7
Internal CHAPTER Control
Review Questions 7-1 Internal control is a process, effected by the entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the categories of (1) effectiveness and efficiency of operations, (2) reliability of financial reporting, and (3) compliance with applicable laws and regulations. The five basic components of an organization's internal control are (1) control environment; (2) risk assessment; (3) control activities; (4) (accounting) information and communication and (5) monitoring. The control environment is composed of integrity and ethical values; commitment to competence; board of directors or audit committee; management's philosophy and operating style; organizational structure; human resource policies and practices; and assignment of authority and responsibility. Separating recordkeeping from custody of the related assets provides an independently maintained record that may periodically be reconciled with assets on hand. This independent record holds the personnel of a custodial department accountable for assets entrusted to their care. If the custodial department maintained the accounting records, opportunity would exist for that department to conceal its errors or shortages by manipulating the records. Key factors in protecting a business against losses through embezzlement include adequate internal control, fidelity bonds, and regular audits by independent public accountants. The risk assessment component of internal control relates to the factors that affect the risk that the organization's financial reporting objectives will not be achieved. An awareness of this component contributes to internal control because management's consideration of the possibility that financial statements may be misstated decreases the likelihood of misstatement. The two types of monitoring are (1) ongoing monitoring activities, and (2) separate evaluations. Examples of ongoing monitoring activities include continuous monitoring of customer complaints and
7-2
7-3
7-4
7-5
7-6
7-7
reviewing the reasonableness of management reports. Separate evaluations include periodic audits by the internal auditors. 7-8 The four types of control activities are (1) performance review, (2) information processing, (3) physical controls and (4) segregation of duties. Performance reviews contribute to internal control by providing management with an overall indication of whether personnel at various levels are effectively pursuing the objectives of the organization. Information processing controls are performed to check the accuracy, completeness, and authorization of transactions. Physical controls contribute by assuring physical security over both records and other assets. Segregation of duties reduces the opportunities for any one person to both perpetuate and conceal errors or irregularities. Assuming that the general category of transaction has already been authorized by top management, at least three employees or departments should usually participate in each transaction to achieve strong internal control. One employee approves the transaction after determining that the details conform to company policies, another employee records the transaction in the accounting records, and the third employee executes the transaction by releasing and/or taking custody of the related assets. (Note: the approval function may be omitted in an extremely simple transaction such as a cash sale not involving a check). The primary objective of the internal auditor is to aid corporate management in efficient administration by investigating and reporting upon compliance with company policies, reliability of accounting and statistical records and reports, adequacy of internal control, efficiency of operating procedures, and effectiveness of performance in all areas of operation. The primary objective of the independent auditors is to determine whether the financial statements fairly reflect the financial position, operating results, and cash flows of the business. The independent auditors have a responsibility to stockholders, creditors, and the public as well as to management. The independent auditors should consider the work of the internal auditors as a portion of the control environment of internal control. After evaluating the competence and relative independence of the internal auditors, the independent auditors will determine the extent to which the work of the internal auditors may be relied upon in determining the nature, timing, and extent of their testing. Auditors consider internal control because its quality determines the extent and nature of the audit work necessary to complete the audit. More specifically, this consideration allows auditors to (1) plan the audit and (2) assess control risk. If the safeguarding of company assets were the only objective of internal control, then some basis might exist for the argument that the bonding of employees was an acceptable substitute for good internal control practices. However, internal control has such other important objectives as assuring the reliability of accounting data and other types of information needed by management for effective direction of the business. When internal controls are weak or absent, the losses from waste and inefficiency are apt to be far greater than losses from dishonest acts by employees. An assessment of internal control by the auditors is a prerequisite to the determination of the nature, timing, and extent of the substantive testing necessary to express an opinion on the financial statements. Under normal circumstances, the assessment of internal control significantly reduces the cost of an audit, because a reduction in the assessed level of control risk permits the auditors to perform much less substantive testing than would otherwise be necessary.
7-9
7-10
7-11
7-12
7-13
7-14
Among the sources of information which auditors may use in preparing a working paper description of internal control are: organization charts, charts of accounts, job descriptions, interviews and discussions with officers and employees, reports of internal auditors, accounting reports and records, inspection of facilities, and working papers and reports from prior examinations. No. Designing audit programs involves complex judgments, resulting in the possibility of inconsistencies in these judgments by auditors in the field. CPA firms attempt to reduce inconsistencies in judgments by developing firm policies, and "decision aids" or guides, that assist auditors in gathering relevant information or combining the information to make decisions about the nature, timing, and extent of substantive procedures. Tests of controls are efficient auditing procedure when the reduction in the substantive testing that results from a lower assessed level of control risk exceeds the amount of work involved in performing the tests of controls. Documentation is usually in the form of flowcharts, questionnaires, or written narratives of the system. During their consideration of internal control, the auditors will inevitably encounter some weaknesses that should be brought to the attention of management. A management letter is the written report to the client describing such weaknesses, along with the auditors' recommendations for corrective action. This report serves as a useful reference document for management in implementing improvements in internal control and may also serve to limit the auditors' liability to the client in the event the control weaknesses subsequently give rise to defalcations or other losses. The auditors' standard report includes the statement that "We have conducted our audit in accordance with generally accepted auditing standards,..." The emphasized phrase refers to the ten standards adopted by the membership of the AICPA. One of these standards reads as follows: A sufficient understanding of internal control is to be obtained to plan the audit and to determine the nature, timing, and extent of tests to be performed. It is apparent therefore that whenever auditors issue the standard report they are by reference indicating that they have considered internal control.
7-15
7-16
7-17 7-18
7-19
7-20
You should explain to the president that auditing standards require the auditors to report significant deficiencies and material weaknesses to the audit committee of the board of directors. Since material weaknesses are significant deficiencies, failure to submit such a report to the board would be a violation of generally accepted auditing standards. The two subsections of Section 404 of the Sarbanes-Oxley Act are 404a and 4040b. Section 404a requires each annual report filed with the SEC to include a report in which management (1) acknowledges its responsibility for establishing and maintaining adequate internal control over financial reporting, and (2) provides an assessment of internal control effectiveness as of the end of the most recent fiscal year. Section 404b requires the company's auditors to attest to, and report on, the assessment made by management. The report must attest both to management's assessment, and directly on the effectiveness of internal control over financial reporting. The six stages of an audit of internal control performed in accordance with PCAOB requirements are: (1) Plan the engagement. (2) Evaluate management's assessment process.
7-21
7-22
(3) (4) (5) (6)
Obtain an understanding of internal control over financial reporting (internal control). Test and evaluate design effectiveness of internal control. Test and evaluate operating effectiveness of internal control. Form an opinion on the effectiveness of internal control.
Questions Requiring Analysis 7-23 (a) (1) The effectiveness of internal control depends directly on the integrity and ethical values of the personnel responsible for creating, administering, and monitoring control of the organization. Control is more effective if the employees are competent in performing their duties. The board of directors or audit committee oversees the quality of the organization's financial reports, and acts as a deterrent to management override of controls and management fraud.
(2) (3)
(b)
Through risk assessment, management can determine when new controls are needed because of changes in the organization's operations or economic environment. This process includes an assessment of financial reporting risk, which is the risk of presenting materially misstated financial statements. Among the factors that result in increased financial reporting risk are (only four required) Changes in the organization's regulatory or operating environment. Changes in personnel. Implementation of as a new or modified information system. Rapid growth of the organization. Changes in technology affecting production processes or information systems. Introduction of new lines of business, products, or processes. Corporate restructurings. Expansion or acquisition of foreign operations. Adoption of new accounting principles or changing accounting principles. The five major objectives of an accounting system include: Identify and record all valid transactions. Describe on a timely basis the transactions in sufficient detail to permit proper classification of transactions for financial reporting. Measure the value of transactions in a manner that permits recording their proper monetary value in the financial statements. Determine the time period in which transactions occurred to permit recording of transactions in the proper accounting period. Properly present the transactions and related disclosures in the financial statements. (1) (2) Performance reviews provide management with an overall indication of whether personnel at various levels are effectively pursuing the objectives of the organization. Information processing controls are designed to check the accuracy, completeness, and authorization of transactions.
(c)
(d)
(e)
The two types of monitoring activities are (1) ongoing monitoring activities and (2) separate evaluations. Ongoing monitoring activities include regularly performed supervisory and management activities, such as continuous monitoring of customer complaints, or reviewing the
reasonableness of management reports. Separate evaluations are monitoring activities that are performed on a nonroutine basis, such as periodic audits by the internal auditors. 7-24 (a) Internal control is defined as a process, effected by the entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objective regarding (1) reliable financial reporting, (2) effectiveness and efficiency of operations, and (3) compliance with applicable laws and regulations. The definition includes the following concepts: (1) Internal control is as a process--as a means to an end. (2) The process is effected by individuals not merely policy manuals, documents, and forms. (3) Internal control can only provide reasonable assurance, which means that the cost of internal control should not exceed the benefits derived. (4) Internal control is designed to achieve objectives in the three areas of reliable financial reporting, effectiveness and efficiency of operations, and compliance with laws and regulations. The five components of internal control include: (1) The control environment. (2) Risk assessment. (3) The accounting information and communication system. (4) Control activities. (5) Monitoring. The major limitations of internal control include: (1) Mistakes may be made in the performance of controls as a result of misunderstanding of instructions, mistakes of judgments, carelessness, distraction, or fatigue. (2) Top management can override internal control. (3) Control activities dependent upon separation of duties may be circumvented by collusion among employees. Monitoring--ongoing. Control environment--human resource policies and procedures. Control activities--application controls. Risk assessment. Monitoring--separate evaluations. Control environment--integrity and ethical values. Control activities--performance reviews. Accounting information and communication system. Control activities--physical controls. Control environment--organizational structure. For purposes of an audit of financial statements, an entity's internal control consists of (1) the control environment; (2) risk assessment; (3) control activities; (4) (accounting) information and communication and (5) monitoring. In planning an audit, the knowledge obtained from an auditor's understanding of the components of an entity's internal control should be used to: (1) Identify types of potential misstatements.
(b)
(c)
(d)
7-25
(1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (a)
7-26
(b)
(2) (3) (c)
Consider factors that affect the risk of material misstatement. Design substantive tests.
An auditor may assess control risk at the maximum level for some or all assertions because the auditor believes controls are unlikely to pertain to an assertion, are unlikely to be effective, or because evaluating their effectiveness would be inefficient. To support assessing control risk at less than the maximum level, an auditor must determine whether the controls are suitably designed to prevent or detect material misstatements in specific financial statement assertions and obtain evidence that the controls are operating effectively. The planned assessed level of control risk is the level the auditors intend to use in performing the audit for as a particular financial statement assertion. For example, after obtaining the understanding of internal control necessary to plan the audit, the auditors will project as a planned assessed level of control risk based on their understanding of internal control. The assessed level of control risk is the level of risk based on the tests of controls performed to evaluate control risk for an assertion. Control risk is the actual, but unknown, level of risk pertaining to an assertion. While obtaining an understanding of internal control, the auditors may determine as a planned assessed level of control risk for the existence of accounts receivable which requires them to test as a sample of sales transactions. Based on the results of the tests of controls for sales, the auditors may arrive at an assessed level of control risk that is either higher or lower than the level planned. The actual level of control risk for existence of receivables is, as always, at an unknown level. After obtaining an understanding of internal control, the auditors determine the planned assessed level of control risk. At this point they may or may not have performed some tests of controls. When they believe that as a lower level of assessed control risk may be possible, and that the related reduction of substantive tests may be cost justified, the auditors will perform additional tests of controls. Finally, when the additional tests of controls have been performed, the auditors will reassess control risk and design substantive tests. Obtain an understanding Inquire of client personnel Inspect various documents and records Observe control activities and operations Perform walk-through of transactions Perform some tests of controls Prepare flowchart Prepare checklists Prepare questionnaires
(d)
7-27
(a)
(b)
7-28
(a)
(b)
Document the understanding
Determine the planned assessed level of control risk
Analyze results obtained
Design and perform additional tests of controls
Analyze information obtained above Perform inquiry procedures Inspect documents for performance Observe application of procedures Reperform application of procedures Analyze results obtained
Reassess control risk and modify planned substantive tests Document the assessed level of control risk
Indicate controls assessed at maximum level Indicate basis for controls assessed below maximum
7-29
Since Bailey's consideration of internal control shows that controls are very weak, he may omit performing tests of controls. He must, however, have an adequate understanding of internal control to plan the remainder of the audit. At a minimum, Bailey should obtain a basic understanding of the control environment, risk assessment, information and communication, monitoring, and important control activities. He should document this understanding, and also document that control risk is assessed at the maximum level. (a) (1) The primary advantage of the internal control questionnaire is that control weaknesses, including the absence of controls, are prominently identified by the "no" answers. Another advantage of the questionnaire is its simplicity. If the questions have been predetermined, as is usual, the auditors' responsibility includes the completion of the questionnaire with yes-or-no answers, and written explanations are required only for the "no" or unfavorable answers. Also, the comprehensive list of questions provides assurance of complete coverage of significant control areas. An advantage of the written narrative approach in reviewing internal control is that the description is designed to explain the precise controls applicable to each examination. In this sense, the working paper description is tailor-made for each engagement and thus offers flexibility in its design and application. A second advantage is that its preparation normally requires a penetrating analysis of the client's system. In requiring a written description of the flow of transactions, records maintained, and the division of responsibilities, the memorandum method minimizes the tendency to perform a perfunctory review. The use of a flowchart in documenting internal control offers the advantage of a graphic presentation of a system or a series of sequential processes. It shows the steps required and the flow of forms or other documents from person to person in carrying out the function depicted. Thus, the tendency to overlook the controls existing between functions or departments is minimized. Another advantage is that the flowchart method avoids the detailed study of written descriptions of procedures without sacrificing the CPAs' ability to appraise the effectiveness of controls under review. An experienced auditor can gain a working understanding of the system much more readily by reviewing a flowchart than by reading questionnaires or lengthy narratives. Information about specific procedures, documents, and accounting records can also be located more quickly in a flowchart. Because of these advantages, flowcharting has become the most widely used method of describing internal control in audit working papers.
7-30
(2)
(3)
(b)
Even though internal control appears to be strong, the auditors are required to conduct tests of controls. Just because controls are prescribed does not mean that the client's personnel are adhering to those requirements. Employees may not understand their assigned duties, or may perform those duties in a careless manner, or other factors may cause the controls actually in place to differ from those prescribed. Through tests of controls the CPAs obtain reasonable assurance that controls are in use and are operating as planned, and they may detect material errors of types not susceptible to effective internal control. In addition, such testing enables the CPAs to comply with the third standard of field work that calls for obtaining sufficient competent evidential matter to provide a reasonable basis for an opinion. Note to instructor--Auditors may forego tests of controls if they conclude that controls are so weak as to provide no basis for assessing control risk at a level lower than the maximum.
7-31 (a)
The following categories of measures and underlying measures are included in the AICPA document on Antifraud Programs and Control Measures: 1. Create and maintain a culture of honesty and high ethics Set tone at the top Create a positive workplace environment Hire and promote appropriate employees Properly train employees Discipline 2. Evaluate the risks of fraud and implement processes, procedures, and controls to mitigate those risks Identify and measure fraud risks Mitigate fraud risks Implement and monitor controls and other measures 3. Develop an appropriate oversight process
(b)
Examples of measures that create a positive workplace environment include (only two required): Encourage and empower employees to help create a positive workplace Allow employees to participate in developing and updating the code of conduct Encourage employees and give them the means to communicate concerns about potential violations of the code of conduct without fear of retribution Examples of factors that detract from a positive workplace environment include (only two required): Top management that does not seem to care about or reward appropriate behavior Negative feedback and lack of recognition for job performance Perceived inequities in the organization Autocratic rather than participate management Low organizational loyalty or feelings of ownership Unreasonable budget expectations or other financial targets Fear of delivering "bad news" to supervisors and/or management Less then competitive compensation Poor training and promotion opportunities Lack of clear organizational responsibilities Poor communication practices or methods within the organization
7-32
The client's plan of organization is entirely unsatisfactory from the standpoint of establishing internal control. He has ignored the basic control principle that two or more employees should participate in every transaction. When one person has complete control over a certain type of transaction or a certain phase of operations, it is usually possible for the individual to conceal any accidental errors or wasteful acts as as well to cover up any fraudulent activities. Placing the functions of purchasing, receiving, and storing of goods under one employee would enable that employee to conceal inefficiency and losses from such causes as duplicate orders, shortages in quantities received, excessive stockpiling, and "kickbacks" from suppliers. The employee who has been given full responsibility for accounts receivable records and for collections from customers would be able to abstract cash receipts and to conceal this theft by falsification of customers' accounts. The employee responsible for all aspects of the payroll could overstate the amounts owing to employees or place fictitious names on the payroll. Cash handling should be separated from recordkeeping. Duties should be divided so that the work of one employee serves as proof of the accuracy of the work of other employees. (a) (1) The primary auditing objective of the independent auditors is to obtain sufficient competent evidence to express an opinion as to the fairness of the financial statements in accordance with generally accepted accounting principles. A secondary objective is to determine that the client recognizes the objectives (listed below) of the internal auditors and that suitable progress is being made toward their achievement. The overall auditing objective of the internal auditors is to assist management in achieving the most efficient administration of the operations of organization. This total objective entails the protection of the interests of the organization, including pointing out existing deficiencies to provide a basis for appropriate corrective action, and the furtherance of the interests of the organization, including the recommendation of changes for the improvement of the various phases of the operations. In conducting audits, internal auditors appraise company policies, organization, records, and performance, whereas independent auditors are essentially concerned with the verification of accounting data. Internal auditors are charged with the responsibility of seeing that company accounting policies are being followed; they are vitally interested in the cost of prescribed procedures and their effect upon customers and company personnel. By reason of the nature of their work, internal auditors undertake more exhaustive detailed inquiries than do the outside auditors. For audit purposes, independent auditors are interested primarily in the end result of the accounting processes but internal auditors are interested in the processes themselves. CPAs propose correction of misstatements disclosed by their examination, whereas internal auditors try to prevent occurrence or recurrence of misstatements. Both auditors are concerned with the verification of the accuracy of the accounting records. Because they must form an opinion on the company's financial statements, independent auditors are primarily concerned that the statements follow generally accepted accounting principles. Internal auditors are aware of this aspect of auditing managerial decisions, but principally concern themselves with determining that the decisions promote administrative efficiency and have been compiled with.
7-33
(2)
(b)
The independent auditors should consider the work of the internal auditors because the latter are an integral part of internal control. Such consideration is necessary by the outside auditors because its results determine the extent of their remaining auditing procedures.
7-34
If the auditors' preliminary work indicates serious deficiencies in internal control over payrolls or other major sections of the client's operations, they might appropriately take the following actions: (1) Discuss the matter immediately with appropriate client officers. This discussion may precede the formal issuance of a management letter and serves to minimize both the client's exposure to losses and the auditor's potential liability in the event that fraud is later disclosed. Discuss with the client the possibility of either the independent auditors or client staff conducting an investigation to determine whether fraudulent acts have occurred. Expand the scope and intensity of the substantive tests in all financial statement areas affected by payroll transactions. If the effects of these transactions are pervasive, it may be necessary to advise the client that it will not be possible to issue an unqualified audit report. Disclose the weaknesses relating to payroll procedures and the auditors' recommendations for improving the internal control in a formal report to both senior management and the audit committee of the board of directors. The types of controls are as follow: (a) D. (b) D. (c) P. The annual physical inventory is a detective control because it would serve to detect misstatements of inventory after they have occurred. The monthly reconciliation of bank accounts is a detective control because it would serve to detect misstatements of cash after they have occurred. Segregation of duties over purchasing would serve to prevent errors and fraud relating to purchase transactions. Segregation of duties prevents individuals from perpetrating errors and fraud and covering them up in the course of performing their assigned duties. Supervisory approval of time cards is a preventative control because it would serve to prevent errors and fraud with respect to payroll transactions. The supervisor approval would help to prevent errors or fraud in the time records. Requiring dual signatures for checks is a preventative control because it would serve to prevent errors and fraud with respect to cash disbursements. Adjustments of perpetual inventory records to physical counts would serve to correct the inventory records. Management review of budget versus actual performance would serve to highlight potential errors and fraud after they have occurred. Therefore, it is a detective control. Internal audits of payroll would serve to detect errors and fraud in payroll after they have occurred. Therefore, it is a detective control.
(2)
(3)
(4)
7-35
(d) P.
(e) P. (f) C. (g) D. (h) D.
7-36
The weaknesses and suggested improvements are as follows: Weakness 1. The audit committee is not made up of all outside directors. Howard Kress, the chief financial officer, is a member. Suggested Improvement The audit should be made up of only outside members of the board of directors. That is, directors who are not officers or employees of the company. The audit committee or the complete board of directors should review and approve related party
2. Howard Kress, the chief financial officer, reviews and approves related party
transactions. 3. The internal auditor reports to Laura Howe, the chief operating officer.
transactions. The internal auditor should report to the audit committee of the board of directors to help ensure objectivity. The code of conduct should be distributed at least annually and employees should be required to recommit to adherence to the code at that time. The hotline should be staffed by an objective function, such as internal auditing.
4. While the company has a written code of conduct, employees are only exposed to it upon employment.
5. The hotline for reporting unethical behavior is staffed by the corporate controller.
Multiple Choice Questions 7-37 (a) (2) Detecting management fraud is generally not considered to be an objective of internal control. In fact, one of the inherent limitations of internal control is that it is subject to override by management. All of the other answers represent valid objectives of internal control. Management review of weekly performance reports is an ongoing monitoring activity that may detect errors or fraud. Answer (1) is incorrect because while periodic audits by internal audit represent a monitoring activity, they best classified as separate evaluations, and not ongoing monitoring activities. Answer (2) is incorrect because the audit of the annual financial statements is the function of the external auditors. Answer (3) is incorrect because approvals of cash disbursements represent a control activity. Because the auditors' purposes are for considering internal control are to obtain the necessary knowledge to (a) plan the audit and (b) to determine the nature, timing, and extent of the tests to be performed, answer (1) is correct. An increase in the substantive tests of details will decrease detection risk, and thereby compensate for the increased assessment of control risk due to a weakness in internal control. Answer (1) is incorrect because if the weakness exists, increasing the extent of tests will only provide more evidence on the weakness--not evidence that compensates for the weakness. Answers (2) and (4) are incorrect because a decrease in detection risk or inherent risk, not an increase, would compensate. Also, in the case of inherent risk, it may not be possible to change the assessment since it is a function of the firm's environment. Preparing bank reconciliations will detect a variety of misstatements related to cash and is a detective control in the sense that it does not prevent the misstatement from occurring, but may detect it. Answers (1) and (2) are incorrect because segregating duties and requiring approvals are primarily designed to prevent misstatements. Answer (4) is incorrect because the primary purpose of keeping backup copies of key transactions (or all transactions) is prevent loss of information in the event of an information system failure.
(b)
(4)
(c)
(1)
(d)
(3)
(e)
(3)
(f)
(4)
The symbol on the left indicates a manual function; the symbol on the right represents a file. The internal auditors' objectivity refers to their relative independence from the organizational units they have been evaluating. This may best be determined by considering the organizational level to which the internal auditors report. The other answers address the issues of the internal auditors' competence, not objectivity. Involvement of the owner in key control functions should be a major step toward preventing material errors or defalcations. Answer (1) would not be cost-effective. Answer (3) would provide some measure of control, but not as much as would daily participation by the owner. If it were feasible to hire additional employees, it would be cheaper to hire permanent employees rather than temporary. The need for internal control is permanent. Answer (4) would weaken, not strengthen internal control. A limitation of internal control is that it may be circumvented by collusion among employees. Although the other answers represent desirable segregation of responsibilities, answer (1) is the most complete response. Management may issue a report on internal control regardless of whether it has discovered a material weakness. In the first audit of a client, the auditors must perform walkthroughs for each major class of transactions. This is a responsibility which they may not delegate to the client.
(g)
(1)
(h)
(2)
(i)
(4)
(j)
(1)
(k)
(1)
(l)
(3)
Problems 7-38 SOLUTION: Orange Corporation (Estimated time: 25 minutes) ORANGE CORPORATION Raw Materials Recording and Transferring System Flowchart December 31, 20__
7-39
SOLUTION: Main Street Theater (Estimated time: 20 minutes) (a) The quantity of serially numbered tickets issued during the shift of each cashier is multiplied by the price per ticket to determine the amount of cash that the cashier should have on hand at the end of the shift. Two employees participate in each transaction. The withholding of cash receipts would require collusion between the cashier and the door attendant because the door attendant does not have access to cash and the cashier cannot cause a patron to be admitted without issuing to him a serially numbered ticket. The following steps should be taken by the manager to make these controls work effectively: (1) (2) (3) Maintain careful control over unused rolls of tickets. Make a record of the serial number of the first and last ticket issued on each cashier's shift. Count the cash in possession of cashier at beginning and end of shift.
(b)
In addition to these regular routines, the manager should take the following steps at unannounced intervals: (4) (5) Observe that the cashier never has loose tickets in his or her possession and does not sell tickets in any manner other than ejecting them from the ticket machine. Verify by inspection of tickets being presented by patrons to the door attendant that only recently issued tickets (current serial numbers) are being used.
(c)
Collusion by the cashier and door attendant to abstract cash receipts often consists of the door attendant pocketing whole tickets presented by patrons rather than tearing the ticket in half. He or she may then give these unused tickets to the cashier; the cashier may then resell the tickets to customers at the box office rather than punching out new tickets on the machines. The cashier withholds the cash received from sales of these "used tickets" and divides it with the door attendant. Observation on a surprise basis by the manager of the serial numbers of tickets being presented at the door by customers may reveal that these tickets are not freshly issued ones. Observation of the cashier's work may reveal that this employee is handling loose tickets.
(d)
7-40
SOLUTION: Island Trading Co. (Estimated time: 25 minutes) (a) Undesirable combinations are as follows: (1) (2) (3) (4) (5) (6) (7) Cash receipts and accounts receivable Cash receipts and credit memos on sales returns and allowances Cash disbursements and accounts payable. Cash receipts and bank reconciliation Cash disbursements and bank reconciliation General ledger and cash receipts Accounts receivable and credit memos on sales returns and allowances
(b)
Assignment of functions Employee No. 1: (1) (2) (6) Maintain general ledger Issue credit memos on sales returns and allowances Reconcile bank account
Employee No. 2: (4) (7) Maintain cash disbursements journal and prepare checks for signature Handle and deposit cash receipts
Employee No. 3: (2) (3) Maintain accounts payable ledger Maintain accounts receivable ledger
7-41 SOLUTION: Prospect Corporation Inc. (Estimated time: 55 minutes) (a) PROSPECT CORPORATION INC. Sales System Flowchart December 31, 20__
(b)
PROSPECT CORPORATION INC. Cash Receipts System Flowchart December 31, 20__
7-42
SOLUTION: Church Cash Receipts (Estimated time: 30 minutes) Part (a) Weakness Financial secretary exercises too much control over collections. Finance committee is not exercising its assigned responsibility for collections. The internal auditing function has been assigned to the finance committee, which also has responsibility for the administration of the cash function. Also, the finance committee has not performed the internal auditing function. The head usher has sole access to cash during the period of the count. One person should not be left alone with the cash until the amount has been recorded or control established in some other way. The collection is vulnerable to robbery while it is being counted and from the church safe prior to its deposit in the bank. Recommended Improvement To extent possible, finance secretary's responsibilities should be confined to recordkeeping. Finance committee should assume a more active supervisory role. An audit committee should be appointed to perform periodic internal auditing procedures or outside auditors should be engaged.
1.
2. 3.
4.
The number of cash counters should be increased to at least two, and cash should remain under joint control until counted and recorded. The collection should be deposited in the bank's night depository immediately after the count. Physical safeguards, such as locking and bolting the door during the period of the count should be instituted. Increasing the number of cash counters will also reduce vulnerability to robbery. The finance secretary should receive a copy of the collection report for posting to the finance records. The head usher should maintain a copy of the report for use by the audit committee. Contributions should be deposited intact daily. If it is considered necessary for the financial secretary to make cash expenditures, he or she should be provided with a cash working fund. The fund should be replenished by check based upon a properly approved reimbursement request and satisfactory support. Key employees and members involved in receiving and disbursing cash should b bonded. Particularly because much of the work involved in cash collections is performed by unpaid, untrained church members, often on a shortterm basis, detailed instructions should be written.
5.
6.
7.
The head usher's count lack usefulness from a control standpoint because he or she surrenders custody of both the cash and the record of the count. Contributions are not deposited intact daily. There is no assurance that amounts withheld by the finance secretary for expenditure will be properly accounted for.
8. 9.
No mention is made of bonding. Written instructions for handling cash collections apparently have not been prepared.
Part (b) Weakness The envelope system has not been encouraged. Control features that it could provide have been ignored. Recommended Improvement The envelope system should be encouraged. Donors should indicate on the outside of each envelope the amount contributed. Envelope contributions should be reported separately and supported by the empty collection envelopes. Prenumbered envelopes will permit ready identification of the donor by authorized persons without general loss of confidentiality. A member's contribution record should be prepared by the financial secretary from the pledge cards and collection envelopes.
1.
2.
3.
The church maintains no permanent record of amounts pledged and contributed. These records are needed to (1) provide valid support for tax deductibility of members' contributions, (2) permit better planning for fund drives, and (3) provide a basis for direct confirmation of amounts contributed. No investigation is made of differences between the amounts pledged and contributed.
4.
5.
Letters certifying to amounts contributed are being furnished to members based upon the amounts shown on pledge cares. This is improper because actual contributions may not equal pledges. No provision is made for the receipt f contributions by mail. This method of giving should be encouraged, but the financial secretary should not handle mail receipts.
All members should be furnished with periodic written advice of the amounts pledged and contributed. If properly handled by the audit committee, this procedure can be combined with direct confirmation of the amount contributed. Not only will control be better, but also members more likely will fulfill their pledges. The maintenance of members' contribution record and the furnishing of periodic advices to members will correct this weakness.
A church employee other than the financial secretary should open mail. This employee should list the receipts, maintain a copy of this listing, and deposit the receipts. Checks should be stamped with the restrictive endorsement when received.
7-43
SOLUTION: Terminology (Estimated time: 15 minutes) 1. 2. 3. 4. 5. c c d g h 6. 7. 8. 9. 10. c d e f i
7-44
SOLUTION: Parktown Medical Center, Inc. (Estimated time: 30 minutes) The deficiencies and resulting misstatements, in addition to the example, that could occur and not be prevented or detected by Parktown's internal control over the cash receipts and billings functions include the following: Deficiency 1. The employees who perform services also are permitted to approve credit without an external credit check. There is no independent verification of the billing process. Potential Misstatement Uncollectible accounts expense could be understated and accounts receivable could be overstated because of the lack of an appropriate credit check. Fees earned and accounts receivable may be understated because not all services performed might be reported for billing. or Fees earned and accounts receivable may be either overstated or understated because of the use of incorrect price or service data or because of mathematical errors. Accounts receivable could be understated and uncollectible accounts expense overstated because writeoffs of accounts receivable could be approved for accounts that are, in fact, uncollectible. or Accounts receivable could be understated and uncollectible accounts expense overstated because writeoffs of accounts receivable might not be initiated for accounts that are uncollectible. Uncollectible accounts expense could be either understated or overstated because the lack of established credit limits may make it more difficult to identify uncollectible accounts. Fees earned and cash receipts or accounts receivable could be understated because of omitted or inaccurate billing. The cash balance per books may be overstated because not all cash is deposited. Uncollectible accounts expense could be either understated or overstated because of the lack of established write-off criteria. Any of fees earned, cash receipts, and uncollectible accounts expense could be either understated or overstated because of undetected
2.
3.
The employees who approve credit also approve write-offs of uncollectible accounts.
4.
Credit is not granted on the basis of established limits.
5.
The employee who initially handles cash receipts also prepares billings. The employee who makes bank deposits also reconciles bank statements. Uncollectible accounts are not determined on the basis of established criteria. Trial balances of the accounts receivable subsidiary ledger are not prepared independently of, or verified and
6. 7.
8.
reconciled to, the accounts receivable control account in the general ledger.
differences between the subsidiary ledger and the general ledger. or Fees earned and cash receipts or accounts receivable could be understated because of failure to record billings, cash receipts, or writeoffs accurately.
7-45
SOLUTION: General Co.(Estimated time: 25 minutes) (a) Tyler's work may be relevant to North in obtaining a sufficient understanding of the design of General's internal control, in determining whether controls have been placed in operation, and in assessing risk. Since an objective of most internal audit functions is to review, assess, and monitor controls, the procedures performed by Tyler in this area may provide useful information to North. Tyler's work may also provide direct evidence about material misstatements in assertions about specific account balances or classes of transactions. Therefore, Tyler's work may be relevant to North in planning substantive procedures. Consequently, North may be able to change the nature, timing, or extent of certain procedures. North may request direct assistance from Tyler. This direct assistance relates to work North specifically requests Tyler to perform to complete some aspect of North's work. If North concludes that Tyler's work is relevant to North's audit of General's financial statements, North should consider whether it would be efficient to consider how Tyler's work might affect the nature, timing, and extent of North's audit procedures. If so, North should assess Tyler's competence and objectivity in light of the intended effect of Tyler's work on North's audit. North ordinarily should inquire about Tyler's organizational status within General and about Tyler's application of the professional internal auditing standards developed by the Institute of Internal Auditors. North also should ask about Tyler's internal audit plan, including the nature, timing, and extent of the audit work performed. Additionally, North should inquire about Tyler's access to General's records and whether there are any limitations on the scope of Tyler's activities.
(b)