Core transaction cycles and their key controls
| Cycle | Key controls |
|---|---|
| Revenue (order → ship → bill → collect) | Credit approval, shipping document matching, separation of billing from cash receipts, lockbox for collections |
| Expenditure (requisition → PO → receive → pay) | Three-way match (PO, receiving report, invoice), vendor master file controls, segregation of purchasing from receiving and payment |
| Payroll | Separate HR (adds employees) from payroll processing; independent review of the payroll register; direct deposit controls |
| Inventory / conversion | Physical counts, perpetual record reconciliation, restricted warehouse access |
IMPORTANT: The classic fraud enabler is one person controlling both the vendor master file and payment processing — that combination allows creating a fictitious vendor and paying it. Adding or changing a vendor should always be independent of approving and releasing payments.
Robotic process automation (RPA)
RPA uses software "bots" to perform rule-based, repetitive tasks across existing applications — reconciliations, data entry, report generation. Benefits: speed, consistency, elimination of manual keying errors, and a complete audit trail of bot activity.
New risks that come with automation
- Bot identity and access — bots need credentials; over-privileged bot accounts are a serious exposure, and shared bot credentials destroy accountability
- Change management over bot logic — a bot is code and must go through testing and approval
- Error propagation at scale — a flawed bot repeats the same mistake thousands of times, quickly
- Loss of human review — automating an approval away can remove the very control that mattered
EXAMPLE: A bot automatically posts recurring journal entries. Without change control over the bot's logic and an independent review of its output, an incorrect or malicious modification could post hundreds of erroneous entries before anyone notices.
EXAM TIP: Automating a process does not remove the need for controls — it changes where the controls belong: from reviewing individual transactions to controlling access, logic changes, and exception handling.