Capex budget and approval
Risk: Assets are purchased without approved budget, business case, technical need or delegated authority.
Controls
- Annual capex budget
- Approval matrix
- Business case review
- Budget overrun approval
Tests
- Match additions to capex budget
- Review approval limits
- Test emergency capex
- Inspect budget overrun approvals
Evidence
Capex budget, approval note, business case, board/committee minutes, purchase request and delegation matrix.
Purchase, receipt and installation
Risk: Asset invoices are paid or capitalised before receipt, installation, commissioning or readiness for use.
Controls
- PO and vendor approval
- GRN/installation evidence
- Commissioning certificate
- Three-way match
Tests
- Match PO, invoice and receipt
- Trace installation evidence
- Review commissioning dates
- Check capitalisation before readiness
Evidence
PO, invoice, GRN, delivery challan, installation report, commissioning certificate and user acceptance.
Capitalisation policy and classification
Risk: Revenue expenditure is capitalised, capital expenditure is expensed, or componentisation criteria are ignored.
Controls
- Capitalisation checklist
- Expense-vs-capital review
- Componentisation review
- Finance approval
Tests
- Sample additions and repairs
- Check nature of spend
- Review componentisation
- Trace finance approval
Evidence
Capitalisation policy, invoice narration, technical note, fixed asset voucher, approval checklist and GL entry.
CWIP ageing and project closure
Risk: Completed assets remain in CWIP, abandoned projects are not reviewed, or depreciation starts late.
Controls
- CWIP ageing review
- Project owner sign-off
- Completion certificate
- Transfer-to-FAR workflow
Tests
- Age old CWIP
- Match completion to FAR transfer
- Review abandoned projects
- Check depreciation start date
Evidence
CWIP ledger, project tracker, completion certificate, project-owner confirmation, FAR transfer and depreciation run.
Fixed asset register quality
Risk: FAR is incomplete, duplicated, not reconciled to GL, or lacks asset ID, location, custodian and useful-life fields.
Controls
- FAR mandatory fields
- FAR-to-GL reconciliation
- Duplicate asset review
- Master-data change log
Tests
- Reconcile FAR to GL
- Scan blank location/custodian
- Check duplicate assets
- Inspect master changes
Evidence
FAR extract, GL control account, reconciliation, asset-class map, change log and reviewer sign-off.
Tagging and physical verification
Risk: Assets are missing, moved, damaged or held by the wrong custodian without detection.
Controls
- Asset tagging
- Physical verification plan
- Custodian confirmation
- Variance approval
Tests
- Inspect tag coverage
- Perform count-to-FAR and FAR-to-count tests
- Review count variances
- Check repeat missing assets
Evidence
Physical verification plan, count sheet, asset tags, photographs, custodian confirmation and variance tracker.
Depreciation and useful life
Risk: Depreciation is calculated using wrong useful life, residual value, method, start date or shift adjustment.
Controls
- Useful-life policy
- Schedule II/technical assessment
- Depreciation run review
- Useful-life change approval
Tests
- Recompute depreciation
- Check residual value
- Test additions/disposals
- Review useful-life deviations
Evidence
Depreciation policy, Schedule II/technical note, FAR depreciation fields, depreciation run and reviewer approval.
Disposal, retirement and scrap
Risk: Assets are sold, scrapped, retired or written off without approval, valuation, receipt tracking or FAR removal.
Controls
- Disposal approval
- Sale/scrap valuation
- Gate-pass control
- FAR removal and accounting review
Tests
- Sample disposals
- Match proceeds to bank
- Check GST/accounting treatment
- Trace FAR removal
Evidence
Disposal note, valuation, sale invoice, scrap register, gate pass, bank receipt, GST support and FAR entry.
Impairment, idle assets and insurance
Risk: Idle, damaged, obsolete or uninsured assets remain at carrying value without impairment or risk review.
Controls
- Idle asset review
- Impairment indicator assessment
- Insurance adequacy review
- Action tracker
Tests
- Review idle/damaged list
- Match insurance cover to FAR
- Inspect impairment assessment
- Trace action on obsolete assets
Evidence
Idle asset list, utilisation report, impairment memo, insurance schedule, claim tracker and management action plan.
ERP access and asset master changes
Risk: Users can create assets, change useful lives, post disposals, backdate capitalisation or approve their own changes.
Controls
- Role-based access
- SoD review
- Asset master change log
- Leaver and privileged access monitoring
Tests
- Review FA module roles
- Test SoD conflicts
- Scan backdated changes
- Match leavers to active users
Evidence
ERP user list, FA role matrix, asset master change log, audit trail, HR leaver list and access review sign-off.