process, distribute • A supervisory-level employee who is not involved following functions: payroll checks or make hiring or termination decisions. in the payroll process reviews and approves the • Make decisions regarding hiring or termination of pre-payment payroll report as well as the final personnel NOTE: In some instances, the Human Resources module payroll reports after the payroll has been • Have access to the payroll system (or payroll and the payroll module may be part of the same system. processed. module) However, the employees responsible for processing the • Distribution of payroll checks is conducted by a • Involved in the payroll process payroll should not have access to the Human Resources supervisory-level employee without payroll • Generate payroll checks module or the Employee Master File and vice versa. responsibilities, and checks not distributed are • Receive payroll checks for distribution investigated. NOTE: For smaller companies where one employee • Gross wages, per the payroll journals and the maintains the Employee Master File and processes general ledger, are reconciled to the W-2s. payroll, this employee should not be able to authorize and execute the pay run (i.e., generate payroll checks) or distribute payroll checks.BDO Consulting Segregation of Duties Checklist 10
  14. 14. Payroll continued Process Control Considerations Recommendation Examples of Compensating ControlTime Entry Are employees able to review and approve their own Hours worked should be reviewed and approved by hours worked or time entered in the timekeeping the employee’s supervisor prior to being recorded or system? transmitted to the payroll department.Payroll Do the same employees responsible for preparing The file prepared for processing payroll should be To enhance controls over the payroll process, the payroll for processing also perform any of the reviewed and approved by an employee who is not following should be considered: following duties: involved in the preparation of this payroll file or part • Use of an outside payroll service provider. • Modify the Employee Master File of the human resources function. • Use of direct deposit instead of payroll checks. • Approve the payroll • Perform a periodic analytical review of the payroll • Generate payroll checks expense, including but not limited to budget to • Distribute payroll checks actual variance analysis. • Receive final payroll reports (e.g., payroll registers) • Perform an analysis of head count to revenue for review and approval ratios. NOTE: If an outside payroll service is used for payroll processing, the same employee responsible for communicating changes to payroll master file data to the outside payroll service provider should not be involved in recording the payroll entries in the general ledger, preparing payroll reconciliations or distributing payroll checks. This employee should also not receive the copies of the final payroll reports (e.g., payroll registers) from the outside payroll service.Payroll Does the same employee responsible for reviewing A supervisory-level employee who is separate from and authorizing the file prepared for processing the payroll processing and human resources functions payroll also perform any of the following functions: should receive and review the payroll reports (e.g., • Generate payroll checks payroll registers) and payroll checks for distribution. • Distribute payroll checks • Receive final payroll reports for review and approvalPayroll Are undistributed payroll checks and rejected payroll Employees not involved in the payroll or human direct deposits investigated and reconciled by a resources function should maintain custody as well as supervisory employee outside of the payroll function investigate and reconcile the returned payroll checks. in a timely manner?Financial Executives Research Foundation (FERF) 11
  15. 15. Payroll continued Process Control Considerations Recommendation Examples of Compensating Control Payroll Does the employee responsible for recording the An employee outside of the payroll and human payroll expense entry in the general ledger perform resources functions should post the payroll journal any of the following functions: entry to the general ledger. • Modify the Employee Master File • Prepare or authorize payroll • Generate payroll checks • Distribute payroll checks Payroll Does the employee responsible for reconciling the Reconciliations should be performed by an employee general ledger to the payroll system also have the who does not have modification rights to the payroll ability to record entries in or make adjustments to the system. payroll system? Payroll When using an outside payroll service to calculate The payroll withholding tax refund checks should not and remit payroll withholding tax, does the employee be received by an employee who is involved in the responsible for receiving the payroll tax refund checks payroll process. perform any of the following functions: • Prepare and process payroll, including but not limited to communicating changes in the payroll master file data to the outside payroll provider • Authorize payroll • Prepare payroll reconciliationsBDO Consulting Segregation of Duties Checklist 12
  16. 16. Business Cycle Inventory Process Control Considerations Recommendation Examples of Compensating ControlPurchasing & Do the employees involved in receiving goods from Employees who receive and sign off on goods vendors also perform any of the following duties: received from vendors should not be involved in theWarehousing • Involved in the purchasing process purchasing or cash disbursement process. • Modify the Vendor Master File • Record invoices in the cash disbursement systemInventory Do the employees with custody of and access to Employees who have access to the physical inventory To enhance controls over the inventory process, the inventory have the responsibility to perform any of should not be responsible for performing inventory following compensating controls can be utilized: the following functions: counts. In addition, these employees should not be • Analytical review of inventory usage should be • Perform physical inventory counts responsible for modifying the perpetual inventory performed and reviewed by a supervisory-level • Modify perpetual inventory records records or the general ledger. employee. • Reconcile the physical inventory counts to the • Modifications to inventory records are reviewed perpetual inventory records and approved by a supervisory-level employee • Reconcile perpetual inventory records to the who is independent of the inventory process. inventory balance per the general ledger • Record manual adjustments (i.e., write-offs) in the perpetual inventory system or the general ledger • Calculate and record the inventory reservesFinancial Executives Research Foundation (FERF) 13
  17. 17. Inventory continued Process Control Considerations Recommendation Examples of Compensating Control Inventory Are physical inventory counts performed by an Physical inventory counts should be performed by an If month-end physical counts cannot be completed by independent party who does not have the employee who does not have day-to-day an independent employee, the following responsibility for maintaining the physical inventory? responsibility for maintaining the physical inventory or compensating controls can be utilized: inventory record-keeping and reconciliation • A count is performed by two employees. responsibilities. • Spot checks are completed on the physical count by an individual who does not maintain the inventory, such as an employee in the finance department. This employee should not have record-keeping responsibilities for the inventory. • Surprise counts are completed by employees without inventory record-keeping and reconciliation responsibilities once a quarter to verify the accuracy of the perpetual inventory records. Inventory Can one employee initiate, authorize and record a All manual adjustments to the perpetual inventory A system report of all manual adjustments to the manual adjustment in the perpetual inventory system? system should be reviewed and approved by a perpetual inventory system should be generated for supervisory employee prior to being recorded. review and authorization by a supervisory-level employee who is not involved in the inventory process, e.g., does not have custody of the inventory and/or responsibility for inventory record-keeping and reconciliation. Inventory Does the employee who has the responsibility for The employee who has modification rights to the The reconciliation of the perpetual inventory system modifying the perpetual inventory system also have perpetual inventory system should not have access to to the physical inventory counts and the general the ability to record journal entries and reconcile the record entries in the general ledger. In addition, the ledger should be reviewed and approved by a perpetual inventory to the physical inventory counts reconciliation of the perpetual inventory system to supervisory-level employee who is not involved in the and the general ledger? the physical inventory counts and the general ledger inventory process. should be completed by someone who does not have the responsibility for modifying the perpetual inventory system.BDO Consulting Segregation of Duties Checklist 14
  18. 18. Inventory continued Process Control Considerations Recommendation Examples of Compensating ControlInventory Can the same employee identify, approve and dispose A supervisory-level employee should review and of scrapped goods and/or obsolete inventory? approve all disposals or sales of scrapped goods and obsolete inventory. In addition, the employee initiating the disposal/sale request should not be responsible for physically disposing of or selling the scrap inventory or have any record-keeping responsibility for scrap or obsolete inventory.Inventory Do employees who initiate and/or authorize the Employees should not be able to both initiate and disposal of scrapped goods or obsolete inventory also approve inventory disposals and record these record or authorize the adjustment for scrap in the adjustments in the inventory records. perpetual inventory system or the general ledger?Inventory Do the employees responsible for the sale of An independent employee in the accounting scrapped goods also invoice the buyer and collect department should invoice the buyer. payments for these sales?Financial Executives Research Foundation (FERF) 15
  19. 19. Business Cycle Fixed Assets Process Control Considerations Recommendation Examples of Compensating Control Fixed Assets Are the employees responsible for approving the Employees responsible for purchases or disposals of To enhance controls over the fixed asset process, the purchase or disposal of the fixed assets responsible fixed assets should not have access to record following compensating controls can be utilized: for any of the following functions: transactions in the fixed asset ledger. • A system report of all fixed asset additions and • Record the transaction (e.g., add, delete, write-off disposals is generated for review and approval by a or dispose assets) in the fixed asset ledger The useful life of the fixed asset (i.e., the life over supervisory-level employee who is not involved in • Determine the useful life of the fixed asset which the asset is depreciated) should be determined decisions about the purchase and disposals of fixed • Determine the company’s depreciation policy based on generally accepted accounting principles and assets. This employee should not have access to • Record or adjust the calculated depreciation on entered in the system by a finance employee record transactions in the fixed asset or general the fixed asset responsible for maintaining the fixed asset ledger. ledgers. • Disposal of the fixed asset • An employee who does not have record-keeping or NOTE: In the event that the computerized fixed asset purchase/disposal authorization performs a periodic system calculates the depreciation based on useful life reconciliation of physical fixed assets to the general by asset category, access to the master files of asset ledger. categories and depreciation tables should be • The useful life by asset category should be pre- restricted to an employee who is not responsible for populated in the computerized fixed asset system. authorizing, recording or reconciling fixed assets. Responsibility for changing the useful life of a fixed asset should be restricted to supervisory-level finance employees without record-keeping or authorization responsibilities. • A system report of useful life by asset category should be generated, reviewed and approved by a supervisory-level employee who is not involved in recording, authorizing or reconciling fixed assets. • A system report of all changes to the master file in the fixed asset system should be generated and reviewed by a supervisory-level employee who is not involved in recording, authorizing or reconciling fixed assets.BDO Consulting Segregation of Duties Checklist 16
  20. 20. Fixed Assets continued Process Control Considerations Recommendation Examples of Compensating ControlFixed Assets Are employees with physical custody of fixed assets Fixed asset disposals should be made after review and A system report of all fixed asset additions and able to dispose of the assets without review and authorization from a supervisory-level employee. disposals is generated for review and approval by a authorization from a supervisory-level employee? supervisory-level employee who is not involved in decisions about the purchase and disposal of fixed assets. This employee should not have access to record transactions in the fixed asset or general ledgers.Fixed Assets Are the employees with access to fixed assets Periodic physical counts of fixed assets should be responsible for periodic physical counts of the fixed conducted by employees without record-keeping or assets? authorization responsibilities, such as a finance department employee or an outside inventory service.Fixed Assets Is the employee who records adjustments related to Adjustments to the fixed asset system should be A system report of all adjustments recorded to the discrepancies between the physical count and the reviewed and approved by a supervisory-level fixed asset system is generated for review and fixed asset system also responsible for any of the employee who is not involved in the physical count of approval by a supervisory-level employee who is not following functions: the fixed assets and maintenance of the fixed asset involved with the physical count or maintenance of • Reconcile the fixed asset system to the physical system. the fixed asset system. count • Authorize purchases or disposals of inventory • Maintain physical custody of fixed assetsFixed Assets Does the employee who is responsible for the The reconciliation of the general ledger fixed asset The reconciliation of the general ledger to the fixed maintenance of the fixed asset system also reconcile balance to the fixed asset system should be asset system should be reviewed and approved by a the general ledger to the fixed asset system? completed by someone who does not maintain the supervisory-level employee who is not involved in fixed asset system. recording, authorizing or reconciling fixed assets.Fixed Assets Is the reconciliation of the fixed asset system to the Account reconciliations should be reviewed and general ledger reviewed and approved by someone approved by someone other than the preparer of the other than the preparer of the reconciliation? reconciliation.Financial Executives Research Foundation (FERF) 17
  21. 21. Business Cycle Sales Process Control Considerations Recommendation Examples of Compensating Control Sales Are new customer accounts approved by employees New customers should be vetted by the finance outside of the sales department prior to processing department or by employees outside of the sales the sales order? department to ensure that: • Customers are financially sound. • Customers are not a related party. Sales Do sales employees have the ability to create Customer accounts and sales contracts should be A sales or accounts receivable system report of all customer accounts and enter sales contracts in the entered in the sales or accounts receivable systems by changes to the Customer Master File should be sales or accounts receivable systems? an employee in the finance department or an generated for review and approval by a supervisory- employee who is independent of the sales function. level employee who is not involved in the sales NOTE:This question assumes that if the company process. uses a separate sales system, then the accounts receivable ledger is automatically updated through an Modifications to customer accounts should be traced IT process once information is entered in the sales and agreed to authorized customer set-up and system. change forms.BDO Consulting Segregation of Duties Checklist 18
  22. 22. Sales continued Process Control Considerations Recommendation Examples of Compensating ControlSales Do employees who initiate customer orders also To enhance the control process, we recommend the As compensating controls, change reports from the perform any of the following functions: following: sales or accounts receivable system can be generated • Approve sales orders and contracts • Sales contracts should be approved by a for independent review. Specifically: • Modify the Customer Master File (e.g., add/delete supervisory-level employee within the sales • A report of all changes to the Customer Master customer accounts, change customer payments, department prior to processing the customer File should be generated for review and approval change discount terms) order. The supervisory-level employee should be by a supervisory-level employee who is not • Modify the Pricing Master File within the Customer independent of the sales order being processed. involved in the sales process. Modifications to Master File • Employees who process sales orders should not customer accounts should be traced and agreed to • Issue, maintain or authorize customer credit limits have the ability to modify the Customer Master authorized customer set-up and change forms. • Generate customer invoices File. • A report of all changes to customer credit limits • Employees who issue, maintain or authorize should be generated for review and approval by a customer credit limits should not be involved in supervisory-level employee who is not involved in generating and recording sales. generating or recording sales. • Customer invoices should be generated by someone in the finance department and/or by an employee who is not involved in the sales process.Sales Do employees in the shipping department have the Employees in the shipping department should not ability to initiate or authorize a sales order? have access to initiate or authorize a sales order.Sales Returns Do employees who initiate customer orders also Sales returns for merchandise should be received by A system report of sales returns should be generated receive sales returns from customers? the shipping department and forwarded to the from the shipping department and compared to the finance department, where returns can be promptly sales return report per the sales system. recorded in the sales and accounts receivable systems.Sales Returns Is the employee responsible for recording sales Sales returns should be recorded in the system by an returns in the sales system independent of the sales employee who is independent of the sales process. process?Sales Is the employee responsible for recording sales An employee who is independent of the sales process transactions in the sales system also responsible for should reconcile sales transactions to the generalReconciliation reconciling the sales system to the general ledger? ledger.Sales Is the reconciliation of the sales system to the general Account reconciliations should be reviewed and ledger reviewed and approved by someone other approved by someone other than the preparer of theReconciliation than the preparer of the reconciliation? reconciliation.Financial Executives Research Foundation (FERF) 19
  23. 23. Sales continued Process Control Considerations Recommendation Examples of Compensating Control Accounts Do employees responsible for issuing, maintaining and Employees responsible for issuing, maintaining and A system report of all adjustments to customer authorizing credit limits for customers also have authorizing credit limits for customers should not accounts should be generated for review and Receivable access to record adjustments to customer accounts in have the ability to record adjustments to customer approval by a supervisory-level employee who does the accounts receivable system (i.e., adjustments to accounts in the accounts receivable system. not have access to the Customer Master File or who the balances owed by customers) ? is not responsible for recording transactions in the accounts receivable system. Invoicing Do the employees responsible for initiating and Access to modifying sales pricing should be restricted processing invoices also have access to modify any of to the employees responsible for recording customer the following: contracts in the Customer Master File. • Sales pricing • Customer contracts • Customer accounts (e.g., access to the Customer Master File) Accounts Do employees who have the ability to post payments Employees who have the ability to modify the or record adjustments to customer accounts also accounts receivable balance should not receive Receivable receive customer payments? customer payments. Accounts Can employees record an adjustment to a customer A supervisory-level employee who is not involved in A system report of all manual adjustments recorded account without review and approval of the recording transactions in the accounts receivable in the accounts receivable system should be Receivable adjustment by a supervisory-level employee? system should review and authorize adjustments to generated for review and approval by a supervisory- customer accounts. level employee who is not involved in recording accounts receivable transactions. Accounts Do the employees responsible for collection on Employees responsible for collections should not have delinquent accounts also receive customer payments? access to customer payments, since these employees Receivable are generally able to record adjustments to customer accounts receivable balances. Accounts Can the employees responsible for collections on Employees involved in the collection process should delinquent accounts also modify existing invoices? not be able to modify existing invoices. Instead, Receivable Specifically, can they modify any of the following fields: access for these employees should be restricted to • Invoice amount documenting notes in the customer account database • Invoice date and the recording of credit adjustments. • Payment terms • Calculation of aging buckets (i.e., accounts NOTE: Credit adjustments should be reviewed and receivable ledger) approved by a supervisory-level employee. Also see “Customer Adjustments” in the Cash Receipts section.BDO Consulting Segregation of Duties Checklist 20
  24. 24. Sales continued Process Control Considerations Recommendation Examples of Compensating ControlAccounts Is the employee responsible for recording transactions An employee who is independent of the accounts in the accounts receivable system also responsible for receivable process should reconcile accountsReceivable reconciling the accounts receivable system to the receivable transactions to the general ledger.Reconciliation general ledger?Accounts Is the reconciliation of the accounts receivable system Account reconciliations should be reviewed and to the general ledger reviewed and approved by approved by someone other than the preparer of theReceivable someone other than the preparer of the reconciliation.Reconciliation reconciliation?Financial Executives Research Foundation (FERF) 21
  25. 25. Business Cycle Treasury and Investments Process Control Considerations Recommendation Examples of Compensating Control Treasury Is the employee who initiates requests to open bank Bank resolutions should indicate that two members of accounts able to authorize such requests with the the senior management team must authorize the bank? opening of bank accounts. Treasury Is the employee who coordinates and opens bank All changes to bank accounts must be authorized by accounts able to authorize changes in bank signatories the employees identified in the bank resolutions. and the authorization levels of those signatories? Treasury Can someone outside of the Treasury department Establishment of all bank accounts should be open and establish bank accounts in the company coordinated by authorized personnel in the Treasury name? department. Treasury Is the employee responsible for opening and The bank should be asked to forward the establishing bank accounts also responsible for confirmation of new accounts to the Treasury ensuring that new bank accounts are entered in the department as well as to a senior member of the general ledger? finance team. Treasury Can the employee responsible for establishing bank The employee responsible for establishing bank accounts also perform any of the following functions: accounts should be restricted from recording • Record transactions in the general ledger transactions in the general ledger and preparing the • Receive cash bank reconciliations. • Generate cash disbursements • Initiate and authorize wire transfers • Prepare bank reconciliations Investments Are banks and investment vehicles that are identified Bank and investment venues selected by the Treasury for use reviewed and authorized by someone other department should be reviewed and approved by a than the employee responsible for corporate member of the senior management team prior to investments? being utilized.BDO Consulting Segregation of Duties Checklist 22
  26. 26. Treasury and Investments continued Process Control Considerations Recommendation Examples of Compensating ControlInvestments Can the employee responsible for corporate Corporate investments should be reviewed and investments initiate and authorize these transactions? approved by a member of the senior management team prior to investing funds.Investments Is the employee responsible for recording investment Investment activity should be recorded in the general transactions also responsible for initiating and ledger by someone other than the employee authorizing these transactions? responsible for initiating and authorizing these transactions.Investments Are investments (e.g., stock certificates) maintained by someone who is not involved in any of the following duties: • Initiate investment transactions • Authorize investment transactions • Record investment transactions • Reconcile investment transactions to the general ledgerInvestments Does the employee responsible for reconciling An employee who is involved in investment investment accounts also perform any of the following reconciliation should be independent of the functions: investment process. This employee should not have • Initiate investment transactions custody of investment assets, initiate or authorize • Authorize investment transactions investment transactions or be responsible for • Record investment transactions recording these transactions in the general ledger. • Maintain investments (e.g., stock certificates)Financial Executives Research Foundation (FERF) 23
  27. 27. Business Cycle Loans Process Control Considerations Recommendation Examples of Compensating Control Loans in the Is one employee able to obtain loans in the name of Bank resolutions should restrict the ability for one the corporation without authorization from another employee to obtain loans from the bank without Name of the senior member of management? written authorization from another senior member of Corporation management or the Board of Directors. Loans in the Do employees other than the persons involved in Loan documents should be forwarded to an obtaining a loan record the loan in the general ledger? employee in the finance department who is Name of the responsible for recording such activity in the financial Corporation statements. Loans Does the employee initiating a loan request from the Loan requests from employees, vendors and employee, vendor, customer or third party also have customers should be directed to a senior member of the ability to authorize such a request? the management team. NOTE: Best practices state that loans should not be given to employees. In the event that a company has a policy to give advances and loans to its employees, such advances and loans should be reviewed and approved by a senior member of the management team. In addition, loans to senior management of publicly traded companies should be prohibited. If loans are granted to senior management in private companies, the loan amount and terms of the loan should be reviewed and approved by the Board of Directors of the company.BDO Consulting Segregation of Duties Checklist 24
  28. 28. Loans continued Process Control Considerations Recommendation Examples of Compensating ControlLoans Do employees responsible for disbursing loan funds Employees responsible for disbursing loan payments also perform any of the following functions: should not be able to initiate and authorize loan • Initiate loan transactions transactions. In addition, these employees should not • Authorize loan transactions be able to record adjustments to loan balances in the • Record adjustments to loan balances in the general general ledger. ledger • Maintain custody of loan documents NOTE: Loan documents and custody of collateral for • Maintain custody of collateral (if any is provided) loans should be maintained by employees not involved in the loan process, such as members of the Treasury department.Loans Do employees responsible for recording loans and Employees responsible for recording loans in the related activity in the general ledger also perform any general ledger should not be involved in initiating or of the following functions: authorizing loan requests. • Initiate loan requests • Authorize loan requests NOTE: Activity in loan accounts should be monitored • Disburse loan funds closely by a member of the senior management team. • Receive cash receipts related to loan payments If loans are granted to senior management in private • Maintain custody of loan documents companies, activity in the loan accounts should be • Maintain custody of collateral (if any is provided) presented to the Board of Directors for review and approval.Loans Are employees who receive loan payments also Loan payments and adjustments to loan balances responsible for recording these payments or should be recorded in the general ledger by an adjustments to loan balances in the general ledger? employee who does not have access to cash receipts.Loan Is the composition and activity in loan accounts Activity in loan accounts should be reviewed and reviewed and approved by a member of the senior approved by someone other than the employeeReconciliation management team? responsible for recording transactions in this account. NOTE: Activity in loan accounts should be monitored closely by a member of the senior management team. If loans are granted to senior management in private companies, the activity in the loan accounts should be presented to the Board of Directors for review and approval.Financial Executives Research Foundation (FERF) 25
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×