Order to Cash workflow controls

Control type

Preventative

Objective types

Existence, Accuracy

Functional requirement

Ability to approve or review a sales order before an issue, if it has certain characteristics

Control rationale

To review sales orders above a certain value limit or for certain customers or classes of customers

Why it matters

It is important to consider what the risk to be addressed is. Does this approval ensure that the sales orders don't have any mistakes? Or, are you trying to ensure that you monitor the amount of business that you do with certain customers?

Factors to consider

What kind of sales orders need to be approved?

• Certain customers
• Certain values
• Certain users
• Certain business units or entities
• Certain product types

Sage Intacct configuration

With access permissions and user types, only certain users can convert or approve a sales order.

Create a transaction definition for 'Sales Order Draft' that converts to an 'Approved Sales Order' transaction definition, where the convert is limited to certain users. Create a smart event to email a user when a new ‘Sales order Draft’ is created to notify them to approve.

Sage Intacct Help page

• Create a sales order
• Convert a sales transaction

Evidence for control

Configuration page in Sage Intacct

How to test

See workflow test.

Control type

Detective

Objective types

Completeness

Functional requirement

Ability to report on sales orders that have been created but not issued to the customer

Control rationale

Supports controls over the completeness of sales

Why it matters

There might be good reasons for not issuing a sales order immediately. So, it's important to ensure that this control is balanced in its approach. Otherwise, it could end up being an unnecessary administrative burden.

Factors to consider

• How often to perform this review
• How old a sales order can be before it's considered a potential problem

Sage Intacct configuration

Create a custom list view that's filtered by the appropriate transaction state:

1. Go to Order Entry > All > Other transaction activity > View transactions.

2. Select Manage views and then select Create new view.
3. Select filters in Step 3 and make sure that State is set to the appropriate value, such as Draft or Pending.

Sage Intacct Help page

Add a custom view to display list items

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how missing sales orders are identified and followed up.

Control type

Detective

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to report on open sales order by date

Control rationale

Supports controls on completeness of revenue. It identifies orders that have not yet been recorded as shipped so might have been fulfilled but not recorded or billed.

Why it matters

Depending on your process, you might have a few or a lot of open sales orders at any given time. Reviewing your open sales orders can address two risks:

• Sales orders that have been left open by accident and should be fulfilled
• Something has gone wrong and the sales order should have been closed or canceled.

Using this control near month or year end can be especially useful to ensure that sales are recorded in the correct period.

Factors to consider

• What are the valid reasons why sales orders might be open? Do you want to exclude those?
• How often to perform this review? How will you ensure that you're not reviewing the same open sales orders?
• What aging buckets should be used?

Sage Intacct configuration

Create a custom list view that's filtered by the appropriate transaction state:

1. Go to Order Entry > All > Other transaction activity > View transactions.

2. Select Manage views and then select Create new view.
3. Select filters in Step 3 and make sure that State is set to the appropriate value, such as Draft or Pending.

Sage Intacct Help page

Add a custom view to display list items

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how missing shipments or invoices are identified and followed up.

Control type

Preventative

Objective types

Existence, Accuracy

Functional requirement

Ability to approve or review a sales order before an issue, if it has certain characteristics

Control rationale

To review sales orders above a certain value limit or for certain customers or classes of customers

Why it matters

It is important to consider what the risk to be addressed is. Does this approval ensure that the sales orders don't have any mistakes? Or, are you trying to ensure that you monitor the amount of business that you do with certain customers?

Factors to consider

What kind of sales orders need to be approved?

• Certain customers
• Certain values
• Certain users
• Certain business units or entities
• Certain product types

Sage Intacct configuration

With access permissions and user types, only certain users can convert or approve a sales order.

Create a transaction definition for 'Sales Order Draft' that converts to an 'Approved Sales Order' transaction definition, where the convert is limited to certain users. Create a smart event to email a user when a new ‘Sales order Draft’ is created to notify them to approve.

Sage Intacct Help page

• Create a sales order
• Convert a sales transaction

Evidence for control

Configuration page in Sage Intacct

How to test

See workflow test.

Control type

Preventative

Objective types

Accuracy

Functional requirement

Sales orders can only contain pre-existing items with pre-existing prices

Control rationale

To enable controls over price overrides

Why it matters

This control is ensures sales people are not undermining the commerciality of the business through over-discounting. Consider the risk factors here. For example, what would drive a salesperson to adjust the price or try to create an inappropriate product?

Note that this is not strictly an accounting control (accounting controls focus on whether the sales is recorded at the correct price). If a salesperson offers an excessive discount, that's a commercial issue rather than an accounting issue. However, indirectly, if the sale price is below cost, then an auditor might raise a concern about the carrying value of inventory.

Factors to consider

• How you will ensure that this control is not circumvented?

• Are other limitations needed? For example, you might not want to allow all products to be selected by all people.

• Do you need pricing data to be adjustable upward?

• How is product and pricing data kept current?

Sage Intacct configuration

Configure Order Entry to enable standard price lists:

1. Go to Order Entry > Setup > Configuration.

2. Scroll to the Price and discounts subsection.
3. Select Price schedules.
4. Select Customer price lists, if applicable.

Configure sales order transaction definitions with the appropriate settings:

1. Go to Order Entry > Setup > More > Transaction definitions.

2. For each applicable sales order transaction definition:

   1. Select Edit next to the transaction definition.
   2. Scroll to the User overrides subsection in the Accounting section.
   3. Make sure that Line-item price is not selected.
   4. Select Track line-item discount or surcharge, if appropriate.

Sage Intacct Help page

• Price lists—Order Entry
• Transaction definitions—Order Entry

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration test.

The test should focus on the elements of the validation that ensure the integrity of financial reporting.

Control type

Preventative

Objective types

Accuracy

Functional requirement

Ability to define required fields before a sales order can be issued

Control rationale

To enable controls over completeness and adequacy of the information that's captured at the start of the sales process

Why it matters

Ensure that the mandatory fields are reasonable. Some of them are important from a financial perspective, such as payment terms. Others are more of an operational issue, such as recording the customer's needs.

Factors to consider

What fields will be mandatory on a sales order and what fields can be left as optional?

Sage Intacct configuration

Several fields are already required on sale orders. You can add custom fields. You can also use smart rules to require using fields that are critical to your business operations.

Sage Intacct Help page

• Custom fields
• Smart rules

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on the fields that are relevant for the purposes of the control framework, for example, financial reporting.

Control type

Detective

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to report on open sales order by date

Control rationale

Supports controls on completeness of revenue. It identifies orders that have not yet been recorded as shipped so might have been fulfilled but not recorded or billed.

Why it matters

Depending on your process, you might have a few or a lot of open sales orders at any given time. Reviewing your open sales orders can address two risks:

• Sales orders that have been left open by accident and should be fulfilled
• Something has gone wrong and the sales order should have been closed or canceled.

Using this control near month or year end can be especially useful to ensure that sales are recorded in the correct period.

Factors to consider

• What are the valid reasons why sales orders might be open? Do you want to exclude those?
• How often to perform this review? How will you ensure that you're not reviewing the same open sales orders?
• What aging buckets should be used?

Sage Intacct configuration

Create a custom list view that's filtered by the appropriate transaction state:

1. Go to Order Entry > All > Other transaction activity > View transactions.

2. Select Manage views and then select Create new view.
3. Select filters in Step 3 and make sure that State is set to the appropriate value, such as Draft or Pending.

Sage Intacct Help page

Add a custom view to display list items

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how missing shipments or invoices are identified and followed up.

Control type

Detective

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to report on deliveries that are overdue (by a selected period)

Control rationale

Supports controls on completeness of revenue by identifying overdue shipments

Why it matters

This control is not likely to be a financial reporting control, although it is part of demonstrating completeness of revenue. This control helps to ensure that all orders are shipped and billed. Ensuring that you fulfill orders on time is an important part of your shipment process.

The key to ensuring this works well is to make it part of a process of follow up that can be repeated, weekly or daily, without duplication. How will you ensure that the check doesn't cover the same items again and again, while using the most up-to-date information.

Factors to consider

• Do you have any terms with customers that result in financial penalties for a certain number of days overdue?
• What is the follow-up and resolution process for overdue shipments?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how shipments outside the threshold of acceptable delivery times are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on over and under deliveries

Control rationale

Supports control over accuracy of revenue

Why it matters

This control can address the following risks:

• The risk that the fulfillment process is not working well, which can lead to problems with customers.
• The risk that Invoices are incorrect, which can lead to incorrect revenue recognition. The accuracy of invoices depends on how they are created.

Factors to consider

• What is an acceptable variance on fulfillment quantity?
• How often will do the review?
• What actions will you take if you find differences?
• How will you differentiate the orders that have problems with the orders where the variance is acceptable? A variance might be acceptable if the customer will accept the variance or a future shipment will complete the sales order.
• Also see Review of closed sales orders with quantity variance.

Sage Intacct configuration

Use the Order Entry standard reports, which show a variety of information. Go to Order Entry > All > Reports.

You can also create custom reports to get more information, if needed.

Sage Intacct Help page

• Order Entry reports
• Custom Report Writer Wizard—CRWZ

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how fulfillment with inappropriate variances are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on closed deliveries where the delivery quantity did not match order quantity

Control rationale

Supports control over accuracy of revenue

Why it matters

This control can address the following risks:

• The risk that the dispatch process is not working well, which can lead to problems with customers.
• The risk that Invoices are incorrect, which can lead to incorrect revenue recognition. The accuracy of invoices depends on how they are created.
• The fraud risk that a person has incorrectly recorded shipments to customers to conceal theft or collusion with a customer (for example, to provide them with additional goods free of charge).

The difference between this control and Review of fulfillment quantity variance is that this control is for closed orders, which means that the invoice is likely to be issued with no further shipments.

Factors to consider

• What is an acceptable variance on dispatch quantity?
• How often will you do the review?
• What actions will you take if you find differences?
• How will you differentiate the orders that have problems with the orders where the variance is acceptable? A variance might be acceptable if the customer will accept the variance or a future shipment will complete the sales order.
• Also see Review of fulfillment quantity variance.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

• Order Entry reports
• Custom Report Writer Wizard—CRWZ

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how shipments with inappropriate variances are identified and followed up.

Control type

Detective

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to report on deliveries that are overdue (by a selected period)

Control rationale

Supports controls on completeness of revenue by identifying overdue shipments

Why it matters

This control is not likely to be a financial reporting control, although it is part of demonstrating completeness of revenue. This control helps to ensure that all orders are shipped and billed. Ensuring that you fulfill orders on time is an important part of your shipment process.

The key to ensuring this works well is to make it part of a process of follow up that can be repeated, weekly or daily, without duplication. How will you ensure that the check doesn't cover the same items again and again, while using the most up-to-date information.

Factors to consider

• Do you have any terms with customers that result in financial penalties for a certain number of days overdue?
• What is the follow-up and resolution process for overdue shipments?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how shipments outside the threshold of acceptable delivery times are identified and followed up.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Invoice values are automatically calculated based on order price and fulfillment.

Control rationale

Supports control over accuracy and existence of revenue

Why it matters

In most cases, populating the invoice directly from the dispatch quantity and the sales order price is sufficient. However, also consider the process and controls to ensure that changes can be made where needed, without circumventing this control.

• Sales orders that have been left open by accident and should be fulfilled
• Something has gone wrong and the sales order should have been closed or canceled.

Using this control near month or year end can be especially useful to ensure that sales are recorded in the correct period.

Factors to consider

• Will overrides need to be made? See Invoice change review.
• What is the process for dealing with orders that fail to populate automatically?

Sage Intacct configuration

Ensure that the transaction definition for the Sales Invoice and all workflow transactions that proceed it have these settings configured:

1. Transaction conversion includes the previous transaction in the workflow. For example, Sales Order or Shipper.
2. The Create Policy in the Document permissions section on the Security Configuration tab is set to 'Convert only'.

With this setup, the quantity and order unit price are transferred to the Sales Invoice during conversion.

Sage Intacct Help page

Order Entry

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on checking that the relevant fields are automatically populated.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on any overrides to automatic invoicing values

Control rationale

If the control for 'Automated population of invoices based on shipper quantity and sales order price' is not applicable this becomes more important.

Why it matters

Designing the process without the need for a lot of invoice changes is the best way to prevent inappropriate or erroneous changes to invoices. However, when changes are necessary, you might want to check them to ensure they are appropriate.

Also see Automated population of invoices based on shipper quantity and sales order price.

Factors to consider

• What will the likely volume of changes be? So, how often will this control need to be run?
• How will you identify the difference between valid changes and inappropriate changes?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate changes to invoices are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on any manually generated invoices

Control rationale

Control over accuracy and existence of revenue

Why it matters

Manual invoices are often used to bypass the main route, which is to dispatch quantities and sales order prices to automatically populate the invoices. Therefore, use this control to enforce the manual invoice policy.

Also use this control in conjunction with Restricted access to create manual invoices.

Factors to consider

• What will be the likely volume of manual invoices? So, how often will this control need to be run?
• How will you identify the difference between appropriate manual invoices and ones that should not have been raised?

Sage Intacct configuration

Create a separate 'Manual Invoice' transaction definition to make review and reporting easier.

Sage Intacct Help page

Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate manual invoices are identified and followed up.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to restrict access to creating manual invoices

Control rationale

Supports controls over override to billing

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

You can use this control in conjunction with Manual invoice listing review.

Factors to consider

Are there any specific people who need to be prevented from having this access for segregation of duties reasons?

Sage Intacct configuration

Create a 'Manual Invoice' transaction definition that has restricted access to certain users.

1. Go to Order Entry > Setup > More > Transaction definitions.

2. Select Edit next to applicable transaction definition.
3. Select the Security configuration tab and scroll to the User and group permissions section.
4.  Select Enable permissions for specific users or groups.
5. Use the fields and table that appear to restrict access to certain users or groups.

Sage Intacct Help page

Add or edit a transaction definition—Order Entry

Evidence for control

Access role design

How to test

See restricted access control test.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Invoice values are automatically calculated based on order price and fulfillment.

Control rationale

Supports control over accuracy and existence of revenue

Why it matters

In most cases, populating the invoice directly from the dispatch quantity and the sales order price is sufficient. However, also consider the process and controls to ensure that changes can be made where needed, without circumventing this control.

• Sales orders that have been left open by accident and should be fulfilled
• Something has gone wrong and the sales order should have been closed or canceled.

Using this control near month or year end can be especially useful to ensure that sales are recorded in the correct period.

Factors to consider

• Will overrides need to be made? See Invoice change review.
• What is the process for dealing with orders that fail to populate automatically?

Sage Intacct configuration

Ensure that the transaction definition for the Sales Invoice and all workflow transactions that proceed it have these settings configured:

1. Transaction conversion includes the previous transaction in the workflow. For example, Sales Order or Shipper.
2. The Create Policy in the Document permissions section on the Security Configuration tab is set to 'Convert only'.

With this setup, the quantity and order unit price are transferred to the Sales Invoice during conversion.

Sage Intacct Help page

Order Entry

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on checking that the relevant fields are automatically populated.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on any overrides to automatic invoicing values

Control rationale

If the control for 'Automated population of invoices based on shipper quantity and sales order price' is not applicable this becomes more important.

Why it matters

Designing the process without the need for a lot of invoice changes is the best way to prevent inappropriate or erroneous changes to invoices. However, when changes are necessary, you might want to check them to ensure they are appropriate.

Also see Automated population of invoices based on shipper quantity and sales order price.

Factors to consider

• What will the likely volume of changes be? So, how often will this control need to be run?
• How will you identify the difference between valid changes and inappropriate changes?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate changes to invoices are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on any manually generated invoices

Control rationale

Control over accuracy and existence of revenue

Why it matters

Manual invoices are often used to bypass the main route, which is to dispatch quantities and sales order prices to automatically populate the invoices. Therefore, use this control to enforce the manual invoice policy.

Also use this control in conjunction with Restricted access to create manual invoices.

Factors to consider

• What will be the likely volume of manual invoices? So, how often will this control need to be run?
• How will you identify the difference between appropriate manual invoices and ones that should not have been raised?

Sage Intacct configuration

Create a separate 'Manual Invoice' transaction definition to make review and reporting easier.

Sage Intacct Help page

Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate manual invoices are identified and followed up.

Control type

Preventative

Objective types

Existence, Accuracy

Functional requirement

Ability to integrate with third-party tax engines for country tax, state and local tax, and similar calculations.

Control rationale

Ensures consistent application of tax and supports optimization of cash collection and related cash flows.

Why it matters

Where companies operate in markets where local tax rules are complex or rapidly changing, maintaining those tax rules in a core finance system can be hard to do and prone to error. In these cases it might be worthwhile to use local tax engines to calculate taxes and duties.

Factors to consider

Are you subject to complex or rapidly changing tax regimes (such as US state & local tax)

Sage Intacct configuration

There are several options for configuration of automated tax calculations, posting, and reporting. Each organization should review the options relevant to the compliance requirements.

Sage Intacct Help page

Sales tax, VAT, and GST

Evidence for control

Will usually be held in documentation for the tax engine. Users should not have access to manually maintain tax rates maintained by tax engines (as this would allow them to override).

How to test

See configuration test (for configuration of tax rates) and access control test (where access should be restricted).

Control type

Detective

Objective types

Completeness, Accuracy

Functional requirement

Ability to reconcile tax control accounts both within Sage Intacct and make data available to external reconciliation engines for tax reconciliation.

Control rationale

Ensures consistent application of tax and supports optimization of cash collection and related cash flows.

Why it matters

A tax control account reconciliation is important to make sure that the tax balance is correct and/or the tax submission is correct. The former is done by checking the tax balance to any expectations (practicality will prevent a review of all tax transactions), while the latter is done by checking the tax balance to the tax submission, where this is done based on data outside the system.

Factors to consider

• What are the thresholds for reconciling items? What will you do if there's for example, a single dollar difference?

• Control account reconciliation is often part of the wider process of balance sheet reconciliations - applying a consistent approach to all reconciliations should be considered.

Sage Intacct configuration

Configurations will vary per tax solution.

Sage Intacct Help page

Sales tax, VAT, and GST

Evidence for control

Reconciliation documentation, including reconciling items and follow-up.

How to test

See reconciliation control test.

Control type

Detective

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to report on deliveries that are overdue (by a selected period)

Control rationale

Supports controls on completeness of revenue by identifying overdue shipments

Why it matters

This control is not likely to be a financial reporting control, although it is part of demonstrating completeness of revenue. This control helps to ensure that all orders are shipped and billed. Ensuring that you fulfill orders on time is an important part of your shipment process.

The key to ensuring this works well is to make it part of a process of follow up that can be repeated, weekly or daily, without duplication. How will you ensure that the check doesn't cover the same items again and again, while using the most up-to-date information.

Factors to consider

• Do you have any terms with customers that result in financial penalties for a certain number of days overdue?
• What is the follow-up and resolution process for overdue shipments?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how shipments outside the threshold of acceptable delivery times are identified and followed up.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Invoice values are automatically calculated based on order price and fulfillment.

Control rationale

Supports control over accuracy and existence of revenue

Why it matters

In most cases, populating the invoice directly from the dispatch quantity and the sales order price is sufficient. However, also consider the process and controls to ensure that changes can be made where needed, without circumventing this control.

• Sales orders that have been left open by accident and should be fulfilled
• Something has gone wrong and the sales order should have been closed or canceled.

Using this control near month or year end can be especially useful to ensure that sales are recorded in the correct period.

Factors to consider

• Will overrides need to be made? See Invoice change review.
• What is the process for dealing with orders that fail to populate automatically?

Sage Intacct configuration

Ensure that the transaction definition for the Sales Invoice and all workflow transactions that proceed it have these settings configured:

1. Transaction conversion includes the previous transaction in the workflow. For example, Sales Order or Shipper.
2. The Create Policy in the Document permissions section on the Security Configuration tab is set to 'Convert only'.

With this setup, the quantity and order unit price are transferred to the Sales Invoice during conversion.

Sage Intacct Help page

Order Entry

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on checking that the relevant fields are automatically populated.

Control type

Preventive

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to automatically match receipts to invoices within predefined tolerance limits

Control rationale

Supports controls over bad debts and existence of revenue

Why it matters

Suggested matches, if used, are not a guarantee of the matches being correct. Think about the process of matching and ensure that this control is one contributing factor to ensure accurate matching.

Factors to consider

How to define tolerance thresholds that are in line with your company's policy?

Sage Intacct configuration

Sage Intacct configuration is set as a default to make automatic payment suggestions, matching customer payments to open invoices.

Sage Intacct Help page

Set up auto-apply for payments, credits, and discounts

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

Control type

Preventive

Objective types

Completeness

Functional requirement

Cash amounts can only be allocated once.

Control rationale

Supports controls over the accuracy of cash balances. Matching cash receipts more than once could be used to conceal fraud, including customer collusion.

Why it matters

While an important factor to consider, this control is most likely assumed by all users as a logical requirement.

Factors to consider

Not applicable

Sage Intacct configuration

Standard bank reconciliation functionality

Sage Intacct Help page

Reconciliation

Evidence for control

Code within system, which indicates ‘matched’ during reconciliation and ‘cleared’ when reconciliation is complete

How to test

See configuration control test.

The three-way match functionality should be tested, along with any threshold for acceptance and blocking of invoices above the threshold.

Control type

Preventive

Objective types

Completeness, Accuracy, Cut-off

Functional requirement

Ability to automatically match receipts to invoices within predefined tolerance limits

Control rationale

Supports controls over bad debts and existence of revenue

Why it matters

Suggested matches, if used, are not a guarantee of the matches being correct. Think about the process of matching and ensure that this control is one contributing factor to ensure accurate matching.

Factors to consider

How to define tolerance thresholds that are in line with your company's policy?

Sage Intacct configuration

Sage Intacct configuration is set as a default to make automatic payment suggestions, matching customer payments to open invoices.

Sage Intacct Help page

Set up auto-apply for payments, credits, and discounts

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on any unallocated cash

Control rationale

Unallocated cash can be used to conceal fictitious invoices and revenue.

Why it matters

A review of unallocated cash will likely be performed very frequently as users try to resolve receipts that aren't very clear or that come from unexpected places. These daily or weekly reviews do not necessarily need to be formalized because they are operational in nature.

At month end, however, you can do an unallocated cash review to ensure the month-end receivables position is accurate and not overstated.

Factors to consider

• Consider the whole allocation process. What are the reasons for unallocated cash, and how will this control identify the ones that are problems?
• At what point in the process will this control be run?

Sage Intacct configuration

Standard bank reconciliation report that shows unreconciled transactions

Sage Intacct Help page

Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how problematic unallocated cash items are reviewed and followed up.

Control type

Detective

Objective types

Existence, Accuracy, Valuation

Functional requirement

Ability to accrue for any conditional discounts, incentives, or rebates

Control rationale

Controls over accounting for conditional discounts, incentives, or rebates

Why it matters

The production of a report is a process and not a control. If the accrual is automatically calculated based on terms in the system, then it's a control. Otherwise, a manual calculation, which might dependent on a report, that leads to a journal posting is needed. However, review of the system-based report and checking against contracts can be used as an IT dependent manual control over this difficult area.

Sage Intacct configuration

Set up price schedules to automate the calculation and application of conditional discounts, incentives, or rebates.

Sage Intacct Help page

Price schedules—Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should be carefully designed to ensure the control objective is met and is not just a general check that some kind of review happened.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to restrict access to those who can enter customer returns

Control rationale

Controls over fraud and collusion with customers

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

This control is primarily for fraud control, but also prevents the inappropriate use of returns instead of adjusting invoices.

Use this control in conjunction with Review of customer returns.

Factors to consider

• Who needs to be restricted to prevent fraud?
• Are other restrictions needed, such as by entity?

Sage Intacct configuration

Create a 'Returns' transaction definition that has restricted access to certain users.

1. Go to Order Entry > Setup > More > Transaction definitions.

2. Select Edit next to applicable transaction definition.
3. Select the Security configuration tab and scroll to the User and group permissions section.
4.  Select Enable permissions for specific users or groups.
5. Use the fields and table that appears to restrict access to certain users or groups.

Sage Intacct Help page

Add or edit a transaction definition—Order Entry

Evidence for control

Configuration page in Sage Intacct

How to test

See restricted access control test.

Control type

Detective

Objective types

Existence, Accuracy, Completeness

Functional requirement

Ability to report on value of customer returns by customer or person recording the return and other criteria

Control rationale

Monitoring controls over levels of returns.

Why it matters

This control can address the following risks:

• Deliveries are incorrect. This operational consideration ensures that the fulfillment process is working and that the quality is appropriate.
• Returns are inappropriate. Appropriate returns ensure that no one is accidentally crediting customers too much or fraudulently entering returns.

Design this review to identify follow-up items for both risks. Be careful of the danger of it becoming a generalized review where it is not easy to evidence how the control addresses the risks.

Factors to consider

• Given the likely volume and value of customer returns, ensure that this control focuses on the right areas to identify problematic returns, rather than it simply being an operational review of customer return volumes.
• To address completeness, an overall comparison of return levels to expected returns would need to be carried out.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Price schedules—Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate returns are identified and followed up.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Ability to restrict access to creating credit notes

Control rationale

Control over accuracy and existence of revenue

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

Use this control in conjunction with Credit note approval workflow and Credit note listing review.

Factors to consider

• Who needs to be restricted to prevent fraud?
• Are other restrictions needed, for example, by entity?

Sage Intacct configuration

You can create transaction definitions (for example, Customer Refund) that have restricted access to certain users.

1. Go to Order Entry > Setup > More > Transaction definitions.

2. Select Edit next to applicable transaction definition.
3. Select the Security configuration tab and scroll to the User and group permissions section.
4.  Select Enable permissions for specific users or groups.
5. Use the fields and table that appears to restrict access to certain users or groups.

Sage Intacct Help page

Add or edit a transaction definition—Order Entry

Evidence for control

Access role design

How to test

See restricted access control test.

Control type

Preventative

Objective types

Existence, Accuracy

Functional requirement

Credit notes require approval before being issued to customer or applied to customer account

Control rationale

Control over completeness of revenue and over fraud (collusion with customer to provide fictitious credit notes).

Why it matters

Without an appropriate level of review and approval for credit notes that are raised, fraud or errors can result in financial loss to the company.

Factors to consider

Is there a minimum level for which approval is needed, but below which no approval is required?

Sage Intacct configuration

Tracking customer credit balances:

1. Create a General Ledger suspense account that is set up to require both Customer and Vendor dimension posting.
2. Confirm both the Customer and Vendor dimensions are enabled in Accounts Payable, Accounts Receivable, Purchasing, and Order Entry.
3. The remainder of the setup steps depend on which applications your organization uses:

• Order Entry and Purchasing

4. Create a ‘Customer Refund’ Order Entry transaction definition (Return type) that posts the credit entry against the suspense account.
5. Create a non-posting ‘Issue Credit Refund’ Purchasing transaction (Requisition type) with an appropriate Approval Policy applied.
6. Create a ‘Customer Refund’ Purchasing transaction definition (Invoice type) which posts the debit entry against the suspense account

• Order Entry and Accounts Payable

4. Create a ‘Customer Refund’ Order Entry transaction definition (Return type) that posts the credit entry against the suspense account.
5. Transact with an AP Bill that posts the debit entry against the suspense account and enable AP Bill approvals as appropriate.

• Accounts Receivable and Accounts Payable

4. Transact with an AR Adjustment that posts the credit entry against the suspense account.
5. Transact with an AP Bill that posts the debit entry against the suspense account and enable AP Bill approvals as appropriate.

When posting transactions, ensure that each line has both the correct associated Customer and Vendor dimension record.

Sage Intacct Help page

Customer refunds overview

Evidence for control

Approval workflow audit trail that indicates the raisers and approvers.

How to test

See workflow control test.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on credit notes by various selection criteria

Control rationale

Credit notes can be used to support fraud, for example, through collusion with the customer. Credit notes can also conceal the impact of other control failings in the Order to Cash process, for example, failure of pricing controls.

Why it matters

This control is a review of all credit notes to ensure that they’re valid. This should be a relatively small list. However, if it's unmanageable or inefficient to check all of them, think about the criteria that you want to apply to find problematic credit notes, such as value, user who created it, customer.

Factors to consider

• How will you identify what constitutes an error, misstatement or fraud?
• How will you ensure that this review is done consistently each time it is performed?
• You might want to split this out by entity or amount. How will you ensure that everyone does this consistently? Will there be central organization and monitoring of the reviews?
• How will you ensure that the person signing off is not responsible for raising credit notes? Consider either a secondary check or ensuring that the reviewer does not have access to raise credit notes.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate credit notes are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy, Valuation

Functional requirement

Ability to accrue for any conditional discounts, incentives, or rebates

Control rationale

Controls over accounting for conditional discounts, incentives, or rebates

Why it matters

The production of a report is a process and not a control. If the accrual is automatically calculated based on terms in the system, then it's a control. Otherwise, a manual calculation, which might dependent on a report, that leads to a journal posting is needed. However, review of the system-based report and checking against contracts can be used as an IT dependent manual control over this difficult area.

Sage Intacct configuration

Set up price schedules to automate the calculation and application of conditional discounts, incentives, or rebates.

Sage Intacct Help page

Price schedules—Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should be carefully designed to ensure the control objective is met and is not just a general check that some kind of review happened.

Control type

Detective

Objective types

Existence, Accuracy, Completeness

Functional requirement

Ability to report on value of customer returns by customer or person recording the return and other criteria

Control rationale

Monitoring controls over levels of returns.

Why it matters

This control can address the following risks:

• Deliveries are incorrect. This operational consideration ensures that the fulfillment process is working and that the quality is appropriate.
• Returns are inappropriate. Appropriate returns ensure that no one is accidentally crediting customers too much or fraudulently entering returns.

Design this review to identify follow-up items for both risks. Be careful of the danger of it becoming a generalized review where it is not easy to evidence how the control addresses the risks.

Factors to consider

• Given the likely volume and value of customer returns, ensure that this control focuses on the right areas to identify problematic returns, rather than it simply being an operational review of customer return volumes.
• To address completeness, an overall comparison of return levels to expected returns would need to be carried out.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Price schedules—Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate returns are identified and followed up.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Ability to restrict access to creating credit notes

Control rationale

Control over accuracy and existence of revenue

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

Use this control in conjunction with Credit note approval workflow and Credit note listing review.

Factors to consider

• Who needs to be restricted to prevent fraud?
• Are other restrictions needed, for example, by entity?

Sage Intacct configuration

You can create transaction definitions (for example, Customer Refund) that have restricted access to certain users.

1. Go to Order Entry > Setup > More > Transaction definitions.

2. Select Edit next to applicable transaction definition.
3. Select the Security configuration tab and scroll to the User and group permissions section.
4.  Select Enable permissions for specific users or groups.
5. Use the fields and table that appears to restrict access to certain users or groups.

Sage Intacct Help page

Add or edit a transaction definition—Order Entry

Evidence for control

Access role design

How to test

See restricted access control test.

Control type

Preventative

Objective types

Existence, Accuracy

Functional requirement

Credit notes require approval before being issued to customer or applied to customer account

Control rationale

Control over completeness of revenue and over fraud (collusion with customer to provide fictitious credit notes).

Why it matters

Without an appropriate level of review and approval for credit notes that are raised, fraud or errors can result in financial loss to the company.

Factors to consider

Is there a minimum level for which approval is needed, but below which no approval is required?

Sage Intacct configuration

Tracking customer credit balances:

1. Create a General Ledger suspense account that is set up to require both Customer and Vendor dimension posting.
2. Confirm both the Customer and Vendor dimensions are enabled in Accounts Payable, Accounts Receivable, Purchasing, and Order Entry.
3. The remainder of the setup steps depend on which applications your organization uses:

• Order Entry and Purchasing

4. Create a ‘Customer Refund’ Order Entry transaction definition (Return type) that posts the credit entry against the suspense account.
5. Create a non-posting ‘Issue Credit Refund’ Purchasing transaction (Requisition type) with an appropriate Approval Policy applied.
6. Create a ‘Customer Refund’ Purchasing transaction definition (Invoice type) which posts the debit entry against the suspense account

• Order Entry and Accounts Payable

4. Create a ‘Customer Refund’ Order Entry transaction definition (Return type) that posts the credit entry against the suspense account.
5. Transact with an AP Bill that posts the debit entry against the suspense account and enable AP Bill approvals as appropriate.

• Accounts Receivable and Accounts Payable

4. Transact with an AR Adjustment that posts the credit entry against the suspense account.
5. Transact with an AP Bill that posts the debit entry against the suspense account and enable AP Bill approvals as appropriate.

When posting transactions, ensure that each line has both the correct associated Customer and Vendor dimension record.

Sage Intacct Help page

Customer refunds overview

Evidence for control

Approval workflow audit trail that indicates the raisers and approvers.

How to test

See workflow control test.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on credit notes by various selection criteria

Control rationale

Credit notes can be used to support fraud, for example, through collusion with the customer. Credit notes can also conceal the impact of other control failings in the Order to Cash process, for example, failure of pricing controls.

Why it matters

This control is a review of all credit notes to ensure that they’re valid. This should be a relatively small list. However, if it's unmanageable or inefficient to check all of them, think about the criteria that you want to apply to find problematic credit notes, such as value, user who created it, customer.

Factors to consider

• How will you identify what constitutes an error, misstatement or fraud?
• How will you ensure that this review is done consistently each time it is performed?
• You might want to split this out by entity or amount. How will you ensure that everyone does this consistently? Will there be central organization and monitoring of the reviews?
• How will you ensure that the person signing off is not responsible for raising credit notes? Consider either a secondary check or ensuring that the reviewer does not have access to raise credit notes.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate credit notes are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy, Completeness

Functional requirement

Ability to report on value of customer returns by customer or person recording the return and other criteria

Control rationale

Monitoring controls over levels of returns.

Why it matters

This control can address the following risks:

• Deliveries are incorrect. This operational consideration ensures that the fulfillment process is working and that the quality is appropriate.
• Returns are inappropriate. Appropriate returns ensure that no one is accidentally crediting customers too much or fraudulently entering returns.

Design this review to identify follow-up items for both risks. Be careful of the danger of it becoming a generalized review where it is not easy to evidence how the control addresses the risks.

Factors to consider

• Given the likely volume and value of customer returns, ensure that this control focuses on the right areas to identify problematic returns, rather than it simply being an operational review of customer return volumes.
• To address completeness, an overall comparison of return levels to expected returns would need to be carried out.

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Price schedules—Order Entry

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate returns are identified and followed up.

Control type

Preventive

Objective types

Accuracy, Valuation

Functional requirement

System automatically calculates the age of a debt based on the invoice date and customer payment terms.

Control rationale

Key for bad debt reporting and calculating bad debt provisions

Why it matters

Sage Intacct will automatically calculate the age of the debt based on the payment terms and the invoice date.

Factors to consider

Not applicable

Sage Intacct configuration

The Customer Aging report provides this functionality. You can run the report on invoice date or due date.

Set up custom aging periods on the Configure Accounts Receivable page, set up Accounts Receivable terms, and assign the terms to customers. Sage Intacct will automate the calculated terms and age of outstanding invoices.

Sage Intacct Help page

• Configure Accounts Receivable: Aging
• Terms—Accounts Receivable
• Run Customer Aging reports

Evidence for control

Review the configured aging periods and terms.

How to test

See configuration control test.

The test should ensure that the age of the invoice is calculated correctly.

Control type

Preventive

Objective types

Accuracy, Valuation

Functional requirement

Set credit limits for customers so that orders are automatically blocked if they would cause the credit limit to be exceeded.

Control rationale

Operational control over bad debts, but often treated as a financial control

Why it matters

While credits limit checks are an important standard control, make sure that processes for overriding these credit limits are not abused.

Factors to consider

• How can credit limit checks be circumvented?
• What will prevent these circumventions from being used?

Sage Intacct configuration

You can add a credit limit to a customer by editing the customer record:

1. Go to Accounts Receivable > All > Customers.

2. Find the customer that you want to set a credit limit for.

3. Select Edit at the end of the row.

4. Select the Additional information tab.
5. In the Credit limit box, enter the amount of credit you are willing to extend to the customer.

6. Select Save.

1. Go to Accounts Receivable > All > Customers.

2. Find the customer that you want to set a credit limit for.
3. Select Edit.
4. Select the Additional information tab.
5. In the Credit limit box, enter the amount of credit you are willing to extend to the customer.

6. Select Save.

You can determine what happens when a credit limit is exceeded on the Configure Accounts Receivable page:

1. Go to Accounts Receivable > Setup > Configuration.

2. Scroll down to the Thresholds section.
3. Select the appropriate option for If customer is on hold, such as blocking the transaction from being created.

Sage Intacct Help page

Credit limits for customers

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on checking that the block is applied automatically when the credit limit is exceeded.

Control type

Detective

Objective types

Accuracy, Valuation

Functional requirement

Ability to report on changes to customer credit limits

Control rationale

Operational control over bad debts, but often treated as a compliance control

Why it matters

This control ensures that credit limits are not circumvented and that policy is being enforced.

Factors to consider

• How will you evidence that the changes are appropriate?
• What supporting evidence will be examined?

Sage Intacct configuration

Take either or both of the following actions:

• Set up a smart event to send an email to reviewer when changes are made to a customer credit limit.
• Run the Audit History report, filtered by appropriate object data areas.

Sage Intacct Help page

• Smart events
• Use an Audit History report

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate changes to credit limits are identified and followed up.

Control type

Detective

Objective types

Not applicable

Functional requirement

Ability to check customer details against embargoed or blacklisted organizations, that is, interface to Governance Risk Compliance (GRC) or other tools that provide this service.

Control rationale

This is a key control to protect against fraud, corruption, money laundering and terrorist financing.

Why it matters

These kinds of checks are usually excluded from financial reporting control frameworks because they are mostly operational in nature, but they are critical for regulatory compliance and the organization’s reputation.

Factors to consider

• What sanctions and jurisdictions impact the organization?
• What instructions have been provided from the legal or commercial risk teams or general counsel?

Sage Intacct configuration

Create a customer compliance checklist.

Sage Intacct Help page

Checklists

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how the checks were carried out and what evidence was inspected.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to restrict access to creating customers

Control rationale

This is a key control over creating customer master data to prevent creating fictitious customers. It's also a control over override to revenue.

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

In particular, this is important to prevent fraud through the creation of fictitious customers against which fictitious sales could be recorded

Use this control in conjunction with Review of customer master data changes.

Factors to consider

• Who needs to be restricted to prevent fraud?
• Are other restrictions needed, such as by entity?

Sage Intacct configuration

Go to the roles or permissions setup page (Company > Admin> Roles or Users > Subscriptions > Permissions) and review existing permissions.

Sage Intacct Help page

Company permissions

Evidence for control

Access role design

How to test

See restricted access control test.

Control type

Detective

Objective types

Accuracy

Functional requirement

Ability to produce an audit trail of creating or changing customer records

Control rationale

This is a key control over creating customer master data to prevent creating fictitious customers. It's also a control over override to revenue.

Why it matters

The control is to identify fictitious customers, which primarily new customer creations. However, it's also possible to change existing customer into a fictitious customer by making a large number of changes.

Use this control in conjunction with Restricted access to create customers or change customer master data.

Factors to consider

• Which fields will be defined as potentially risky?
• How much checking back to the original information will be performed?
• Will you use a sample-based approach?

Sage Intacct configuration

Take either or both of the following actions:

• Set up a smart event to send an email to reviewer when changes are made to a customer credit limit.
• Run the Audit History report, filtered by appropriate object data areas.

Sage Intacct Help page

• Smart events
• Use an Audit History report

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate changes to customer records are identified and followed up.

Control type

Preventative

Objective types

Accuracy

Functional requirement

Ability to set fields as mandatory so that a customer cannot be set up without sufficient information

Control rationale

This is primarily an operational control, but also ensures that sufficient data is captured to operate accounting controls.

Why it matters

Ensure that these mandatory fields are reasonable. Many of them will be important from a finance perspective, but some might be more an Management Information issue. Too many mandatory fields encourage people to enter dummy data, undermining the culture of control.

Factors to consider

What fields will be mandatory on a customer and what fields can be left as optional?

Sage Intacct configuration

Several fields are already required in a customer record. You can add custom fields. You can also use smart rules to require using fields that are critical to your business operations.

Sage Intacct Help page

• Custom fields
• Smart rules

Evidence for control

Configuration page in Sage Intacct

How to test

See configuration control test.

The test should focus on the fields that are relevant for the purposes of the control framework, for example, financial reporting.

Control type

Detective

Objective types

Accuracy

Functional requirement

Ability to report on manual price overrides, that is, prices or discounts given on a specific sales order

Control rationale

Supports controls over order pricing and accuracy of revenue

Why it matters

Price overrides can be problematic, primarily when the price is reduced. It is important to consider whether price changes are a normal part of the sales process and whether there's a risk of fraud. This control is one potential control to prevent inappropriate price changes, but consider others, such as restricting access or changing configurations.

Factors to consider

• How will you differentiate between valid and invalid price overrides?
• How often does a manual price override occur, and therefore, how often will you need to review this?

Sage Intacct configuration

Create a custom report: Go to Customization Services or Platform Services > All > Custom reports.

Sage Intacct Help page

Use the Custom Report Writer

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate changes to sales order pricing are identified and followed up.

Control type

Detective

Objective types

Accuracy

Functional requirement

Ability to report on changes to prices

Control rationale

Supports controls over sales order pricing and accuracy of revenue

Why it matters

Price master data changes can be caused by error or fraud. A review like this should be able to detect the latter. However, if you have many prices changes, set things like thresholds to make the control more efficient. If you have an annual or biannual price change, there Can be better ways to check those changes, for example, by reviewing the changed data directly.

Factors to consider

• How often are product prices changed? Is this on a specific basis (for example, annual price review) or more frequently?
• Are there certain people who would not be expected to change prices?

Use this control in conjunction with Restricted access to pricing master data.

Sage Intacct configuration

Run the Audit History report, filtered by appropriate object data areas.

Sage Intacct Help page

Use an Audit History report

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The focus of the test should be on how inappropriate changes to sales order pricing are identified and followed up.

Control type

Preventive

Objective types

Existence, Accuracy

Functional requirement

Ability to restrict access to maintain prices

Control rationale

Support controls over approval of any value impacting the price charged to the customer

Why it matters

Give normal considerations as for all restricted access controls, with access minimized and excluded from those who should not have it.

You can use this control in conjunction with Product price change review.

Factors to consider

• Who needs to be prevented from having access?
• Is there a process in place to change master pricing data? Having such a process helps avoid a proliferation of access from people who have a justifiable need to get a price changed, and therefore request access to do it themselves.

Sage Intacct configuration

Go to the roles or permissions setup page (Company > Admin> Roles or Users > Subscriptions > Permissions) and review existing permissions.

Sage Intacct Help page

Company permissions

Evidence for control

Access role design

How to test

See restricted access control test.

Control type

Detective

Objective types

Existence, Valuation

Functional requirement

Ability to report on invoices overdue by more than specified periods

Control rationale

Supports controls on completeness of revenue by identifying overdue shipments

Why it matters

This control primarily checks that the business is not losing money by not following up on invoices and that you log instances of late payment against your customer records to prevent future issues. However, this control also feeds into the process for bad debt write offs. It's important that the logic for the bad debt write off is clear and that the two processes do not get confused in documentation. Consider, for example, having two tabs, one for following up on customers and one for calculating the bad debt write off.

Factors to consider

• What is the business' overdue invoices policy?
• Who will perform this review? Ideally, it should be someone with collections responsibility.

Sage Intacct configuration

The Customer Aging report provides this functionality.

Sage Intacct Help page

Run Customer Aging reports

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See configuration control test.

The test should focus on how problematic invoices and customers are identified and followed up.

Control type

Detective

Objective types

Existence, Accuracy

Functional requirement

Ability to report on manual adjustments to revenue through journals or by other means

Control rationale

This is key for monitoring management override to sales (revenue) accounts.

Why it matters

Revenue adjustments are a potentially major fraud risk. Design this control to enforce the manual journal policy and to detect fraudulent entries.

Like all review controls, the review should not just be a scan, or a "sense check", as this will be insufficient evidence of review. Identify a combination of thresholds and variables to detect risky entries, and document the conclusion. More detailed investigation can always be done if the control operator wants to.

Factors to consider

• When will this review be performed? Will it be done pre- or post-close, or less frequently?
• The nature of the adjustments that are expected will drive the design of this control. If there are many small adjustments, make sure that they are not ignored if they could aggregate to a large impact.

Sage Intacct configuration

Standard Journals Report (General Ledger > All > Reports > Journals)

Sage Intacct Help page

Journals report

Evidence for control

Report with annotations by the reviewer. Follow up queries should be evidenced. Ensure it is clear what the conclusions were and how they were reached.

How to test

See review control test.

The test should focus on how inappropriate revenue adjustments are identified and followed up.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to report on users with access to maintain customer and post manual sales invoices

Control rationale

This is a key segregation of duties control to prevent override of sales / revenue amounts.

Why it matters

This control is important to prevent fraud. It's important to remember that segregation of duties is violated easily if access changes regularly.

Factors to consider

In a segregation of duties control, the ideal scenario is that no one has access to do both of the activities. Even in this case, the control should ideally be operated to ensure this is true on an ongoing basis, because it is easy for someone to be given access inadvertently (or change roles and retain old access). Preventative controls within the access provisioning process should stop this occurring. However, because of the risk of fraud, check segregation of duties conflicts regularly.

In the case of conflicts, simple approval of the conflict is not normally sufficient. The 'mitigating controls' should be identified, for example, a review of activity logs to ensure the conflict is not abused.

Sage Intacct configuration

Go to the roles or permissions setup page (Company > Admin> Roles or Users > Subscriptions > Permissions) and review existing permissions.

Sage Intacct Help page

• Assign permissions to users
• Example Permissions report for all users—CRW

Evidence for control

Conflict report, annotated with mitigating controls

How to test

See segregation of duties test.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to report on users with access to process sales invoices and perform cash application

Control rationale

This is a key segregation of duties control to prevent override of sales / revenue amounts.

Why it matters

This control is important to prevent fraud. It's important to remember that segregation of duties is easily violated if access changes regularly.

Factors to consider

In a segregation of duties control, the ideal scenario is that no one has access to do both of the activities. Even in this case, the control should ideally be operated to ensure this is true on an ongoing basis, because it is easy for someone to be given access inadvertently (or change roles and retain old access). Preventative controls within the access provisioning process should stop this occurring. However, because of the risk of fraud, check segregation of duties conflicts regularly.

In the case of conflicts, simple approval of the conflict is not normally sufficient. The 'mitigating controls' should be identified, for example, a review of activity logs to ensure the conflict is not abused.

Sage Intacct configuration

Go to the roles or permissions setup page (Company > Admin> Roles or Users > Subscriptions > Permissions) and review existing permissions.

Sage Intacct Help page

• Assign permissions to users
• Example Permissions report for all users—CRW

Evidence for control

Conflict report, annotated with mitigating controls

How to test

See segregation of duties test.

Control type

Preventive

Objective types

Existence

Functional requirement

Ability to report on users with access to cash application and record bad debts

Control rationale

Key segregation of duties controls to prevent override of sales and revenue amounts

Why it matters

This control is important to prevent fraud. It's important to remember that segregation of duties is easily violated if access changes regularly.

Factors to consider

In a segregation of duties control, the ideal scenario is that no one has access to do both of the activities. Even in this case, the control should ideally be operated to ensure this is true on an ongoing basis, because it is easy for someone to be given access inadvertently (or change roles and retain old access). Preventative controls within the access provisioning process should stop this occurring. However, because of the risk of fraud, check segregation of duties conflicts regularly.

In the case of conflicts, simple approval of the conflict is not normally sufficient. The 'mitigating controls' should be identified, for example, a review of activity logs to ensure the conflict is not abused.

Sage Intacct configuration

Go to the roles or permissions setup page (Company > Admin> Roles or Users > Subscriptions > Permissions) and review existing permissions.

Sage Intacct Help page

• Assign permissions to users
• Example Permissions report for all users—CRW

Evidence for control

Conflict report, annotated with mitigating controls

How to test

See segregation of duties test.