Checklist 11.4: Accounts Payable Controls Risk Assessment
Risk
Rating
Management Controls
1. Does the financial institution log or number vendors invoices as they are
received, or use pre-numbered accounts payable vouchers which are
subsequently accounted for, in recording amounts due to vendors for goods and
services accepted?
2. Do persons, other than those who maintain the records of unmatched items,
match receiving documents with vendors’ invoices and follow up on longunmatched receipts?
3. Does a designated official review the results of follow-up on missing
documents?
4. Do persons, other than those who maintain the accounts payable control
account and subsidiary records, account for completeness of processing of
vendors invoices received or purchase vouchers, and follow-up on missing
documents?
5. Does a designated official review the results of follow-up on unmatched
receipts?
6. Does the financial institution use access control software or application
specific access controls, together with appropriate user password procedures
and physical controls over access to workstations, LANs, and online terminals,
to limit access to accounts payable processing to only those authorized?
7. Does the financial institution use pre-numbered journal entry forms and
account for all numbers each period?
8. Has the financial institution established control totals (e.g., totals of
appropriate columns in book of original entry) for posting to control accounts
before invoices are forwarded to the persons posting to the subsidiary records?
9. Do persons, other than those who prepare purchase orders or receiving
records, verify quantities billed by vendors with receiving documents and
purchase orders?
10. Do persons, other than those who prepare purchase orders or receiving
records, verify invoiced prices with approved purchase orders or agreements?
Yes
No
N/A
Risk
Rating
Management Controls
11. Do persons, other than those who prepare purchase orders or receiving
records, verify extensions and footings of invoices?
12. Do financial institution personnel periodically verify the mathematical
accuracy of summaries (e.g., by periodic refootings or agreement to
independent control totals) used as a basis for general ledger entries?
13. Does the financial institution ensure that invoices have been checked and
approved as being valid before posting of amounts to accounts payable control
account and subsidiary records?
14. Does a designated official, who did not participate in its preparation, review
and approve each journal entry?
15. Does a designated official review and approve vendors’ invoices and
vouchers prior to recording as accounts payable?
16. Does a designated official review exception reports on the verification and
checking of invoices and vouchers?
17. Do persons, other than those who (1) check or approve accounts payable
documents or (2) maintain the accounts payable control account, maintain the
accounts payable subsidiary records?
18. Does the financial institution maintain policy statements, procedures
manuals, organization charts, and/or other documentation that lists balances,
reports, activities, policies, and procedures that are to be substantiated, when
they are to be substantiated, how the results should be documented, and to
whom they should be communicated?
19. Does the financial institution periodically perform (by computer or users) a
reconciliation of the accounts payable subsidiary records with related control
accounts?
20. Do supervisory personnel review the results of the reconciliation and
investigate any exceptions?
21. Do persons, other than those who (1) maintain a manual accounts payable
control account, (2) keep unused checks, (3) prepare checks, (4) handle signed
checks, or (5) are involved in computer operations and programming,
Yes
No
N/A
Risk
Rating
Management Controls
periodically reconcile accounts payable subsidiary records with related control
accounts?
22. Does the financial institution periodically perform a reconciliation of the
accounts payable subsidiary records with vendors’ statements by persons with
no incompatible duties?
23. Does the financial institution compare recorded amounts of reserves and
accruals with subsequent transactions?
24. Does the financial institution maintain policies and procedures to provide
prompt follow-up on vendor complaints?
25. Do supervisory personnel periodically compare recorded balances with
budgeted amounts and prior periods?
Comments:
Yes
No
N/A