Question

Ingenious Measurement Systems Inc. (IMS) is a Canadian public company that manufactures high-end measuring devices used primarily in the oil and natural gas industries. In 2013, it had sales of $100 million and earnings before income tax of $5 million. The company has a December 31 year end.

Ted Pollock, IMS's CEO, is a proponent of strong corporate governance. He has spent the last year strengthening IMS's internal control environment. He believes that organizations that demonstrate good corporate governance practices will be perceived favourably by the markets. Ted wants to make a presentation to IMS's audit committee supporting the position that throughout the year the company's internal controls functioned in accordance with the company's control objectives. Depending on the reaction of the audit committee, Ted would like to make the presentation an annual occurrence. IMS has hired your professional services firm to assist Ted in preparing the content of his presentation.

Your firm is currently assessing the purchasing process. Accordingly, IMS has provided you with relevant material and access to the company s resources (Exhibit II). As part of the analysis of this process, IMS has asked you to:

1. identify the existing key internal controls within the purchasing process,

2. describe the procedures that IMS could use to test the controls, and

3. identify the internal control weaknesses within the purchasing process and recommend improvements.

It is now the first week of March 2014. You, CPA, are asked by the partner to prepare the analysis of IMS's purchasing process, addressing the three requirements, and to identify any additional issues and make any observations that would be relevant to the engagement.

IMS (continued)

EXHIBIT I

PURCHASING PROCESS DOCUMENTATION UPDATED NOVEMBER 2013

The purchasing process has four major components, namely:

1. Vendor prequalification

2. Purchase of goods and/or services

3. Receipt of goods

4. Settlement

Process description

The purchasing process begins when there is a requirement for goods or services. A manually completed purchase request form is sent from the operating department (e.g., Sales, Marketing, Manufacturing, etc.) to the purchasing department. The purchasing clerk numbers these documents and reviews each purchase request form to verify that a signature is present.

Purchase request forms must be authorized by the signature of a person with the appropriate level of authority. The amount of the expenditure determines the level of authority required, and the expenditure authorization levels are organized in tiers. Because there are so many possible combinations of departments and authorization levels, the operating departments are responsible for ensuring that their purchase request forms are signed by individuals with the appropriate level of authority. This requirement eliminates the need for the purchasing clerk to check the specifics of the signatures.

The purchasing clerk sends the purchase requests to the purchasing manager for review and approval.  

The approved purchase request is then sent to the buyer who sources the purchase. If the amount is below $5,000, selection of the vendor is left up to the buyer. For purchases in excess of $5,000 but less than $25,000, a vendor from the Prequalification Listing is selected, again at the discretion of the buyer. For purchases in excess of $25,000, a formal bidding process is performed. However, at the discretion of the buyer, the bid process can be waived if deemed to be cost inefficient.

Upon selection of the vendor, the buyer inputs the purchase request information into a purchase order form. The purchase order is forwarded to the purchasing manager for review and a photocopy is made and filed, in numerical order, with the appropriate photocopy of the purchase request. The original purchase order is then sent back to the buyer who delivers it to the vendor.  

EXHIBIT I (continued)

PURCHASING PROCESS DOCUMENTATION UPDATED NOVEMBER 2013

All goods are received in the warehouse. All employees have access to the warehouse. The goods are checked against the packing slip and are examined for damage, etc. If the goods are acceptable, the bill of lading is signed off by the receiver. A copy of the signed bill of lading is then forwarded to the purchasing clerk who matches it to the file copy of the purchase request and purchase order. If there are differences in the details (over/under shipment, wrong product, etc.), the bill of lading is forwarded to the buyer for resolution with the vendor. If no problems are noted, copies of the three documents are sent to the payables group for settlement once the vendor invoice arrives.

The receiver, John Smith (who was hired 6 months ago), sends the goods to the user department that made the original purchase request along with a photocopy of the bill of lading. The user department agrees the quantities noted by the receiver and files the bill of lading. User departments have noted that, recently, there have been an increasing number of manual adjustments to the quantities shipped versus received.  

Any unmatched purchase requests and purchase orders that remain outstanding for over 90 days are returned by the purchasing clerk to the user department that originally ordered the goods on the assumption that the goods have been received. It is then the responsibility of the user department to follow up and forward the paperwork to the payables group for settlement.

If a signed bill of lading is forwarded to the purchasing clerk for which there is no source documentation (i.e., no purchase request or purchase order exists), the purchasing clerk follows up with the buyer to understand the nature of the receipt. At the same time, a copy of the bill of lading is also sent to the payables group.

Answer 1

Answer:

The case involves an engagement to review the control effectiveness of the purchasing process in a manufacturing company, IMS. The case asks for a report to the engagement partner, addressing the three points the IMS CEO, Ted Pollock, has asked the firm to report on. A further requirement is identifying any additional issues and making any observations that would be relevant to the engagement to note for the partner.

The case requires a detailed analysis of controls and would be useful as an in-class exercise, perhaps in small break-out groups.

This is an engagement of the type that may be done for a public company where management is required by securities regulations to provide a certification of the company’s internal control effectiveness. The response assumes the PA firm would not be acting as the financial statement auditor in this engagement,. The following report uses a format that would be appropriate for this purpose. Other reporting formats are also acceptable, but should be written in the role of the staff member, and addressed to the control review engagement partner using appropriate language and level of detail. While it is assumed this is a report to management rather than to outside parties, the case also  provides insights into auditors’ assessment of internal control effectiveness for either a stand-alone report or as part of an integrated audit approach where the financial statement audit report gives opinions on both control effectiveness and fair presentation (e.g., the ‘integrated audit’ approach set out in the U.S. in PCAOB AS5, or as a voluntary audit report in Canada following the CICA standard OCS 5925 on the management certification required by CSA NI 52-109).

MEMORANDUM

To:   Engagement Partner

From:   Staff  Member

Subject:           Analysis of Integrated Measurement Systems (IMS) purchasing process

Here is the analysis of the IMS purchasing process as you have requested.

It covers the three questions the IMS CEO has asked us to address in our analysis:

1. Identification of the existing key internal controls

2. Description of the procedures IMS could use to test the controls

3.Identification of control weaknesses with recommendations for  improvements to overcome the weaknesses

The report also contains additional issues and observations that would be relevant for us in relation to this control review engagement.

Key Internal Controls in the Purchasing Process

Many controls are incorporated in the IMS purchasing process. The table below lists the key controls we identified and explains why they are important to meeting the stated control objectives of IMS.

Control Procedure	Control objectives it meets
1. The Purchase Request (PR) approved by being signed by personnel with appropriate level of authority.	Purchasing activities result in purchases that are authorized. Levels of authority ensure that personnel with an appropriate level of seniority review and approve significant expenditures.
2. PRs reviewed and approved by the purchasing manager.	All requests are approved by senior independent manager before a purchase order is issued. Any unusual purchase requests can be questioned through the review process.
3. Prequalification of suppliers and bidding process for larger purchases.	Ensures suppliers meet IMS prequalification criteria before being given an order. (Prequalification criteria should ensure suppliers are of sufficient size to meet orders, have met performance standards for delivery times and quality, and include a reference check.) Bidding process ensures all qualified suppliers have opportunity to bid, so that competitive prices are obtained for major purchases, and collusion between suppliers and buyers is prevented.
4. Purchasing manager reviews the Purchase Orders (PO)	Purchasing manager review prevents buyers from trying to get around the control system. Approved POs ensures all purchases are authorized.
5. Receiver matches the quantities received against the Bill of Lading (BL) and signs BL	Ensures company will not pay for goods not received, that missed items or overshipments will be documented for follow-up. Receiver’s signature indicates this control has been performed.
6. All goods are received in warehouse.	Central receiving allows for better safeguarding of goods, and better record keeping through application of control 5. by receiver in warehouse.
7. Signed copy of BL matched to PR and PO authorization.	Ensures goods received were ordered. The PO commits IMS to the purchase transaction. Records  goods received that is all that should be paid for, and records proper amounts/price that should be paid . Matching BL, PO and PR provides control over existence, completeness and accuracy of transactions to be entered into the accounting system (Accounts Payable, Inventory, etc.)
8. Copy of BL goes to user department with goods, and user agrees quantity received to BL copy	Person placing order can verify accuracy and completeness of what was received, compared to what was received in warehouse
9.  Purchasing clerk forwards BLs with no matching source documentation to buyer for investigation	Buyer can catch errors in goods received, such as over -shipments by supplier, or goods shipped that were not ordered. Ensures existence and accuracy of goods received and payments recorded.
10. Purchasing clerk forwards PRs and POs unmatched for over 90 days to user group for investigation.	User group follow up can  identify errors where goods were received by users but no BL was processed to ensure accurate recording. This control can also ensure safeguarding of asset by indentifying potential unauthorized or fraudulent transactions where goods received have been removed without proper authorization.

Internal Control Weaknesses and Recommendations to Strengthen Control

My review and analysis of the purchasing process revealed the following significant control weaknesses, as well as some inefficiencies that are listed in the final section of this report. I provide recommended changes to the process that would strengthen the control and overall cost-effectiveness of IMS controls.

Control Weakness and Potential Impact	Recommended action to improve control
1. PR authorizing signatures are not verified by purchasing clerk or manager. There is no check that the person signing has a high enough level of authority. Unauthorized purchase commitments may arise for IMS	Provide purchasing clerk with list of authorized individuals and levels of authority, which should be updated regularly. Clerk should check PRs are properly authorized by appropriate individuals.
2. PRs  are not prenumbered. Clerk could assign same number, allowing a false order to be processed.	Prenumbered PRs should be used across the company. The purchasing clerk should log the numbers of the PRs received and processed into POs so that all orders can be tracked through the purchasing process and accounting system.
3. Buyers have discretion to select suppliers for purchases of up to $25,000, or over if buyer claims bidding process is too costly. Buyers could split up orders to come in less that $5,000 to allow discretion not to choose from prequalified supplier list. Buyers could collude with one supplier, favour them over other suppliers, and receive kickbacks from this arrangement.	Introduce additional procedures to automatically rotate through preapproved supplier list, and for manager to review and approve when supplier for large purchases has been selected by buyer discretion. Manager should review purchases by supplier to look for evidence of order splitting or favouring a single supplier.
4. Purchasing manager sends PO back to buyer who delivers it to supplier. Buyer can alter PO before it is delivered, and arrange for extra goods to be ordered that the buyer would keep when they arrive. The buyer could cover up by telling the user group the extras over what they put on their PR were an overshipment that the buyer has agreed to “ship back” to supplier. The BL and PO will match and get recorded into accounts payable and ultimately IMS will pay too much for the goods it actually needed and received. This weakness can also facilitate collusion as the buyer is delivering the PO to the supplier.	Once approved by the purchasing manager, the PO should be sent directly to the supplier. The buyer would not have the opportunity to alter the PO or collude with the supplier.
5. All employees have access to the warehouse. Employees could steal some inventory from the warehouse.	Access to warehouse should be physically restricted or monitored so only those employees who require access to do their jobs are permitted access, through use of access cards or keys.
6. BL not matched to PO by receiver. Receiver only checks goods on BL match what was received but does not check that these goods were ordered. Goods could be received and paid for that were not ordered.	The receiver should have a copy of the PO so the authorization and details of the order can be checked before the goods are accepted.
7. Receiver sends BL to user group where it is filed and to the payables group for payment. The receiver could steal goods and report them as short shipments to user group, while payables group will pay for the full amount. There is evidence this may be happening now, as users are noticing a lot of manual adjustments on BLs.	The user group should sign off on the BLs to verify the goods were received as shown, then send the signed BLs to the payables group so the information can be matched prior to payment. User groups can keep another copy of the BL if they require it for their own records.
8. Discrepancies between BL and PR are resolved by buyer. When purchasing clerk matches the PR, PO and BL, any differences are forwarded to buyer for resolution. The buyer can alter the documents to cover up collusion with a supplier, possibly altering prices or quantities to increase payment by IMS. This weakness overrides any control that IMS can achieve by using POs and can provide an opportunity for fraud to occur.	The purchasing manager should be the only person allowed to approve discrepancies, to segregate initiation of the purchases from approving differences. The buyer should provide supporting documentation to the purchasing manager explaining all differences.
9. The buyers is asked to explain BLs that have no matching PO and PR (It is difficult to see how this could happen as all orders should result from a PR and PO being created - but this may arise if a supplier splits a shipment and the documents are only matched to the first BL, so the second has nothing to match to) If users groups are circumventing controls by ordering goods without approving a PR and getting a PO, the buyer may not have any reason to report this, especially if the buyer is colluding with someone in a user group to obtain goods improperly.	The purchasing clerk should not send the BL to the payables group until the manager of the user group and the purchasing manager approve it
10. Unmatched BL is sent to payables group for payment. Items could be purchased and paid for that have not been approved.	Purchasing clerk should ensure all BLs are approved before sending to payables group.
11. Unmatched PRs and POs are sent back to the user group after 90 days for follow up,  on the assumption the goods must have been received. Errors in recording cancelled orders, or  missing paperwork, will not be detected on a timely basis.	Purchasing clerk should follow up on outstanding orders weekly.

Tests of Controls

IMS can use the following procedures to test the controls identified above.

Control	Test
Authorization of PR by user department	Select a sample of PRs (either from file in purchasing department or in account payable department) Review PRs for evidence of approval by  a person with proper level of authority
Review of PR and PO by purchasing manager	(Assuming the manager signs as evidence of review) Select a sample of PRs and POs (from accounts payable) Review for evidence of manager review Verify the information on the PR and PO match in terms of quantities and descriptions, appropriate supplier selection, etc.)
Vendor selected from prequalified list	Select a sample of POs Review supplier selection and trace to prequalification list for purchases $5000-$25000, and to evidence of bidding process if > $25000 If bidding process waived, investigate with buyer and assess validity of reasons supporting the waiver. To address potential circumvention of process by a buyer, these additional tests could be done: 1. Generate a list of purchases sorted by buyer and by supplier to see whether a buyer is favouring only one or a few suppliers. 2. Generate a list of purchases sorted by buyer and by amount, to see if an unusual proportion of the purchases is under $5,000 which may indicate order splitting to circumvent supplier selection control policies. 3. For any suppliers not on the prequalified list, enquire of buyer responsible and assess validity of explanation for not following the policy. 4. Select purchases close to the $5000 and $25000 cutoff levels to see whether they tend to be placed by one buyer with one supplier, which may indicate possible collusion between the buyer and the supplier.
Goods received in the warehouse by the receiver, who signs off on BL	Periodically observe the receiver performing his/her duties in the warehouse. Select a sample of BL (from purchasing or accounts payable)  and examine for receiver’s signature
Signed BLs are matched to PR and PO	Select a sample of POs Verify there are matching PRs and BLs are signed by receiver Trace to copied POs and PRs kept by purchasing manager to verify authorization
A copy of BL is sent to user group	(Assuming the user group signs the BL as evidence of approval) Select a sample of BLs from user groups Examine for evidence of approval Vouch to BL used in accounts payable to ensure not altered by receiver (to address weakness of  2 copies of BL being sent to users and to purchasing )
Unmatched documents are investigated.	Select a sample of unmatched BLs and unmatched PR/POs from accounts payable Review for evidence that discrepancies are followed up and resolved Ensure unmatched documents have not been processed for payment

Other observations relevant to this engagement

The IMS CEO has adopted a corporate governance framework that can be expected to strengthen its control environment and other company level controls as set out in the COSO framework. We have been engaged to support the adoption of its main elements, by documenting its purchasing process and identifying key controls, evaluating control strengths and weaknesses in regards to IMS’s main control objectives (authorization of transactions, safeguarding assets, prevention of error and fraud, accuracy and completeness of records, and appropriate use of information) and advising on how IMS could test its controls for effectiveness. My analysis and recommendations above should meet these requirements of the engagement.

As a further help to the CEO in this exercise, I have also identified the following potential inefficiencies, and recommended solutions. More efficient procedures can save time that IMS can devote to implementing stronger control procedures.

Potential Inefficiencies	Recommended solution
1. Review of both PR and PO by purchasing manager is redundant since purchasing clerk has already reviewed them and they contain the same information.	Consider having purchasing manager review only the POs, since these commit IMS to purchasing the goods. The purchasing manager can use this review as an opportunity also to monitor selection of suppliers, to further increase efficiency.
2. The buyer creation of PO by re-entering data from PRs is redundant, and the second entry introduces more chance of input errors.	Allow the user group to generate a PO, which the buyer can add the supplier information to. Then submit this PO to the review and approvals as required. It may be a further efficiency to generate a PO only for purchases over a certain dollar amount, such as $500.
3. As described the system requires a lot of photocopies of documents, which is inefficient and may also allow documents to be altered prior to copying so the changes are hard to detect	The company could benefit from using multipart forms with the number of copies required, to reduce need for photocopying. IMS could also consider whether automating the purchasing process would be cost effective.

I hope this report will be useful to you in completing the engagement. Please contact me if you require any other work for this engagement, or if any questions arise.  I would be happy to accompany you to your next meeting with Ted Pollock if that will be helpful.

Best regards,

Staff member

(CICA Adapted)