The Purchase Order That Never Existed
You are auditing Corvus Retail Ltd, a company with 40 stores and a central accounts payable function. The payables ledger shows 6,200 suppliers and a balance of $14.2m; materiality is $150,000. While testing a sample of 60 payments you find three payments, totalling $96,000, to a supplier 'Pinnacle Services Ltd' that was set up 14 months ago. For each: a purchase order exists, a goods received note exists, and the invoice matches the PO exactly - but the goods received notes are all signed by the same warehouse supervisor, the PO was raised by the same supervisor, and the bank account was changed on the supplier master file two weeks before the first payment by a user with the supervisor's login. The supervisor approved the new bank details. No other store has ever received goods from Pinnacle. The supervisor is on annual leave and cannot be reached.
1. Assess the risk indicators in this finding and determine the audit response, including the assertion(s) affected.
Read the worked answer
Risk assessment: This is a classic fictitious supplier / bank details fraud pattern. Indicators:
- Segregation of duties failure - the same individual raised the PO, signed the GRN, and approved the change of bank details. No independent check exists at any control point.
- Master file change - bank details changed shortly before first payment, by the same user, with no call-back verification to a known contact.
- Self-authorised change - the supervisor approved his own supplier amendment.
- New supplier, no trading history - 14 months old, single-store activity, no other store has received goods.
- Perfect three-way match - documents are internally consistent but all originate from the same person, so the match provides no independent assurance; it is circular evidence.
Assertions affected: Occurrence (payments/expenses), Existence (payables/expense), Rights and obligations, and Presentation/disclosure (related party if the supervisor is connected to Pinnacle).
Audit response (ISA 240 - presumed fraud risk in expenditure):
- Treat as a significant risk; extend testing.
- Obtain the full population of payments to Pinnacle and all suppliers added in the last 18 months; test each for genuine delivery (contact store managers, inspect stock records, delivery signatures from someone other than the supervisor).
- Inspect the supplier master file change log for all bank detail amendments and identify who approved each.
- Perform Companies House / registry search on Pinnacle to identify directors and shareholders - check for connection to the supervisor.
- Confirm the bank account directly with the bank, not via the supplier.
- Consider whether other supervisors have the same access; test the IT general controls over the supplier master file.
- Escalate to the engagement partner and, if fraud is indicated, to those charged with governance; consider the auditor's reporting responsibilities.
2. The client's finance director says the three-way match control operated and therefore no further work is needed. How do you respond, and what does this tell you about the design of the control?
Read the worked answer
The three-way match is a detective control that depends on the independence of the three documents. Here, all three documents were created or signed by the same person, so the match confirms only that one individual was internally consistent - it provides no assurance over occurrence. A control that can be defeated by a single user is poorly designed, not merely poorly operated.
Response to the FD: The control did not operate as designed because the design permits one user to originate the PO, the GRN and the master file change. Testing the control's operating effectiveness is therefore not meaningful for these transactions; substantive testing is required regardless.
Control design deficiency to report (ISA 265):
- No segregation between purchasing, goods receipt and supplier master maintenance.
- No independent authorisation of bank detail changes (should require a second approver and a call-back to a verified number).
- No review of master file change reports by a second person.
Documentation: record the deficiency, its potential effect ($96,000 found; extrapolate to the population), and a recommendation. Even if the amount is below materiality individually, the nature (fraud indicator) means it cannot be dismissed on size alone - consider qualitative materiality and the cumulative effect.