Requiring the matching of a purchase order (PO), receiving report, and invoice before payment is a robust control designed to prevent overpayment and other types of fraudulent activities related to vendor payments.
This control ensures that:
* The goods or services invoiced were actually ordered (verified by the purchase order).
* The goods or services were received (verified by the receiving report).
* The invoice amount matches the agreed-upon terms and quantities (verified by the invoice).
This three-way match process helps prevent discrepancies such as overpayments, duplicate payments, or payments for goods/services not received. By ensuring all three documents align, it mitigates the risk of fraud and errors in vendor payments.
References:
* The Institute of Internal Auditors (IIA) Standards and Practice Advisories.
* COSO Internal Control - Integrated Framework, specifically on control activities.
* "Internal Auditing: Assurance & Advisory Services" by IIA, Chapter on Procurement and Accounts Payable Controls.

When the CEO frequently bypasses written policies and procedures, it indicates a significant deficiency in the effectiveness of the organization's system of internal control. This behavior can undermine the control environment and set a precedent that policies and procedures can be disregarded, thereby affecting the overall control culture of the organization. In such cases, the auditor should report that the system of internal control is not effective.References: IIA guidance on evaluating the effectiveness of an organization's system of internal control.

By recommending revisions to the internal audit charter that include requirements regarding the hiring and compensation of the chief audit executive and the approval of the internal audit budget, the board is most likely defining the functional and administrative responsibilities of the internal audit activity. These aspects pertain to the organizational structure and resource management within the internal audit function, which are fundamental to its operation and effectiveness.References: IIA guidance on internal audit charters and governance.

The best demonstration of conformance with the Standards regarding the internal audit activity's purpose, authority, and responsibility is the discussion and formal presentation of the internal audit charter to the board of directors. This ensures that the board is fully aware of and agrees with the internal audit's defined role within the organization, thereby establishing a clear basis for its operations and scope of work.References: The IIA's International Standards for the Professional Practice of Internal Auditing on Charter requirements.

Policies that provide examples of inappropriate business relationships best promote objectivity in the internal audit activity's work by explicitly defining what constitutes a conflict of interest and guiding auditors on how to avoid situations that might impair their objectivity. This clear delineation helps maintain the independence and unbiased perspective necessary for effective auditing.References: Institute of Internal Auditors (IIA) - Code of Ethics and Professional Standards; literature on maintaining objectivity in internal auditing.