In testing controls, the auditor can obtain evidence from the client’s information system and analyze it in a tabular or visual form. Your client has controls in place regarding credit limits for customers. The client’s software has the capability to compare a customer’s outstanding receivable balance, plus the anticipated sale, with the customer’s credit limit in the approved customer master file. Credit limits vary by customer. For a sale to be made that will cause the customer to exceed the established credit limit, special authorization must be granted by the credit department. The table titled “Missing Credit Checks” is a list of customer numbers for customers who did not have authorization to exceed the established credit limit. The visualization titled “Credit Limit Compared to Total Sales” is the difference between the invoices for the month and the customer’s credit limit.

This control seems to fail to record or flag the lack of authorization of the sale when the invoices for the month exceed the credit limit, but it does not prevent the sale. Why do you think that the control functions this way? What would you say in your management letter to the client?

What other analysis may the auditor want to do with the invoice data in the file?

How can the client use a program like Tableau to manage control deviations?