A failed purchase-order check gives the reviewer a finding to investigate. The transaction amount, the accounting effect and the significance of the control failure are separate questions. Keeping them separate produces a more useful workpaper.
Start with the finding you can support
Take the synthetic supplier invoice in the OpenAuditor financial-audit walkthrough. Northstar IT Supply bills $24,800 for 20 laptops at $1,240 each. The arithmetic reconciles, the supplied vendor record is active, and the invoice has no purchase-order reference. The configured control requires a reference above $1,000.
The supported observation is precise: the submitted invoice fails the PO-reference requirement. The invoice value is the amount of the transaction reviewed. It is not yet a quantified error, loss or financial statement misstatement. The reviewer still needs to establish whether the purchase was authorized, whether the goods arrived and how the transaction was recorded.
That distinction changes the investigation. Searching for an omitted PO reference is different from investigating a purchase made without authorization. Both can start with the same failed check.
Keep the control threshold separate from audit materiality
The $1,000 threshold answers an operational question: when does purchasing policy require a PO reference? Financial statement materiality concerns whether a misstatement or omission could influence users' decisions. Audit planning considers amount and circumstances, including whether particular accounts or disclosures require a lower materiality level. PCAOB AS 2105 sets out these materiality considerations for audits under PCAOB standards.
A company's control can deliberately operate well below engagement materiality. Routine authorization requirements help maintain discipline across many purchases. Comparing $24,800 with a larger planning figure does not answer whether this invoice complied with that control, or whether similar exceptions indicate a broader problem.
In the workpaper, identify the policy and threshold used for the test. Record the engagement's materiality assessment separately, with its rationale and the person responsible for it. Internal audit teams should also state the operational objective and escalation criteria that apply to their review.
Investigate the cause before assigning an amount
The first follow-up should resolve the missing evidence. Ask purchasing for the original order and approval history, compare them with the source invoice, and inspect receiving records. Establish when each record existed; a PO created after the purchase can tell a different story from a valid earlier PO omitted by an export.
| What follow-up establishes | How the finding changes |
|---|---|
| A valid, timely PO exists but its reference was dropped from the export. | Investigate the data extraction and preserve evidence of the correction. The original automated finding remains accurate about its supplied input. |
| The laptops arrived and were recorded correctly, but the purchase bypassed required approval. | The authorization exception remains. Correct accounting does not demonstrate that the purchasing control operated. |
| Only 18 laptops arrived, while the invoice and accounting entry record 20. | Investigate the two-unit difference and the relevant delivery and contract terms. At the stated unit price, $2,480 is the difference requiring evaluation. |
These are possible investigation outcomes, not facts established by the saved example. Each requires evidence beyond the supplied invoice fields. Keep the transaction value and any subsequently identified accounting difference in separate fields to prevent an exception report from overstating losses.
Assess the pattern as well as the individual item
An isolated export defect and repeated purchasing overrides call for different follow-up. Review who initiated the transaction, whether exceptions cluster around the same approver or supplier, and whether the process permits retrospective approval. A pattern can change where the team directs further work without turning every transaction in the pattern into a misstatement.
When actual misstatements are identified, evaluate them together with other relevant misstatements and their qualitative circumstances. An effect on a loan covenant or an intentional accounting adjustment may matter beyond its size. PCAOB AS 2810 explains the evaluation of uncorrected misstatements and relevant qualitative factors; that evaluation follows evidence about the accounting issue.
A search for similar missing references can define the affected population for further review. Document the period, systems, entities and excluded records. A count of exceptions from one extract describes that extract, so confirm its coverage before extending the conclusion to the business.
Choose follow-up that answers the remaining question
For authorization, inspect evidence that the required control operated. For the recorded amount, examine the invoice, receipt and accounting entry. A successful arithmetic check cannot substitute for evidence of approval. PCAOB AS 2301 distinguishes tests of controls from substantive procedures and explains why the absence of detected misstatements does not establish control effectiveness.
Assign a control owner and a review owner. The control owner explains the process and proposed correction; the reviewer evaluates the evidence and whether further testing is needed. Keep an unresolved item open when the response is an explanation without sufficient supporting records.
Write a disposition another reviewer can follow
A useful disposition states the original condition, the follow-up performed, the evidence obtained and the conclusion reached. It also explains the materiality assessment where relevant, any accounting adjustment, and the action taken on the control issue. Include dates and the preparer and reviewer identities.
If a corrected export supplies the missing reference, preserve both requests and both results. Link the later result to the correction instead of replacing the original evidence. If the purchase was unauthorized, adding a PO number later should not erase the question of whether the control operated when required.
Use the automated result within that review
OpenAuditor returns the failed assertion and its evidence pointers for the supplied record. Its current API does not set engagement materiality, quantify every exception as a misstatement or waive a finding based on a materiality assessment. It also does not issue an audit opinion or maintain the complete workpaper.
Use the verification result as one part of the review record. Keep your source evidence, materiality reasoning and disposition in your own workflow. The audit concepts guide explains how these professional judgments relate to the product's supported checks.