Question

You are an audit manager of Tissa & Co, the auditor of Setoi Berhad which operates an electric power station. The company produces electricity 24 hours a day, seven days a week.

Setoi Berhad employs over 250 people and approximately 70% of the employees work in production at the power station. There are three shifts every day with employees working eight hours each. The production employees are paid weekly in cash. The remaining 30% of employees work at the head office in non-production roles and are paid monthly by bank transfer.

The company has a human resources (HR) department, responsible for setting up all new joiners. Pre-printed forms are completed by HR for all new employees and, once verified, a copy is sent to the payroll department for the employee to be set up for payment. This form includes the staff member’s employee number and payroll cannot set up new joiners without this information. To encourage staff to attend work on time for all shifts, Setoi Berhad introduced a discretionary bonus, paid every three months, for production staff. The production supervisors determine the amounts to be paid and notify the payroll department. This quarterly bonus is entered into the system by a clerk and each entry is checked by a senior clerk for input errors prior to processing. The senior clerk signs the bonus listing as evidence of undertaking this review.

Production employees are issued with smart cards and are required to swipe their cards at the beginning and ending of their shift. This process is supervised by security staff 24 hours a day. Each card identifies the employee number and links into the hours worked report produced by the payroll system, which automatically calculates the gross and net pay along with relevant deductions. These calculations are not checked.

On a quarterly basis, exception reports relating to changes to the payroll standing data are produced and reviewed by the payroll director. No overtime is worked by employees. Employees are entitled to take 28-holiday days annually. Holiday request forms are required to be completed and authorised by relevant line managers; however, this does not always occur.

On a monthly basis, for employees paid by bank transfer, the senior payroll manager reviews the list of bank payments and agrees this to the payroll records prior to authorising the payment. If any errors are noted, the payroll senior manager amends the records.

For production employees paid in cash, the necessary amount of cash is delivered weekly from the bank by a security company. Two members of the payroll department produce the pay packets, one is responsible for preparing them and the other checks the finished pay packets. Both members of staff are required to sign the weekly payroll listing on completion of this task. The pay packets are then delivered to the production supervisors, who distribute them to employees at the end of the employees’ shift, as they know each member of their production team.

Monthly management accounts are produced that indicate variances between budgeted and actual amounts. Revenue and key production costs are detailed, however, as there are no overtime costs, wages and salaries are not analysed.

(a) Identify FIVE (5) key controls of the payroll system, in which the auditor may seek to place reliance on.

(b) Describe a Test of Control for each of the five key controls in (a) above, which the auditor should perform to assess if each of these key controls is operating effectively.

(c) Identify and explain FIVE (5) deficiencies in Setoi Berhad’s payroll system and provide a recommendation to address each of these deficiencies.

Answer 1

a,b	Control	Test of Control
1	Review of bonus amounts entered by clerk, by senior clerk	Verify if the control is functioning effectively, by examining the senior clerk's sign off
2	Capturing of time thorugh swipe records	Verify if the time is captured correctly in the system, approvals if the swipe card is forgotten
3	Security staff to ensure no tailgating and proper swiping of smart cards	Verify if the employee can enter the premises without swiping, and security register for details of any persons who forgot swipe cards
4	Review of changes to payroll data by Payroll director	Verify if the reviews are documented, approvals are obtained for changes, any errors noted and actions taken.
5	Review of bank payments by payroll senior manager	Verify if the review is documented, approvals and actions for any exceptions.
c	Deficiencies	Recommendation
1	Payment to employees in production roles using cash (When cash is used, the risk of misappropriation of cash increases.)	All the employees to be paid through bank transfers.
2	Absence of verification of calclations of gross pay and net pay	A person may be appointed to ensure the calculations are right (or the system configurations are right), as there is no mechanism to verify the HR data.
3	Absence of proper system to record holidays / leaves of employees	System workflow for application and approval of leave to be introduced, and the same may be linked with payroll system
4	Absence of review of data collected by HR	Employee master to be maintained in the system with complete details of employees, and it is to be reviewed when new records are added.
5	Absence of variance analysis of payroll cost	As it is a significant part of expenses, payroll cost should also be analyzed, especially as there would be variance due to excess leaves taken by the employees.