ACCA F8 (INT) Audit & Assurance - 2010 - Study text

Подождите немного. Документ загружается.

Chapter 9: Tests of controls

 There is a risk that purchase invoices will be incorrectly recorded in the accounts

of suppliers. A control objective is to identify and correct any such errors that

may occur.

 There is a risk that credit will not be claimed from suppliers for goods returned.

A control objective is to make sure that credit is taken for purchase returns.

Principal controls

Suitable controls may be as follows:

 Purchase invoices must be checked against purchase orders before they are

recorded in the accounts. If the purchase order number is not printed on an

invoice, it should be written on the invoice by the individual making the check

or entered onto the system alongside the invoice details.

 Regular statements should be received from suppliers, and the balance on the

statement should be checked against the account balance in the trade payables

ledger.

 There should be regular control account reconciliations for trade payables.

 A debit note should be created each time that goods are returned to a supplier.

Debit notes should be sequentially numbered and matched with the supplier’s

credit note when it is received. An IT system could produce a regular exception

report of unmatched debit notes for follow up by an employee.

Tests of control

Here are some suggested tests of control:

 The auditor should look for evidence that purchase invoices are matched against

purchase orders. Evidence may be provided by a signature or initials on the

purchase invoice of the individual making the check or by checking references

on screen.

 There should be evidence that statements from suppliers are checked and

approved. Again, evidence may be provided by a signature or initials on

statements of the individual making the check.

 The auditor should look for documentary evidence of control account

reconciliations.

 The auditor should be able to check a list of sequentially-numbered debit notes,

cross-referenced to a supplier’s credit note.

Paper F8: Audit and assurance (International)

206 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

The payroll system

 Elements ofthe payroll system

 Calculating gross wages and salaries

 The calculation of tax and other deductions

 Recording wages and salaries payable in the accounts

 Payment of wages and salaries

 Possible control weaknesses in a payroll system

4 The payroll system

4.1 Elements of the payroll system

A similar approach can be taken to designing tests of controls in the payroll system.

Elements of the payroll system may be classified as follows:

 Calculating gross wages and salaries

 Recording wages and salaries payable in the accounts

 The calculation of tax and other deductions from wages and salaries

 The payment of wages and salaries.

Some risks, control objectives, principal controls and tests of control are suggested

below for each element of the payroll transaction cycle. However, the control

objectives, principal controls and tests of control are now presented in tabular form,

for ease of reading.

4.2 Calculating gross wages and salaries

Risks

 Wages and salaries may be paid to individuals who are not employees.

 Employees may be paid for work they have not done.

 Gross wages and salaries could be calculated incorrectly.

 Taxation and other deductions could be calculated incorrectly.

Control objectives

 Ensure that only ‘real’ employees are paid: for example wages or salaries should

not continue to be paid to former employees who have now left, or that

payments are not made to ‘phantom’ employees.

 Ensure that employees are paid only for work they have done: for example to

make sure that employees are not paid for overtime work if they have not done

it.

 Ensure that gross pay, deductions (tax and other deductions) and net pay are

calculated correctly.

Chapter 9: Tests of controls

Examples of control

objectives

Examples of principal

controls

Tests of control

Wages and salaries should

not be paid to individuals

who are not employees.,

There should be a

segregation of duties: the

individual responsible for

preparing wages and

salaries should not be the

person who actuall

them.

The auditor can check that

the segregation of duties

does exist.

The gross pay for each

individual employee

should be authorised by

an appropriate person.

The auditor should check

that departmental payroll

lists are properly

authorised.

There should be formal

authorisation of new

employees.

Documentation for

authorising new emplo

ees

and putting them on the

payroll file (manual or

computerised) should be

checked.

Salaries should be

calculated correctly.

There should be formal

personnel records, giving

details of each employee

and his or her rate of pa

and dates of starting and

leaving employment.

The payroll file should be

checked.

Employees paid time-

based wages should only

be paid for time they

have worked.

There should be time

sheets for hourly-based

employees, and these

should be authorised by

an appropriate

supervisor.

Time sheets can be

checked. These should

include the signature of

the manager or supervisor

confirming the hours

worked by the individual

employee.

Alternatively, a clock

card system might

operate.

For a clock card system,

the auditor will need to

test the controls in

operation (such as to

ensure that employees

cannot clock in for each

other).

Payments should not be

made except for work

done and unless properly

authorised. Payroll

calculations should be

accurate.

A senior manager

should check the total

payroll cost each week

or month, to make sure

that the total amount

does not appear

excessive.

Authorised payroll lists

should be checked. These

should contain the

signature or initials of the

manager who checked the

list.

Paper F8: Audit and assurance (International)

208 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

Examples of control

objectives

Examples of principal

controls

Tests of control

In a computerised

payroll system,

exception reports might

also be produced, for

example, reporting gross

wages over pre-set

parameters and then

followed up by

management.

Test data could be used to

check that the exception

reporting system is

working properly.

Exception reports could be

reviewed for evidence of

follow up (e.g. annotated

explanations).

Bonus payments to

individuals must be

authorised.

Check a sample of bonus

payments to ensure that

the payments are properly

calculated and authorised.

4.3 The calculation of tax and other deductions

Examples of control

objectives

Examples of principal

controls

Tests of control

Taxation and other

deductions from pay

should be calculated

correctly.

Payroll procedures (IT or

manual) should provide

for the deduction of all

appropriate deductions,

using up-to-date rates of

tax.

The auditor can review

any manual procedures

for calculating deductions,

and the tax rates used. In

an IT system, general IT

controls will be important

to check that the system

was properly developed,

tested and implemented.

Test data could be used

and results compared to

independently calculated

figures.

Voluntary deductions

from pay (for example,

for pension

contributions) should

only be made with the

consent of the employee.

Senior management

should check the total

amount of deductions

each week or month.

The auditor can check that

a senior manager has

approved total

deductions, evidenced by

his or her signature on the

appropriate document.

All voluntary deductions

must be authorised in

writing by the employee,

and this written

authorisation should be

kept in the payroll file.

The payroll file can be

checked against the

calculation of deductions

in employee wages or

salaries, to confirm that

voluntary deductions are

authorised.

Chapter 9: Tests of controls

4.4 Recording wages and salaries payable in the accounts

Risk and control objective

The principal risk is that gross pay, deductions and net pay may not be properly

recorded in the accounts. The control objective should therefore be to ensure that

gross pay, deductions and net pay are all properly and accurately recorded in the+

accounts.

Examples of control

objectives

Examples of principal

controls

Tests of control

Gross pay, deductions

and net pay should be

properly and accurately

recorded in the accounts.

The accounts are prepared

from payroll data that has

been approved by a senior

manager.

There should be evidence

that the payroll has been

formally approved. (In an

integrated IT system, the

nominal ledger accounts

will be automatically

updated.)

Accounting for payroll

should be completed

within a strict timescale.

There should be checks on

the procedures for

recording payroll and the

time within which the

work is done.

There should be control

accounts for payroll, with

regular reconciliations

between control totals and

the payroll records of all

individual employees.

There should be

documentary evidence of

control account

reconciliations and review

of these reconciliations.

4.5 Payment of wages and salaries

Risks

 Incorrect amounts of net pay could be paid over to employees.

 Incorrect amounts of deductions could be paid over to the authorities.

 Payment could be made to the wrong employee.

Examples of control

objectives

Examples of principal

controls

Tests of control

The correct amounts of

net pay should be paid to

employees.

When wages and salaries

are paid by automated

bank transfer, the list of

payments should be

authorised by an

appropriate manager.

Authorised lists of

payments can be checked.

Paper F8: Audit and assurance (International)

210 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

Examples of control

objectives

Examples of principal

controls

Tests of control

The correct amount of

deductions is paid to the

appropriate authority

(for example, the tax

authority).

There should be formal

procedures and a formal

timetable for the payment

of deductions, and

recording payments in the

accounts.

The procedures for

payments of deductions

and manual recording of

payments in the accounts

can be checked. (In an

integrated IT system, the

nominal ledger accounts

will be automatically

updated for deductions.)

Payments of net wages

and salaries are made

only to the proper person

(the employee).

Bank statements should

be used to check that

payments have been

properly recorded in the

accounts.

Evidence of bank

reconciliation checks can

be obtained.

Payments are correctly

recorded in the accounts.

There should be controls

within the accounting

system to ensure that

there is reconciliation

between total amounts

payable and total paid.

The accounts can be

checked to confirm that

payrolls each week or

month (total payable and

total paid) are reconciled.

Again, this will not be

necessary in an integrated

IT system, provided that

the auditor is satisfied that

the system is working

properly, perhaps by

processing a “dummy”

payroll run.

Note: The suggested control objectives, controls and tests of control in the above

table assume that all wages and salaries are paid by bank transfer. When payments

of wages are in cash, or where casual labour is paid in cash, additional controls will

be needed.

4.6 Possible control weaknesses in a payroll system

Remember that in the F8 exam, you may be asked to identify control weaknesses in

a payroll system, given information about procedures in a client entity described in

a case study-type of question. The following are possible weaknesses that may exist.

 Weaknesses in the system for recording time spent at work. When employees

are paid by the hour, there will be a system of ‘clocking on’ and ‘clocking off’,

typically using employee identity cards and a time recording device.

Alternatively, employees may be required to arrive at work at a given time, and

use identity cards and a recording device to record their arrival at work. The risk

is that employees will ‘clock on’ on behalf of a colleague, using the identity card

that the colleague has given him. (A control to prevent this from happening is

that the ‘clocking on’ process should be observed each day.)

Chapter 9: Tests of controls

 Overtime payments may not be properly authorised. Is the overtime authorised?

If so, has the amount of the payment been checked and authorised?

 Responsibility for making the payroll payments. The actual payments of wages

and salaries (often direct payments through the banking system) may be made

by a junior person in the accounts department without proper authorisation.

 The payroll lists for each department may not be properly authorised. This

creates a risk that payments may be made to ‘phantom’ employees.

Some weaknesses in a payroll system may be risks that are common to other types

of IT system too, for example:

 Weaknesses in the use of passwords. An IT system may use passwords to

prevent unauthorised access to files and records. However, the passwords used

may be ‘guessed at’, particularly if they are names of family members or

domestic pets, or names included in home addresses. Passwords should be

difficult to guess (ideally a combination of letters and numbers) and should be

changed regularly.

 Weaknesses in the use of e-mails. Important information may be sent by e-mail.

However, since the information is not on paper (in ‘hard copy’ form) there is a

greater risk that it will be overlooked or forgotten. In a payroll system,

notification that employees have left their job may be sent to the payroll

department by e-mail. If the e-mail is not acted upon, there is a risk that former

employees will continue to be paid, even after they have left.

Paper F8: Audit and assurance (International)

212 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

The bank and cash system

 Risks and control objectives

 Principal controls and tests of control

 Petty cash

5 The bank and cash system

5.1 Risks and control objectives

Bank and cash is often one of the most sensitive areas of an audit, in the sense that it

is the asset which is most likely to be misappropriated. However, it may not be an

area of high audit risk in practice, because the client company should be aware of

the potential high level of risk and should therefore set up appropriate control

systems.

Auditors will be particularly interested in establishing that all receipts belonging to

the organisation have been recorded – completeness is a key assertion in the area of

cash receipts.

The term ‘cash’ is used below to mean both notes and coins, and also money in a

bank account. Many entities try to reduce the risks of misappropriation of cash

(banknotes) by arranging receipts and payments through their bank.

Cash payments are also an area of potential risk. Payments might be made to

unauthorised persons, or individuals might be paid more than they should be paid.

Some control objectives for cash might therefore be as follows:

 All money received is recorded.

 All money received is banked.

 All money held as cheques, notes and coins is properly safeguarded.

 All payments are properly authorised.

5.2 Principal controls and tests of control

Some of the principal controls for cash, and tests of those controls, are suggested

below:

Control objectives Principal controls Tests of control

All money received is

recorded

There should be

segregation of duties. The

handling of cash should be

kept separate from other

accounting functions.

Check that segregation

of duties does exist.

Chapter 9: Tests of controls

Table continues

Control objectives Principal controls Tests of control

Controls over receipts by

post

There should be

supervision of the opening

of mail.

There should be a listing of

all money received.

Mail and cheques should

be date-stamped.

Controls over receipts by

post

Observe that mail

opening and cash

handling procedures are

being followed.

Check amounts recorded

as receipts from

customers against the

remittance advices

(document from the

customer confirming the

amount paid).

Cash sales

Only a restricted number of

employees should be

authorised to receive cash.

Cash tills and till rolls

should be used to record

cash sales.

Another person should

check the actual cash

received against the till roll

total.

Restrict the employees who

are able to receive cash

If the till rolls are not

produced, receipts should

be given for cash receipts,

and a copy of receipts

retained. Receipts should

be sequentially numbered.

Cash sales

Check amounts in receipt

books or on till rolls to

paying-in slips, the cash

book and bank statements.

Check whether bankings

are made daily.

Check payments out of

cash takings, if any.

Check for evidence that till

roll totals or receipts totals

are checked against cash

received by an authorised

person.

All money received is

banked

There should be daily

banking, if possible.

The amount of cash

payments received should

be recorded, and

subsequently checked

against the amount banked.

Check the frequency of

banking receipts.

Check that receipts are

recorded in the cash book

and that the bank

statement matches the

cash receipts recorded on

a dail

basis.

Paper F8: Audit and assurance (International)

Table continues

Control objectives Principal controls Tests of control

Proper safeguards

should exist over

money held

Bank

There should be

established procedures for

opening new bank

accounts.

There should be restrictions

on individuals authorised

to prepare and hold

cheques.

There should be safe

custody of cheque books.

In a manual system there

should be no pre-signed

cheques.

In an IT system there must

be strong physical controls

over access to pre-signed

cheques, such as being kept

in a safe until the next

payment run and batch and

control totals used over

cheque numbers.

Bank

Confirm that new bank

accounts have only been

opened under established

procedures.

Observe which

individuals are involved

with company cheques.

Enquire as to custody of

cheque books and check

to see whether any

cheques are blank and

pre-signed.

In an IT system, observe

a payment run and that

pre-signed cheques are

removed from the safe

immediately before being

printed and returned

immediately afterwards.

Arrange for a cheque to

be missed out of the run

and ensure the system

flags it up as missing.



Cash

Notes and coin should be

kept in a secure place, such

as a safe.

Only a very limited

number of employees

should have access to the

cash.

Receipts of cash and

payments of cash must be

recorded.

Cash

Review the nature of cash

payments made.

Observe cash custody

procedures.

All payments should be

properly authorised,

made to the correct

person and are properly

recorded

Cheque payments

Cheque requisition forms

should be used to request

payments, backed by

supporting documentation.

Cancellation of

documentation once

cheque has been prepared.

Cheque payments

Review paid cheques for

payee, date, amount and

signature.

Agree payments in the

cheque book or BACS

listing to entries in the

accounting records, bank

statements and supplier

statements.

ACCA F8 (INT) Audit &amp; Assurance - 2010 - Study text - Emile Woolf Publishing

Подождите немного. Документ загружается.

ACCA F8 (INT) Audit & Assurance - 2010 - Study text - Emile Woolf Publishing