Instructions:
1 The Process Note provided herein is illustrative in nature.
2 Document all the process notes under "2.05-System Documentation" in APT NG.
Audit Team to give reference / tag this workpaper in the APT NG at Stage II : UIC - CARA and & ITGC Risk Assessment
Questionnaire as relevant.
2 Audit Team should understand the process and identify the controls implemented and followed by the client through inquiry or observation.
3 Audit Team should conduct walkthroughs to re-affirm the process and control as understood through inquiry or observation.
4 Audit Team shall list down the controls in the format specified under "2.XX.01".
5 Document your understanding of the business processes in the cycle including the following:
- Processes by which transactions are initiated, processed, recorded and reported
- Controls in place to prevent, or detect and correct, errors (including how detailed records are reconciled to the general ledger)
- Staff members, information systems, supporting documents and accounting records directly related to this process.
6 Identify any Information Produced by the Entity (IPE) that will be used in CARA or in obtaining audit evidence (TOCs, DATs or OSPs) (if
applicable).
7 Identify any IT applications that support the process. Ensure all IT applications identified are documented in the relevant question in the IT
Environment template, the Simple UIC-CARA & ITGCs, and/or the ITGC Risk Assessment questionnaire.
8 The process mentioned in "2.XX.01" should be modified in accordance with the actual process followed by the client.
9 Determine whether the control identified meets the definition of a 'Control activity relevant to the audit' ('CARA').
10 Decide whether the controls as noted in "2.XX.01" are 'Controls Relevant to Audit' (CARA). If yes, document the controls in the
UIC - CARA and & ITGC Risk Assessment Questionnaire as relevant along with appropriate details. In case the controls do not
satisfy the definition of CARA, no further action is required.
11 For all CARA, document the following:
- CARA # - assign each CARA a number so it is easy to cross reference to it later.
- Frequency - how often does the control operate?
- Control owner - Title/position of person responsible for the control.
- FSA/Assertion - List all FSAs and assertions relevant to the control.
- the IT application that the CARA depends on (if any)
- Is the control manual, automated, or computer dependent?
- Is the control preventive or detective?
12 Evaluate design and implementation of CARA.
13 Consider the need to raise potential RMMs (whether IRMMs or ELRs) in APT if a control deficiency has ben identified. Also record
the control deficiencies in the ETD Points, Management Letter Points and TCWG Points screens in APT. Unless otherwise
addressed, such findings will be evaluated at the Engagement Team Discussion.
14 Document CARA and plans to perform TOCs in the Control Detail screen in APT.
15 Ensure correct conclusion is drawn on the basis of process understanding and walkthroughs performed.
16 Use the Link document feature to link the relevant working paper and document.
17 Rename the sheet "2.XX.01" as per document number reflected in APT.
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
CLIENT NAME
DOCUMENT
NAME Process Note
BUSINESS
CYCLE Purchase
PERIOD END
DOCUMENT #
<Objective>
To obtain an understanding of the entity's Purchase cycle processes including the internal control activities in place that are
relevant to the audit. In this working paper, we will evaluate the adequacy of the control designs and update in APT .
<Work Done>
Date of Discussion
Venue
M S K A / M S K C Representatives / Des
Client Representatives / Designations
<Guidance>
1. Engagement Teams should ensure that all the controls that are identified and documented from this walkthrough
documentation workpaper match with the corresponding risks and controls documented in the "APT Risks and Responses
screen", and which will be further tested by the teams in the TOC workpapers (in Execution stage).
2. When auditing various group entities, the Engagement Teams should ensure that walkthrough documentation of the
process and related risks and controls is done separately, for each group entity.
INITIATION PROCESS(ES) DESCRIPTION OF THE PROCESS DEPARTMENT(S) IPE PRODUCED IN IS THE IPE PART OF REFERENCE TO THE Reference to Testing IT APPLICATION(S) CONTROL (C ) / CONTROL
PROCESSING THE CYCLE THE CARA AUDIT PROCEDURES procedures SUPPORTING THE PROCESS (P) OWNER
AUTHORISATI (IF USED TO OBTAIN IDENTIFIED IN THIS (TOC/TOD) WHICH performed on IPE PROCESS
ON EVIDENCE IN DATS WALKTHROUGH USE THE IDENTIFIED and conclusions (NAME AND
RECORDING OR OSPS) EXERCISE? If yes, IPE thereon DESIGNATION)
REPORTING provide details of
the IPE
Initiation A. Request for - The Purchase Team sends the request for quotations to vendors/suppliers as
purchase and vendor stated in the “Standard Supplier List”. The Standard supplier lists is approved by
selection __________.
- The Purchase request is prepared by ____________.
- The Purchase request is approved by ____________.
- The Purchase request consists the following information:
-
-
-
- Vendor List available as on___________ approved by ____________.
- Quotations are received from 3 (or any other number) vendors ___________.
- Multiple Quotations received are compared and shortlisted by _________. He is
required to complete a checklist (name) for comparison of various quotations
available with the Company.
- Quotation selected and selection evaluation checklist is approved by
___________.
Initiation B. Preparation of
Purchase order: - On the basis of the purchase request and the quotation received from the
vendor/supplier, purchase order is prepared by ______________ .
- The purchase order is approved by ___________.
- Any changes to the purchase order after forwarding to the vendor/supplier are
intimated by _________to _______ via an email.
Processing C. Receipt of - The goods/services received are verified by _________ on the basis of purchase
Goods/Service order.
- In case of inconsistency, then ___________.
- The goods received are entered into the gate register by ____________ and a
Goods Receipt Note is prepared by ____________.
- The goods receipt note is approved by ____________ after the quality test is
approved by the Quality Department.
- The Delivery challan is signed and stamped by ________ as a proof of receipt of
goods.
Processing F. Payment processing: - As per the terms of agreement with the supplier/vendor, the payment is
processed by ______________.
- The supporting documents such as GRN, approved invoice and approved PO is
verified by _____ before processing for payment.
- The payments are approved by ______________.
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
INITIATION PROCESS(ES) DESCRIPTION OF THE PROCESS DEPARTMENT(S) IPE PRODUCED IN IS THE IPE PART OF REFERENCE TO THE Reference to Testing IT APPLICATION(S) CONTROL (C ) / CONTROL
PROCESSING THE CYCLE THE CARA AUDIT PROCEDURES procedures SUPPORTING THE PROCESS (P) OWNER
AUTHORISATI (IF USED TO OBTAIN IDENTIFIED IN THIS (TOC/TOD) WHICH performed on IPE PROCESS
ON EVIDENCE IN DATS WALKTHROUGH USE THE IDENTIFIED and conclusions (NAME AND
RECORDING OR OSPS) EXERCISE? If yes, IPE thereon DESIGNATION)
REPORTING provide details of
the IPE
Recording D. Booking of Vendor - On the basis of purchase order and goods /services received, the Invoice is
Invoice received by _________.
- The invoice received along with the supporting is sent to ___________for
approval.
- The invoices along with supporting and requisite approvals are sent to Accounts
Team for payment processing and accounting.
Recording E. Verfication of - The Purchase Invoice along with the supporting are submitted by ________ to the
Vendor Invoice accounts Team for accounting purposes.
- Based on the 3 way match, the purchases are booked by ____________ on a daily
basis.
- The entry for purchases is approved by ___________.
Recording G. Purchase returns: - On receipt of the goods, the quality control department approves the goods
before the goods are issued for production.
- In case the goods are not as per the specifications/purchase order, the goods
are sent to the suppliers/vendors.
- The Inspection report is prepared by ______________.
- The inspection report is reviewed and approved by __________.
- In case the goods are sent to the supplier/vendor, the Goods Rejection Report
stating the following is prepared by_______________
- The Goods Rejection Report is reviewed and approved by ___________.
- The Goods Rejection Report along with the Invoice copy is forwarded to
Accounts Team for accounting purposes.
Recording H. Accounts Payables
and Vendor master
- Vendor account is created after following verification process.
creation and review
- '- For all new vendor creation in the accounting software supporting documents
of identification are obtained for authorisation by _______
- The vendor creation form is approved by ________
- On verification of the approved creation forms and supporting documents, the
code is generated by _______.
-
-
- The Accounts payables are monitored by ____________on a monthly basis.
- A monthly ageing report of Accounts payables is prepared by ____________ or
extracted from the Accounting Software.
Reporting H. Accounts Payables
& Inventory reporting
- The ageing report is reviewed by ______________.
- The COGS standard rates are prepared on periodic basis i.e. ________ by ______
and same is approved by ________
- COGS standard rates reconcilaes with Actual BOM on periodic basis i.e. ________
by ______ and same is approved by ________ and perform reconcilations for the
same by ______ and same is approved by ________
- Physical Verification activity has been conducted on periodic basis performed by
_______ and approved by ______
Processing I. Trade Payable Balance confirmations are obtained for Trade Payables by _________
Reconciliation (Designation) at the end of the month/quarter/year for material balances (update
the threshold taken by Management). On receipt of responses, reconciliation is
prepared by _________ (Designation) and approved by _______ (Designation) before
posting the entries in system if required.
Discrepancies if any, are investigated, reported to _____________ (Designation)
and rectified after approval of ____________ (Designation).
<Conclusion>
Based on the work done, we are satisfied that the control designs are ……
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
DOES CONTROL MEET CARA TITLE FINANCIAL ASSERTION(S) TYPE OF PREVENTIVE/ FREQUENCY EVALUATE THE EVALUATE THE WHETHER THE DESIGN IF RESPONSE TO RATIONALE FOR DESIGN RATIONALE FOR
THE DEFINITION OF AND STATEMENT CONTROL DETECTIVE DESIGN OF CARA IMPLEMENTATION OF AND IMPLEMENTATION COLUMN Z IS 'NO' THEN CONCLUSION IMPLEMENTATION
CARA? DESCRIPTION AREA(S) (Manual(M) / (DOCUMENT HOW CARA OF CARA IS WHETHER RISK IS CONCLUSION
(If Yes, Evaluate Computer CARA MEETS (DOCUMENT EFFECTIVE? (IF NO, IDENTIFIED IN APT?
Columns IF YES, FILL Dependent(CD) / CONTROL OBJECTIVE) CORROBORATIVE CONSIDER POTENTIAL (Y/N)
IN COLUMNS M TO Automated(A)) EVIDENCE TO IRMM)
AA) SUPPORT CORRECT
(If NO, no further IMPLEMENTATION OF
action is to be taken) CARA)
C E A V P
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
DOES CONTROL MEET CARA TITLE FINANCIAL ASSERTION(S) TYPE OF PREVENTIVE/ FREQUENCY EVALUATE THE EVALUATE THE WHETHER THE DESIGN IF RESPONSE TO RATIONALE FOR DESIGN RATIONALE FOR
THE DEFINITION OF AND STATEMENT CONTROL DETECTIVE DESIGN OF CARA IMPLEMENTATION OF AND IMPLEMENTATION COLUMN Z IS 'NO' THEN CONCLUSION IMPLEMENTATION
CARA? DESCRIPTION AREA(S) (Manual(M) / (DOCUMENT HOW CARA OF CARA IS WHETHER RISK IS CONCLUSION
(If Yes, Evaluate Computer CARA MEETS (DOCUMENT EFFECTIVE? (IF NO, IDENTIFIED IN APT?
Columns IF YES, FILL Dependent(CD) / CONTROL OBJECTIVE) CORROBORATIVE CONSIDER POTENTIAL (Y/N)
IN COLUMNS M TO Automated(A)) EVIDENCE TO IRMM)
AA) SUPPORT CORRECT
(If NO, no further IMPLEMENTATION OF
action is to be taken) CARA)
C E A V P
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
DESIGN DEFICIENCY? NATURE OF CONTROL DESCRIPTION OF WALK-
(Y / N) DEFICIENCY DEFICIENCY? THROUGH TEST
APT RISK #?
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
DESIGN DEFICIENCY? NATURE OF CONTROL DESCRIPTION OF WALK-
(Y / N) DEFICIENCY DEFICIENCY? THROUGH TEST
APT RISK #?
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
CLIENT NAME
DOCUMENT Walkthrough
NAME
BUSINESS Purchase
CYCLE
PERIOD END
DOCUMENT #
Note: The table given below is for illustrative purposes. Audit Team may add/delete columns where required
1 Objective
To confirm our understanding, as per process note, of the flow of significant types of
transactions within significant processes including how these transactions are initiated,
authorized, processed, recorded and reported. In this working paper, we will evaluate the
efficiency and effectiveness of the control designs.
2 Work Done
Date of Discussion
Venue
MSKA / MSKC Representatives / Designations
Client Representatives / Designations
3 Basis of Selection
4 Transaction tested for Walkthrough
Understanding the Process Controls Identified
Sr.No Description of Transaction
Step 1 - Step 1 - Step 1 - Step 1 - Name Name
Describe Describe Describe Describe Control 1 Control 2
1
This is CARA This is CARA /
/ not CARA not CARA
5 Conclusion
Conclusion to include the following:
Walkthrough was satisfactory / unsatisfactory
Walkthrough could be conducted for the complete process / could not be conducted for the entire process
Controls identified match with the identification as per Process Note / no / additional controls identified
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
Controls Identified
Name
Control 3
This is CARA /
not CARA
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
<Accounting Entries>
Sr. No. Description / Purpose of the Entry Account Code / Accounting Entry
Sub Code
Evaluation of the Accounting Policy
Accounting Policy as per the financial statements as on ___ (year end/period end) is as follows:
[Insert Accounting Policy here]
<Conclusion>
Based on the understanding of the Process, the accounting entries passed seem to be appropriate / inappropriate.
[In case inappropriate, suggest the changes required. Note down the same in the Query sheet, discuss with senior
and then with the client. Also, consider whether such changes will amount to changes in accounting policies and
consequential impact thereon.]
Based on the understanding of the Process and the Accounting, the Accounting Policy followed by the Company is
appropriate / inappropriate.
[In case inappropriate, suggest the changes required. Note down the same in the Query sheet, discuss with senior
and then with the client. Also, consider whether such changes will amount to changes in accounting policies and
consequential impact thereon.]
M S K A Associates/ M S K C Associates
V.1.2024
Chartered Accountants
