From Business Risk to Audit Procedure

An audit procedure is useful when someone can explain what risk it addresses and what its result would establish. “Check purchase documents” is an activity. It is not yet a defensible test.

The missing piece is traceability: a clear connection between the business event, the question being tested and the evidence needed to answer it.

Start inside the business

Consider an original fictional restaurant group. Its outlets receive packaging supplies throughout the month, while supplier invoices sometimes arrive later. Finance relies on a receiving report to identify transactions that may require recognition before the invoice is processed.

The business concern is broader than an accounting entry. Unresolved receipts can distort the view of obligations, complicate supplier reconciliation and make payment planning less reliable. For this exercise, the internal audit team narrows its objective to whether the month-end process identifies received supplies that belong in the relevant accounting period.

Assume the applicable contractual and accounting criteria have been established for this fictional engagement. Receipt alone does not settle the treatment of every transaction: ownership terms, returns, acceptance and other facts still matter.

Turn the concern into a testable claim

The specific financial reporting concern is completeness: an obligation that should be recorded may be missing. Testing only items already in the payable ledger is therefore an incomplete response. A missing item cannot be selected from a list that excludes it.

This is why the starting population matters. The team begins with receiving activity and follows qualifying items into the accounting records or a supported reconciliation disposition.

An assertion helps articulate the financial reporting claim in this example. For an operational engagement, the comparable question might concern delivery reliability or process timeliness rather than a financial statement assertion. Use the claim that fits the engagement objective.

Understand the control before choosing the test

The proposed control is a month-end review of receipts not yet matched to invoices. The reviewer examines unresolved items, determines their treatment and records a reason for each disposition.

A report being available is not evidence that this review operated. A signature is not enough to show that the reviewer investigated the exceptions or used a complete report.

Evaluate the control's design separately from its operation. Ask whether it can identify the relevant unmatched receipts, who resolves them, what information they use and how unresolved differences reach someone with authority to act.

Write a procedure another auditor could perform

A more precise procedure is: obtain the receiving population for the defined boundary period; assess its completeness and relevant fields; select items using a documented method; and trace qualifying receipts to a supported accounting treatment or reconciliation explanation.

Check the business meaning of document dates and system statuses. Establish whether cancelled, returned, duplicated or in-transit records belong in the population. Reconcile report totals or identifiers to an appropriate independent record where available, and investigate unexplained differences. Two reports built from the same underlying data may repeat the same omission; agreement alone does not establish independent corroboration.

For each selected item, retain the receiving reference, relevant contract or order terms, transaction facts, invoice or subsequent documentation, accounting reference and explanation of the period assessed. A later invoice may corroborate the transaction; its arrival date alone does not determine the earlier period's accounting.

If the objective also includes control operation, select review occurrences and inspect the actual follow-up separately. Do not assume a successful transaction trace proves that a monthly review was consistently performed.

Evaluate what the evidence supports

Suppose a selected receipt has no accounting reference. That is a reason to investigate, not an automatic finding. The item may have a valid exclusion, be recorded through another appropriate process, or reveal an actual omission.

Resolve contradictory evidence before concluding. A spreadsheet labelled “complete” cannot settle a disagreement with the underlying receiving records without further work.

If population completeness cannot be established, document that limitation and assess its effect on the assurance provided. Successful traces of selected items do not remove it. Report the result with its boundaries: which population and period were examined, how items were selected, what exceptions were resolved and what remains uncertain. Targeted selections should not be presented as a representative estimate of the whole population without a valid basis.

Preserve the reasoning, not just the documents

For this case, the chain is straightforward: missed obligations; completeness; unmatched-receipt review; receiving-to-accounting tracing; corroborated transaction support; and a conclusion limited to the work performed.

Try reversing the chain. Can the proposed conclusion be traced back to evidence, a suitable procedure and the original risk? If any link is missing, adding more documents will not necessarily repair the reasoning.