Skip to content

CS Professional · Internal and Forensic Audit · Internal Controls

Kaveri Pharma Ltd's purchase manager can create vendors, approve purchase orders and also release vendor payments. Which COSO-type control activity is missing, and what is the main risk?

Segregation of duties is missing. One person handling vendor creation, order approval and payment release can make and hide a fraudulent payment, for example to a fictitious vendor, because no independent party checks the sequence of transactions.

  1. ASegregation of duties; one person can commit and conceal a fraudulent paymentCorrect
  2. BPhysical safeguarding of assets; inventory may be stolen
  3. CIndependent verification; payments may be delayed
  4. DAuthorisation limits; purchase orders may be too small

Explanation

Segregation of duties separates authorising, recording and custody or payment functions. When one person controls vendor creation, ordering and payment, a fictitious vendor can be paid and concealed. The other options address different controls and not the stated conflict.

Did you get it right without looking?

One question tells you little. A timed set on Internal Controls shows your real accuracy, how long you take and where you lose marks.

Practise Internal ControlsFree diagnostic mock

More Internal Controls questions