Auditing the Purchasing Department of Small Organizations

C.

As an IS auditor auditing a small organization's purchasing department, the greatest concern would be the potential lack of segregation of duties, making option C the most concerning.

Option A raises concerns about the competence of the purchasing officer, but this may not necessarily result in significant risks or control issues if the purchasing officer has adequate oversight and control mechanisms.

Option B highlights a control weakness but is not as significant a concern as option C. If expenses are being approved after being incurred, it may lead to delayed recognition of unauthorized purchases or expenditure, which can result in an adverse financial impact. However, it is not as significant a concern as the risk associated with unauthorized purchases or payments.

Option D raises concerns about the effectiveness of the purchasing department's procedures and processes. While outdated procedures and processes can lead to control weaknesses and risks, they are not as significant as the risk of unauthorized purchases or payments, as highlighted in option C.

Option C is the most concerning as it implies that some members of the department can initiate and authorize payments for purchases, which is a significant segregation of duties violation. When the same person is responsible for both initiating a transaction and authorizing it, it increases the risk of errors, fraud, and misuse of resources. The lack of segregation of duties can lead to unauthorized purchases, overpayment, or payment for goods or services that were not received.

In conclusion, while all options highlight potential control weaknesses, the greatest concern to an IS auditor when auditing a small organization's purchasing department is the lack of segregation of duties highlighted in option C.