Duplicate Vendor Payments: Management Wants the Finding Downgraded
Fieldwork identified 43 duplicate vendor payments totaling $1.4 million over 14 months. The root cause is a three-way-match control that is bypassed whenever an invoice is flagged "urgent" - roughly 6% of all invoices. Two of the duplicates, totaling $210,000, involve a vendor owned by the accounts payable manager's brother-in-law. Management's draft response calls the matter "an isolated processing error, immaterial at 0.3% of spend" and asks that the finding be moved out of the report's high-risk section into an appendix observation, because the audit committee meeting is open to the public. The CFO has recovered $900,000 and expects full recovery within two months.
1. Evaluate management's "isolated" and "immaterial" arguments.
Read the worked answer
Both arguments fail on the evidence already in hand.
"Isolated": the bypass mechanism applies to 6% of invoices - a recurring, designed-in workaround, not a one-off. A control that can be switched off by a label is a control design deficiency affecting the whole population, and 43 instances over 14 months is a pattern.
"Immaterial at 0.3% of spend": materiality is not only a percentage of spend. The relevant dimensions here are the control environment, the existence of a possible related-party transaction, and the deterrent/behavioural effect of an unrecorded bypass. Recovery of $900,000 is a mitigating factor in the financial consequence, not a reason to lower the significance of the control failure - and the loss was only detected by internal audit, not by management's own monitoring.
Rating logic: rate on likelihood (bypass available and used) × impact (financial loss plus control environment and related-party exposure), not on the net residual after recoveries. State the rating criteria in the report so the rating is not merely asserted.
2. How should the report be communicated, and what do you do about the related-party element?
Read the worked answer
Related party first, and separately. Escalate to the CAE the same day. Do not fold it into the general finding and do not wait for the report. Internal audit is not the investigator, but it must ensure the matter reaches those charged with governance promptly, because it engages the AP manager's objectivity and may be a fraud indicator under the organization's code of conduct. Recommend that the audit committee direct an independent review.
Report content: keep the finding at its assessed rating, with the criteria/condition/cause/effect/risk structure intact. Include management's response in the report as management's position, accurately attributed - the standards require the auditee's response to be presented, not that it be accepted.
Disagreement path: discuss with management; if unresolved, the CAE decides the final wording and rating, and the disagreement is disclosed to the audit committee. An open public meeting is not a valid reason to change a rating - if anything, public accountability argues for accurate reporting.
Confidentiality: handle the related-party detail through the appropriate governance channel, but do not suppress it.
3. Management proposes to delay issuing the report until all $1.4 million is recovered. How do you respond?
Read the worked answer
Decline, and explain why the premise is wrong.
Timeliness is a reporting attribute in its own right. The control deficiency remains open regardless of the recovery balance; a report issued after recovery would describe a state of affairs that no longer reflects the conditions found, and the 6% bypass would keep operating in the meantime.
What the report can do: state the amount identified, the amount recovered to date, the recovery plan and owner, and the target date - presented as an open management action plan subject to follow-up. That gives the audit committee complete information now and a commitment to monitor later.
Risk of delay: if the audit committee meets before the report is issued, members are asked to rely on a dashboard or verbal summary that omits a significant control failure. That is a communication failure independent of the finding itself.
If management still resists: the CAE raises the matter with the audit committee chair and documents the request and the response in the engagement file.