Many organizations use electronic funds transfer (EFT) when they are transferring cash among banks, collecting from customers, paying employees, and paying vendors. Under these systems, cash is transferred instantly. For example, when Hillsburg Hardware Limited receives a debit card payment from ABC Hardware Ltd., the cash is transferred immediately from ABC's bank account to Hillsburg's bank account. No cheque is issued. EFTs such as those via debit card and electronic data interchange (EDI) have the potential to improve internal controls, since there is no cash handling by employees. However, the risk of incorrect transfers or theft by unauthorized transfers still exists. When assessing internal controls, the auditor needs to evaluate and document controls in all software involved (data communications, data transfer, specialized EDI programs, and access). With electronic payments, year-end balances of accounts receivable, accounts payable, or inventory may be reduced since funds are received closer to the date of the transaction. Where funds are transferred electronically, there is an increased need for the enhanced security features of encryption, access control, and authentication (verifying the identity of the parties to a transaction).
APPLYING YOUR PROFESSIONAL JUDGMENT
1. When accounts receivable and inventory are small (i.e., immaterial), what type of audit testing is used for the sales and accounts receivable transactions? Why?
2. What is the role of password protection in the use of EDI and EFT? How does the auditor test such controls?