How to Assess Control Risk in Your Client’s Purchasing Procedures

By Maire Loughran from Auditing For Dummies

When assessing purchasing control risk, auditors assume that control risk is directly affected by purchasing internal controls set in place by the business. The purchases process has control risk associated with two broad issues: orders placed with fictitious vendors and orders placed for personal use.

If good controls aren’t in place regarding the various approval processes, employees could set up fictitious companies with whom they place nonexistent orders. Order payments then go directly back to the employees through the dummy vendors.

You can ferret out these types of fraudulent transactions in a couple ways:

Checking vendor identification: Confirm that a vendor exists by opening a telephone book or doing an Internet search. Be particularly suspicious if you notice invoices from vendors with company names consisting only of initials or invoices that show only a post office box (no physical address). Another tactic is to try to match employee addresses with vendor addresses.
Checking payment and service terms: Poorly defined terms for the goods or services invoiced are hallmarks of fictitious transactions. The fraudulent employee uses this method to keep the items in the order vague yet plausible so that a quick review will conclude that the order looks acceptable.

Pay close attention to any invoices that are broken out into numerous small payments, thus circumventing the approval process set in place by dollar amount. For example, it’s a lot of work to prepare many small purchase orders if cash disbursement approval is set at $250. But if the employee slips a $1,000 purchase order through and then pays the invoice in increments of under $250, there’s one less hoop to jump through in the path of diverting cash from the company to personal use.

While testing cash disbursement transactions, look for items that just don’t make sense for the company to order. For example, a floral delivery company is unlikely to need to order bedding and linens, so if you see that type of purchase on an invoice, you should immediately question whether it’s for business or personal use.

Another big problem is that employees may take home legitimate inventory or equipment purchases. This type of fraud happens in many different ways. In a retail clothing shop, the employee could merely walk out of the shop at the end of the shift wearing the clothes. A receiving clerk can take items directly from the shipping container and hide them in garbage bags outside the receiving room door.