{"id":11290,"date":"2017-08-10T12:00:00","date_gmt":"2017-08-10T12:00:00","guid":{"rendered":"https:\/\/zapliance.com\/?p=11290"},"modified":"2022-08-26T13:59:14","modified_gmt":"2022-08-26T13:59:14","slug":"automated-audit-of-purchase-to-pay-in-sap","status":"publish","type":"post","link":"https:\/\/zapliance.com\/en\/blog\/automated-audit-of-purchase-to-pay-in-sap\/","title":{"rendered":"Automated Audit of Purchase-to-Pay in SAP"},"content":{"rendered":"\n

In this second blog post on auditing of purchase-to-pay in SAP, I would like to present the automated approach in greater detail, taking a look at all its various aspects. A lot of these analyses can of course be executed manually, but this is very time-consuming to do and thus should be avoided.<\/p>\n\n\n\n

Purchase-to-pay master data<\/h2>\n\n\n\n

\u201cVendors\u201d is the keyword when it comes to purchase-to-pay master data. Every single vendor that delivers goods or even services has a master data record. Many mistakes can be made here, ones that should lead to questions being asked at the audit stage at the very latest. In certain cases, you may even be forced to ask yourself: \u201cHow has it even come to this?\u201d. But one thing that we can tell you for sure is that nearly every indicator developed by us is something that has already occurred at least once in the past. One very good example in the area of master data in my opinion is that of the:<\/p>\n\n\n\n

Missing vendor<\/h3>\n\n\n\n

Taking a look at the criterion that is used to tag a document with this indicator makes it clear what we are dealing with here:<\/p>\n\n\n\n

A document will be marked when it references a vendor (Table BSEG, Field LIFNR) that does not exist in the vendor master data (Table LFA1 or LFB1).<\/p>\n\n\n\n

In our last post, we already introduced the SAP data structure in purchase-to-pay, including the relevant data tables. We therefore know that the relevant vendor master data can be found in tables LFA1 and LFB1. The reference starts in one of the most important SAP tables in accounting: the \u201cBSEG\u201d table. But why does the BSEG table only contain a reference to table LFA1 or LFB1? The simple answer is that by doing this redundancy is avoided. Think of it like this: would you write a shopping list for yourself and then write another one for your spouse or partner? That wouldn\u2019t make any sense at all, right? That is why data is often stored with a reference to other tables, which contain the necessary information. This should be clear to see simply by taking a look at the following tables:<\/p>\n\n\n\n

  Table BSEG                                        Table LFA1<\/p>\n\n\n\n

Vendor No.<\/td>Document No.<\/td> <\/td>Vendor No.<\/td>Name<\/td><\/tr>
1203<\/td>1800000004<\/td> <\/td>1203<\/td>Obst M\u00fcller<\/td><\/tr>
1204<\/td>1800000013<\/td> <\/td>1205<\/td>Beton Berta<\/td><\/tr>
1205<\/td>1800000068<\/td> <\/td> <\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

If vendor 1204 is also missing in table LFB1, the document number \u201c1800000013\u201d would be marked for the indicator concerned. There is a risk of insufficient traceability of business transactions due to missing vendor master data.<\/p>\n\n\n\n

Other examples of indicators in the area of master data are:<\/p>\n\n\n\n

Vendor master data with inappropriate or incomplete payment terms<\/h3>\n\n\n\n

The aim of this indicator is to identify opportunities for savings.
There is a risk that inefficiencies or working capital losses have been caused by lax payment management.
The criterion for a document being marked for this indicator is as follows:
The document will be marked if the payment terms of the referenced vendor are not maintained or are inadequate.<\/p>\n\n\n\n

Vendors without bank account<\/h3>\n\n\n\n

This aim of this indicator is to meet the audit objective of compliance and correctness.
There is the risk that payments cannot be traced due to missing bank account details.
The criterion for a document being marked for this indicator is as follows:
The document will be marked if it references a vendor where a bank account has not been maintained. However, at least one payment has been identified for this vendor.<\/p>\n\n\n\n

It would be going beyond the scope of this blog post to introduce all indicators in this field here. This is why we have prepared a whitepaper containing details of all of the purchase-to-pay indicators that we have developed and implemented in zap Audit:<\/p>\n\n\n\n

\"Download\"\/<\/a><\/figure>\n\n\n\n

Purchase orders and goods received<\/h2>\n\n\n\n

Especially in the area of purchase orders and goods received, business transactions can frequently occur in unwanted ways. There are cases where the purchase order is posted after the goods received, where there is no reference to a purchase order for an item of goods received, or where purchase orders have been set up with missing or inappropriate payment terms. There are plenty of other cases I could mention. But these three examples should be enough for now:<\/p>\n\n\n\n

Purchase order creation after invoice creation<\/h3>\n\n\n\n

Audit objective<\/strong>:
This indicator aims to meet the audit objective of compliance and correctness.
Description<\/strong>:
The document will be marked if an FI document was entered prior to the referenced purchase order.
Risk<\/strong>:
Standard processes and internal controls have been circumvented by directly entering the invoice.<\/p>\n\n\n\n

Goods receipts without purchase order<\/h3>\n\n\n\n

Audit objective<\/strong>:
This indicator aims to meet the audit objective of process standardization.
Description<\/strong>:
The FI document has been marked because it is linked to a material document with the movement type 501. 501 means there is a goods receipt without a purchase order.
Risk<\/strong>:
There is the risk that invoice verification will be hindered due to the absence of a purchase order.<\/p>\n\n\n\n

Purchase orders with inappropriate or incomplete payment terms<\/h3>\n\n\n\n

Missing payment terms are always a good sign of opportunities for savings, and that is precisely the objective of this indicator. There is a potential risk of lost discounts due to missing payment terms. This indicator helps you to easily identify opportunities for savings and thus save money in the future. It may also help you to improve your purchase-to-pay processes, if used correctly. In total, we have implemented 15 indicators for auditing opportunities for savings in zap Audit.<\/p>\n\n\n\n

Auditing of invoices<\/h2>\n\n\n\n

Once your purchase orders and goods received have been audited, the next step is usually to audit invoices. But in some cases, there may be deviations from the standard process, where the invoice has been cleared before the goods received was posted. Of course, we have also accounted for this scenario:<\/p>\n\n\n\n

Invoice cleared before goods received<\/h3>\n\n\n\n

This indicator does not directly analyze the data in the SAP tables, but instead analyzes the generated sequences by Financial Process Mining<\/a>. One risk that may come to mind here is that of payment for services \/ goods without the service \/ goods being rendered. For this reason, an invoice is marked if it was cleared prior to the posting date of the goods received document.<\/p>\n\n\n\n

zap Audit does not just analyze sequences in this area. Invoices in particular offer a great deal of scope for analysis and thus give rise to a lot of different indicators. From statistical outliers such as the \u201cvery high incoming invoice amount\u201d indicator to that for \u201cduplicate payments\u201d, which we will take a look at in the next section. But first, here\u2019s one for the statistics fans among you:<\/p>\n\n\n\n

Very high incoming invoice amount<\/h3>\n\n\n\n

The document will be marked if it contains a very high invoice amount for a specific vendor. \u201cVery high\u201d means that the invoice amount is more than six standard deviations above the average invoice amount for the specific vendor. Vendors are only taken into consideration when more than 20 different invoice documents for the specific vendor have been found. The outlier analysis is based on Tchebysheff\u2019s inequality. If you want to read more about this indicator, simply take a look at our blog series: \u201cGetting serious: What are high incoming invoice amounts?<\/a>\u201c<\/p>\n\n\n\n

Duplicate payments<\/h2>\n\n\n\n

It is not always that easy to say what added value the internal audit function contributes to the company. Internal audit is often seen as a regulatory necessity. It would therefore be much easier to justify this necessity by saving money. This is precisely why we have already devoted a comprehensive four-part series to duplicate payments. You can find the first part here: \u201cCashback: How the audit department pays off with duplicate payments<\/a>\u201c. For this reason, I will only explain the basics of how to detect duplicate payments in brief here. It is nearly impossible to say with absolute certainty that a duplicate payment occurred. Instead, there are several indications of such a scenario and if they crop up at the same time, then it is probable that a duplicate payment has occurred:<\/p>\n\n\n\n