ACCT 332 Week 7 Discussion Board Forum 4 Example

Discussion Board Forum 4: Monitoring and Auditing Accounting Information Systems

ACCT 332 Accounting and Control, Discussion Board Forum 4

Thread by [Student Name]

The trucking company, its invoice counts and the three classmates are composites; the textbook, Scripture and the peer-reviewed sources cited are real.

An internal auditor at a composite regional trucking company plans the annual review of accounts payable. The traditional approach would pick a sample of sixty vendor invoices from the year's 186,000 and trace each to a purchase order and receiving record. If the sample is clean, the auditor concludes the process works. But sixty invoices are 0.03 percent of the population, and a duplicate payment hiding in the other 99.97 percent would go unseen.

Richardson et al. (2018) describe computer-assisted audit techniques, including generalized audit software that can read an entire file and test every record, as a way to audit through the computer rather than around it. Applied here, a duplicate payment test matches invoices on vendor number and amount, then looks for invoice numbers that differ only slightly, such as a missing hyphen or a transposed digit. Run across all 186,000 invoices, the test flagged 214 pairs. Investigation confirmed 38 true duplicates, totaling $96,500, mostly fuel vendors who had resubmitted invoices after a system change.

Huang et al. (2022) argue that when complete data are available, sampling loses much of its meaning, and they present an approach for testing entire populations with analytics and machine learning. The trucking example supports that view: no sample would have found $96,500 in duplicates. Yet 176 of the 214 flags were false alarms, each needing a look. Kogan et al. (2014) found in their continuous auditing design that testing complete data produced better results only when audit practices changed to handle the resulting exceptions. Full-population testing does not reduce the auditor's work; it moves the work from choosing what to look at to deciding what each flag means.

Paul urged believers to examine themselves and test themselves (English Standard Version Bible, 2001/2016, 2 Corinthians 13:5). Organizations that test their own payments in full practice a version of that discipline, finding their errors before anyone else does. For the trucking company, recovering $96,500 from fuel vendors is the visible benefit; learning that a system change caused the resubmissions is the more lasting one.

Reply to Olivia

Olivia, you argued that the trucking company's managers, not the auditors, should run the duplicate test every week. I agree, and research supports you. Masli et al. (2010) found that companies that implemented technology to monitor their internal controls had a lower likelihood of material weaknesses and smaller increases in audit fees after SOX. If management catches duplicates weekly, the auditor can test the monitoring itself rather than every payment, which is cheaper for everyone. Your point also gives management a reason to invest: lower audit fees partly pay for the software. The weekly run would also catch duplicates before the money leaves, instead of a year later when recovering it from a vendor is much harder.

Reply to Ethan

Ethan, your post suggested that auditors could simply rely on the client's own automated tests. That raises an independence question. Richardson et al. (2018) distinguish monitoring, which is management's responsibility, from auditing, which must be independent of the activity it examines. If the auditor relies on tests that management designed, the auditor must first test whether those tests work, for example by planting a known duplicate and checking that it is caught. Otherwise the auditor is trusting the system being audited to report on itself, which defeats the purpose. Reperforming a few of management's tests independently each year is a modest cost that keeps the reliance honest.

Reply to Chloe

Chloe, your ghost employee test, matching payroll bank accounts and addresses against each other and against vendor files, is a strong example of full-population testing. Hardy and Laslett (2015) describe Metcash running more than 100 automated tests daily with an integrated system for managing the exceptions, and your test would fit that model well. I would add one refinement: compare payroll records with badge or log-in activity, since a ghost employee is paid but never appears at work. Combining two data sources often cuts false alarms sharply. It would also catch a former employee left on payroll after leaving, which a duplicate-address test alone would miss, and that case is often more common than an invented person.

References

English Standard Version Bible. (2016). Crossway. (Original work published 2001)

Hardy, C. A., & Laslett, G. (2015). Continuous auditing and monitoring in practice: Lessons from Metcash's business assurance group. Journal of Information Systems, 29(2), 183-194. https://doi.org/10.2308/isys-50969

Huang, F., No, W. G., Vasarhelyi, M. A., & Yan, Z. (2022). Audit data analytics, machine learning, and full population testing. The Journal of Finance and Data Science, 8, 138-144. https://doi.org/10.1016/j.jfds.2022.05.002

Kogan, A., Alles, M. G., Vasarhelyi, M. A., & Wu, J. (2014). Design and evaluation of a continuous data level auditing system. Auditing: A Journal of Practice & Theory, 33(4), 221-245. https://doi.org/10.2308/ajpt-50844

Masli, A., Peters, G. F., Richardson, V. J., & Sanchez, J. M. (2010). Examining the potential benefits of internal control monitoring technology. The Accounting Review, 85(3), 1001-1034. https://doi.org/10.2308/accr.2010.85.3.1001

Richardson, V. J., Chang, C. J., & Smith, R. (2018). Accounting information systems (2nd ed.). McGraw-Hill Education.