Transaction Flow Auditing

TRANSACTION FLOW AUDITING Andersen once used Transaction Flow Auditing (TFA) methodology to conduct its audits. The approach is designed to focus audit work in those areas of highest audit risk and to minimize work in those areas with low audit risk. Morgan, Noonan, Abend & Co. adopted this methodology. One way auditors minimize the time spent on audits is to rely on client’s internal control techniques. If a client’s internal control techniques reduce the risk that financial statements are misstated, the auditors can reduce the amount of substantive testing of the client’s records. This reduces audit time because substantive testing generally requires much more time and is more extensive than tests of controls. Before relying on a client’s internal controls, auditors must first understand the client’s internal control structure. This structure consists of three elements: 1. The control environment (e.g. Management style and philosophy, corporate organizational structure, personnel policies, methods of assigning authority and responsibility, existence of internal audit functions, etc.) 2. The accounting system (e.g. Methods and records of identifying, assembling, classifying, recording and reporting transactions, and maintaining accountability of assets and liabilities.)  3. Control procedures (e.g. Authorization of transaction and activities, segregation of functions, design and use of documents, and safeguards over assets and records.) IMPORTANT POINT!! While an understanding of the control environment (the first element noted above) is necessary to understand the risks inherent in a client’s operations, the auditors generally do not rely directly on overall controls or control systems. They generally rely only on specific control techniques that relate to a specific transaction or activity. For instance, a client may have a policy of hiring only very capable people. This is a positive aspect of the control environment and may indirectly affect the auditors’ decision to rely on controls. But the auditors would not reduce the amount of substantive testing of sales transactions solely because the client has competent personnel. 1  IMPORTANT POINT!! Generally, auditors place direct reliance only on control techniques and procedures that relate to a particular transaction or account and to particular financial statement assertions by management. For instance, an auditor may rely on the client’s procedure for accounting for all invoice numbers in the sales journal to reduce the risk that all sales may not have been recorded. (completeness assertion). Another example of a control technique on which auditors might rely would be a client’s having an independent billing clerk recompute the preparation of all sales invoices (accuracy assertion). In this case, the client’s policy of hiring only competent personnel may be a positive factor in the decision to rely on the recomputation control technique, but the auditors do not directly rely on the hiring policy itself. On the other hand, a weakness noted in the control environment may preclude reliance on some otherwise effective control techniques. For example, if the auditors are aware that top management frequently overrides established control techniques, they may decline to rely on those techniques. As you can see, reliance on internal controls tends to be very specific as opposed to a vague or general reliance. As a result, the auditors have to identify specific internal control techniques on which they will rely and, then, they have to test those control techniques to make sure they actually function effectively. Each auditing firm has internal control evaluation methodologies designed to minimize audit risk and audit cost. The TFA methodology and the equivalent methodologies developed by other firms have the following common characteristics. 1. Simplification -- This is accomplished by breaking the client’s operations down into smaller, more understanding portions - generally called cycles - and breaking each cycle into smaller portions which can be more readily assessed as to risks. 2. Standards for assessment -- The assessment of whether control techniques are adequate presumes there is some standard of sufficiency the techniques should meet. These “standards of sufficiency” are stated in control objectives in the TFA methodology. These objectives relate to financial statement assertions. 2 3. Formal documentation -- The methodologies include standardized documentation that is designed to facilitate making correct assessments of control techniques in an orderly, logical manner. The documentation also leaves a trail as to the thought processes followed in making the assessments. It also permits careful review of the assessments by engagement partners and managers and others who may wish to determine the adequacy of the planning process. 4. Bridge to the audit program -- The assessment of internal controls must be related directly to the tests and procedures included in the audit program. Transaction Flow Auditing (TFA) provides a disciplined approach for: 1. Identifying significant risks in a client’s operations. 2. Identifying specific internal control techniques on which the auditors may rely. 3. Evaluating those techniques relative to specific control objectives and financial statement assertions. 4. Documenting the relationship, or bridge, between the evaluation of specific control techniques and the audit tests performed. The first step in TFA is segmenting the client’s operations into distinct activities called cycles. Although this case calls the cycles by different names than most textbooks and TFA, the concepts are similar to those discussed in textbooks. These cycles for the MII audit are as follows: 1. Capital cycle – This cycle includes all activities related to acquiring, maintaining, and repaying financial resources from the financial markets outside the client organization. The financial statement captions connected with this cycle include all the debt and the stockholders’ equity captions, interest and dividends payable and interest expense. 2. Cash cycle – This cycle includes all activities related to receiving, holding, and paying out financial resources. The captions connected with this cycle include cash, time deposits, short-term investments, and related interest income. 3. Expenditure cycle – 3 This cycle includes all activities related to the purchasing, receipt of, and payment for raw materials, fixed assets, and goods and services used by the client to produce or service. The captions connected with this cycle include accounts payable, accrued liabilities, purchases, prepaid expenses, and most expense accounts. 4. Payroll cycle – This cycle includes all activities related to hiring, personnel, pay rates, employee benefits, time reporting, and wage/salary disbursements. The accounts connected with this cycle include various payroll and withholding payables and payroll expense accounts. 5. Production cycle – This cycle includes activities related to the holding of inventory and the production of goods and services. The financial statement captions connected with this cycle include inventory, fixed assets, cost of goods sold and depreciation expense. 6. Revenue cycle – This cycle includes all activities related to marketing, credit, order entry, shipping, billing, accounts receivable, and collections. The captions connected with this cycle include sales, commissions, receivables, allowance for bad debts, and the provision for bad debts. Although these cycles will typically be found in most manufacturing and commercial businesses, other kinds of businesses will have other cycles that are appropriate for their industry. For instance, a bank would have deposit and lending cycles.  IMPORTANT POINT!! During the planning phase of the audit, the auditors will (1) identify the cycles, (2) identify the significant audit risks connected with each cycle and (3) develop an audit strategy for each cycle. This strategy will pinpoint those areas in which the auditors expect they will be able to rely on the client’s internal control techniques. The auditors will then perform a detailed evaluation of internal controls only in those areas. To facilitate these detailed evaluations of controls, each cycle is segmented again into smaller parts called “functions.” For instance, in the revenue cycle, typical functions would be as follows: 1. Customer acceptance – This function involves the evaluation and acceptance of customers, setting credit limits, etc. 4 2. Order entry – This function involves the obtaining of orders, reaching agreement as to prices and terms, and acceptance of orders for processing. 3. Shipping – This function involves the processing and delivery of orders to customers. In the case of MII, due to the nature of its products and services, the production cycle interfaces with the revenue cycle at this point. After the orders are completed in the production cycle, they are turned over to the revenue cycle’s shipping function for customer pick-up or delivery. The “shipping” function at MII is normally performed by the same individuals performing order entry functions. In situations like this, auditors would consider the risks resulting from the failure to segregate functions. 4. Billing – This function involves the preparation of billings to customers and the recording of sales transactions on the books. 5. Accounts receivable – This function involves the maintenance of the accounts receivable subsidiary records. 6. Cash receipts – This function involves the receipt of cash from customers and interfaces with the cash cycle for the deposit and recording of cash in bank accounts. 7. Collections – This function involves the collection of problem receivables, processing of bad debt write-offs and maintenance of the allowance for bad debts. 8. Adjustments – This function involves the processing of sales returns and allowances. All the cycles can be broken down into functions. The nature of the activities within these functions depends upon the nature of economic events that flow through the cycle. 5 The functions vary from client to client depending on the client’s organization and the nature of its products or services. The audit senior will direct the staff accountants to prepare detailed evaluations of the adequacy of the control techniques in some or all of the functions in a particular cycle, depending upon the earlier initial assessment of risk during the planning phase. The activities within a single function are normally limited enough that an auditor can relate specific control techniques to specific risks and make reasonable judgments as to whether the techniques are adequate. However, to determine whether something is “adequate” implies that there is a basis or standard against which to measure adequacy. In TFA, these standards for measuring the adequacy of internal control techniques are called internal control objectives. These objectives are derived from the definition of internal accounting control included in Statement on Auditing Standards No. 1: “Accounting control comprises the plan of organization and the procedures and records that are concerned with the safeguarding of assets and reliability of financial records and consequently are designed to provide reasonable assurance that: a. Transactions are executed in accordance with management’s general or specific authorization. b. Transactions are recorded as necessary (1) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements and (2) to maintain accountability for assets. c. Access to assets is permitted only in accordance with management’s authorization. d. The recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any differences.” To these four basic control objectives, Andersen added six additional control objectives that relate to the integrity of processing economic events or transactions through a business. A summary of the overall control objectives in graphic and narrative form is located at Overall Control Objectives. However, to actually apply these objectives in a particular cycle or function is difficult when the objectives are stated in a general manner. Consequently, Andersen developed specific control objectives for each cycle. These specific objectives are the ones used 6 for measuring whether the client’s control techniques are adequate. The only cycle control objectives you will need to complete this assignment are the ones for the revenue cycle. The evaluation of the control techniques in a particular function is called a Transaction Flow Review (“TFR”) and is documented on a standard form like the one at TFR Form. A completed TFR for MII’s order entry function appears at Order Entry TFR as an illustration and reference for you in completing this assignment. In the following paragraphs, we will review that TFR in detail so you will be able to understand the TFR process more easily. This MII Module # 3 assignment asks you to complete the billing function TFR for MII. Now let’s review the TFR on the order entry function at Order Entry TFR. The first thing you should notice is how the form is headed up with the name of the client, the cycle, the function, and the audit date. Also note that the staffperson has indexed and signed and dated the schedule.  IMPORTANT POINT!! Next you will see a simplified flowchart of the transaction flow through the order entry function. Note that the flowchart reflects only economic events flowing through the function. It does not include any control techniques and it includes only those documents necessary for the completion of the economic event. The flowchart is to help the auditor understand the risks inherent in this particular economic activity so he will more clearly evaluate the controls, which are listed in the second column below in narrative form. An economic event is any change or occurrence that results in a change in values in the assets or liabilities of a company. In most cases, economic events are transactions that are easily identified and promptly captured by the accounting system. Other economic events are not so easily identified or captured. For instance, it is easy to identify that a sales transaction takes place at a supermarket because customers line up and a clerk checks out the items sold and collects the money, all of which are immediately captured on the cash register. On the other hand, a receivable becoming uncollectible is also an economic event, but it is more difficult to determine whether the event has happened or not, by how much, and when it happened. Making sure the economic event is promptly captured by the accounting system is also more difficult. After reducing the transaction flow to its bare essentials and documenting it on the upper part of the TFR form, the audit staffperson had to determine which of the revenue cycle control objectives on page 3-13 and 3-14 relate to this function. She reviewed the list of objectives and wrote the ones that apply to this function in the first column on the bottom of the TFR form. By the time the revenue cycle TFR’s are completed, all the objectives for that cycle will have been considered. Only a few normally apply to an individual function, however. 7 Next to each of the control objectives she selected, she listed the control techniques the client uses to achieve those objectives. Information about these control techniques comes from procedure manuals, discussion with client personnel, and narrative descriptions of procedures form the auditor’s permanent file. At this point, the auditor does not take the time to make sure the client is actually performing the control technique effectively. This testing will be done only when the audit team is satisfied the technique would achieve the objective and the risk involved is significant enough that the auditors want to take time to test it. In some cases, the risk related to a particular objective is not great enough to warrant spending the time to test the related controls. After the staffperson listed the control techniques related to each objective, she evaluated whether the objective was achieved and documented the results of her evaluation. In each case, she determined that the objectives were achieved and that tests of controls were appropriate. She then inserted the references to the numbered steps in the audit program which provide for tests of those control techniques. If no test had been included for a technique she felt was significant, she would propose an addition to the audit program. See Revenue Cycle Audit Program for excerpts from the revenue cycle audit program related to this function. In MII Module # 4, you will have the opportunity to test controls over the billing function using the audit program to guide your work.  IMPORTANT POINT!! Note how the evaluation of specific control techniques results in specific tests included in the audit program. The TFR acts as a bridge between the review of internal controls and the nature and extent of testing performed on the audit. 8