Control-free checking: an unscrupulous manager goes on a check-writing spree, and relationship-building pays off for auditors conducting a budgeting-system audit - Roundtable

Internal Auditor, Dec, 2003 by J. Mike Jacka

COMPANY MANAGEMENT ASKED internal auditing to perform an audit of the local checking account used by one of the firm's site offices. The site manager's administrative assistant had 'alerted management that she believed personal expenses were flowing through the site account.

The internal auditors began their review by requesting support for the most recent six months of activity in the checking account, including copies of the check register, bank statements, and cancelled checks. After just a brief review of the support materials, the auditors quickly realized that the site manager was abusing her account privileges. On several occasions, she had used the account for reimbursement of employee business expenses. Although some organizations permit this practice, the company's policies explicitly stated that employee business expenses should be processed and paid via the accounts payable department, not the local checking account.

The auditors also found record of several gift purchases that appeared to be personal in nature. For example, they discovered a check written to upscale-jewelry retailer Tiffany & Co. for us $2,045. The check register indicated that items purchased were "key chains, money clips, and trinkets for clients." Skeptical of these claims, the auditors obtained stockkeeping numbers from the receipts and contacted the vendor for detailed item descriptions. Store personnel told them purchases included a $260 toggle heart necklace, a $135 heart chain bracelet, two $130 money clips, a $495 cap and gown tassel charm, and a $1,025 heart charm bracelet. Clearly, these items seemed unusual for client gifts, and none was modest enough to constitute a "trinket."

As their investigation progressed, the auditors discovered more and more suspicious checking activity. They found several checks that had been made payable to a credit card company, totaling more than $3,000. Apparently, these payments did not constitute business-related expenses, as the checks were used to pay the manager's personal credit card bills, as well her husband's. The auditors also noticed a check written for the purchase of American Express gift certificates. After obtaining copies of the cashed certificates, they realized that items had been bought by members of the manager's family. In addition, the account records showed payments made for shipping charges incurred by the manager's family.

Based on these findings, the auditors expanded their review to include the manager's expense reports. They found that she not only paid for her personal credit card expenses through the company checking account, but had also received reimbursement for more than $300 of the same expenses through normal expense reporting. In addition, she had submitted two different airline tickets for the same date, which resulted in an over-reimbursement of $250.

After internal auditing's investigation, the manager was interviewed and given an opportunity to explain the exceptions noted. The company also gave her several days to produce the necessary support to substantiate her questionable expenses. In light of auditing's findings and the outcome of the interviews, the manager was eventually asked to find employment elsewhere.

This incident was primarily the result of one "small" flaw in internal controls--no one had been reviewing expenses paid through the site checking account. This weakness enabled the site manager to prepare checks and approve expenses, effectively giving her autonomous control.

PHILADELPHIA CHAPTER

PROFITABLE RELATIONSHIPS

Company management asked internal auditing to test a portion of the corporate budgeting system. The system had just undergone a major transformation, including conversion to a new control platform, and management wanted to ensure that budget processes had not been adversely affected.

With more than 100 budget codes to review and very little time to complete their work, the internal auditors faced an ambitious task. In fact, they determined it would be impossible to check each of the codes within the time frame allotted for this assignment. To expedite their review, the auditors decided to leverage relationships they had built during previous audits by asking individuals from other departments to help them sort through the codes.

Because of the comfort level internal auditing had established with individual departments over the years, the employees felt at ease sharing what they knew, without fear that any problems they disclosed might be held against them. Discussions with the employees quickly revealed that three major codes had not been converted accurately during the system upgrade. A miscommunication during the budget-code conversion apparently led to these errors. The company's information technology department later fixed this problem by simply changing descriptions on the input screen used to process payments.

As discussions with department personnel continued, the auditors obtained information that led to findings outside the original test scope. The employees volunteered that none of them could account for approximately $1.5 million in expenses allocated to various departments each month. They knew the main office performed these allocations, but no one understood where this money came from. Again, the employees did not fear negative consequences for revealing this problem--they had been troubled by the error and knew they could count on internal auditing for help. Although no one from this group offered any clue as to the cause of the error, the auditors eventually were directed to an employee in the home-office accounting department who understood what had happened.