RE: Accounts Receivable Confirmations

[Guay, Larry J]

I question the need for confirms from an IA standpoint.  Unless your purpose is to verify the AR balance at particular date, as in an external audit, there are better means of testing controls and processes around the AR function.  The best proof of the validity of a receivable is subsequent payment by the customer.  If the customer billed later pays, then what do we gain by sending him a confirm in the interim?  Reviewing (and following up on) the aging reports, tracing payments from AR back to the cash received, and checking out credit memos and other adjustments tell me a lot more than sending a bunch of confirms, most of which will be ignored and the rest of which will probably require follow-up to track down some inconsistency that doesn't really exist.   To me, confirms are one of those things that it seems like auditors should do, like counting every petty cash box to make sure the $25 is really there.  There are other, much more meaningful, procedures that can and should be applied.  The time spent is not justified by the value added. -----Original Message----- From: Melinda Stinnett [mailto:[EMAIL PROTECTED]] Sent: Thursday, February 20, 2003 6:20 PM To: [EMAIL PROTECTED] Subject: Accounts Receivable Confirmations I have a question for you regarding AR confirmations.   At my company we spend (as internal audit) approximately 800 man hours per year on AR confirmations – yes, 800 man hours, and currently we employ about 7 full time auditors.  Obviously, that is a significant portion of our audit budget.  I am not sure we get the benefit for the amount of time spent.    Using those man hours, we send roughly 600 to 800 confirmations in the aggregate on a base of 650,000+ retail customers, and we experience a response rate of about 25%.  We now have approximately 300 districts which record their own sales, cash receipts, etc. and they maintain individual AR detailed trial balances and agings (there is no way to centralize or accumulate that information in total).   That means that at best each district on average gets 5 letters to its customer base during a two-year timeframe.    I am really uncertain as to the value lost if we spend say half the time or less to do a statistically valid sample and leave it at that.  The only thing I think we would need to do is carefully evaluate the type of other audit work we are doing to ensure we are covering our bases related to AR risks.   The risks I see with AR and the work we currently perform through site and desk audits are as follows:   �      The accounts receivable listing or individual balances may be inaccurate – we do not currently do any “build up” of balances, though we do a lot of sales/fuel ticket testing.  �      Accounts receivable balances may not exist – we review the AR aging for “unusual” accounts, but do not do anything else specifically on this outside of the confirmation process. �      Accounts receivable may not be collectible – we currently perform an aging review and inquire of specific customers with past due accounts.  We ask district management to justify why a write-off is not necessary in the case of aged or inactive accounts �      Bad debts write-offs may not be valid – we review credit memos issued and ensure proper approval is granted.  I am not sure we can say that we ensure the write-offs or credits are proper, though the auditors would be reading the reason for the credit at the time of the review.  This should be easily addressed by formalizing the procedure. �      Sales transactions may be processed in the wrong period – we do look at sales cut-off during our site and desk audit work   Some preliminary thoughts I have if we do indeed reduce the time spent on the confirmations would be to extend our sales testing to include testing the posting of the sale to the individual customer’s account (in the cash work, we are tracing payments received to the proper customer account, so we would probably not need to do anything further there).  We lack the technology to do any “fun” tests as to customer existence (again, no common platform to pull from; one would have to query each district separately so there is not a good way to use ACL or another query technology), so I am not certain how to specifically tackle that risk.  I think we are well covered on the other items.   Any thoughts or advice you would be willing to share are much appreciated.    melinda