Auditing the purchasing process requires internal auditors to understand and test key management assertions. These assertions relate to the validity, completeness, accuracy, timing, and classification of transactions. Using a matrix approach, auditors can link assertions to potential misstatements, related internal controls, and appropriate audit procedures. This structured method enhances both risk assessment and test design.
Purchasing Process Phases:
-
Identify Needs – Recognize and justify procurement requirements.
-
Request – Create purchase requisitions and obtain approval.
-
Source – Select vendors and negotiate terms.
-
Order – Issue purchase orders.
-
Receive – Accept and inspect goods or services.
-
Pay – Match invoice, PO, and receiving report before payment.
-
Review – Assess supplier performance and compliance.
Assertions and Internal Controls Matrix:
| Assertion | Potential Misstatement | Example of Internal Control | Relevant Questions / Tests |
|---|---|---|---|
| Occurrence | Fake or duplicate purchases | Three-way match (PO, invoice, receiving report) | Are all purchases supported by authorized documentation? |
| Completeness | Missing purchase transactions | System-enforced requisition and PO tracking | Are all purchase requests and POs sequential and accounted for? |
| Authorization | Purchases made without approval | Hierarchical approval workflow for requisitions | Were all purchases approved according to policy limits? |
| Accuracy | Incorrect quantity or pricing on invoice | Automated matching of PO and invoice in ERP system | Do invoice values match POs and receiving reports? |
| Cutoff | Purchases recorded in wrong accounting period | Timely entry of receiving and invoicing dates | Are receipts and invoices recorded in the correct period? |
| Classification | Misclassified purchases in incorrect GL accounts | Pre-defined account codes and validation controls | Are purchases recorded in the correct accounts/categories? |
Practical Example:
During an audit of a public university’s purchasing function, the auditor found that lab equipment was recorded in office supply accounts. This violated the classification assertion. Though purchase requests were approved, the chart of accounts was not well-enforced. The auditor recommended mandatory selection from a validated account list within the purchasing system and follow-up training for requisitioners.
Using an assertion-control matrix like this helps auditors design relevant tests and ensures that all aspects of a process—like purchasing—are evaluated for integrity, compliance, and risk.