CS Professional · Internal and Forensic Audit

Internal Audit of Specific Functions: formula sheet

Full chapter guide

Key formulas

Three-way matching: Pay only if Purchase Order = Goods Receipt Note = Vendor Invoice (item, quantity, rate, terms); Some entities add a fourth match with the inspection or quality report. Differences beyond the set tolerance need approval before payment.
Segregation of duties in purchasing: Requisition ≠ Approval ≠ Ordering ≠ Receiving ≠ Invoice processing ≠ Payment; Where full separation is not possible, use compensating controls such as independent review.
Price variance: Price variance = (Invoice rate − PO rate) × Quantity invoiced; A positive result means overpayment against the agreed rate.
Quantity variance: Quantity variance = (Quantity invoiced − Quantity received) × PO rate; A positive result means you are billed for goods not received.
Inventory measurement rule: Carrying value = Lower of (Cost, Net Realisable Value); Applied item by item or to groups of similar items, as the accounting standard permits.
Net realisable value: NRV = Estimated selling price − Estimated cost of completion − Estimated cost to make the sale; For raw materials held for use, replacement cost may be the best evidence of NRV where the finished goods will sell above cost.
Inventory turnover: Inventory turnover = Cost of goods sold ÷ Average inventory; A falling ratio can signal slow-moving or obsolete stock.
Days inventory held: Days inventory = 365 ÷ Inventory turnover; Compare with past periods and industry norms.
Stock reconciliation: Closing stock = Opening stock + Receipts − Issues; Use it to reconcile bin card, stores ledger and physical count.
Book-to-physical difference: Difference = Physical quantity − Book quantity; Value it at cost. Investigate before any adjustment is approved.
Debtors turnover ratio: Net credit sales ÷ Average trade receivables; Higher means faster collection. Compare with prior periods and industry to spot slow recovery.
Average collection period: 365 ÷ Debtors turnover ratio (or Average receivables ÷ Net credit sales × 365); Compare with the credit terms given to customers. A longer period signals weak credit control.
Gross profit ratio: Gross profit ÷ Net sales × 100; A sudden fall may point to unauthorised discounts, pricing errors or cost misposting.
Net sales: Gross sales − Sales returns − Trade discounts allowed; Use to check that returns and discounts are properly deducted and approved.
Ageing of receivables: Group outstanding invoices by days past due (for example 0-30, 31-60, 61-90, over 90); Basis for assessing recoverability and provisioning for doubtful debts.
Revenue recognition core rule: Recognise revenue when control of goods or services passes to the customer, at the amount the entity expects to receive; Under Ind AS 115, the principle is a five-step model. Check cut-off at the period end.
Payroll reconciliation: Gross salary − Statutory deductions − Other deductions = Net pay; Net pay as per payroll must agree with the bank payment file and the salary payable in the books.
Headcount reconciliation: Opening headcount + Joiners − Leavers = Closing headcount; Closing headcount must match payroll employee count. A difference points to ghost employees or missed exits.
Payroll cost reconciliation: Payroll register total = Salary expense booked + Related accruals; Differences between register and ledger need explanation.
Segregation of duties rule: Hiring ≠ Master data change ≠ Payroll approval ≠ Payment release; These duties should sit with different people or approval levels.
Cost of an asset: Cost = Purchase price + Duties and taxes not recoverable + Freight and installation + Other directly attributable costs − Trade discounts; Recoverable GST input credit is not part of cost. Costs after the asset is ready for use, such as training or idle running, are generally not capitalised.
Straight-line depreciation: Annual depreciation = (Cost − Residual value) ÷ Useful life in years; Check that the method and useful life are applied consistently. Charge from the date the asset is available for use.
Written down value (WDV) depreciation: Depreciation for the year = Opening WDV × Rate; Rate is applied on the reducing balance. Additions during the year are depreciated for the period used.
Profit or loss on disposal: Profit or loss = Sale proceeds − Carrying amount (WDV) at the date of sale; A positive result is a profit. A negative result is a loss. Depreciate up to the date of sale first.
Three-way reconciliation: Asset register = General ledger = Physical count; Any difference must be investigated, explained and approved before adjustment.
Bank reconciliation: Balance as per cash book ± reconciling items = Balance as per bank statement; Reconciling items include cheques issued but not presented, cheques deposited but not credited, bank charges, direct credits and errors. Check for old unpresented items.
Current ratio (liquidity check): Current ratio = Current assets ÷ Current liabilities; Used to judge liquidity position. Interpret against the entity's industry and policy, not a fixed number.
Debt service coverage ratio: DSCR = Earnings available for debt service ÷ (Interest + Principal repayment due); Lenders often set a minimum in covenants. The auditor checks the covenant compliance calculation.
Interest accrual on borrowings: Interest = Principal × Rate × Time (years); Use to recompute interest expense and check accrued interest at the period end.
Foreign exchange gain or loss on settlement: Gain or loss = Foreign amount × (Settlement rate − Transaction rate); For a receivable, a higher settlement rate is a gain. For a payable, it is a loss.
Two layers of IT controls: IT controls = General controls (environment) + Application controls (each system); General controls support all applications; application controls are specific to one process.
Application control categories: Input controls → Processing controls → Output controls; Examples: validation checks, batch totals, reconciliation of outputs, exception reports.
ITGC areas to remember: Access security + Change management + Backup and recovery + IT operations + Business continuity; Use this as a checklist for any ITGC question.
Access principle: Least privilege + Segregation of duties + Periodic access review; Users get only the access their role needs, and no one controls a whole transaction cycle.
Recovery measures: RTO = maximum acceptable downtime; RPO = maximum acceptable data loss (measured in time); They guide backup frequency and the design of the recovery plan.
Material usage variance: (Standard quantity for actual output − Actual quantity used) × Standard price; A negative result means adverse variance, that is, excess use of material. Use it to test wastage claims.
Normal and abnormal wastage: Normal wastage % = (Normal loss ÷ Input) × 100; Normal loss is built into standard cost. Loss above the norm is abnormal and needs investigation. Do not treat both the same way.
Yield: Yield % = (Actual output ÷ Actual input) × 100; Compare with the standard yield. A fall in yield points to wastage, theft or process faults.
Rejection rate: Rejection rate % = (Units rejected ÷ Units inspected) × 100; A quality control measure. Track it by batch, line and period to spot trends.
Capacity utilisation: Capacity utilisation % = (Actual output ÷ Normal capacity) × 100; Low utilisation signals idle time, poor planning or breakdowns.
Compliance rate: Compliance rate % = (Requirements met on time ÷ Total requirements tested) × 100; A simple measure for reporting the result of testing a sample of filings.

Quick revision

Use the same flow for every function: objective, risk, control, test, finding, recommendation.
Purchase: check requisition, approval, vendor selection, order, goods receipt and invoice matching before payment.
Segregation of duties between ordering, receiving and paying is the main purchase control.
Inventory: check physical verification, records, valuation, slow-moving stock, safe custody and cut-off.
Sales: check credit approval, pricing, billing completeness, returns, discounts and collection follow-up.
Payroll: check that employees are genuine, changes are authorised and statutory deductions are correct and paid on time.
Fixed assets: check approval of capital spending, the asset register, physical verification, capitalisation and disposal.
Treasury: check authority limits, bank reconciliations, borrowing terms and investment policy compliance.
IT audit: separate general controls such as access and change management from application controls such as input and processing checks.
Production: review planning, capacity use, wastage, quality control and cost records.
A finding is complete only with the condition, criteria, cause, effect and recommendation.
In case answers, tie every conclusion to a fact given in the question.

Common mistakes

Listing controls without naming the risk they address. Fix: Write each point as risk, then control, then test. This shows audit thinking.
Confusing the internal auditor's role with approving purchases. Fix: Say the auditor reviews and recommends. Management owns approval and the controls.
Valuing inventory at cost without checking net realisable value Fix: Always compare cost with NRV for each item and write down only the shortfall on items where NRV is lower.
Adjusting book stock to physical stock straight away Fix: Investigate the cause first, check cut-off and unrecorded movements, and adjust only after approval by an authorised person.
Treating the audit as only a check of sales ledger totals. Fix: Cover operations too: policy compliance, pricing authority, credit approval and efficiency of collection.
Testing only from invoice to dispatch records. Fix: Test in both directions. Invoice to dispatch proves occurrence. Dispatch to invoice proves completeness, catching unbilled goods.
Treating payroll audit as only a recalculation of salaries. Fix: Cover the full cycle: hiring, master data, inputs, processing, payment, statutory dues and exit.
Ignoring employee master data changes. Fix: Test that changes in pay, bank account and status are authorised, documented and reviewed through a change log.
Writing only about physical verification and ignoring approval, capitalisation and disposal. Fix: Cover the full life cycle. Use the six headings every time.
Including recoverable GST input credit in the cost of an asset. Fix: Capitalise only non-recoverable taxes. Recoverable credit is excluded from cost.

Exam tips

Structure answers by stage of the cycle. It earns marks for completeness and is easy for the examiner to follow.
Use the case facts. Name the exact weakness, then give the control and the audit test.
Always mention segregation of duties, approval limits, vendor master control and three-way matching where relevant.
Do the arithmetic cleanly in numerical cases and show the check.
Close with recommendations and follow-up, as papers are written and case-based.
Write answers in the order of weakness, risk, procedure and recommendation. Examiners reward this structure in case questions.
If figures are given, compute NRV or the stock difference first and show each line. Marks are given for method.
Always name the standard rule for valuation (lower of cost and NRV) and say that the method must be applied consistently.