IIA-CIA-PART3 practice question 19 of 35

During a review of payments to supplier invoices, the internal auditor identified that the IT process allows invoice processing staff to ignore the…

During a review of payments to supplier invoices, the internal auditor identified that the IT process allows invoice processing staff to ignore the auto-generated alert triggered when the invoice amount is different from the purchase order value. The manager explained that staff must be able to bypass the alert because of small differences in transport charges. Which of the following would be the most appropriate internal audit recommendation?

Answer options

A: The alert is a control that should never be ignored, and suppliers should be advised that invoices will not be paid unless the invoice is equal to or less than purchase order value

B: The manager should raise a purchase order amendment each time the amounts differ, and the supplier should be asked to quote the amended order number in the invoice

C: The manager should establish a monetary limit on the amount of difference that will be tolerated, where the IT process will allow the staff to ignore the alert Correct answer

D: No additional controls are needed, as it is appropriate for a process to allow staff to exercise discretion when processing invoices

Correct Answer:

C. The manager should establish a monetary limit on the amount of difference that will be tolerated, where the IT process will allow the staff to ignore the alert

Explanation

The most appropriate recommendation balances operational efficiency with effective control. Allowing staff to bypass an alert for small, legitimate differences (like transport charges) is reasonable. However, this discretion must be controlled. Establishing a pre-approved monetary tolerance limit automates this control. The system would permit overrides below this threshold but require managerial review and approval for variances exceeding the limit. This prevents unlimited overrides, reduces the risk of significant unauthorized payments, and avoids the inefficiency of amending every purchase order for minor amounts.

Why Incorrect

A. This approach is too rigid and operationally inefficient. It ignores legitimate, minor business-related variances that are common in procurement processes.
B. This creates excessive administrative burden for small, routine variances, which is inefficient and not a value-added activity for either the organization or the supplier.
D. Allowing unlimited staff discretion is a significant control weakness. It creates an opportunity for both errors and fraudulent payments to go undetected.

References

1. The Institute of Internal Auditors (IIA). (2017). International Professional Practices Framework (IPPF). Standard 2130.A1 – Internal auditors must evaluate the adequacy and effectiveness of controls in responding to risks within the organization's governance, operations, and information systems regarding the reliability and integrity of financial and operational information. (Establishing a tolerance limit is a key control for financial information integrity).

2. Sawyer, L. B., Dittenhofer, M. A., & Scheiner, J. H. (2003). Sawyer's Internal Auditing: The Practice of Modern Internal Auditing (5th ed.). The Institute of Internal Auditors Research Foundation. Chapter 23, "Auditing the Procurement Function," discusses the importance of three-way matching (PO, receiving report, invoice) and the practical need for tolerance levels for minor discrepancies to ensure process efficiency.

Keep practicing

Take the free IIA-CIA-PART3 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test