Order to cash runs from a customer order to cash applied against the receivable. It carries the revenue recognition risk, and it is where customer credit, pricing and returns decisions turn into entries. This post sets out an RCM and tests for each key control. For issuers, authorization and recording controls trace to Section 13(b)(2)(B) of the Exchange Act, and the SEC's interpretive guidance for management treats critical accounting policies and estimates as generally carrying higher misstatement risk.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| O2C-01 | Sales to unapproved or fictitious customers | New customer setup approved outside sales with credit check and tax status documented | Preventive | Occurrence | Sample new customers; agree to approval and credit file |
| O2C-02 | Unauthorized pricing or terms | Price list changes approved; system blocks manual price overrides above a threshold | Preventive, automated | Accuracy | Test configuration; review override log |
| O2C-03 | Orders accepted beyond credit limit | Credit hold enforced in the order system; releases require credit manager approval | Preventive, automated | Valuation | Test hold configuration; test releases against approvals |
| O2C-04 | Revenue billed without shipment or delivery | Invoice generated only from shipping confirmation; billing sequence checked | Preventive, automated | Occurrence | Reperform match of invoices to shipping records for sample |
| O2C-05 | Revenue recorded in the wrong period | Cutoff review of shipments and invoices in the last and first five days around period end | Detective | Cutoff | Reperform: trace last-five-day invoices to shipping and first-five-day shipments to invoices |
| O2C-06 | Unauthorized credit memos or write-offs | Credit memos above threshold approved by someone other than sales; reviewed monthly | Preventive and detective | Occurrence, valuation | Population of credit memos; test approvals; analyze by creator |
| O2C-07 | Cash misapplied or diverted | Lockbox receipts reconciled daily; unapplied cash aged and reviewed weekly | Detective | Existence, accuracy | Agree bank deposits to applications; test unapplied cash aging |
| O2C-08 | Allowance for credit losses misstated | Quarterly allowance computation reviewed by controller; aging report tested for completeness | Detective | Valuation | See /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls |
| O2C-09 | Revenue misstated for contract terms (bundles, rights of return, variable consideration) | Contract review checklist for non-standard terms by revenue accounting | Preventive | Accuracy, presentation | Select non-standard contracts; reperform accounting analysis |
| O2C-10 | Manual journal entries to revenue | Entries approved by someone outside the preparer, reviewed monthly | Preventive, detective | Occurrence | See /us/blog/journal-entry-testing-au-c-240 |
Analytics
Data analytics can test an entire population instead of a sample. For O2C:
- Cutoff analysis. All invoices dated within five days of period end compared to ship dates; list the ones where the ship date falls after period end.
- Credit memos after period end that reverse invoices recorded in the last week of the period.
- Customer concentration of late-period sales to detect bill-and-hold patterns.
- Unapplied cash older than 30 days by customer and by clerk.
- Credit limit breaches at invoice date.
- Price variance between invoice and price list by customer.
- Duplicate invoices by customer, amount and reference.
Worked example: cutoff test
A company with $180 million of revenue closes on December 31 and has materiality of $1.8 million. Internal audit extracts all invoices dated December 26 to 31 and January 1 to 5 and the shipping records for the same dates.
- Invoices in the last five days: 412, total $6.9 million. Match to shipping confirmations: 405 shipped by December 31; 7 shipped January 2 or later, total $1.15 million. These are revenue recorded in the wrong period.
- Shipments in the first five days: 380, total $6.2 million. None shipped in December but was invoiced in January, so there is no offsetting understatement.
- Net overstatement of fiscal-year revenue: $1.15 million. Performance materiality at 75 percent of $1.8 million is $1.35 million, so the amount is below it. A misstatement below materiality still signals a control failure in O2C-05, and it must be evaluated together with other deficiencies that affect revenue. See /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion.
The control description in the RCM reads "review of the last and first five days." The test showed the review was performed on a report that included only invoices created in the ERP's billing module, which excluded manually keyed invoices. Cause: the report's scope. Corrective action: expand the report.
Fraud and override considerations
Revenue recognition fraud risk belongs in the engagement scope; Standard 13.2 Engagement Risk Assessment requires internal auditors to consider specific risks related to fraud. See /us/blog/fraud-risk-assessment-for-icfr-override-and-antifraud-controls and /us/blog/revenue-recognition-audit-procedures. Include a test of top-side revenue entries and of side agreements by sales staff.
ASC 606 judgments
The revenue accounting policy itself is a critical area. Controls over contract identification, performance obligations, transaction price and timing should be in the RCM with the owner and the review evidence. See /us/blog/asc-606-revenue-recognition.
Mistakes to avoid
- Testing invoices but not shipments.
- Relying on a cutoff report whose scope was never tested.
- Treating credit memo approval as an AR task when sales initiates the credit.
- Ignoring unapplied cash as a revenue and collectability indicator.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- Securities Exchange Act of 1934, section 13(b)(2)(B), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m
- SEC, Release No. 33-8810, Section II.A.2.a (misstatement risk factors; critical accounting policies and estimates): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- The IIA, Global Internal Audit Standards (2024), Standard 13.2 Engagement Risk Assessment: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error