AUDIT COMMITTEE SUMMARY
March 17, 2020
Audit of Finance Department Vendor Master File
Report Issued March 4, 2020
Audit Objective
Determine if proper internal controls are in place to ensure the City’s Vendor Master File is reliable and disbursements are accurate.
Background
The Vendor Master File (VMF) is a foundational element of the accounts payable and procurement processes. It is a listing maintained in the SAP financial management system of all approved vendors from whom the City purchases goods and services.
According to best practices, access to the VMF should be limited as a vendor’s existence within the listing allows payments to be processed. As such, it is essential to effectively maintain the VMF in order to minimize the risk of inappropriate or duplicated payments and overall system inefficiencies. Employees within the Financial Operations Division are tasked with maintaining the listing by overseeing the following processes; vendor creation, change management, and file maintenance. In addition, vendors are incorporated into the following categorizes; trade, remit, employee, and payroll.
Scope and Methodology
The audit scope included the VMF, vendor disbursements, and SAP users with access to vendor maintenance roles from October 2015 through July 2019. We reviewed samples of new vendors and vendor changes to confirm they were supported with adequate source documentation and were properly validated by the Division. We also reviewed the Division’s annual file maintenance process to determine whether inactive vendor records were adequately blocked. We also performed data analysis over the vendor master file and disbursements files to identify potential anomalies. In addition, we reviewed SAP application controls specific to the VMF to confirm they were operating as intended. Finally, we reviewed SAP user access to confirm access was appropriate.
Conclusions
The Financial Operations Division currently has adequate internal controls to ensure new vendor records are supported with proper documentation. Additionally, there is an adequate process in place to identify and block inactive vendors on an annual basis.
However, there are opportunities to improve the change management process. Currently, adequate documentation to support vendor record changes is not maintained. In addition, potential issues with vendor records such as blank required fields and duplicate vendor records were identified. Finally, user access is not appropriate for users with access to vendor maintenance roles.
We made recommendations to address the opportunities. Management agreed with the recommendations and developed a positive corrective action plans.