To establish internal control that prevents a purchase order (PO) creator from also making payments to vendors, you can implement a segregation of duties (SoD) framework. Here's a simple and effective approach:
Internal Control Framework: PO Creation vs. Vendor Payment
1. Segregation of Duties (SoD)
- PO Creator Role: Responsible for initiating and approving purchase orders.
- Payment Processor Role: Responsible for verifying invoices and executing payments.
- These roles should be assigned to different individuals or departments in your ERP system (e.g., SAP S/4HANA).
2. Role-Based Access Control (RBAC)
- Configure system roles so that users with PO creation rights cannot access payment functions.
- Use authorization objects (e.g., object level authorization) to restrict access.
3. Workflow Approval
- Implement multi-level approval workflows:
- PO approval by a manager or procurement head.
- Invoice verification by accounts payable.
- Payment release by treasury or finance controller.
4. Audit Trail and Logging
- Ensure all actions (PO creation, invoice posting, payment execution) are logged and auditable.
- Use SAP audit logs or GRC tools to monitor for violations.
5. Exception Reporting
- Set up automated reports to flag any user who has access to both PO creation and payment functions.
- Review these reports periodically for compliance.
6. Periodic Access Review
- Conduct quarterly or bi-annual reviews of user roles and access rights.
- Remove any conflicting access to maintain control integrity.
------------------------------
Eashwar Seshadri CMA
Director/Manager
IBM India Ltd
Norristown PA
United States
------------------------------