APS Exam Dumps - IOFM Accounts Payable Certification Questions and Answers

TheInternal Controlstopic in the APS Certification Program explains that detective controls are designed to identify errors, fraud, or control failures after they occur. They include activities like reviewing transactions for irregularities and assessing the effectiveness of preventive controls.Segregation of duties, however, is a preventive control, not a detective one, as it prevents fraud by dividing responsibilities.

Item I (Establish segregation of duties): Segregation of duties prevents fraud by ensuring no single employee controls all aspects of a transaction (e.g., invoice approval and payment). This is a preventive control, not detective.

Item II (Look for errors and irregularities): Detective controls, such as account reconciliation or audits, identify errors or fraudulent activities after they occur. This is a valid function.

Item III (Determine if preventive controls are effective): Detective controls, like monitoring or control testing, assess whether preventive controls (e.g., vendor validation) are working. This is a valid function.

Option A (I, II, and III): Incorrect, as Item I is a preventive control.

Option B (I and III only): Incorrect, as Item I is not a detective control function.

Option C (II and III only): Correct, as Items II and III describe detective control functions.

Option D (I and II only): Incorrect, as Item I is not a detective control function.

Reference to IOFM APS Documents: The APS e-textbook underInternal Controlsstates, “Detective controls, such as audits and reconciliations, look for errors and irregularities and evaluate the effectiveness of preventive controls.” It clarifies that “segregation of duties is a preventive control to avoid conflicts of interest.” The training video discusses detective controls as tools for “post-transaction review and control assessment,” excluding segregation of duties.

TheVendor Master Filetopic in the IOFM APS Certification Program emphasizes the importance of maintaining an audit trail for changes to the vendor master file (VMF) to ensure transparency, accountability, and fraud prevention. An effective audit trail should recordwho requested the change(to verify authorization),who actually made the change(to track accountability), andthe date the change was made(to establish a timeline), ensuring a complete record for compliance and audits.

Item I (Who requested the change): Essential to verify that the request came from an authorized individual, supporting internal controls and fraud prevention.

Item II (Who actually made the change): Critical to track the individual who modified the VMF, ensuring accountability and traceability.

Item III (The date the change was made): Necessary to document when the change occurred, aiding in audits and fraud investigations.

Option A (I, II, and III): Correct, as all three items are essential components of a VMF audit trail.

Option B (I and II only): Incorrect, as Item III (date) is also essential.

Option C (II and III only): Incorrect, as Item I (requester) is also essential.

Option D (I and III only): Incorrect, as Item II (changer) is also essential.

Reference to IOFM APS Documents: The APS e-textbook underVendor Master Filestates, “An audit trail for VMF changes must include who requested the change, who made the change, and the date of the change to ensure transparency and compliance.” The training video reinforces, “Recording the requester, the person making the change, and the date in the VMF audit trail is critical for fraud prevention and audit readiness.”

Automating accounts payable (AP) processes offers several incentives, includingreduced costs of handling paper(Option I) through digital invoicing and workflows, andbetter forecasting(Option II) by providing real-time data for cash flow and spend analysis. However, automation does noteliminate the need for audits(Option III), as audits remain essential for compliance, fraud prevention, and internal controls, even with automated systems.

The web source from Esker states: “AP automation reduces costs associated with paper-based processes, such as printing and mailing, and improves forecasting by providing real-time visibility into financial data.” The Tipalti source adds: “Automation enhances efficiency but does not eliminate audits, which are still required for regulatory compliance.” This supports Options I and II, while ruling out Option III.

The IOFM APS Certification Program covers “Technology and Automation,” emphasizing the benefits of AP automation. The curriculum’s focus on “peer-tested best practices” aligns with cost reduction and improved forecasting as key incentives, while maintaining the necessity of audits.

Assigning a user name and password is a method ofdata authentication, which verifies the identity of users accessing systems or data to ensure only authorized individuals can perform actions. This is a fundamental security control in accounts payable to protect sensitive financial information. Optical character recognition (Option A) is used for extracting data from documents, robotic process automation (Option B) automates repetitive tasks, and security lockdown (Option D) refers to broader measures like restricting system access during a breach, not specifically user authentication.

The web source from Esker states: “Data authentication, such as assigning user names and passwords, ensures that only authorized personnel can access sensitive AP systems and data.” This directly supports Option C.

The IOFM APS Certification Program covers “Internal Controls,” including security measures like authentication to protect AP processes. The curriculum’s focus on “peer-tested best practices” aligns with using user names and passwords as a standard authentication method.

TheVendor Master Filetopic in the APS Certification Program emphasizes fraud prevention through robust vendor validation processes. Key practices include confirming a vendor’s physical address, checking government sanction lists (e.g., OFAC), and requiring a W-9 to verify tax identification numbers (TINs). However,verifying that vendors are bonded(i.e., insured against financial loss) is not a standard requirement for vendor fraud prevention, as it is more relevant to specific industries (e.g., construction) and not universally applicable.

Option A (Confirmation of a physical address): Verifying a physical address ensures the vendor is a legitimate entity, reducing the risk of fraudulent shell companies. This is a key practice.

Option B (Verifying that vendors are bonded): Bonding is not a standard AP requirement for fraud prevention. It may apply to certain vendors (e.g., contractors), but it is not essential for all vendor fraud prevention programs. This is the correct answer.

Option C (Checking government sanction lists): Checking lists like OFAC (Office of Foreign Assets Control) ensures compliance with regulations and prevents payments to sanctioned entities, a critical fraud prevention step. This is a key practice.

Option D (Requiring a W-9): A W-9 provides the vendor’s TIN, enabling verification with the IRS to prevent fraudulent identities and ensure tax compliance. This is a key practice.

Reference to IOFM APS Documents: The APS e-textbook underVendor Master Filelists “confirming physical addresses, checking sanction lists, and requiring W-9 forms” as essential for vendor fraud prevention. It notes that “bonding is not a universal requirement for vendor validation,though it may be relevant for specific contracts.” The training video emphasizes vendor verification processes, highlighting address checks, sanction list reviews, and W-9 requirements but not bonding.

The tolerance level for discrepancies between a purchase order (PO) and an invoice refers to the acceptable variance (e.g., in price or quantity) that an organization allows before requiring additional approval or investigation. Keeping this tolerance level confidential is critical to prevent vendor fraud, as vendors could exploit knowledge of the tolerance to submit invoices with intentional discrepancies just within the acceptable range, leading to overpayments or unauthorized charges.

The web source from NetSuite highlights the importance of internal controls in invoice matching: “Three-way matching is an AP process used to verify a supplier invoice by checking it against its corresponding purchase order and order receipt. It reduces the chances of fraudulent invoices going undetected and, worse, being paid.” While this source does not explicitly address confidentiality of tolerance levels, the emphasis on fraud prevention implies that exposing tolerance thresholds could undermine these controls. If vendors know the tolerance, they might adjust invoices to exploit it, bypassing scrutiny.

Options B, C, and D are incorrect. Keeping procurement alert (Option B) is a general goal but not directly tied to confidentiality of tolerance levels. Avoiding internal audit scrutiny (Option C) is not a legitimate reason, as internal audits ensure compliance. Option D (depositing overages into a fund) is unethical and unrelated to accounts payable processes.

The IOFM APS Certification Program covers “Internal Controls,” which includes measures toprevent fraud and ensure accurate invoice processing. The program’s focus on “peer-tested best practices” and fraud prevention, as noted in the curriculum description, supports the need to keep tolerance levels confidential to safeguard against vendor manipulation.

The Check Clearing for the 21st Century Act (Check 21), passed in 2003, enables banks to process checks electronically by allowing check truncation, where a physical check can be converted into a digital image (substitute check) at any point in the clearing process. This expedites check clearing and reduces costs associated with physical check handling. The law was enacted after September 11, 2001, partly in response to disruptions in check processing caused by grounded air transport post-9/11.

The web source from Tipalti states: “Check 21, passed in 2003, allows check truncation by converting checks into electronic images, speeding up the clearing process.” The other options areincorrect:

The Patriot Act (B)focuses on anti-terrorism and money laundering.

Gramm-Leach-Bliley (C)addresses financial privacy and was passed in 1999.

Sarbanes-Oxley (D)deals with corporate governance and financial reporting, passed in 2002.

The IOFM APS Certification Program covers “Tax and Regulatory Compliance,” including regulations affecting payment processes. The curriculum’s emphasis on “peer-tested best practices” includes understanding laws like Check 21 that impact check processing.

The Internal Revenue Service (IRS)Publication 463, titled "Travel, Gift, and Car Expenses," is the primary document that addresses travel and entertainment (T&E) expenses. It provides detailed guidance on what qualifies as deductible business travel, entertainment, and related expenses, including rules for substantiation, accountable plans, and per diem rates.

The web source from the IRS states: “Publication 463, Travel, Gift, and Car Expenses, explains what expenses are deductible, how to report them, and the rules for an accountable plan.” This directly supports Option B. The other options are incorrect:

Notice 1009 (A)does not exist in the context of T&E expenses.

Advisory 972 (C)is not a recognized IRS document.

Form 1046 (D)is not related to T&E; IRS forms like 1040 or 1099 are unrelated.

The IOFM APS Certification Program covers “Tax and Regulatory Compliance,” including IRS guidelines for T&E expenses. The curriculum’s focus on “peer-tested best practices” emphasizes familiarity with Publication 463 for compliance with T&E reporting requirements.

TheTax and Regulatory Compliancetopic in the APS Certification Program includes detailed coverage of the Sarbanes-Oxley Act (SOX), which mandates internal controls for public companies to ensure accurate financial reporting. SOX requires companies to use a recognized framework, such as COSO (Committee of Sponsoring Organizations), to design and test controls over financial reporting (Item II). However, it does not mandate specific controls over AP hiring (Item I) orrequire the CFO to be a CPA (Item III).

Item I (Establish controls over accounts payable hiring): SOX focuses on financial reporting controls, not hiring processes for specific departments like AP. While internal controls may indirectly influence hiring (e.g., segregation of duties), there is no specific SOX requirement for AP hiring controls. This item is not required.

Item II (Use a recognized framework to design and test controls over financial reporting): SOX Section 404 mandates that public companies establish and test internal controls over financial reporting using a recognized framework, such as COSO. This is a core requirement.

Item III (Ensure that the company CFO is a CPA): SOX requires CFOs to certify financial reports (Section 302), but there is no mandate that they hold a CPA designation. This item is not required.

Option A (I and II only): Incorrect, as Item I is not a SOX requirement.

Option B (II only): Correct, as only Item II (using a recognized framework like COSO) is mandated by SOX.

Option C (I, II, and III): Incorrect, as Items I and III are not SOX requirements.

Option D (I only): Incorrect, as Item I is not a SOX requirement, and Item II is required.

Reference to IOFM APS Documents: The APS e-textbook underTax and Regulatory Compliancestates, “SOX Section 404 requires public companies to use a recognized framework, such as COSO, to design and test internal controls over financial reporting.” It clarifies that “SOX does not mandate specific hiring controls for departments like AP or require CFOs to be CPAs, though it emphasizes executive accountability.” The training video discusses SOX’s focus on financial controls, citing COSO as the standard framework and noting no specific hiring or CPA requirements.

TheVendor Master Filetopic in the APS Certification Program highlights vendor validation to prevent fraud, including checking addresses for red flags. A significant red flag is when avendor’s address matches one of the organization’s own locations, as this may indicate insider fraud (e.g., an employee creating a fake vendor using a company address).

Option A (The vendor has the same address as one of the organization’s own locations): Correct. This is a red flag, as it suggests potential fraud, such as an employee setting up a fictitious vendor at a company site.

Option B (The vendor does not appear to use a post office box): Incorrect. Not using a P.O. box is not inherently suspicious; many legitimate vendors use physical addresses.

Option C (The vendor’s warehouse and its accounts receivable address are different): Incorrect. Different addresses for operational and financial functions are common and not a red flag.

Option D (The vendor is located in an unincorporated area): Incorrect. Location in an unincorporated area is not inherently suspicious and does not indicate fraud.

Reference to IOFM APS Documents: The APS e-textbook underVendor Master Filestates, “A red flag during vendor address checks is when the vendor’s address matches an organization’s own location, indicating potential insider fraud.” The training video notes, “Always verify vendor addresses against company locations to detect fraudulent setups.”