Auditors organize a company’s activity into five transaction cycles in auditing work: revenue and collection, expenditure and disbursement, payroll and personnel, production and inventory, and finance and investment. Each cycle groups related transactions with the general ledger accounts they touch, which lets the audit team test the controls governing a whole stream of activity and gather evidence about several account balances at once. The cycle approach is the backbone of how audit work is divided, and it explains why auditors ask for the documents they ask for.
Why the Work Is Split This Way
A mid-size company can process hundreds of thousands of transactions in a year. Testing them individually would be impossibly slow. Grouping them by common flow lets an auditor evaluate the controls over an entire stream at once. Testing controls over sales invoicing, for example, produces evidence about both Accounts Receivable and Sales Revenue in a single pass.
Every cycle maps to a set of financial statement assertions: existence or occurrence, completeness, valuation or allocation, rights and obligations, and presentation and disclosure. When designing tests, the auditor picks the assertions most at risk. In the revenue cycle, the biggest worry is usually that recorded sales didn’t actually happen. In the expenditure cycle, the worry flips: real liabilities were left off the books. That asymmetry drives how procedures differ from one cycle to the next.
Revenue and Collection Cycle
This cycle covers everything from a customer’s order through the collection of cash. It flows through sales order processing, credit approval, shipping, billing, and cash receipts. The primary accounts are Sales Revenue, Accounts Receivable, the allowance for doubtful accounts, and Cash.
Credit approval is the first real control point. Before goods ship, someone independent of the sales team should verify that the customer’s credit limit can absorb the order. Once approved, the shipping department transfers the goods and generates a shipping document, which triggers billing and formally records the receivable. Later, when payment arrives, strong controls require that the person who handles incoming cash be different from the person who records it in the books.
Revenue recognition draws the heaviest scrutiny. Under ASC 606, revenue is recognized as each performance obligation is satisfied, and auditors focus on whether it landed in the right period. Channel stuffing, where a company pushes excess product to distributors just before period-end, can inflate reported sales when the goods carry return rights that make the “sale” closer to a consignment. Unusually large shipments in the final days of a quarter are treated as a red flag.
To test existence, auditors confirm a sample of outstanding receivable balances directly with customers. Auditing standards presume external confirmations will be requested unless receivables are immaterial, confirmations would be ineffective, or the combined assessed risk is low enough that other procedures give sufficient evidence. An auditor who skips confirmations must document why. Valuation testing centers on the allowance for doubtful accounts, comparing management’s estimate against aging data and historical write-off patterns.
Expenditure and Disbursement Cycle
The expenditure cycle mirrors the revenue cycle from the other side of the transaction: purchases and the payments that follow. It runs from purchase requisition to purchase order, receiving, invoice processing, and cash disbursement. The primary accounts are Inventory or operating expenses, Accounts Payable, and Cash.
The Three-Way Match
The central control is the three-way match. Before an invoice is approved for payment, an accounts payable clerk compares the purchase order (confirming authorization), the receiving report (confirming the goods arrived), and the vendor’s invoice (stating what is owed). If quantities, prices, and vendor name align, the liability is recorded and queued for payment. If anything is off, the discrepancy is investigated before money moves. That cross-check is what stops the company from paying for goods it never ordered or never received.
Vendor Master File
Less visible but equally important is who can add or change entries in the vendor master file. Fictitious vendor fraud works by inserting a fake supplier, generating purchase orders to it, and approving invoices for goods that were never delivered. The person who creates a new vendor should not be the person who approves invoices or initiates payments. Periodic reviews of the vendor master file look for duplicate tax identification numbers, vendors with only a post office box address, or vendor bank accounts matching an employee’s account.
Searching for Unrecorded Liabilities
Completeness is the focus because the natural incentive is to understate expenses. A common and effective procedure is examining cash disbursements made in the weeks after the balance sheet date. If a check went out on January 8 for goods received on December 20, the liability should have been on the December 31 balance sheet. Payments like these without a matching year-end accrual are strong evidence that Accounts Payable is understated.
Payroll and Personnel Cycle
Payroll is sometimes treated as part of the expenditure cycle, but it carries enough unique risks to stand on its own. The cycle covers hiring, timekeeping, pay calculation, disbursement of wages, and remittance of payroll taxes and benefit withholdings. Primary accounts include Salary and Wage Expense, Payroll Tax Expense, Accrued Wages Payable, and the withholding liability accounts for federal income tax, Social Security, Medicare, state taxes, and voluntary deductions like retirement contributions and health insurance.
Segregation of duties matters here because the same small group often controls the employee roster, time records, and payments. The person entering time data should not be adding employees to the system or setting pay rates. Nobody should enter their own hours. When a department is too small to separate every role, the compensating control is a supervisor independently reviewing and signing off on each period’s payroll expense report.
The headline fraud risk is the ghost employee scheme: someone adds a fictitious person to the payroll system, submits fabricated timesheets, and routes the paychecks to themselves. Red flags include employees with no personnel file, multiple direct deposits to the same bank account under different names, and paychecks with no tax withholdings. Auditors detect these by cross-referencing the current payroll register against the HR employee roster and investigating names that appear on one list but not the other.
Beyond fraud, auditors verify that employee classifications are correct. Misclassifying an employee as an independent contractor, or a non-exempt worker as exempt, creates payroll tax liability that may not surface until a government audit finds it. Testing includes recalculating a sample of paychecks from gross pay through every deduction to the net deposit, and confirming that the employer’s share of Social Security and Medicare was calculated and remitted correctly.
Production and Inventory Cycle
For manufacturers, this is usually the most complex cycle because costs move through multiple stages of conversion. Raw materials become work in process, work in process becomes finished goods, and finished goods become cost of goods sold when they ship. Each transfer is a journal entry, and each entry involves allocations and estimates.
Raw materials issue to the floor is documented through material requisition forms. Labor attaches through time tickets and payroll records. Manufacturing overhead, meaning the indirect costs like factory rent, utilities, and equipment depreciation, gets applied using a predetermined allocation rate. Auditors evaluate whether that rate is reasonable, reflects actual cost behavior, and has been applied consistently.
Valuation and Obsolescence
Under GAAP, inventory measured using FIFO, average cost, or any method other than LIFO or the retail method must be carried at the lower of cost or net realizable value. Net realizable value is the estimated selling price minus the costs to complete and sell. When evidence shows a decline in value from damage, obsolescence, or falling market prices, the company must write the inventory down and recognize the loss immediately. Auditors review inventory aging reports for items that haven’t moved, compare carrying values to recent selling prices, and ask management to justify slow-moving inventory that hasn’t been written down. This is where management estimates matter most, and where the temptation to delay a write-down is strongest.
Observing the Physical Count
Existence is the other major assertion. Under PCAOB Auditing Standard 2510, when inventory quantities are determined by physical count, the auditor must ordinarily be present to observe the count, perform test counts, and evaluate the reliability of the client’s counting methods. If the company uses cycle counting or statistical sampling instead of a full annual count, the auditor must be satisfied that those methods produce results substantially equivalent to a complete count. An auditor who cannot satisfy the requirements through observation alone performs or observes additional counts and tests the transactions between the count date and the balance sheet date.
Finance and Investment Cycle
This cycle involves transactions that change the capital structure or long-term asset base. Issuing bonds, taking on a term loan, repurchasing stock, declaring dividends, and buying or selling property, plant, and equipment all belong here. Primary accounts include Long-Term Debt, Equity (Common Stock and Retained Earnings), Investment accounts, Property Plant and Equipment, and related income statement items like interest expense, depreciation, and gains or losses on disposals.
Volume is low but dollar magnitude is high, which flips the audit approach. Rather than sampling a large population, auditors often examine every transaction individually. Each one typically requires board-level authorization, verified by reading minutes of board meetings and reviewing signed loan agreements or underwriting documents. If the board authorized a $50 million bond issuance in March and the general ledger shows $50 million of new long-term debt, the auditor traces the amount, terms, and covenants from the minutes through the legal agreements to the recorded liability.
For property, plant, and equipment, the focus is whether costs were properly capitalized versus expensed, whether depreciation methods and useful life estimates are reasonable, and whether recorded assets physically exist. Auditors inspect a sample of major assets in person and review disposal records to confirm that retired assets were removed from the ledger. Interest expense, lease obligations, and the classification of instruments as debt versus equity all get tested within this cycle, and each can involve accounting judgments that require close scrutiny of the underlying agreements.
How Cycle Work Feeds the Internal Control Opinion
For public companies, cycle auditing doesn’t stop at the financial statements. Sarbanes-Oxley Section 404(a) requires management to assess and report on the effectiveness of internal controls over financial reporting each year. Section 404(b) requires the independent auditor to attest to that assessment. The work on each cycle feeds directly into that opinion because each cycle’s controls are part of the overall internal control structure.
Under PCAOB Auditing Standard 2201, the auditor’s objective is to express an opinion on whether internal controls are effective, which requires obtaining enough evidence to determine whether any material weaknesses exist as of the assessment date. A material weakness is a deficiency, or combination of deficiencies, where there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. If even one material weakness exists, the auditor must conclude that internal controls are not effective, even if the financial statements themselves happen to be correct. A significant deficiency is less severe but still warrants the attention of those overseeing financial reporting.
The audit of internal controls is integrated with the audit of the financial statements. Cycle-level testing is designed to accomplish both objectives at once. A control failure in the expenditure cycle, say a three-way match that is routinely overridden, could be a material weakness that must be reported even if the resulting Accounts Payable balance happens to be correct this year.
When Pieces of a Cycle Sit Outside the Company
Many companies outsource parts of their cycles. Payroll processing, claims administration, and cloud-based financial applications are common examples. Outsourcing the work doesn’t outsource the responsibility. Management still owns the accuracy of its financial statements, and the auditor still needs assurance that controls at the service provider are designed and operating effectively.
That assurance typically comes through a SOC 1 report, an independent attestation issued by a CPA firm under AICPA standards. A Type 1 report evaluates control design at a point in time; a Type 2 report evaluates both design and operating effectiveness over a period, usually six to twelve months, and provides stronger audit evidence. When a company relies on a SOC 1 report, management must review it, evaluate any exceptions noted, and document how the findings affect its own control conclusions. If a service provider lacks a SOC 1 report, or the report reveals significant exceptions, the auditor may need to expand testing or perform procedures at the service organization directly. In practice this is where cycle boundaries blur: a payroll cycle might span the HR department, an outsourced payroll processor, and a separate benefits administrator, each with its own control environment to evaluate.