Quiz 3: Internal Control Issues
The audit objective for a client's payroll function is to assess the level of control risk in the payroll cycle. Tests will focus on completeness (whether all payroll liabilities are reported in the correct amounts and in the correct period) and auditors will look for unusual variations in periodic payroll expense and accrual. Comparing payroll expense/accrual for comparable periods taking into account changes in the number of workers, salary increases etc. will identify unusual variations. The auditor will also create its own expectation for payroll expense and compare it to reported expense in the period to test for reasonableness.
D's payroll system had several control weaknesses: • One person had disproportionate control over the payroll system including system design and a high level of involvement in operations. • Key personnel did not have enforced vacations. Many firms require mandatory vacations for key payroll personnel (and others with direct access to funds). These mandatory vacations seek to remove the key person from the payroll process for a period of time to ensure that the system/process functions normally in their absence. Mandatory vacations have a practical effect (to ensure that one person does not have too much control over the process) as well as a sentinel effect (to prevent individuals from misappropriating funds). • The payroll system was not tested on a regular basis by control/risk personnel.
Several audit tests might have uncovered the payroll misappropriation scheme. • Limit tests to identify whether certain employees were being paid for an excessive number of hours. • Reasonable assessment (using analytic techniques) to compare reported payroll with estimated payroll. • Unannounced check distribution (perhaps a week or a few days early) for certain departments.