RE: Accounts Receivable Confirmations

[Carlsen, David]

Title: Message

Melinda   One question I would have relates to your external audit.  Do you perform a lot of the testing for them?  Can you place more of your annual reliance on the Accounts Receivable substantive testing performed by the external auditors?  Or, do you feel that the coverage you receive from your external audit is inadequate for the level of assurance internal audit seeks?  It just seems like so much of this would also relate to your annual financial audit.  One tool that I've seen used in public accounting is a regression analysis in which certain variables are used to predict certain other variables.  A correlation coefficient of ___ % (usually 90%) is sought.  It is a fairly quick and valid way to perform analytical procedures on certain account balances.  I am unsure as to what software exists for internal auditors to perform such testing.  Maybe others would know.  -----Original Message----- From: Melinda Stinnett [mailto:[EMAIL PROTECTED]] Sent: Thursday, February 20, 2003 8:20 PM To: [EMAIL PROTECTED] Subject: Accounts Receivable Confirmations I have a question for you regarding AR confirmations.   At my company we spend (as internal audit) approximately 800 man hours per year on AR confirmations - yes, 800 man hours, and currently we employ about 7 full time auditors.  Obviously, that is a significant portion of our audit budget.  I am not sure we get the benefit for the amount of time spent.    Using those man hours, we send roughly 600 to 800 confirmations in the aggregate on a base of 650,000+ retail customers, and we experience a response rate of about 25%.  We now have approximately 300 districts which record their own sales, cash receipts, etc. and they maintain individual AR detailed trial balances and agings (there is no way to centralize or accumulate that information in total).   That means that at best each district on average gets 5 letters to its customer base during a two-year timeframe.    I am really uncertain as to the value lost if we spend say half the time or less to do a statistically valid sample and leave it at that.  The only thing I think we would need to do is carefully evaluate the type of other audit work we are doing to ensure we are covering our bases related to AR risks.   The risks I see with AR and the work we currently perform through site and desk audits are as follows:   Ø      The accounts receivable listing or individual balances may be inaccurate - we do not currently do any "build up" of balances, though we do a lot of sales/fuel ticket testing.  Ø      Accounts receivable balances may not exist - we review the AR aging for "unusual" accounts, but do not do anything else specifically on this outside of the confirmation process. Ø      Accounts receivable may not be collectible - we currently perform an aging review and inquire of specific customers with past due accounts.  We ask district management to justify why a write-off is not necessary in the case of aged or inactive accounts Ø      Bad debts write-offs may not be valid - we review credit memos issued and ensure proper approval is granted.  I am not sure we can say that we ensure the write-offs or credits are proper, though the auditors would be reading the reason for the credit at the time of the review.  This should be easily addressed by formalizing the procedure. Ø      Sales transactions may be processed in the wrong period - we do look at sales cut-off during our site and desk audit work   Some preliminary thoughts I have if we do indeed reduce the time spent on the confirmations would be to extend our sales testing to include testing the posting of the sale to the individual customer's account (in the cash work, we are tracing payments received to the proper customer account, so we would probably not need to do anything further there).  We lack the technology to do any "fun" tests as to customer existence (again, no common platform to pull from; one would have to query each district separately so there is not a good way to use ACL or another query technology), so I am not certain how to specifically tackle that risk.  I think we are well covered on the other items.   Any thoughts or advice you would be willing to share are much appreciated.    melinda