Glossary
Audit and controls terms, in plain words
Each entry gives a short definition and says why the term matters to internal audit and controllers. Each one has a worked example and a note on how IRAME handles it.
A
- Action taken report (ATR)
- An action taken report (ATR) records what management has done about each audit finding, who owns it and whether it is closed.
- Audit trail
- An audit trail is a time-stamped record of who created, changed or approved a record, and when.
C
- Continuous controls monitoring (CCM)
- Continuous controls monitoring (CCM) is the automated testing of controls on every transaction as it is recorded.
- Control deficiency
- A control deficiency exists when a control's design or operation does not let staff prevent or detect misstatements on time.
D
- Duplicate payment
- A duplicate payment is a payment made more than once for the same supplier invoice or obligation.
F
- Full-population testing
- Full-population testing is testing every transaction in scope against a control, with no sampling.
I
- ICFR (internal control over financial reporting)
- Internal control over financial reporting (ICFR) is the set of processes that give reasonable assurance that a company's financial statements are reliable.
J
- Journal entry testing
- Journal entry testing is the review of entries posted to the general ledger to find ones that are unauthorized, unusual or wrong.
R
- RACM (risk and control matrix)
- A risk and control matrix (RACM) maps each risk in a process to the controls that address it and the test for each control.
- Revenue leakage
- Revenue leakage is revenue a company has earned but does not bill, collect or keep.
S
- Segregation of duties (SOD)
- Segregation of duties (SOD) is a control that splits a process between people so that no one person can both make and hide an error or fraud.
- SOX 404
- SOX 404 is the section of the US Sarbanes-Oxley Act of 2002 that requires an annual assessment of internal control over financial reporting.
T
- Three-way match
- A three-way match checks that the purchase order, the goods receipt and the supplier invoice agree before the invoice is paid.
V
- Vendor master audit
- A vendor master audit reviews the supplier records in the ERP for duplicates, missing details, risky changes and vendors that should not be there.
Stop sampling. Let IRA test everything.
Bring one process. In 30 minutes we show you the exceptions IRA finds and the evidence behind each one.