I work as an auditor mainly with nonprofit organizations as well as commercial clients. One AIS
we use would be how we record our time. We record our time down to the tenth of an hour
in order to bill to clients. At the end of each week, I have submitted (Electronicky) my time
card composing of all the hours I worked throughout the week. We record it with the client
code, work code, and hours worked. There is a spot for a note, and is sometimes used to
describe what is worked. This information is sent to HR who handles payroll as well as to the
partners to monitor billable hours, it also gets sent to the AR department to compose the bills
for the clients. When I enter my information, it gets used by many different departments to do
many different things. Billing to clients, payroll for the firm as well as reviewing work done is
all composed over the original numbers I enter.
A control I would implement would be an approval process of hours before each payroll
period. Since my work is done mostly by myself with not much oversite, I enter the hours as I
seem fit. Someone in the origination could bill hours to clients when that amount of work was
not actually done. Based on what they enter as billable hours could be not true, they would
get paid for those hours, get a bonus for large amount of billable hours, and clients would get
billed for more hours then was actually worked. A control for this would be for a partner or
manger to look at time cards and approve that what was reported was actually worked on.
Another way the approval could work would be requiring employees to enter in the notes
section what part of the audit was worked on, discussing what the time being billed for is
being worked on. Since the information entered is used in many locations, the most effective
control would be at the entering of that data, this would reduce the compounding faults down
the line of the AIS.
