I work as an auditor mainly with nonprofit organizations as well as commercial clients. One AIS
we use would be how we record our time. We record our time down to the tenth of an hour in
order to bill to clients. At the end of each week, I have submitted (Electronicky) my time card
composing of all the hours I worked throughout the week. We record it with the client code,
work code, and hours worked. There is a spot for a note, and is sometimes used to describe
what is worked. This information is sent to HR who handles payroll as well as to the partners to
monitor billable hours, it also gets sent to the AR department to compose the bills for the
clients. When I enter my information, it gets used by many different departments to do many
different things. Billing to clients, payroll for the firm as well as reviewing work done is all
composed over the original numbers I enter.
A control I would implement would be an approval process of hours before each payroll
period. Since my work is done mostly by myself with not much oversite, I enter the hours as I
seem fit. Someone in the origination could bill hours to clients when that amount of work was
not actually done. Based on what they enter as billable hours could be not true, they would get
paid for those hours, get a bonus for large number of billable hours, and clients would get
billed for more hours then was worked. A control for this would be for a partner or manger to
look at time cards and approve that what was reported was worked on. Another way the
approval could work would be requiring employees to enter in the notes section what part of
the audit was worked on, discussing what the time being billed for is being worked on. Since
the information entered is used in many locations, the most effective control would be at the
entering of that data, this would reduce the compounding faults down the line of the AIS.
