The Trustworthy AP Clerk

The AP clerk holds all three legs of the cash-disbursement cycle:

• Asset custody: prints and mails checks.
• Recordkeeping: maintains the vendor master and enters invoices.
• Reconciliation: reconciles the bank account for most of the last five months.

That combination permits a classic scheme: create or alter a vendor, change its bank details, enter and approve the payment, print the check, then reconcile the bank statement so the payment appears legitimate - or conceal it. The reconciliation during the assistant controller's leave is the most serious element because it removes the one detective control that could catch the change.

The two payments to a vendor whose bank details were changed by the clerk without independent verification are a red flag, not a routine exception: the change was made by the person who also processes and reconciles payments. The audit should establish who changed the details, when, whether the vendor confirmed the change, and where the money went before treating this as a documentation gap. Consider expanding testing across the leave period and notifying the CAE and, through the CAE, the audit committee and legal counsel.

Size affects the form of segregation, not the need for it. In a 12-person team you cannot separate every function, so the objective shifts to making error, collusion, or concealment detectable through detective controls and independent verification.

Practical options:

• Vendor master changes require a second approver and an independent call-back to a previously known vendor number before bank details change.
• Positive pay, or bank confirmation of new payees.
• Reconciliation performed by someone outside AP (the controller, the assistant controller on return, or a rotating reviewer), with evidence of review.
• Check printing released only against an approved payment run, with the controller comparing signed checks to the approved list.
• Periodic independent review of the vendor master for new vendors, duplicate addresses or bank accounts, and employee details.
• Surprise audits of the function.

Also address the underlying cause: the assistant controller's five-month absence removed a key control and nobody covered it. That is a management failure, not a trustworthiness question. 'Completely trustworthy' is a character judgment, and character is not a control - controls exist for the case where trust is misplaced.

Classification depends on magnitude, likelihood, and whether any compensating control existed. Reconciliation performed by the same person who processes payments is a design deficiency with no compensating control during the leave, so it is at least a significant deficiency and should be assessed for material weakness if payment values and volume are large enough to permit material misstatement. Do not default to 'significant' without the numbers; document the amounts tested and the potential exposure.

Communication: report in writing to the controller and CFO, and to the audit committee. This is not an informal verbal comment. State the deficiency, the fraud opportunity, the specific evidence, and the recommended controls.

The two payments: treat them as a potential fraud indicator. Preserve evidence; determine whether the vendor was legitimate, whether goods or services were received, and whether the bank change was authorized. Internal audit investigates enough to establish the facts, then refers to management and legal per protocol. It does not confront the clerk or conduct an interview without the CAE and legal involvement. If fraud is confirmed, escalate immediately to the audit committee.