Purchasing Cycle: Where Control Failure Becomes Financial Misstatement

A purchasing exception can travel into the accounts

Procure-to-pay connects business commitment, receipt, accounting and cash. A failure at one handoff can affect another team and a different account. Reviewing the cycle therefore means following the transaction, not only checking whether a document is signed.

Authorize the commitment

Confirm that the right person approved the purchase within delegated authority and that the supplier and terms are valid. An approval gap is a control exception; whether it caused a financial misstatement needs separate evidence.

Verify what was received

For goods, compare actual receipt with the order and the supplier's documentation. For services, obtain appropriate evidence of performance or acceptance. A signature with no supporting basis may conceal a quantity, quality or occurrence issue. Receipt evidence also helps establish the timing and nature of the transaction.

Recognize the obligation

At period-end, investigate unmatched receipts, outstanding invoices and other evidence of obligations under the applicable recognition policy. A missing invoice does not settle whether a liability or accrual is needed. Equally, physical receipt alone should not override contractual facts and the accounting framework.

Control the cash outflow

Check payment authorization, independent verification of supplier-bank changes through a trusted channel, duplicate identifiers and resolution of matching exceptions. A payment may be authorized but directed to an incorrect bank account; a genuine supplier invoice may still be paid twice. Test the evidence behind the control, not merely a status flag.

Classify and reconcile

Review whether expenditure belongs in the appropriate inventory, expense, asset or other account under the relevant policy. Reconcile the purchasing subledger, general ledger and cash movement. A correct total can conceal an incorrect classification or offsetting errors.

In a hypothetical month-end review, accepted services are not captured because the invoice arrives later. The audit question is whether an obligation existed, when it arose, what reliable evidence supports the amount, and how the applicable policy treats it. The invoice arrival date is only part of that assessment.

Controls such as matching, segregation and exception review are design examples, not a universal checklist. Their effectiveness depends on the process, systems, actual operation and evidence. A control failure is a warning to investigate; it is not by itself proof of a quantified misstatement.

Beyond the numbers. Inside the business.