The purchases and expenses system: controls and tests of controls

A company's storekeeper orders goods from his brother's shop at inflated prices, signs for deliveries that never arrive and passes the invoices to a clerk who pays them without checking. The same pattern happens in many organisations because buying is where the money goes out.

Controls over purchases and expenses protect against buying what is not needed, buying from the wrong people, paying for what was not received and paying the wrong amount.

This topic applies the risk, control objective, control and test method to purchases and expenses: placing orders, receiving goods and invoices, and recording and accounting for purchases. The previous topic did the same for sales and the next does payroll.

Key terms in plain English

Syllabus check

This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:

• accounting systems and internal controls in the purchases cycle
• the evaluation of internal controls
• tests of controls

CAMA 2020 and the purchases system

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

The elements of the system

Leaving out the making of payments to suppliers, the main elements of the system for purchases and other expenses are:

• (a) placing orders, including requisitioning and placing the order
• (b) receiving goods or services and invoices
• (c) recording and accounting for purchases and expenses

The same basic approach applies as for sales.

The objectives are the same for all systems, but the controls and tests differ between manual and IT systems.

Placing orders

Controls:

• segregation: those who requisition new supplies do not place the orders;
• purchase orders numbered in sequence;
• a procedure for placing suppliers on the approved list, and in an IT system physical and access controls over the approved supplier master file;
• all orders placed with approved suppliers, perhaps shown by an approved supplier reference number, and in an IT system the program can address orders only to suppliers on the file; and
• orders above a set value authorised by a senior manager, who confirms that competitive tenders were obtained.

Tests of control:

• check that segregation exists
• inspect lists of numbered orders or view them on screen, or submit a test order and check that it gets the next number
• ask management for evidence that the procedure for approving suppliers operates, and in an IT system test the controls over the master file
• check orders for the approved supplier reference
• check large orders for management authorisation

Receiving goods and invoices

Here there is little difference between manual and IT systems, because the controls rest on physical receipt of goods and invoices by people.

Controls: keep a copy of every delivery note with the signature of the person who received and checked the goods; produce a goods received note (GRN) for every delivery, from the delivery note or after counting; make a member of the accounts or purchasing staff responsible for checking discounts; segregate the people who take delivery, those who place orders and those who record invoices; and check every purchase invoice against a purchase order and a GRN.

Tests of control:

• check that delivery notes, GRNs and invoices are matched and that the person who matched them signed or initialled the invoice
• look for evidence of invoices, orders or GRNs that cannot be matched, which would show that the control is not working
• look for evidence that discounts are checked and claimed
• check that segregation exists

Recording and accounting for purchases and expenses

Controls: check purchase invoices to purchase orders before recording, with the order number written on the invoice or entered in the system if not printed; receive regular supplier statements and check the balance to the payables ledger; do regular control account reconciliations of trade payables; and raise a numbered debit note each time goods are returned, to be matched with the supplier's credit note, with an IT exception report of unmatched debit notes for follow-up.

Tests of control:

• look for evidence that invoices are matched to orders, such as initials on the invoice or references on screen
• evidence that supplier statements are checked and approved
• evidence of control account reconciliations
• a list of numbered debit notes cross-referenced to supplier credit notes

The three-way match

The central purchases control is the match of three documents: the purchase order (what was ordered and at what price), the goods received note (what actually arrived) and the supplier's invoice (what is being charged). Payment is made only if all three agree.

In an IT system, the program may match them automatically and report exceptions, so the auditor tests the matching rules and the follow-up of exceptions, not each invoice.

Expenses other than inventory

The same ideas apply to services and expenses such as repairs, rent, utilities and consultants. Where there is no goods received note, the control is an approval by the person who received the service, such as a manager's sign-off that the work was done. Contracts above a limit need senior approval and, where possible, competitive quotes.

Recurring expenses, such as rent and utilities, are reviewed against contracts and budgets, and unusual changes are investigated. Capital items are separated from revenue items by an authorisation process that checks the classification.

Linking the controls to the assertions

The approval of orders and the three-way match support the occurrence and accuracy of purchases. Numbered orders, GRNs and debit notes, and the supplier statement reconciliation, support completeness of purchases and payables. Cut-off is supported by GRNs dated at receipt. If the tests show that the controls operate, the auditor can reduce substantive testing of purchases and payables.

If not, the auditor extends the search for unrecorded liabilities and tests of cut-off.

Worked examples

1. The control over the approved supplier file is weak: a fictitious supplier can be added.
2. Access to the file should be restricted and new suppliers approved by a senior manager.

1. The invoice is for 50 units more than were received, ₦20,000 too much.
2. The three-way match should stop the invoice until the supplier issues a credit note or the missing 50 units arrive.

1. She can order for herself, confirm receipt falsely and record the invoice.
2. These tasks should be done by three different people.

1. Credit may never be claimed, so payables are overstated.
2. A numbered debit note for each return, matched to the credit note, would prevent this.

How to score full marks

• Divide into ordering, receiving and recording.
• Use risk, objective, control and test for each part.
• Mention the three-way match and the approved supplier list.
• Adapt tests to manual or IT systems.

Common mistakes in the exam

• Giving only substantive tests such as confirming payables.
• Forgetting segregation of ordering, receiving and recording.
• No test of the approved supplier master file.
• Ignoring purchase returns.

Quick revision

• Order, receive, record.
• Approved suppliers; numbered orders; tenders for large orders.
• GRN; three-way match; supplier statements; reconciliations; debit notes.
• Tests: inspect evidence of matching; test data; check segregation.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.