Document ID: chunk:federal_register_of_legislation:F2023C01130:body:0:p85
Version: federal_register_of_legislation:F2023C01130
Segment Type: other
Provision Reference: 
Character Range: 253638–256844

reviewing whether the expenses seem reasonable and within policy.  An example of an automated approval is when an invoice unit cost is automatically compared with the related purchase order unit cost within a pre-established tolerance level.  Invoices within the tolerance level are automatically approved for payment.  Those invoices outside the tolerance level are flagged for additional investigation.

           * Reconciliations – Reconciliations compare two or more data elements.  If differences are identified, action is taken to bring the data into agreement.  Reconciliations generally address the completeness or accuracy of processing transactions.

           * Verifications – Verifications compare two or more items with each other or compare an item with a policy, and will likely involve a follow-up action when the two items do not match or the item is not consistent with policy.  Verifications generally address the completeness, accuracy, or validity of processing transactions.

           * Physical or logical controls, including those that address security of assets against unauthorised access, acquisition, use or disposal.  Controls that encompass:

                   + The physical security of assets, including adequate safeguards such as secured facilities over access to assets and records.

                   + The authorisation for access to computer programs and data files (i.e., logical access).

                   + The periodic counting and comparison with amounts shown on control records (for example, comparing the results of cash, security and inventory counts with accounting records).

The extent to which physical controls intended to prevent theft of assets are relevant to the reliability of financial report preparation depends on circumstances such as when assets are highly susceptible to misappropriation.

           * Segregation of duties.  Assigning different people the responsibilities of authorising transactions, recording transactions, and maintaining custody of assets.  Segregation of duties is intended to reduce the opportunities to allow any person to be in a position to both perpetrate and conceal errors or fraud in the normal course of the person's duties.

For example, a manager authorising credit sales is not responsible for maintaining accounts receivable records or handling cash receipts.  If one person is able to perform all these activities the person could, for example, create a fictitious sale that could go undetected.  Similarly, salespersons should not have the ability to modify product price files or commission rates.

Sometimes segregation is not practical, cost effective, or feasible.  For example, smaller and less complex entities may lack sufficient resources to achieve ideal segregation, and the cost of hiring additional staff may be prohibitive.  In these situations, management may institute alternative controls.  In the example above, if the salesperson can modify product price files, a detective control activity can be put in place to have personnel unrelated to the sales function periodically review whether and under what circumstances the salesperson changed prices.

21.               Certain