The Acquisitions Cycle

The acquisitions cycle exists in all types of entities—government, not-for-profit, and for profit. Some of the most common ordering, receiving, and warehousing internal control objectives are

•     authorization for the procurement of all goods and services at agreed-upon prices from approved vendors.

•     all goods and services received are recorded and classified correctly and accurately.

•     damaged or substandard goods are promptly identified and appropriate action is taken.

•     payment is made for goods and services received and they have requisite quality.

•     all goods are adequately safeguarded.

In many for profit entities, such as retail establishments and manufacturers, most transactions in the acquisitions cycle are for the procurement of either finished goods inventory for resale (retail establishments) or for raw materials inventory for production (manufacturers). These entities can also have a significant number of transactions for the procurement of services.

This section will address the ordering, receiving, and warehousing phases of a typical acquisitions cycle, noting where errors or fraud could occur, and presenting various types of internal controls to prevent and detect errors and irregularities. A control matrix will be presented to illustrate how controls can achieve relevant control objectives. Additionally, a fraud case is provided to illustrate this section's objectives.

Ordering

A typical acquisitions cycle's ordering, receiving, and warehousing phases are described as follows. Most entities will have variations to these examples within their own procurement processes, as it is appropriate to adjust controls to each entity's specific needs.

Assume that a large organization has numerous departments that use a variety of office supplies. A central purchasing department combines purchase requisitions from various departments in order to obtain quantity discounts on bulk purchases and also decrease the large amount of ordering and material handling costs that would be incurred if each department ordered its own supplies.

On a monthly basis, the departments within the large organization determine what supplies are needed by having a responsible employee observe the types and quantity of supplies on hand in the departmental supply rooms. A numerically sequenced purchase requisition is prepared by this employee and approved by the departmental manager. A copy of the purchase requisition is filed numerically in the requesting department and another copy is sent to the purchasing department.¹

The purchasing department accounts for the numerical sequence of purchase requisitions by department to provide assurance that no purchase requisitions are missing. All identical items that are requested by different departments are summarized. The purchasing department is the only department that can issue purchase orders, and purchase order forms are under the control of the purchasing department.

The purchasing department has a list of approved vendors for each item that is used by the various departments. This approved-vendors list is constructed based upon factors such as length of time from order to delivery, payment terms, prices, and the quality of goods provided.

Once a supplier has been identified, the purchasing department creates a four-part numerically sequenced purchase order. The purchase order is approved by an appropriate supervisory employee in the purchasing department and serves as a written authorization for the vendor to ship the requested goods to the customer. The purchase order is sent to the vendor, copies of the purchase order are distributed to accounts payable and receiving, and a copy is retained in the purchasing department.

Additionally, company policy prohibits purchasing personnel from receiving gifts or other types of remuneration from vendors. This company policy is distributed to all vendors each year. A review of a sample of the purchase prices paid by the purchasing department and quality of goods received is conducted by an individual outside of the purchasing department each month.

Some acquisitions systems in larger entities require purchase requisitions to be approved by management other than management in the department that requisitioned the goods or services. An alternative to this policy is to have purchase requisitions above a certain dollar amount be approved by management outside of the requisitioning department.

Larger entities also oftentimes rotate the purchasing agents and suppliers so that no one purchasing agent works consistently with the same supplier. There is oftentimes a policy whereby new vendors are investigated by personnel outside of the purchasing, receiving, warehousing, and accounts payable departments.

See exhibit 1-1 for a flowchart of ordering process, exhibit 1-2 for an example of a purchase requisition, and exhibit 1-3 for an example of a purchase order.²

Exhibit 1-1 A Typical Ordering Process

Exhibit 1-2 Purchase Requisition

Exhibit 1-3 Purchase Order

Receiving and Warehousing

When goods are received, receiving department personnel complete a four-part sequentially numbered receiving report. The receiving report includes information as to the number and quality of goods actually received (the number of goods received could be different from what was ordered due to numerous reasons such as the vendor being low on stock, theft of goods during shipment, and more). Exhibit 1-4 contains an example of a receiving report used by the United States General Services Administration (GSA).³ The person who receives and inspects the goods compares the purchase order number on the vendor's packing slip with the internal purchase order copy to provide assurance that the goods were actually ordered by an authorized individual. If the purchase order numbers do not agree or if the received goods are different from what is indicated on the purchase order then management is notified to resolve this error. The receiver's inspection of the goods provides assurance that the quality of goods received meets the organization's standards. The name of the person inspecting the goods is included on the receiving report and this employee can be contacted in case there are problems with either the quality or the amount of the purchased goods. Note that the GSA form has an option for a second person to inspect the goods; this would provide added assurance as to the quantity and quality of goods received.

What if purchased goods are damaged? Many receiving reports allow the receiver or inspector to note if goods received were either damaged or substandard in quality. A debit memo (the buyer's accounts payable is reduced) is issued to the vendor for these goods and the vendor will issue the buyer a credit memo (the vendor's accounts receivable is reduced). A copy of the debit memo is attached to the goods that are sent to the shipping department as authorization to ship the goods back to the vendor. A copy is also sent to accounts payable to adjust the vendor's invoice for the damaged or substandard goods.

What if purchased goods are okay? A copy of the receiving report is sent to accounts payable, purchasing, and the warehouse. Also, a copy of the receiving report is maintained in the receiving department as evidence of goods received. Accounts payable will match the receiving report, purchase order, and vendor invoice before payment is made for the goods. The purchasing department receives a copy of the receiving report and the open order is changed to filled status because the ordered goods have been received. Purchasing periodically reviews the outstanding purchase orders and investigates any long-outstanding orders.

The warehouse provides intermediate storage for the purchased goods. The goods are sent from the receiving department to the warehouse and the goods are counted again by warehouse personnel. The goods received are compared with the receiving report copy and the goods are stored. If there is a discrepancy between the number of goods noted on the receiving report and the number counted by warehouse personnel, then management is notified and the reason for the discrepancy is investigated and resolved.

Exhibit 1-4 Receiving Report

Access to the warehouse should be restricted to authorized employees and enforced by the use of locks and other physical safeguards. All employees should be issued identification cards that must be worn at all times. All employees should be required to pass through a security entrance where the employees' identification cards are either examined by security personnel or can be used to gain access to approved areas. Goods susceptible to theft should have additional physical access controls, such as being kept in a separate locked gated area of the warehouse. For example, a distributor of fine crystal and china may keep its more valuable items locked in a separate part of the warehouse that is under twenty-four hour camera surveillance. In addition, security guards may patrol the premises.

A physical inventory count of goods should be conducted at least annually and differences between the count and recorded amounts should be investigated promptly. The inventory process should be observed by personnel independent of the warehousing function and periodic test counts should be made by these independent personnel during the physical inventory.

A flowchart of the receiving and warehousing process is presented in exhibit 1-5.

Exhibit 1-5 Receiving and Warehousing Process

Variations of the Typical Acquisitions Cycle

There are numerous variations of the acquisitions process described previously, depending upon the size and type of entity. For example, a larger company might use the evaluated receipts settlement process (discussed subsequently) as their primary method of procurement. Many retail and manufacturing entities also have steps in the acquisitions process that are different from the examples described here. One method used by larger companies is the Evaluated Receipts Settlement (ERS) process as a basis for paying vendors. The ERS process does not require vendor invoices in order to make a payment to a supplier. Rather, payments are made based upon the matching of purchase orders and receiving reports. A key internal control aspect of this process is that vendors quote prices at the time orders are placed and the receiving department counts and inspects goods when they are received. Any differences between what was ordered and what was received are resolved by the trading partners.

The ERS process can also be incorporated with a just-in-time inventory system so that ordered goods are received as needed for production (manufacturing) or customer delivery (retail).

Manufacturing Environment

In a manufacturing environment raw materials are ordered based upon expected or actual demand. The traditional procurement process discussed previously can be employed to acquire raw materials. It should be noted that some manufacturers do not use the traditional method for raw materials procurement. Some manufacturers list their raw materials needs (including any specifications) at a website, then vendors submit competitive bids for the listed items.

Many large manufacturers will use the evaluated receipts settlement method described previously, for order processing. Still yet other manufacturers will use the traditional procurement method and make payment based upon the matching of a receiving report, invoice, and purchase order.

Regardless of the procurement process, eventually the warehouse will issue raw materials to production based upon receipt of a materials requisition form. The materials requisition form contains the standard bill of materials for a particular job or process.

A common control for job costs in a manufacturing environment is a cost accounting system where standards are established for raw materials, labor, and overhead. An important aspect of this control is that variances from standard are investigated by appropriate personnel.⁴

Two commonly used cost accounting variances that might be indicative of a kickback fraud from a supplier are the material usage and material price variances. The material usage variance is the difference between the standard quantity of materials that should have been used for the number of units actually produced and the actual quantity of materials used, valued at the standard cost per unit of material. If more material was used than was planned (an unfavorable materials usage variance), then an investigation should take place. There may be a number of events that could cause such a variance. An unfavorable materials usage variance might be explained due to the company having inadequately trained personnel. These personnel might use more than the standard amount of material needed due to the extensive rework that had to be done due to inadequate training. An unfavorable variance might also be explained by production having to use more material due to the vendor having supplied substandard materials. In yet another possible scenario, the vendor could have paid a kickback to purchasing personnel for authorizing the purchase of substandard raw materials.

The direct material price variance is the difference between the standard cost and the actual cost for the actual quantity of material used or purchased. The actual price paid might be higher than budgeted due to economic factors, such as an unexpected spike in demand for materials or a decrease in the supply of the raw materials. The price difference might also be due to the purchasing department having received a kickback from the vendor for paying more than the market price for the raw materials.

As mentioned previously, one possible control to mitigate the risk of vendor kickbacks is to have the prices paid periodically reviewed by an independent employee. Additionally, another employee could sample the received goods and evaluate the quality of the goods to provide assurance that the received goods met the specifications that were contained on the purchase order.

Retail Environment

In a retail environment goods are ordered based upon expected or actual demand. Retailers can use the typical acquisitions model described previously in the manufacturing section to acquire inventory. Still yet, many larger retail stores use another method to acquire inventory—vendor-managed inventory (a part of supply chain management).

In vendor-managed inventory, the manufacturer (the vendor in this example) is responsible for monitoring and maintaining the retailer's inventory levels. The manufacturer has access to the retailer's inventory data and is responsible for generating purchase orders.

The manufacturer receives electronic data (usually EDI on a private network or via the Internet) that informs the manufacturer of the retailer's sales and stock levels. The manufacturer can view every item that the retailer has in stock as well as point of sale data. The manufacturer is responsible for creating and maintaining the inventory plan. It is important to note that, under vendor-managed inventory, the manufacturer (vendor) generates the purchase order, not the retailer. A key aspect of vendor-managed inventory is the trading partner's agreement between the vendor and the customer, whose terms should include, among other items, dispute resolution procedures.

A major internal control issue with retail inventory is that oftentimes inventory is accessible to unknown third parties (customers) and thus is highly susceptible to theft. For example, a major shoe store chain's outlets have their inventory placed on shelves with access to all customers. The store does not have any surveillance cameras. The inventory does not have any sensor tags attached to the shoes that would activate an alarm if the perpetrator were to leave the store with un-purchased merchandise. It is unsurprising that many individuals have experienced shopping at such a shoe store, only to open a shoe box and find someone's old sneakers instead of the pricy boots that should have been there. A thief had gone into the shoe store, left his old shoes in the shoe box, and walked out in a new pair of shoes. A simple theft occurred when controls were lacking. It is also important to note that this discount shoe store may very well have performed an extensive cost analysis and concluded that the dollars lost due to theft may be less than expenses incurred to set up adequate controls to prevent such theft. In each process, a cost analysis should be performed when determining controls to implement (or not implement).

Services

Many entities will outsource service activities. Significant acquired services specifications (performance expectations, timetable, payment terms, and more) should be documented in a formal contract. An entity's supervisory personnel should monitor the provider's performance to provide assurance that the service meets the contractual requirements. Unlike the purchase of tangible assets, such as inventory, it is oftentimes difficult to obtain evidence that a service was actually provided. For example, at a construction site, the site superintendent can contract for clean-up services at the job site. It can sometimes be difficult to assess if this service was provided or not. The site superintendent could state that a clean-up service was provided when it really was not and submit a fictitious invoice for the clean-up fee. A control to mitigate this risk could be the use of a webcam at the jobsite to monitor activities and to provide evidence that the clean-up actually occurred. A budget can also be used to control the cost of the clean-up (or other services), thus keeping any possible fraud at a minimum.

Smaller Entity

Many smaller entities do not have the personnel resources to have adequate segregation of duties between purchasing, warehousing, receiving, and accounts payable. Some controls that might be implemented in a smaller environment would include requiring any purchase orders over a material amount to have a second approval by a member of management. All large receipts could also require an additional review by supervisory personnel. Management can walk through the warehouse or retail store and observe if categories of existing physical inventory correlate with their knowledge of purchases and sales. Inventory that is susceptible to theft could be placed under surveillance (use of cameras or webcams) or have access restricted through the use of keys and locks, or both. For example, at a jewelry store, the less expensive items may be displayed in a glass cabinet that can easily be broken (and the items stolen). The more expensive jewelry items are typically kept locked in a safe with the combination known only by select employees. An additional control in this example would be to count the inventory of the more expensive jewelry on a daily basis and the less expensive items perhaps weekly.

Internal Controls in the Ordering, Receiving, and Warehousing Processes

Errors, Fraud, and Controls

A plethora of errors and fraud could occur in the ordering, receiving, and warehousing phases of the acquisitions cycle if controls in the typical acquisitions system are not implemented. A few examples are provided in the following paragraphs.

A good exercise to help determine what a company's risks are in a given process is to perform a “what if” analysis. For example, what if there is not adequate separation of duties between the bookkeeping, authorization, access, and independent reconciliation functions? Any of the following can occur (the list is not exhaustive):

1.     If there is not a central purchasing department, then goods could be ordered by each individual department. Quantity discounts might not be obtained if each department is allowed to place its own order.

2.     If the receiving and warehousing functions are not separated (no separate warehousing function) then receiving could receive goods, steal some of the goods, and complete a receiving report indicating that all goods were received. (Note that under the typical acquisitions process, warehousing personnel make an independent count of goods obtained from the receiving department.)

      Receiving personnel could also be in collusion with the vendor and state that all goods were received when they were not. Receiving personnel could then be paid a kickback by the vendor, and the vendor could then send an invoice for all goods “received” by the customer.

      This fraud could be discovered when a physical inventory is taken by employees independent of the receiving or warehouse function. This fraud might also be discovered if sales were being made based upon data in the inventory system and the goods either were not available for delivery to the customer (retail store) or were not available for issuance to production.

      In a smaller entity the inventory “shortage” might be noticed when an owner tours the inventory storage area and assesses if the inventory on hand is consistent with his or her estimates based upon his or her knowledge of operations (sales and purchases).

3.     If purchasing receives goods (as opposed to a separate receiving or warehousing department) then purchasing could receive goods of a substandard quality and state that the goods met company specifications, meanwhile receiving kickbacks from the vendors.

      If the company is receiving substandard goods and is a retail store then a possible red flag for this type of fraud would be an increase in the amount of sales returns (due to substandard products). A separate customer complaint department may also summarize reasons for complaints, and those complaints due to substandard products would be investigated.

      If this is a manufacturing entity and the raw materials obtained are of a substandard quality, then a possible red flag would be the increase in the amount of warranty expense above budget due to customers having purchased products produced with substandard components.

4.     If the warehousing and receiving functions do not exist and if purchasing receives goods, then, similar to situation 2, purchasing personnel could state that goods were received when they were not and obtain a kickback from the vendor. Also, similar to situation 3, substandard goods could have been accepted.

      Additionally, received goods could be stolen and this would not be discovered until a physical inventory by independent personnel is conducted.

5.     If a physical inventory is conducted by warehouse personnel and if the physical inventory process is not observed by independent personnel who do test counts, then the warehouse personnel could steal inventory and include the amount of the stolen inventory in the physical inventory counts. A compensating control against the theft of inventory could include the use of webcams or other surveillance methods of the warehouse facility. Additionally, high-valued inventory could have additional physical access controls (kept in a locked gated area).

6.     Even if there is adequate separation of duties, the types of fraud discussed previously can occur if collusion exists between purchasing and receiving, purchasing and warehousing, receiving and warehousing, or all three. Rotating duties performed (or cross-training) by individuals can help prevent collusion – but there is no foolproof way to prevent it.

Other types of fraud or errors not due to inadequate separation of duties may occur. These are addressed as follows (the list is not exhaustive):

•     All purchase requisitions are numerically sequenced and are approved by departmental supervisory personnel. Departmental supervisory personnel might be presented with a large volume of purchase requisitions and sign off on requisitions without giving the requisition adequate attention if the purchase requisition is made by a “trusted” employee (oftentimes referred to as a “rubberstamp” approval). Errors could occur if the supervisor does not scrutinize all purchase requisitions. For example, the department supervisor might approve a purchase requisition for an amount of goods that is greater than the amount needed. Also the supervisor might grant approval for goods that the department does not use—but for goods the “trusted” employee receives and steals.

•     If the accounting for the numerical sequence of purchase requisition forms is not performed, then a departmental employee could steal a purchase requisition form and forge the supervisor's signature. When the requested supplies are received, the perpetrator could take the supplies. To cover his tracks, the perpetrator could also complete a receiving report and forward it to accounts payable. The departmental manager might discover this fraud when the manager is provided with a variance analysis report of goods used. Additionally, a physical observation of inventory would highlight this problem.

•     A purchase order form is used that is numerically sequenced. The purchase order that is issued to the vendor serves as written authorization for the purchase. Because the order is in written format, this should prevent potential disputes over pricing, quality of goods, or other issue from occurring. The accounting for the numerical sequence of the purchase order forms will highlight any forms that are out of sequence. If the purchase order forms are accessible to any employee, and not just the purchasing department, then a form can be stolen. If the accounting for the numerical sequence of the purchase forms control indicates that a form is missing, then this might be due to the theft of a purchase order form (perhaps by a purchasing department employee). A perpetrator could forge the authoring employee's signature on the purchase order form and then goods could be acquired from a valid vendor by a perpetrator. The perpetrator could pick up the goods at the vendor's place of business or have them shipped to a temporary address. This fraud would be discovered when the vendor sends an invoice to the company and accounts payable does not have a copy of the related purchase order or receiving report. However, the perpetrator would have already absconded with the goods, and the company most likely would be held liable for the goods that were stolen. If the purchase order forms are under the custody of the purchasing department, then this should help focus the investigation on employees in the purchasing department.

•     If there is not a list of approved vendors, then a vendor with a questionable reputation as to the quality of their products might inadvertently be selected to provide goods to the company. For example, a large toy manufacturer might outsource production to a vendor who produces toys that contain lead paint. Another issue is that a vendor could be selected that cannot meet a tight delivery schedule, and the company could lose sales.

•     If the receiving department does not inspect the goods, then the company might pay for goods of a substandard quality.

•     If the receiving department does not complete a receiving report, then the company might pay for goods that it never received.

•     Receiving personnel might miscount the received goods. If there is not a second count of received goods by either the warehouse department or another independent employee, then the company might pay for more inventory than it actually received.

•     If access to inventory is not controlled, then inventory can be stolen.

•     If the receiving department does not have a copy of the purchase order then goods that were not ordered might be accepted.

•     If warehouse personnel do not count the goods delivered to the warehouse by the receiving department, then there is no accountability in case there is an inventory shortage when a physical inventory is taken. It would be difficult to pinpoint whether the shortage occurred due to a miscount, theft of goods by the receiving department personnel, acceptance of miscounted goods, or inventory theft by the warehouse department personnel.

•     If there are no access controls to the warehouse storage area, then goods can be stolen, and this might not be detected until a physical inventory is taken.

•     If there was no company policy prohibiting employees from accepting gifts or other remuneration from vendors then the purchasing department might favor acquiring goods from those vendors who provide gifts instead of those who produce good products at market prices and meet promised delivery schedules.

•     If shipping orders for returned goods are not matched with vendor debit memos, then the company might return goods for which they have not reduced their liability to the vendor for the returned goods. The company might ultimately pay the vendor for the returned goods.

Control Matrix

An example of a control matrix that lists several controls presented in the ordering, receiving, and warehousing phases of the acquisitions process is presented in exhibit 1-6. Note that one control can achieve multiple objectives or assertions. Also note that additional controls are needed for quality and efficiency purposes (not just accounting purposes).

Summary

A typical acquisitions cycle's ordering, receiving, and warehousing processes were presented. Aspects of these processes that are somewhat unique to the manufacturing, retail, and service industries were also discussed.

Internal controls for each process were reviewed and the consequences of not having adequate controls, in terms of error and fraud, were presented. A sample control matrix showed that oftentimes one control can achieve several internal control objectives. Finally, a case was presented that illustrated how frauds could be perpetrated by different employees if internal controls were not present.