Auditing for Value in the Procure to Pay Cycle Dallas IIA Chapter

Auditing for Value in the Procure to Pay CycleDallas IIA ChapterOctober 1, 2009

Supply Chain Risk Overview*Today’s Focus* Includes Working Capital benefits1 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Overview of ProcurementMost organizations spend 20% to 70% of their revenues procuring third party goods and services. This expenditurepresents very significant opportunity and risk. Risks include the loss of cash, supply continuity, delivery performance andquality, outsourcing risk, process inefficiency, legal and regulatory compliance and fraud. From an opportunity perspective,dollars saved through procurement activities flow directly to the bottom line.Key Procurement Processes:– Strategic Sourcing is the process to analyze spend anddetermine the best supply base and sourcing strategy to followfor each spend category. Strategic sourcing establishes the waycompanies execute the procurement process.– Contract Management is the process of creating and managingcontract templates and libraries, creating and approvingcontracts, managing contract administration and changes, andmonitoring contract performance and compliance.– Purchasing Execution and Control is the transactionalcomponent of creating a requisition, creating and issuing aPurchase Order and processing the payment, including suppliermaster file management.– Supplier Management is the process of measuring andmonitoring supplier performance, certifying suppliers, andstrategic integration with selected suppliers through SupplierRelationship Management.SupplierPerformanceMonitoring,Development& Certification10%Requisition,Purchasing,AccountsPayableSupplierRelationshipManagement10%CategoryForecast &RiskAnalysis10% 10% 10%10%10%10%Supplier SetUp & On-BoardingSales &OperationsPlanningContractCreation,Award &ControlPlanningSupplyMarket &RiskAnalysisSourcingStrategy10%Analysis &Selection10%Negotiation& ContractPlanningSupplierEvaluation& SelectionUnderstanding and mitigating procurement and accounts payable risks while optimizing procurement capabilities is among themost effective and least painful ways for companies to enhance controls while delivering and sustaining value-addedimprovements and higher profitability.2 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Accounts Payable Process – Key Activities• Invoice Receipt, Archiving and Storage• Invoice Validation, Reconciliation andAudit• Routing and Approval• Disbursement Planning• Settlement• Handling Vendor Queries• Visibility / Access to Spend Data3 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Trends in Internal Audit Focus / Coverage ConsiderationsPossible P2P Implications• Financial risks – 41% have increased coverage• SOX – 64% remained the same or decreased• Operations risks – 47% increased coverage• Compliance risks – 65% decreased or remained the same• Credit and liquidity risks – approximately a third increased• Effectiveness of risk management – 35% have increased coverage• Company exposure to 3 rd parties in financial distress – 39% have increased coverage• Cost reduction/containment – 47% increased coverage• Model validation – 47% decreased or remained the same• Off-shoring/vendor risks – 19% increased• Reputational risk – 69% remained the same or slightly decreasedSource: 2009 GAM Presentation by Richard Chambers, President of the IIA4 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

So What Does this Mean for P2P?Possible Focus PointsThe purchase-to-payment process (P2P) attracts more auditor scrutiny and fosters more managementconcern than virtually any other business process. Companies face a number of risks associated with theirP2P process including financial leakage, internal control issues, and operational risks.Fraud – Revenue and Procurement• Revenue recognition• Procurement• Embezzlement• FCPAWorking Capital and Cash Management• Days Sales Outstanding• Days in Inventory• Days Payables Outstanding= Total Days “Trapped” in Working CapitalControls Automation• Manual controls cost more to execute and to audit• Automated controls can provide higher levels of assurance• Maximize the ERP effectivenessCost Containment and Reductions• Organizational control structure/span of control• Third-party contract administration, including outsourcingagreements• Construction and capital projects• Sales commissions• Vendor payments and contract compliance, including erroneouspayments• Overtime payments• Revenue assurance• IT infrastructure spend• SOX costsThe Internal Audit Process Itself• Data mining and CAATs• Smarter, better, quicker• Look at all components – planning, execution of fieldwork and reporting• Measure, benchmark and improve• Support the audit process with technology5 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Internal Audit Coverage Considerations for A/PFocus and Scope OptionsTraditional Audit FocusTransactional controls and compliance aroundpurchasing execution (primarily). General risks coveredinclude:– Access to and control of supplier master file– Expenditure authorization limits and purchaseapprovals– Segregation of duties (access to supplier masterfile, PO creation, receiving, and invoiceprocessing)– Compliance with bidding policies (3 bid minimum)– AP processing: 3-way match controls, invoiceoverrides, invoice holds and approvals– Use of preferred suppliers,– Control over non-PO purchases and non-POinvoice processing– Credit notes and other adjustments may not beaccurately calculated or recorded.– All purchases may not recorded via PO (novisibility of outstanding commitments andrequired accruals)– Service purchases or non-PO invoices may notbe appropriately verified and approved prior toprocessing for paymentSCOPE -- Typically direct materials and possibly capitalequipment.Potential Other Areas for IA Consideration /Impact• Traditional transactional controls and compliancearound purchasing execution (including general risks)PLUS• Process / Capabilities assessment, covers purchasingexecution as well as: strategic sourcing, contractmanagement, and supplier management.• Spend Assessment covering 100% of total spend.• Benchmarking, analysis of results, andrecommendations to improve cost effectiveness, staffproductivity, process efficiency, and cycle time.• Other potential areas / sources of operational risks:– Spend reduction– Decreased maverick spend– Overall procurement process and policyimprovement– Cycle-time reduction– Enhanced procurement monitoring andreportingSCOPE -- Includes all 3rd party expenditures (direct /indirect materials, services, capital, utilities, etc.)6 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Internal Audit Coverage Considerations for A/PBenefitsTraditional AuditsIdentification of transactional processing controlgaps and recommendations.Potential Other Areas for IA Consideration/Impact• Identification of transactional processing control gaps andrecommendations PLUS• Benchmark current organizational performance against industrypeers and leading practices to determine opportunities forprocess improvement and cost savings.• Identification of risks and opportunities for:– Reduction in supply interruption risk, leverage spend forcost savings, proactive procurement risk management,decrease time to market for new products– Identification and quantification of financial leakage,recovery of overpayments, and improving master dataintegrity.– Improved contract compliance (milestones, pricing, quality,performance), reduction in legal risk exposure, reducemaverick spend to fully realize potential cost avoidanceand cost savings opportunities– Improved supplier performance around quality, lead times,communication, data integrity, etc.– Supply base consolidation and rationalization, identificationof opportunities to improve commodity managementaround replenishment planning and excess and obsoletecontrol, material standardization, etc.– Identification of risks and improvement opportunities acrossall aspects of risk management infrastructure (Strategy &Policy, Process, People & Organization, ManagementReporting, Methodologies, Systems & Data), where astraditional audits just look at process component.7 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Potential Focus Points and Impact OpportunitiesProcess Improvement Opportunity Identification8 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Sample Data Analysis Activities9 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Data Analysis Approach OverviewProject Management and CommunicationKey Tasks10 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

CAAT’s s Examples for ConsiderationProcure-to-Pay Examples• Vendor Master File Analysis (Address, POBoxes, phone numbers between vendors toidentify duplicates)• # of Inactive Vendors with Activity• Payments to Inactive Vendors• Duplicate Vendors, Invoices, Payments• Vendor to Employee Match (SSN/TIN,Address, Phone Number)• Benford’s Law Analysis - Invoice, Payments,PO, and/or Credit Analysis• Missed Discounts – Late Payments• Authorization and Analysis of PR, PO,Invoice, and Payment• Aging and Analysis of AP and CreditProcessing• Holiday Activity• Void/Reissue Payment Analysis• Pricing Books – Accuracy of the Amounts,How often Prices are Monitored forChanges, and How Freight and Sales &Use Tax is Accounted for• Payment Gap Analysis• User Analysis between Vendor Setup,Voucher, and Payment Processing• Analysis of Debit Memos/Adjustments• Analysis of Voucher Reversals/Re-Entry• Analysis of Overpayments/Refunds (unusedcredits)11 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Example Output and Analysis ResultsDuplicate PaymentsExample: “$3.5m duplicate payments recovered; $2m in working cap reduction”Approach• Standardize FavorablePayment Terms• Assess ProcurementTransactions• Evaluate Vendor MasterFile for CleanupOpportunities• Determine Potential forProfit Recoveries• Data and SpendAnalytics: A/P, P-Cards,T&E, Claims, ContractCompliance and Fraud• Assessment ofPurchasing and APOperationsBenefit• Reduced FinancialLeakage• Immediate Cash FlowBenefits• Apply Unused CreditMemos• Working CapitalBenefits• Reduced Risk ofFraudulent Activity• Purchase OrderProcessing Efficiency12 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Example Output and Analysis ResultsSupplier Master File– Illustrative –For Discussion Purposes OnlyAnalysis of the supplier master file can not only be a useful tool in the assessment of potential risk for fraud,it can also be a valuable source of information on potential duplicate payments and/or other misalignedinformation.28,029 Active Suppliers18,702 in in assessed system 1 (67%); 9,327 in in assessed system 2 (33%)Step 1 – Consider InactivationStep 2 – Review / UpdateSupplierswith NoActivitysince1/1/2006Supplierswith NoActivity inthe last 24monthsSupplierswith NoActivity inthe last 18months9,092 active suppliers remainafter inactivation considerationNote: Suppliers listed in Step 1were not included in the populationof suppliers in Step 2.DuplicateSuppliersSuppliersWithMissingAddressInformationSuppliersWithMissingFederal IDs(FEIN) – USonlySupplierswith InvalidFEINInformation– US only17,7063598721,71170261,414(63%)(1%)(3%)(6%)(0.2%)(0.1%)(5%)• 63% of suppliers (17,706) had no paymentactivity since 1/1/2006– 68% of suppliers (18,937 ) have had no payment in thelast 18 months• Of the suppliers for inactivation consideration:– 66% are from assessed system 1– 34% are from assessed system 2• 1,711 suppliers are identified as potential duplicates– 33% are from assessed system 1– 67% are from assessed system 2• 1,510 suppliers are recommended for updates and/oradditional data– 62% are from assessed system 1– 38% are from assessed system 2A well-controlled SMF reduces the risk of financial leakage and fraud while increasingprocessing efficiency and management analysis.13 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Example Output and Analysis ResultsSpend Management: Analyze Supplier Fragmentation– Illustrative –For Discussion Purposes OnlyExample: “$13m savings in the first year through consolidation of supply base.”Approach• Assess Strategic SourcingOpportunities• Standardize Specifications• Aggregate Volume ofDemand• Forecast Visibility• Rationalize Supplier Base• Assess Management andMonitoring of ProcurementTransactions• Contract Compliance• Supplier FeasibilityAnalysisBenefit• Enhanced product quality dueto optimized specifications.• Managed supply based andenhanced on-time deliverythrough performancemonitoring and partnering.• Lower Price for Materials andServices• Lower Inventory Costs• Demand Analysis to HelpInventory and Forecasting• Reduced Risk of SupplyInterruption14 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

CAAT’s s Examples for Consideration (cont’d)G/L and Journal Entry ExamplesTravel and Entertainment Examples• Benford’s Law on Journal Entriesby User• Journal Entries identifyingoutliers (Uncommon Accounts,Profit Centers, Cost Centers)• Manual Round Dollar Entries• Unusual Posting Dates/Times• Analysis of Split Entries (Entriesjust below Approval Threshold)• Analysis of Suspense, Clearing,and Intercompany Accounts• Credits vs Aged Invoices• Reversed Month End JournalEntries• Entries within Accounts• Inactive Accounts Entries• Calculate and sort percentagevariances in GL accountsbetween periods• Spend by Employee• Analysis of Expenses byEmployee (just belowthreshold, comparison ofemployees expensingduplicates, expensing airfarebut no hotel (vice versa),expensing car but no airfare,etc)• Analysis of MCCG and MCC ofT&E or P-Card Transactions• Benford’s Law Analysis onEmployee Expenses• Expense Dollar and VolumeStratification• Inactive Employee SpendAnalysis• Spend by Expense Type• Large Dollar ExpensesIdentification• Non-Timely ExpenseSubmission• Expense Analysis by Category(e.g., Airfare, Office Supply,Cell Phone, Professional Dues)• Per Diem ExpenseIdentification and comparison totrips, policy threshold, andpotential duplicates in mealreimbursement and per diem• Duplicate Expense Submission• Analysis of WeekendTransaction Dates• Analysis of No Activity fromPersonnel in Expense-CentricDepartments15 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Procurement Process ReviewFraud Indicator Overview– Illustrative –For Discussion Purposes OnlyReviewing fraud indicators is part of our comprehensive approach and is effective for financial riskmitigation.HighPriorityLow(1)450400400350Examples:30025020015010050016685 91 91533520 20 202210 13 9 10 5Employee SSNvs. DeceasedMaster FileInvalid SSNEmployee vs.Vendor AddressPayments AfterTerminationTotal ReturnedFlagged for ReviewSampledRequires Further ReviewPayments After TerminationEmployee Termination Date Last Payment Date Days Difference Payee Name Payment Count Payments to EmployeeJohn Smith XXX XXX XXX John Smith XX $XXXEmployee vs. Deceased Master FileEmployee Name SSN City State Status Terminated Death master SSN First Name Last Name Death DateJohn Smith XXX-XX-XXXX XXX XX XXX XX XXX-XX-XXXX Jane Williams XXInvalid Social Security NumberValidation SSN Name Job Description Address1 Address2 City State Zip Status TerminatedBad - Invalid Group XXX-XX-XXXX John Smith XXX XXX ABC Lane XXX XX XX XXXXX XX NoEmployee vs. Vendor AddressEmployee Name Employee Key Employee Address City State Vendor Name Vendor Address Vendor City Vendor StateJohn Smith XXXXX ABC Lane XXX XX ABC Company DEF Avenue XXX XX16 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Selected Metric Considerations17 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Selected Accounts Payable MetricsCost EffectivenessTotal cost per invoice processedTotal cost per invoice line item processedTotal cost per FTEPersonnel cost as % of total costPersonnel cost per FTESystems cost as % of total process costSystems costs per $100,000 RevenueSystems costs per $100,000 PurchasesTotal process cost per $1,000 RevenueTotal process cost per $1,000 PurchasesStaff ProductivityNo. FTE’s per $1Billion RevenueNo. FTE’s per $1Billion PurchasesNo. expense report line items processed annually per FTENo. invoice line items processed per FTENo. of invoices processes per FTEValue of purchases (millions) per FTENo. of disbursements per FTENo. FTE’s to process “expense reimbursements” per $1Million T&EExpendituresProcess Efficiency% of invoice line items that are matched the first time% of invoices which are manually keyed into the G/L% use of EDI for receiving invoices, and for entering into the system% of invoice line items paid on timeNo. invoiced line items per $1,000 purchases% of discounts available that are taken% of disbursements that are first time error free% of invoice line items matched with a PONo. expense report line items processed per $1,000 Purchases% of T&E expenditures using cash advance% of expense report exception line itemsCycle TimeC.T in days to resolve an invoice errorC.T in days from receipt of invoice until approved/scheduled for paymentC.T in hours to enter invoice data into the systemC.T in days from receipt of invoice to paymentC.T in days to approve and schedule T&E reimbursements18 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Example Usage of BenchmarkingP2P Metric ConsiderationsThere are various cost drivers within the overall Purchase-to-Payment process where use ofbenchmarks against industry best practices to determine improvement opportunities.Cost Components of the Purchase-to-Pay Process% of Sub Process100%90%80%70%60%50%40%30%20%10%0%CreateExisting VendorVMF SetupWorkflowManualApprovalProcessBuyer Manager Director VPE-Mail EDI Mail Fax PhoneCentralized De-CentralizedApproval Level PO Issuance InvoiceReceived• 50% of transactions are processed outside of existing workflow technology• 65% of POs are issued by mail or phone• 25% of invoices are received in a de-centralized locationManual EDI ERS P-CardInvoiceProcessingObservations‣ The following processes contribute to increased costs within the Purchase-to-Payment ProcessCheck Wire ACH OtherPaymentProcessingCentralized De-CentralizedProcumentFunction• 50% of invoices are processed manually through Accounts Payable• 58% of all payments are remitted by paper check19 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

Value Drivers Within P2P ActivitiesPossible IdeasComponents & Value DriversProcure-to-Pay• Increase DPO• Reduce AP Processing Costs• Reduce Lost Discounts• Reduce Financial Leakage• Reduce Spend / TCOIncrease DPO Improve integrity of Vendor Master File Monitor and enforce use of approved Payment Terms – extend where feasible Update existing agreements upon expirationReduce Invoice Error Rate / Processing Costs / Lost Discounts / Leakage Standardize (and consolidate) AP processes Increase use of Purchase Orders to automate matching process (decrease Payon-Approvalvolume) Leverage ERP functionality / automate manual process Enhance supporting capabilities Develop / improve monitoring and reportingReduce Spend / Total Cost of Ownership (TCO) Strategic Sourcing (Total Cost of Ownership (TCO), leverage volume, specificationimprovements, global sourcing, etc.) Manage contract complianceImprovements in Working Capital Management can freeup cash and generate significant annual savings andimpact to the bottom line!20 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

In SummaryToday’s economic environment requires active assessment and management ofP2P activities and operations is critical.• Inventories and receivables are growing.• Spend is highly fragmented indicating an opportunity for supplier consolidation and leveraged buying.• Sourcing focused on Indirect Spend including prioritization of Sub-Categories and setting of savingstargets.• Saving opportunities continue to exist through: Immediate strategic sourcing initiatives, Ensuringpayment term discounts are realized; and Eliminating multiple payment terms for the same supplier.• Fraud indicators exist but are often times not recognized and/or not acted upon.• Movement to reduce process costs and increase in efficiency by addressing Supplier Master File.• Potential for financial leakage in the form of duplicate payments, unused credit memo’s, etc.• Need to establish standards for payment terms and target key supplier for improvement initiatives.Internal Audit teams have not only the responsibility for periodic assessment of theseactivities but also have a tremendous opportunity to drive value and be an agent ofpositive change for their organization!21 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

References• Invalid Social Security Number –www.ssa.gov provides rules governing invalid SSNand based on these rules you can internally build the file to perform testing against.• Deceased person file – a subscription can be purchased from NTIS,http://www.ntis.gov/products/ssa-dmf.aspx. Quarterly, we update will pull updates fromthis site to update our database.• Benchmarking - http://www.apqc.org/portal/apqc/site22 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.

For more information or if you have questions, please contact:Clint McPherson, Managing Director469.374.2438 (Office) or 214.215.8374 (Mobile)clint.mcpherson@protiviti.comCindy Hart, Manager972.788.8505 (Office) or 817.253.9176 (Mobile)cindy.hart@protiviti.com23 © 2009 Protiviti Inc. An Equal Opportunity Employer.CONFIDENTIAL: This document is for your company's internal use only and may not be copied nor distributed to another third party.