ACC 542 Week 6 Using the Information System to Perform Audit Functions Example

Testing Every Transaction Instead of a Sample: Benford Analysis, Duplicate Payment Searches, Journal Entry Tests and a Vendor-Employee Match at a Composite 42-Store Grocery Chain

[Student Name]

University of Phoenix

ACC/542: Accounting Information Systems

Week 6 Assignment

[Instructor Name]

[Date]

The grocery chain, its data and all results are composites written for a model paper; methods and research findings come from the sources listed.

A composite grocery chain operates 42 supermarkets and a distribution center, buys from about 2,600 vendors and pays about 610,000 vendor invoices a year totaling $1.9 billion. Its auditors identified three risks in purchasing and financial reporting: duplicate or fictitious vendor payments, fraud through vendors connected to employees and management override through journal entries. Sampling a few hundred invoices would say little about risks concentrated in a handful of transactions. When a risk hides in a few transactions among hundreds of thousands, the most efficient sample is the whole population. This paper describes the analytics the team used.

Preparing and Validating the Data

The team obtained extracts of the vendor invoice file, the payment file, the vendor master file, the employee master file and the general ledger journal entry file. Before any analysis, it validated the data: it reconciled the invoice file's total to accounts payable activity in the ledger, confirmed that record counts matched system reports, checked for gaps in journal entry numbers and verified that dates and amounts were in valid formats. It also obtained the extracts through a query it observed being run, so the data came directly from the system. AICPA guidance on audit data analytics emphasizes that the reliability of the underlying data must be established before analytics can provide evidence (American Institute of Certified Public Accountants, 2017).

Choosing the Tests

Each test was chosen for a specific risk and assertion. The first-digit and duplicate tests address the occurrence and accuracy of recorded expenditures. The vendor and employee match addresses the risk of fictitious vendors, which bears on occurrence. The journal entry tests address the fraud risk of management override, which auditing standards require in every audit.

Test One: First-Digit Analysis

Benford's law predicts how often each first digit should appear in many sets of real-world amounts, with 1 appearing as the first digit about 30% of the time and 9 about 5% (Nigrini, 2012). Vendor invoice amounts, which arise from varied quantities and prices, generally fit this pattern. The team compared the first digits of all 610,000 invoice amounts with the expected distribution. Overall conformity was close, but invoices beginning with the digits 4 and 9 appeared more often than expected in one category: store maintenance.

Follow-up explained most of the excess. Store managers could approve maintenance invoices up to $5,000 and $10,000 at two levels, and invoices just below those limits, beginning with 4 and 9, were more common than expected. The team selected 60 such invoices and found that most were legitimate repairs, but three vendors had submitted several invoices for the same job on consecutive days, each just under $5,000. Together these totaled $68,000, split to avoid district manager approval.

Test Two: Duplicate Payments

The team defined possible duplicates as payments to the same vendor for the same amount within 30 days, or with invoice numbers that matched after removing spaces, hyphens and leading zeros. The system's own control already blocks exact duplicate invoice numbers, so the test targeted variants. It flagged 412 pairs. Review found that 371 were recurring charges, such as weekly deliveries at a fixed price, and 41 were true duplicates totaling $213,000, mostly invoices entered once from a paper copy and again from an emailed copy. The chain had recovered 26 of them through vendor statements, but 15, totaling $94,000, had not been recovered.

Test Three: Journal Entries

Management override is a risk in every audit. The team tested all 48,000 manual journal entries for characteristics associated with override: entries posted on weekends or holidays, entries by senior finance staff who do not normally post, entries with round amounts over $100,000, entries posted after the close and entries to unusual account combinations, such as debits to inventory with credits to cost of sales outside the normal inventory adjustment process. The tests flagged 188 entries. The team examined support for all of them. Most were routine, such as quarter-end accruals posted by the controller on a Saturday. Four entries reversing part of the shrinkage reserve at two stores lacked support and had been posted by a regional finance manager; they were referred to management and the audit committee and proposed as adjustments.

Test Four: Vendors and Employees

The team matched the vendor master file's addresses, phone numbers and bank account numbers with the employee master file. It found three matches. Two were employees who were also legitimate part-time suppliers, disclosed and approved. The third was a floor-care vendor whose bank account matched that of a store manager's spouse; the vendor was one of the three splitting maintenance invoices. The matter was referred to the chain's investigations team.

Recommendations to Management

The analytics also produced control recommendations. The chain should aggregate maintenance invoices by vendor and job before applying approval limits, so splitting cannot avoid review. It should add a duplicate-detection rule that compares normalized invoice numbers and amounts, not only exact matches, and review vendor statements monthly for credits. It should restrict manual journal entries to the reserve accounts to the corporate controller's team and require documented support before posting. And it should run the vendor and employee match quarterly, with results reviewed by internal audit. Several of these tests can become continuous monitoring, run automatically each month by the chain's own staff.

Planning for Next Year

Because the analytics are now scripted, the team can rerun them next year at low cost, compare results across years and focus follow-up on changes, such as a vendor whose invoices suddenly cluster below approval limits.

Turning Results Into Evidence

Analytics provide evidence about entire populations, but they do not prove misstatement on their own. Appelbaum et al. (2017) noted that big data and analytics can change audit procedures but raise questions about how auditors evaluate the large number of exceptions such tests produce. The team's approach was to define criteria before running each test, investigate every flagged item or a documented subset and record how many flags proved to be errors. The results were a $94,000 unrecovered duplicate payment, $68,000 of split invoices tied to a possible conflict of interest and four unsupported journal entries, which together were below materiality but led to control recommendations and an expanded review of the maintenance category.

Limits

Analytics test only the data provided. A fictitious vendor with an address unlike any employee's would pass the match. Benford analysis cannot detect a single large fraudulent invoice that looks normal. And analytics cannot confirm that goods were received. The team therefore combined them with traditional procedures, such as confirming balances with major vendors and observing inventory counts.

Conclusion

By testing entire populations of invoices, payments and journal entries, the team found split invoices, unrecovered duplicates, unsupported entries and a vendor linked to an employee, none of which a small sample would likely have revealed. Validated data, predefined criteria and disciplined follow-up turned the analytics into audit evidence.

References

American Institute of Certified Public Accountants. (2017). Guide to audit data analytics.

Appelbaum, D., Kogan, A., & Vasarhelyi, M. A. (2017). Big data and analytics in the modern audit engagement: Research needs. Auditing: A Journal of Practice & Theory, 36(4), 1-27. https://doi.org/10.2308/ajpt-51684

Nigrini, M. J. (2012). Benford's law: Applications for forensic accounting, auditing, and fraud detection. Wiley.