The Why and How of Auditing Payables and Expenses

Here's an overview of common payable and expense risks and how to audit them

Are you auditing payables and expenses? In this post, we’ll answer questions such as, “how should we test accounts payable?” and “should I perform fraud-related expense procedures?” We’ll also take a look at common risks and how to respond to them.

auditing payables and expenses

Picture from AdobeStock.com

Auditing Accounts Payable and Expenses — An Overview

What is a payable? It’s the amount a company owes for services rendered or goods received. Suppose the company you are auditing receives $2,000 in legal services in the last week of December, but the law firm sends the related invoice in January. The company owes $2,000 as of December 31, 2016. The services were provided, but the payment was not made until after the period-end. Consequently, the company records the $2,000 in its year-end payables. 

In determining whether payables exist, I like to ask, “if the company closed down at midnight on the last day of the month, would it have a legal obligation to pay for a service or good?” If the answer is yes, then record the payable—even if the invoice is received after the month-end. Has the service been received by month-end? Have the goods been received by month-end? If yes and the company has not paid for the service or good by month-end, then the company has a payable.

In this post, we will cover the following:

  • Primary accounts payable and expenses assertions
  • Accounts payable and expense walkthroughs
  • Directional risk for accounts payable and expenses
  • Primary risks for accounts payable and expenses
  • Common accounts payable and expenses control deficiencies
  • Risk of material misstatement for accounts payable and expenses
  • Substantive procedures for accounts payable and expenses
  • Typical accounts payable and expense work papers

Primary Accounts Payable and Expense Assertions

The primary relevant accounts payable and expense assertions are:

  • Existence
  • Completeness
  • Cutoff
  • Occurrence

Of these assertions, I believe—in general—completeness and cutoff (for payables) and occurrence (for expenses) are most important. When a company records its payables and expenses by period-end, it is asserting that they are complete and that they are accounted for in the right period. Additionally, the company is implying that amounts paid are for legitimate purposes.

Accounts Payable and Expense Walkthroughs

As we perform walkthroughs of accounts payable and expenses, we are looking for understatements of accounts payable and expenses (though they can also be overstated as well). We are asking, “What can go wrong—whether intentionally or by mistake?” 

In performing accounts payable and expenses walkthroughs, ask questions such as:

  • Who reconciles the accounts payable summary to the general ledger?
  • What controls ensure the recording of payables in the appropriate period?
  • Who authorizes purchase orders?
  • How does the company vet new vendors?
  • Who codes invoices and how?
  • Do larger payments require multiple approvals?
  • Which employees record invoices into the general ledger? 
  • Who signs checks or makes electronic payments?
  • Is there adequate segregation of duties for persons:
    • Approving purchases,
    • Paying payables, 
    • Recording payables, and 
    • Reconciling the related bank statements
  • Which persons have access to check stock and where is it stored?
  • Who can add vendors to the payables system?
  • Who reconciles the bank statements and how often?

As we ask these questions, we inspect documents (e.g., payables ledger) and make observations (e.g., who signs checks or makes electronic payments?).

If controls weaknesses exist, we create audit procedures to respond to them. For example, if—during the walkthrough—we see that one person prints and signs checks, records payments, and reconciles the bank statement, then we will perform fraud-related substantive procedures (more about this in a moment).

Directional Risk for Accounts Payable and Expenses

The directional risk for accounts payable and expenses is an understatement. So, in performing your audit procedures, perform procedures to ensure that invoices are properly included. For example, perform a search for unrecorded liabilities (explained below).

Primary Risks for Accounts Payable and Expenses

The primary risks for accounts payable and expenses are:

  1. Accounts payable and expenses are intentionally understated 
  2. Payments are made to inappropriate vendors
  3. Duplicate payments are made to vendors 

Common Accounts Payable and Expense Control Deficiencies

In smaller entities, it is common to have the following control deficiencies:

  • One person performs two or more of the following: 
    • Approves purchases,
    • Enters invoices in the accounts payable system, 
    • Issues checks or makes electronic payments,  
    • Reconciles the accounts payable detail to the general ledger,
    • Adds new vendors to the accounts payable system
  • A second person does not review payments before issuance 
  • No one performs surprise audits of accounts payable and expenses 
  • Bidding procedures are weak or absent
  • No one reconciles the accounts payable detail to the general ledger
  • The vetting of new vendors does not occur
  • The company does not create a budget
  • No one compares expenses to the budget

When segregation of duties is lacking, consider whether someone can use the expense cycle to steal funds. How? By making payments to fictitious vendors. Or intentionally paying a vendor twice—and then stealing the second check.

Risk of Material Misstatement for Accounts Payable and Expenses

In smaller engagements, I usually assess control risk at high for each assertion. When I assess control risk at less than high, I have to test controls to support the lower risk assessment. Therefore, assessing risks at high is usually more efficient (than testing controls). 

When control risk is assessed at high, inherent risk becomes the driver of the risk of material misstatement (controls risk X inherent risk = risk of material misstatement). The assertions that concern me the most are completeness, occurrence, and cutoff. So my RMM for these assertions is usually moderate to high. 

My response to higher risk assessments is to perform certain substantive procedures: namely, a search for unrecorded liabilities and detailed expense analyses. 

Search for Unrecorded Liabilities

How does one perform a search for unrecorded liabilities?  Use these steps:

  1. Obtain a complete check register for the period subsequent to your audit period 
  2. Pick a dollar threshold for the examination of subsequent payments
  3. Determine if the period-end payables suitably include or exclude amounts by examining the subsequent payments and related invoices 
  4. Inquire about any unrecorded invoices 

As the RMM for completeness increases, vouch payments at a lower dollar threshold. 

How should you perform a detailed analysis of expense accounts? First, compare your expenses to budget—if the entity has one—or to prior year balances. If you note any significant variances (that can’t be explained), then obtain a detail of those particular expense accounts and investigate the cause. 

Theft can occur in numerous ways—such as duplicate payments or fictitious vendors. If you see control weaknesses in the expense cycle, consider performing fraud-related procedures. (For information about fraud prevention, check out my book on Amazon.) When fraud-related control weaknesses exist, assess the RMM for the occurrence assertion at high. Why? There is a risk that the expense (the occurrence) is fraudulent. So, how should you respond to such risks?

Auditing for Duplicate Payments

An example of a fraud-related test is one for duplicate payments. How? 

  • Obtain a check register in Excel 
  • Sort by the vendor
  • Scan the check register for payments made to the same vendor for the same amount
  • Inquire about payments to the same vendor for the same amount

In a duplicate payment fraud, the thief intentionally pays an invoice twice. He then steals the second check and converts it to cash.

Substantive Procedures for Accounts Payable and Expenses

My customary audit tests are as follows:

  1. Vouch subsequent payments to invoices using the steps listed above
  2. Compare expenses to budget and examine any unexplained variances 
  3. When control weaknesses are present, design and perform fraud detection procedures

Typical Accounts Payable and Expenses Work Papers

My accounts payable and expenses work papers frequently include the following:

  • An understanding of internal controls as they relate to accounts payable and expenses 
  • Risk assessment of accounts payable and expenses at the assertion level
  • Documentation of any accounts payable and expense control deficiencies
  • Accounts payable and expenses audit program
  • An aged accounts payable detail at period-end
  • Budget to actual expense reports
  • Fraud-related expense work papers (when needed)

So, now you know the why and how of auditing accounts payable and expenses.

Continuing Audit Series

This post is a part of my series titled the Why and How of Audits. If you’ve missed the previous series articles, click here

Next week, we’ll look at how to audit payroll. Subscribe below to see this audit series.

Learn from the CPA Scribo newsletter!

Get my free weekly accounting and auditing digest with the latest content.

Powered by ConvertKit

Please note: I reserve the right to delete comments that are offensive or off-topic.

Leave a Reply

Your email address will not be published. Required fields are marked *