Explain exception reporting and how it supports internal controls in AIS.

Explain exception reporting and how it supports internal controls in AIS.

• A. Exception reports highlight transactions outside predefined rules, prompting investigation and corrective action.
• B. They summarize all transactions for the period.
• C. They replace need for internal audits.
• D. They escalate only to external regulatory bodies.

Answer: (A)

Exception reporting focuses on deviations from what the controls expect. In an AIS, you set up rules or thresholds that define normal, approved activity—for example, spending limits, proper approval requirements, or matching of invoices to purchase orders. When a transaction doesn’t fit these rules, it’s flagged. The resulting exception report surfaces these outliers so staff can quickly review, investigate the cause, and take corrective action. This directly supports internal controls by providing timely detection of errors, irregularities, or potential fraud, enabling management to enforce approvals, reconciliations, and proper segregation of duties. It also aligns with the idea of management by exception: concentrate attention on issues that matter rather than every routine transaction, improving efficiency while maintaining control. For context, this approach is more than just listing data. it’s about turning routine processing into a monitoring tool that highlights when controls are violated or at risk, so investigators can determine root causes and strengthen processes. Examples include a payment that exceeds a vendor’s approved limit or a mismatch between a shipment and an invoice. These triggers help ensure corrective actions occur promptly and that control effectiveness is observable over time. Other options miss the point because summarizing all transactions is just general reporting, not flagging deviations; internal reports like exception lists do not replace internal audits; and escalating only to external regulators ignores the internal review workflow that typically handles exceptions first, with escalation only as needed.

Exception reporting focuses on deviations from what the controls expect. In an AIS, you set up rules or thresholds that define normal, approved activity—for example, spending limits, proper approval requirements, or matching of invoices to purchase orders. When a transaction doesn’t fit these rules, it’s flagged. The resulting exception report surfaces these outliers so staff can quickly review, investigate the cause, and take corrective action. This directly supports internal controls by providing timely detection of errors, irregularities, or potential fraud, enabling management to enforce approvals, reconciliations, and proper segregation of duties. It also aligns with the idea of management by exception: concentrate attention on issues that matter rather than every routine transaction, improving efficiency while maintaining control.

For context, this approach is more than just listing data. it’s about turning routine processing into a monitoring tool that highlights when controls are violated or at risk, so investigators can determine root causes and strengthen processes. Examples include a payment that exceeds a vendor’s approved limit or a mismatch between a shipment and an invoice. These triggers help ensure corrective actions occur promptly and that control effectiveness is observable over time.

Other options miss the point because summarizing all transactions is just general reporting, not flagging deviations; internal reports like exception lists do not replace internal audits; and escalating only to external regulators ignores the internal review workflow that typically handles exceptions first, with escalation only as needed.