Audit Sample Failure: Receiving Reports, Split Orders, and Segregation of Duties
An internal audit sampled 60 obligations from a $180M O&M portfolio. Fourteen lacked a receiving report or acceptance evidence; eight were recorded after the period of performance began; and two were split into three orders of $49,000 each to avoid a $50,000 review threshold. The sample covered October through March and represented $42M of obligations. The audit also found that the same GS-12 employee certifies funds availability, approves payment requests in the accounting system, and reconciles the monthly obligation report. The activity's corrective action plan proposes annual training for all staff and a new policy memo. The commander wants to know whether the plan is adequate and what to fix first. The activity has 45 days before the next audit follow-up and a limited IT staff.
1. Assess the root causes of the audit findings using the components of internal control. Which findings are control deficiencies versus isolated errors?
Read the worked answer
The segregation-of-duties finding is a control-activity deficiency, not an isolated error. One employee certifies funds, approves payments, and reconciles the obligation report, which removes independent review over the entire transaction stream and creates both error and fraud risk. It also weakens the control environment because management has not established clear accountability.
The missing receiving reports are a control-activity failure in the three-way match. Fourteen of 60 samples, about 23%, is systemic, not isolated. The late obligations point to a monitoring and information-communication weakness: the activity is not detecting obligations recorded after performance begins. The split orders are a control-activity and monitoring failure; two instances may be isolated in number, but the pattern suggests deliberate circumvention of the $50,000 review threshold and should be treated as serious.
Annual training and a policy memo address awareness but not design. They do not create independent review, do not enforce a receiving report before payment, and do not detect split purchases. The root causes are weak preventive controls, insufficient monitoring, and unclear consequences for circumvention.
2. Prioritize corrective actions for the 45-day follow-up. Justify the order.
Read the worked answer
First, separate the duties immediately. Remove payment approval or reconciliation from the employee who certifies funds, or add an independent reviewer before payment. This is the highest priority because it affects every obligation and payment and is the most serious fraud-risk finding. It can be implemented through role changes and system access adjustments without waiting for new policy.
Second, impose a hold on payments without receiving report and acceptance evidence. Require a documented three-way match before certification and release. Third, investigate the split orders and review all orders just below $50,000 for the same vendor or requirement; if the split was deliberate, refer the matter for legal or integrity review. Fourth, implement a monthly monitoring routine that flags late obligations, missing receiving reports, and near-threshold orders.
Training and the policy memo should follow, not lead. They are useful for sustainment but will not satisfy the follow-up unless the activity can show the new controls are designed and operating. The corrective action plan should assign owners, dates, and a testing method for each action.
3. Design a test of the revised funds-certification control that the auditor could perform.
Read the worked answer
Define the population as all obligations recorded in the revised process for a defined period after implementation. Use a sample of 25 to 30 obligations, stratified to include services, high-dollar awards, and orders near the $50,000 threshold. For each obligation, inspect the funds certification to confirm it is signed and dated before the obligation was incurred. Trace the certification to the accounting system and verify that the appropriation, fiscal year, program element, and available balance were correct at the time.
Next, test segregation of duties by comparing system access roles with the certification and payment approvals for each transaction. Confirm that the certifying official did not also approve the payment or perform the reconciliation. Inspect receiving reports and acceptance evidence for the same sample, and verify the payment was not released before receipt.
Finally, run data analytics for split purchases: same vendor, same requirement, sequential order dates, and amounts just below the review threshold. Evaluate exceptions, determine whether they are isolated or systemic, and conclude on operating effectiveness. The test should include a walkthrough of the revised process so the auditor can see how the control is supposed to work before testing the sample.