Progress for process: the rapid evolution of technology has yielded new ways to identify and mitigate procurement risks in purchasing systems

Internal Auditor, June, 2004 by Morris Attaway

COMPUTING SYSTEMS BASED ON ENTERPRISE RESOURCE PLANNING (ERP) technology are streamlining the way purchasing departments conduct business, giving them the ability to increase efficiency and control transactions in real time. However, the benefits come with challenges for internal auditors, calling for new methods of evaluating risks and controls in areas that include requisitions, purchase-order processing, contracts, procurement, electronic receipts settlement (ERS), electronic funds transfer (EFT), and purchasing cards.

[ILLUSTRATION OMITTED]

[ILLUSTRATION OMITTED]

REQUISITIONS

Organizations typically have relied on a manual system for purchasing requisitions. The person making the requisition prepared the document manually and forwarded it to the authorizing manager, who sent it to the purchasing department, where it was manually entered into the company's purchasing system.

With today's ERP-based purchasing systems, requisitions can be generated online, routed electronically for authorization, and electronically forwarded to purchasing, where a buyer easily can access the document via computer and convert it into a purchase order. This set of tools can improve requisitioning and purchasing efficiency significantly by making it unnecessary for buyers to re-key requisition data.

RISKS

* Requisitions may not be authorized.

* The documentation may contain inaccuracies.

* Requisitions may not be completed fully.

* The requisition process may not be handled timely.

AUDITING STEPS

* Examine how requisitions get routed for approval. The release strategies used in electronically authorizing requisitions should be consistent with management's authorization guidelines.

* Verify that edit and validation routines exist for critical fields. This helps ensure requisitions are accurately and completely entered.

* Verify that buyers do not have the capability of authorizing requisitions.

* Review the pending requisition file, checking for requisitions that have not been processed timely.

* Determine whether changes to electronic routings are logged and accounting management reviews a report of all changes.

* Verify there are procedures to ensure that notification of functional role changes are made timely so the routing of electronic approvals can be modified appropriately.

* Determine if authorization to create, modify, and delete electronic approval routings or release strategies are restricted adequately using the ERP system's authorization concept.

PURCHASE-ORDER PROCESSING

With ERP systems, those departments using it or an organizationwide process typically set the requirements for materials or services, and the supply source can either be determined by the system or entered by the users. If supply sources for a requested material exist within the system, the buyer can find the sources automatically and allocate the purchase requisition to the appropriate supplier. If quotations are required, the buyer can solicit them using a tool in the system that processes a request for quotes (RFQ).

RISKS

* Orders may be placed without adequate authorization.

* Unauthorized purchase adjustments may be processed.

* Purchase orders may contain inaccurate information.

* Materials may not be purchased at the lowest possible cost.

* Buyers may show favoritism when issuing orders.

AUDITING STEPS

* Review the existing edit and validation routines for critical fields. The ERP system should be configured to ensure purchase orders are entered accurately and completely.

* Verify that someone in purchasing monitors the number of purchase orders by vendor and the dollar amount of purchases issued by each buyer on an ongoing basis. This will help identify whether purchase-order limits are being circumvented.

* Verify that the tool used to process purchase adjustments or changes is restricted appropriately and segregated from the payment function.

* Verify that the ERP's tolerance functionality restricts buyer limits and prevents buyers from processing adjustments for unauthorized amounts. The system's tolerance limits should reflect management's authorization guidelines.

* Determine whether an RFQ policy exists, it indicates the levels at which buyers should solicit competitive bids, and that buyers are following it.

* Verify that quotes are reviewed and any variations from company policy are authorized.

* Examine how the purchasing department treats changes to purchase orders, specifically whether requisitioners are notified of changes to prices, quantities, and specifications. For electronically generated requisitions, workflow should be considered one way of notifying requisitioners of a difference between what was on the requisition and what appears on the purchase order.

CONTRACTS

Before ERP systems were implemented, buyers would issue a contract to a supplier. As orders were issued against the contract, the buyers would have to assign the orders to the appropriate contract manually and insert the negotiated conditions. Today's ERP systems enable buyers to create orders that automatically use the negotiated conditions in the contracts. Therefore, the buyer puts all the data in the system only once when setting up the contract, thus reducing the likelihood of errors.