It is always important to test controls when systems and/or processes change. Sometimes a current process may have adequate controls, but the new process may not be as secure.
Equipment Serial Numbers
A large company with several plants purchased expensive, highly specialized, equipment for use in its manufacturing plants. A central purchasing organization made all the purchases and the inventory held until required by a plant. The inventory manager was understandable proud of the inventory system; having recently implemented just-in-time inventory practices while maintaining a quick response time to orders from plant managers. This meant that expensive equipment was only purchased if, and when, required. The new inventory practices were saving the company millions of dollars every year. However, he had heard a few rumblings about inventory theft, and although he was not personally aware of any problems, he asked audit to take at look at the issue.
The audit teams conducted a thorough review of the controls and only found one area of concern – when items were shipped to the plants, they were automatically removed from the electronic inventory system. The receiving plant manager did not have to send any proof of receipt, so there was no sure way of knowing if the item had reached its proper destination. The inventory manager countered that if someone had ordered an item and did not receive it, he would certainly hear about it. He even produced a few emails where the recipient had questioned the status of deliveries that were only a day late. The audit team leader smiled as said, ‘what if they were not expecting a delivery?’.
The audit team requested a copy of all high dollar equipment that had been purchased in the last year; this included all equipment that had been shipped to the plants. The data was sorted and a check for duplicate serial numbers performed. The results revealed that 53 expensive items, used in the manufacturing process, had duplicate serial numbers. The company had purchased hundreds of thousands of dollars worth of equipment – twice; and in each case, the shipping agent was the same person.
The auditors, with the help of the inventory manager, set out to catch the thief. They noted that while all equipment had been shipped to various manufacturing plants, none of the managers at the plants had placed an order for, or received the equipment. The next time the clerk in question prepared a shipment for delivery for which the receiving plant manager had not placed an order, audit arranged for a private security company to follow the truck. Instead of delivering the equipment to the plant specified on the shipping receipt, the equipment was delivered to a warehouse in the city. Two days later, the inventory manager asked the clerk to place an order for the same model equipment. The security personnel followed the truck as it delivered the same equipment back to the company warehouse.
In the weeks that followed, audit was able to prove that the clerk was placing false orders for equipment, charging the inventory to phony projects. The equipment was delivered to a warehouse and held until a purchase order was placed for the same item. The clerk would then arrange for the equipment to be shipped to the company – selling the company back its own inventory. The serial number had not been changed, so it would have been identified as a duplicate if the equipment had not been removed from the inventory system when it was shipped the first time.
As a result of the investigation, the clerk was fired and the serial numbers of all new equipment were compared to those of equipment that had previously been in the inventory system. Controls were put into effect to ensure that equipment was shipped to, and received by, project managers.
ACL Commands: FILTER, SORT, RELATE