All-Around Sound Co. discovered a fraud whereby one of its front office administrative employees used company funds to purchase goods such as computers, digital cameras, and other electronic items for her own use. The fraud was discovered when employees noticed an increase in the frequency of deliveries from vendors and the use of unusual vendors. After some investigation, it was discovered that the employee would alter the description or change the quantity on an invoice in order to explain the cost on the bill.
What general internal control weaknesses contributed to this fraud?
Answer:
All-Around Sound Co. should not have relied on the unusual nature of the vendors and frequency of deliveries to uncover this fraud. The purchase and payment cycle is one of the most critical business cycles to control because the potential for abuse is so great. Purchases should be initiated by a requisition document. This document should be countersigned by a superior so that two people agree as to what is being purchased. The requisition should initiate a purchase order to a vendor for goods or services. The vendor responds to the purchase order by delivering the goods. The goods should be formally received using a receiving document. An accounts payable clerk matches the requisition, purchase order, and invoice before any payment is made. Such “triple
matching” prevents unauthorized requests and payments. In this case, the requests were unauthorized, suggesting that the employee has sole authority to make a request. Another issue is that this employee had access to the invoices. This access allowed the employee to change critical characteristics of the invoice to hide the true nature of the goods being received. The invoice should have been delivered directly to the accounts payable clerk to avoid corrupting the document. There apparently was no receiving document (common for smaller companies); thus, only the invoice provided proof of what was received and needed to be paid. If there had been a receiving report, the invoice could not have been doctored and gone undetected because it would not have matched the receiving report.