As part of the preliminary survey, an internal auditor sent an internal control questionnaire to the accounts payable function. Based on the questionnaire responses, the auditor determines that there is no established procedure for adding and approving new vendors. What would the auditor do next?
After determining that there is no established procedure for adding and approving new vendors from the internal control questionnaire, the auditor should document the observation for further follow-up. This step ensures that the issue is formally recorded and will be addressed during the testing of the operating effectiveness of controls. This follow-up can help determine the root cause and the potential impact of the lack of procedures, which is crucial for developing appropriate recommendations and actions to mitigate any risks identified.
Interviewing personnel may be necessary later to gather more information, but the initial step after identifying the lack of procedures would be to document it and plan for further testing to understand the root cause and impact.