CHAPTER 5 Internal Control Evaluation: Assessing Control Risk LEARNING OBJECTIVE

Review Checkpoints 1. Distinguish between management s and auditors responsibilities regarding a compan! s internal control. De&ine and describe internal control. De&ine and describe the &ive basic components o& internal control, and speci&! some o& their characteristics. 1, ", #, $, % Exercises, Problems, and Simulations

". #.

', (, ) *, 1+, 11, 1", 1#, 1$, 1%, 1', 1(, 1) '", '', '*, (+

$. Explain the phases o& an evaluation o& control and risk assessment and the documentation and extent o& audit work re,uired. %. Describe additional responsibilities &or management and auditors o& public companies re,uired b! Sarbanes-.xle! and /S ". '. Explain the communication o& internal control de&iciencies to the audit committee and other ke! management personnel. Explain the limitations o& all internal control s!stems.

1*, "+, "1, "", "#, "$, "%

'+, '$, '%, '(, ')

"', "(, "), "*, #+, #1

'#

#"

(1

(.

##, #$, #%, #'

'1

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1

OL!TION "OR REVIE# CHEC$POINT

%.1 /s stated in the Sarbanes-.xle! /ct o& "++", management is responsible &or establishing a control environment, assessing risks it wishes to control, speci&!ing in&ormation and communication channels and content 8including the accounting s!stem and its reports9, designing and implementing control procedures, and monitoring, supervising, and maintaining the controls. :usiness managers can make estimates o& bene&its to be derived &rom controls and weigh them against the cost. 2anagers are per&ectl! &ree to make their own ;udgments about the necessar! extent o& controls. 2anagers can decide the degree o& business risk the! are willing to tolerate. External auditors are not responsible &or designing e&&ective controls &or audit clients. 1he! are responsible &or evaluating existing internal control and assessing the control risk in them. %." Control risk is the probabilit! that the client<s internal control procedures will &ail to prevent or detect material errors and &rauds, provided an! enter the data processing s!stem in the &irst place. /ssessing control risk is part o& using the audit risk model in the planning stage o& the audit. 1he primar! reason &or conducting an evaluation o& a client<s existing internal control s!stem is to give the auditors a basis &or &inali=ing the details o& the account balance audit program>to determine the nature, timing and extent o& subse,uent substantive audit procedures. ?or public companies, Sarbanes-.xle! re,uires auditors to audit internal controls as part o& the &inancial statement audit. / secondar! purpose &or conducting an evaluation o& internal control is to be able to make constructive suggestions &or improvements. .&&iciall!, the pro&ession considers these suggestions a part o& the audit &unction and does not de&ine the work as a consulting consultation. /nother purpose o& the evaluation is to report to management and the board o& directors or its audit committee an! discover! o& an! signi&icant internal control de&iciencies. %.$ %.% %.' 5& control risk is low, auditors can per&orm less e&&ective substantive procedures, earlier in the audit, with smaller sample si=es, than i& control risk is moderate or high. @sing a numeric evaluation provides a precise level o& risk that can be included in statistical sampling procedures. 4owever, using words recogni=es the imprecise nature o& evaluating control risk. 1he three categories o& control ob;ectives areA Reliabilit! o& &inancial reporting. E&&ectiveness and e&&icienc! o& operations. Compliance with applicable laws and regulations. /uditors are primaril! concerned with reliabilit! o& &inancial reportingB however, some operating and compliance controls ma! be important &or the &inancial statement audit. %.( 5nternal control is operated b! people. People make the s!stem work at ever! level o& compan! management. People establish the ob;ectives, put control mechanisms in place, and operate them. Since people operate the controls, breakdowns can occur. 4uman error, deliberate circumvention, management override, and improper collusion among people who are supposed to act independentl! can cause &ailure to achieve ob;ectives. 4ence, a compan!<s managers can decide that certain controls are too costl! in light o& the risk o& loss that ma! occur.

%.#

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-"

%.)

?our t!pes o& breakdowns relate to people-caused &ailures. 1he &our areA human error, deliberate circumvention, management override, and improper collusion among people who are supposed to act independentl! can cause &ailure to achieve ob;ectives. 5nternal control can help prevent and detect these people-caused &ailures, but it cannot guarantee that the! will never happen.

%.*

1he control environment sets the tone o& the organi=ation. 5t is the &oundation &or all other components o& internal control. 5t provides discipline and structure. Control environment &actors include the integrit!, ethical values, and competence o& the compan! s people. 1he &ollowing are general elements o& an internal control environmentA 2anagement s philosoph! and operating st!le 2anagement and emplo!ee integrit! and ethical values Compan! organi=ational structure Compan! commitment to competence>;ob skills and knowledge ?unctioning o& the board o& directors, particularl! its audit committee 2ethods o& assigning authorit! and responsibilit! Presence o& an internal audit &unction 4uman resource policies and practices 1he C.S. Report states that internal control consists o& &ive interrelated components: 2anagement s control environment 2anagement s risk assessment 2anagement s control procedures 2anagement s monitoring 2anagement in&ormation and communication s!stems. 1he purpose o& risk assessment is to identi&! and control &or those &actors, events, and conditions that ma! prevent the organi=ation &rom achieving its business ob;ectives. /ll companies &ace the risk that their &inancial statements ma! be unreliable. 1he! ma! report assets that do not exist or ones that are not owned b! the compan!. /sset and liabilit! amounts ma! be improperl! valued. 1he! ma! &ail to report liabilities and expenses. 1he! ma! present in&ormation that does not con&orm to 3//P. 1he risk o& producing unreliable &inancial reports arises &rom control breakdowns. / compan! control procedure is an action taken &or the purpose o& preventing, detecting, or correcting errors and &rauds in transactions ?our kinds o& &unctional responsibilities that should be segregatedA 1. /uthori=ation to execute transactions. ". Recording o& transactions 8bookkeeping9. #. Custod! o& assets. $. Periodic reconciliation 8comparison9 o& existing 8real9 assets to recorded amounts. 1he audit trail is the set o& accounting operations &rom transaction anal!ses to reports. 5t starts with the source documents, proceeds to data entr!, then to transaction processing and posting to ledger accounts, then &rom ledger accounts to the &inancial reports. /uditors o&ten &ollow this trail &orwards and backwardsC 1he! will &ollow it backwards &rom the &inancial reports to the source documents to determine whether ever!thing in the &inancial reports is supported b! appropriate source documents. 1he! will &ollow it &orward &rom source documents to reports to determine that ever!thing that happened 8transactions9 got recorded in the accounts and reported in the &inancial statements.

%.1+

%.11

%.1" %.1#

%.1$

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-#

%.1%

513C appl! to all the applications s!stems and help insure their continued proper operations. 1he! include controls over data center operations, s!stem so&tware ac,uisition and maintenance, access securit!, and application s!stem development, including changes in so&tware and data bases. 1he! include ph!sical securit!, hardware controls, segregation o& duties within the 51 department, documentation and back-up procedures, and other controls. 51/C include computeri=ed steps within the application so&tware and related manual procedures to control the processing o& various t!pes o& transactions. 51/C are speci&ic to each c!cle 8e.g. revenue and collection, ac,uisition and expenditure, etc.9. 1he! are divided into the &ollowing categoriesA input controls, processing controls, and output controls.

%.1'

1. ". #. $. %.

Dalid character tests Dalid sign test 2issing data test Se,uence test 6imit or reasonableness

Customer name alphanumeric and customer number numeric. /ll amount &ields positive, sales amount greater than =ero. :ill o& lading document number included. 5nvoice numbers are in se,uence and none missing. 1otal invoice less than E"%,+++ test

%.1( %.1)

2an! &inancial reporting processes such as &inal ad;usting entries, consolidating entries, and &ootnote amounts are per&ormed using spreadsheet applications. Ever!da! monitoring examplesA .perating managers compare internal reports and published &inancial statements with their knowledge o& the business. Customer complaints o& amounts billed are anal!=ed. Dendor complaints o& amounts paid are anal!=ed. Regulators report to the compan! on compliance with laws and regulations 8e.g., bank examiners< reports, 5RS audits9. /ccounting managers supervise the accurac! and completeness o& transaction processing. Recorded amounts are periodicall! compared to actual assets and liabilities 8e.g., internal auditors< inventor! counts, receivables and pa!ables con&irmations, bank reconciliations9. External auditors report on control per&ormance and give recommendations &or improvement. 1raining sessions &or management and emplo!ees heighten awareness o& the importance o& controls. 1hese are monitoring controls when the! are used to determine the e&&ectiveness o& control procedures.

%.1*

Fes and no. 1he phase 1 understanding must alwa!s be &ollowed b! a control risk assessment phase and documentation o& control risk less than 1++G 8compliance phase9. 4owever, test o& controls procedures are onl! re,uired &or non public companies i& an auditor wants to lower the control risk assessment. /n auditor can &ind client<s documentation o& the accounting s!stem in theA Chart o& accounts /ccounting manual>de&initions and instructions about measuring and classi&!ing transactions Computer s!stems documentation Computer program documentation S!stems and procedures manuals ?lowcharts o& transaction processing Darious paper &orms

%."+

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-$

%."1

1.

/dvantages o& control ,uestionnaireA Eas! to complete. Checklist o& ,uestions. 6ess chance o& overlooking something important. DisadvantagesA 2a! contain numerous irrelevant ,uestions. 1endenc! to treat it like another &orm to &ill out. /dvantages o& memorandum documentationA Can explain the precise controls applicable to the particular client. 8precise tailoring9 Re,uires penetrating anal!sis. 2inimi=es tendenc! toward per&unctor! review. DisadvantagesA 4ard to write. .&ten length!. 4ard to revise in subse,uent !ears. /dvantages o& &lowchartA 3raphic presentation o& s!stems. Shows the steps re,uired and the &low o& &orms and documents. Eas! to read and anal!=e. Eas! to update in subse,uent !ears. DisadvantagesA 1akes some time to draw neatl!.

".

#.

%.""

/ Hbridge working paperH connects the control evaluation to the audit program 8subse,uent procedures9. 5t contains brie& descriptions o& control strengths and weaknesses, implications &or control or error related to accounts, and statements o& audit program procedures related to the strengths and weaknesses. 1he procedures related to control strengths are test o& control proceduresH, and the ones related to control weaknesses are substantive procedures. / test o& controls is an audit procedure designed to produce evidence about the e&&ectiveness o& a client<s control activit!. / test o& control procedure is a two-part statement, consisting o&A Part .neA 5denti&ication o& a data population &rom which a sample o& items will be selected &or audit. Part 1woA Expression o& an action o& either 819 determining whether the selected items correspond to a standard or 8"9 determining whether the selected items agree with in&ormation in another data population. / test o& control procedure ma! also consist o& a direct observation o& a control activit! that leaves no documentar! trail.

%."#

%."$

H5nspection,H in a test o& control procedure, re&ers to auditors looking to see whether client personnel stamped, initialed, or le&t other signs that their assigned control procedures had been per&ormed. HReper&ormance,H in a test o& control procedure, re&ers to auditors doing again the control that was supposed to have been per&ormed b! the client personnel 8recalculating, looking up the right price, comparing ,uantities, and so &orth9.

%."%

/ Hdual-purpose testH serves the purposes o& 819 obtaining evidence about a client<s control per&ormance Itest o& controlJ, 8"9 obtaining evidence to help detect material misstatements in account balances and disclosures Isubstantive procedureJ. 1he auditor issues two opinions related to &inancial reporting controlsA one on management<s evaluation o& their internal controls over &inancial reporting, and one on the compan! s internal controls.

%."'

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-%

%."(

2anagement must do the &ollowingA a. /ccept responsibilit! &or the e&&ectiveness o& the compan!<s internal control over &inancial reportingB b. Evaluate the e&&ectiveness o& the compan!<s internal control over &inancial reporting using suitable control criteriaB c. Support its evaluation with su&&icient evidence, including documentationB and d. Present a written assessment o& the e&&ectiveness o& the compan!<s internal control over &inancial reporting as o& the end o& the compan!<s most recent &iscal !ear. 1he six steps &or auditing internal controls areA 1. Plan the engagement ". Evaluate management<s assessment process #. 3ain an understanding o& internal control over &inancial reporting $. 1est and evaluate design e&&ectiveness o& internal control over &inancial reporting %. 1est and evaluate operating e&&ectiveness o& internal control over &inancial reporting '. ?orm an opinion on the e&&ectiveness o& internal control over &inancial reporting /n internal control de&icienc! exists when the design or operation o& a control does not allow the compan! s management or emplo!ees to detect or prevent misstatements in a timel! &ashion. / signi&icant de&icienc! is de&ined as a condition that could adversel! a&&ect the organi=ation s abilit! to initiate, record, process, and report &inancial data in the &inancial statements. / material weakness in internal control is de&ined as a condition which results in more than a remote likelihood o& a material misstatement o& the &inancial statements. /uditors can issue one o& three t!pes o& reports on internal controlsA @n,uali&ied>no material weaknesses Kuali&ied or disclaimer>auditor cannot per&orm all o& the procedures considered necessar! /dverse opinion>material weakness exists 8the auditor ma! give an un,uali&ied opinion on management<s report i& the! identi&! the weakness and sa! internal control is not e&&ective9. 1he auditor should documentA 1he understanding obtained and the evaluation o& the design o& each o& the &ive components o& the compan!<s internal control over &inancial reportingB 1he process used to determine signi&icant accounts and disclosures and ma;or classes o& transactions, including the determination o& the locations or business units at which to per&orm testingB 1he identi&ication o& the points at which misstatements related to relevant &inancial statement assertions could occur within signi&icant accounts and disclosures and ma;or classes o& transactionsB 1he extent to which the auditor relied upon work per&ormed b! others as well as the auditor<s assessment o& their competence and ob;ectivit!B 1he evaluation o& an! de&iciencies noted as a result o& the auditor<s testingB and .ther &indings that could result in a modi&ication to the auditor<s report. /uditors must communicate signi&icant de&iciencies and material weaknesses that come to their attention in the per&ormance o& the audit to management, the board o& directors, or its audit committee. /uditors o&ten issue another t!pe o& report to management called a management letter. 1his letter ma! contain commentar! and suggestions on a variet! o& matters in addition to internal control matters.

%.")

%."*

%.#+

%.#1

%.#"

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-'

%.##

5nternal control cannot provide absolute assurance that &inancial statements will not contain a material misstatement becauseA 1he e&&ectiveness o& controls will be limited b! the realities o& human &railt!. 5nternal controls can break down due to misunderstanding, mistakes, and errors due to carelessness, distraction or &atigue. 2anagement can o&ten override controls. 1he collusive activities o& two or more individuals can result in control &ailures. Controls must be sub;ected to cost-bene&it anal!sis Reasonable assurance is closel! related to cost-bene&it anal!sis. :! de&inition, reasonable assurance recogni=es that the cost o& an organi=ation<s internal control should not exceed the bene&its obtained b! the control. 2anagement is responsible &or assessing the cost and bene&its o& controls, hence their reasonable assurance. /uditors get into the act o& reasonable assurance assessment when the! consider whether to make recommendations about control improvement in a management letter. :oth parties must consider that the SEC regards reasonable assurance is a high standard that means the probabilit! o& controls not detecting or preventing material misstatements is remote.

%.#$

%.#%

/udit problems can arise when costl! controls are necessar! to prevent, detect, and correct material misstatements in the accounts. 2anagement ma! believe the costs outweigh the bene&its and appeal to Hreasonable assuranceH to ;usti&! not having some controls. Levertheless, control can there&ore be de&icient, and the auditors will need to take the de&icienc! under consideration when planning the substantive audit program. 1he general theor! o& internal control is applicable to both large and small businesses as long as the underl!ing behavioral assumptions are met. 4owever, the &act that small businesses have onl! a &ew people usuall! means that the general theor! re,uirement o& separation o& duties is not satis&ied, and the general theor! is less applicable as a practical matter. 1he bureaucratic assumptions o& strict separation o& duties, a tight authorit! structure, an extensive s!stem o& rules and &iles, and impersonalit! are harder to satis&! in small businesses that have onl! a &ew emplo!ees operating in an in&ormal manner. Mhen the assumptions cannot be observed to exist, then an auditor must be care&ul not to rel! blindl! on the general theor!.

%.#'

OL!TION "OR %!LTIPLE&CHOICE '!E TION

%.#( a. b. c. d. %.#) a. b. c. d. 5ncorrect Correct 5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect 5ncorrect E&&ectiveness and e&&icienc! is an ob;ectives categor!, not a &undamental concept. HPeopleH is the most important &undamental concept. Reliabilit! o& &inancial reporting is an ob;ectives categor!, not a &undamental concept. Compliance with laws and regulations is an ob;ectives categor!, not a &undamental concept. 2anagement letter suggestions are a secondar! purpose. Second 3//S &ieldwork standard. 1his is a paraphrase o& the third 3//S &ieldwork standard. Communication o& control-related matters is a secondar! purpose.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-(

%.#*

a. b. c. d.

5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect Correct 5ncorrect Correct 5ncorrect 5ncorrect 5ncorrect Correct Correct 5ncorrect 5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect 5ncorrect Correct 5ncorrect 5ncorrect 5ncorrect 5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect Correct 5ncorrect 5ncorrect

6arger sample si=es expand audit procedures. Per&orming procedures at !ear-end instead o& at interim generall! represents stricter application. External evidence represents stricter application. Smaller sample si=e is a restriction or relaxation o& audit procedure application. :atch totals can be used as input, processing, and output controls. :atch totals can be used as input, processing, and output controls :atch totals can be used as input, processing, and output controls :atch totals can be used as input, processing, and output controls 1his is a general control that secures the hardware. 1his is a general control over so&tware changes. 1his is a general control &or all data. 1his is an output control. 1he terminated person would not be in the timekeeping total. Morks onl! i& the correct number o& checks is known. 1he terminated emplo!ee will have a valid number. 1he header label onl! identi&ies the correct pa!roll &ile. 1he absolute amount o& cost is irrelevant. Fear-end substantive work usuall! costs more than control evaluation work. 1he !ear-end cost savings exceeds the control evaluation cost. Mhether the cost o& control work exceeds 8or does not exceed9 the cost o& !ear-end work is irrelevant. E&&icienc! relates to the cost that can be saved as a result o& control evaluation work. E&&icienc! is not achieved b! cost reductions being less than control work cost. 1he narrative is the documentation result o& obtaining evidence. 1he 5CK is a device &or collecting evidence in the &orm o& answers to control ,uestions. / &lowchart is the documentation result o& obtaining evidence. 81his is the throwawa!C9 1he audit documentation is the documentation o& the evidence obtained. 1he bridge working paper connects control evaluation &indings o& strengths to test o& control procedures &or testing the strengths, and control evaluation &indings o& weakness to suggestions &or substantive procedures. Control ob;ectives are onl! implicit in the bridge working paper. Control ob;ectives are onl! implicit in the bridge working paper. /ssertions are related directl! to substantive procedures and not to test o& control procedures. Substantive procedures produce evidence about &inancial statement assertions. Compan! control procedures accomplish compan! control ob;ectives. /nal!tical review is not accomplished with test o& control procedures. 1ests o& controls produce the evidence about actual operation o& compan! control procedures. 1his describes an audit procedure. 1his is one general wa! to de&ine the purpose o& control procedures. 1his is a de&inition o& an accounting s!stem. 1his is a description o& one o& the elements o& the control environment.

%.$+

a. b. c. d. a. b. c. d. a. b. c. d. a. b. c. d.

%.$1

%.$"

%.$#

%.$$

a. b. c. d.

%.$%

a. b. c. d.

%.$'

a. b. c. d. a. b. c. d.

%.$(

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-)

%.$)

a.

Correct

/t the audit planning stage, prior-!ear experience with the client is the best initial in&ormation about error and &raud characteristics o& the client<s transactions. 8/ll the other answers deal with per&ormance o& the current-!ear audit work.9 1he occurrence check is a comparison o& a transaction entr! with a known valid record in a &ile. 8a N reasonableness test, b N error log reporting, d N t!pe o& redundant echo check9 Record totals suggest dollar amounts. 4ash totals involve non dollar totals. Data totals suggest dollar amounts. ?ield totals suggest dollar amounts. Cash deposits O discounts N pa!ments credit to receivables. 8/nswers a, b, and c use the wrong arithmetic9 1his is the de&inition used in the statement. /uditors are re,uired to issue two reports on internal controls. /S " applies to &inancial reporting controls onl!. /S " re,uires testing &or design e&&ectiveness and operating e&&ectiveness. /ll three are indicators a material weakness. /ll three are indicators a material weakness. /ll three are indicators a material weakness. /ll three are indicators a material weakness. 1his is an appropriate report. 1his is an appropriate report. 1his is not one o& the options o&&ered b! /S ". 1his is an appropriate report. 5n principle, the pa!roll &unction should be divided into its authori=ation, recording, and custod! &unctions. /uthori=ation o& hiring, wage rates, and deductions is provided b! personnel. /uthori=ation o& hours worked 8executed b! emplo!ees9 is provided b! production. :ased on these authori=ations, accounting calculates and records the pa!roll. :ased on the calculated amounts, the treasurer prepares and distributes pa!roll checks. Supervisors should per&orm the reconciliation. 1he total time spent on ;obs should closel! approximate the total time indicated on time cards. 1imekeeping s comparison o& these records should provide an independent check o& the accurac! o& time reported on the time cards. 1his should be done b! accounting. Rate authori=ations are kept b! personnel.

%.$*

c.

Correct

%.%+

a. b. c. d. d. a. d. c. c. a. b. c. d. a. b. c. d. a.

5ncorrect Correct 5ncorrect 5ncorrect Correct Correct Correct Correct Correct 5ncorrect 5ncorrect 5ncorrect Correct 5ncorrect 5ncorrect Correct 5ncorrect Correct

%.%1 %.%" %.%# %.%$ %.%% %.%'

%.%(

%.%)

%.%*

a. b. c. d.

5ncorrect Correct 5ncorrect 5ncorrect

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-*

OL!TION "OR E(ERCI E ) PROBLE% ) AN* I%!LATION

%.'+ Internal Control Audit Standards (AICPA solution) a. b. 5n planning an audit, an auditor<s understanding o& the internal control components should be used to identi&! the t!pes o& potential misstatements that could occur, to consider the &actors a&&ecting the risk o& material misstatement, and to in&luence the design o& substantive procedures. /n auditor obtains an understanding o& the design o& relevant internal control procedures 8policies and procedures9 and whether the! have been implemented. /ssessing control risk below the maximum level &urther involves identi&!ing speci&ic control procedures 8policies and procedures9 relevant to speci&ic assertions that are likel! to prevent or detect material misstatements in those assertions. 5t also involves per&orming tests o& controls to evaluate the operating design and e&&ectiveness o& the client<s control procedures. Mhen seeking a &urther reduction in the assessed level o& control risk, an auditor should consider whether additional audit evidence su&&icient to support a &urther reduction is likel! to be available, and whether it would be e&&icient to per&orm tests o& controls to obtain that audit evidence. /n auditor should document the understanding o& a client<s internal control s!stem components to plan the audit. 1he auditor also should document the basis &or the conclusion about the assessed level o& control risk. 5& control risk is assessed at the maximum level, the auditor should document that conclusion and the reasons &or it. 4owever, i& the assessed level o& control risk is below the maximum level, the auditor should document the basis &or the conclusion that the e&&ectiveness o& the design and operation o& internal control procedures supports that assessed level.

c. d.

%.'1

Costs and Benefits of Control /. Porterhouse management ma! hesitate because its expected loss &rom bank accounting errors ma! be less than E1+,+++, or the expected bene&it 8reduction o& the expected loss9 b! E1+,+++ or more might be in doubt. :ank accounting is generall! ver! accurate and &urther anal!sis might con&irm management<s hesitation. Posh 4arper should install the steel doors and burglar bars but not hire the armed guards. Cost-:ene&it o& Doors and :ars :ene&it E%++,+++ loss x *+G elimination Kualitative bene&it> no longer a Hpush-over targetH &or thieves Direct cost Direct cost-subse,uent maintenance Kualitative costs Let bene&it estimated Cost-:ene&it o& /rmed 3uards :ene&it Kualitative bene&it>no longer a Hpush-over targetH &or thieves Direct cost Direct cost>subse,uent in&lation Kualitative cost>possibilit! o& someone being killed or wounded in robber! attemptB social and insurance costs Let bene&it estimated E$%+,+++ @nknown 8E"%,+++9 small none 8Q9 E$"%,+++ E%++,+++ @nknown 8(%,+++9 some expected remote, but high E$"%,+++

:.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1+

%.'1

Costs and Benefits of Control (part B, Continued) 2arginal /nal!sis 82easurable 5n&ormation9 1. ". 6oss expected without control Remaining expected loss with control :ene&it 8expected loss reduction9 Cost o& control Let bene&it Doors and :ars .nl! %++,+++ %+,+++ $%+,+++ "%,+++ $"%,+++ 3uards .nl! %++,+++ -+%++,+++ (%,+++ $"%,+++ :oth %++,+++ -+%++,+++ 1++,+++ $++,+++ Leither %++,+++ %++,+++ + -++ 5& armed guards are hired, no more loss reductions 8bene&it9 is available to ;usti&! the additional E(%,+++ direct cost.

1he armed guards control has two adverse &actors not expected with the doors7bars controlA 819 5n&lation in guard costs will probabl! outpace the doors7bars maintenance costs and 8"9 1he possibilit! o& a shooting incident on compan! propert! is not ver! appealing. C. :oth o& the manager<s assertions are ;usti&iable. 1. Cost-:ene&it o& the Lew /rrangement :ene&its $ meals R E' x "'+ da!s 1+ meals R E' x 1+$ da!s Customer satis&action Possible reduction o& exposure to the&t loss to collecting cashier at end o& &ood line 8&ormer arrangement9

',"$+ ',"$+ some

S 1",$)+ S1he control is cost-bene&icial without considering whether the&t o& cash had occurred. Costs Lew salar!, annual Lew calculator, %-!ear li&e Emplo!ee dissatis&action 1.1/6 C.S1 Let bene&it, &irst !ear Let bene&it, succeeding !ears 1+,+++ %++ none expected 1+,%++ 1,*)+ ",$)+SS

SS/ssuming in&lation in &ood prices tends to o&&set &uture salar! increases.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-11

%.'1

Costs and Benefits of Control (part C, Continued) ". 1he control is better because 8i9 1he recording dut! and cash custod! are separate. Running the cash register amounts to authori=ing and recording transactions &or all practical purposes, and under the &ormer arrangement this person also handled the cash. 1he cashier could have &ailed to ring up a sale and ;ust pocketed the mone!. 1he manager can compare the internal calculator cumulative total to the cash register total &or correspondence o& amounts. / the&t would re,uire collusion o& both persons.

8ii9

D.

1he accountant should not express an! opinion on management<s statement. Fou could disclaim an! opinion about the statement. Fou could give advice to the manager about the anal!sis. Still, the manager is responsible &or risk anal!sis and cost-bene&it decisions.

%.'"

Audit Simulation: Segregation of duties 1. %. /bigail Reconcile bank account 2aintain personnel records ". '. (. *. :r!an .pen mail and list checks Prepare deposit and take to bank 2aintain pett! cash 2aintain general ledger #. $. ). Chris Prepare checks &or signature Prepare pa!roll checks 2aintain accounts receivable records

1+. Reconcile accounts receivable records to general ledger account

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1"

%.'#

Effects of Sarbanes-O le! Act 2r. ?oster Puckett, CE. Central .&&ice Suppl!, 5nc. 5ndianapolis, 5L Dear ?oster, 1he Sarbanes-.xle! /ct and the related PC/.: /uditing Standard Lumber " will cause increased costs !ou Central .&&ice Suppl! 8C.S9, should !our board o& directors decide to go public. 1he speci&ic e&&ects regarding internal control reporting appl! both to the management o& C.S and to the audit. Fou will be responsible &or documenting, testing and assessing the ,ualit! o& !our internal controls over &inancial reporting. 1his is usuall! a costl! procedureB however, it will likel! be bene&icial &or C.S to have a &irm grasp o& the controls in place. Fou will have to prepare a written assessment whereb! management accepts responsibilit! &or the controls and evaluates the e&&ectiveness o& the controls as o& the end o& each !ear. Fou will have to support !our evaluation with su&&icient evidence, including documentation. /s auditors, we will have to gather evidence to report on !our assessment, and to prepare an additional audit report on the internal controls in connection with the &inancial statement audit. Me will be able to use some o& the tests !our personnel per&orm, but the principle evidence &or our report must be based on our own work, and we cannot use !our work to reduce the work we per&orm on the control environment. Me are unable to provide a precise estimate o& the additional cost o& the additional work, but it is true that man! companies have seen their audit &ees double as a result o& the new re,uirements. 1he board should &actor this possibilit! into the costs o& going public. Sincerel!, Four name, /udit Partner.

%.'$

IC" Items: Assertions, #ests of Controls, and Possible Errors or $rauds 1. a. b. c. d. Recorded pa!roll transactions are valid 8occurrence>no &ictitious emplo!ees9. Select a sample o& personnel &iles &or new hires and terminations and trace to reports submitted to the personnel department. 1race also to &irst or last pa!check issued and to cumulative pa!roll records. Pa!checks might be dela!ed and terminated workers might continue to be HpaidH 8with the&t o& check b! someone else9 i& pa!roll is not promptl! noti&ied o& new hires and terminations. Select a sample o& terminated emplo!ees. 5nterview their supervisors or the emplo!ees themselves &or in&ormation about termination date. Search next pa!roll register &or evidence o& overpa!ment the next pa! period. Recorded pa!roll deductions are valid 8occurrence9. Select a sample o& pa!roll deductions and vouch them to signed authori=ations. 5ncorrect amounts might be deducted &rom pa!. Same as tests o& controlsA Select a sample o& pa!checks, and vouch the deductions to the amount authori=ed according to the personnel &iles. Recorded pa!roll transactions are valid and authori=ed 8occurrence9. .bserve the timekeeping operations to determine whether the! are per&ormed separatel!. 5& pa!roll department personnel were also responsible &or time records, the! would have e&&ective control over transaction authori=ation 8i.e., hours worked approval9 and could overpa! themselves or &riends. Select the pa!checks issued to the people involved in combined duties. Examine them &or evidence o& overpa!ment 8wage rate or overtime9. 0 1he 2c3raw-4ill Companies, 5nc., "++( %-1#

".

a. b. c. d. a. b. c. d.

#.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

%.'$

IC" Items: Assertions, #ests of Controls, and Possible Errors or $rauds (Continued) $. a. b. c. d. Pa!roll and labor cost transactions are complete 8completeness9. .btain reconciliation worksheets or check-o&& reports and see i& the reconciliation is done. Cost accounting records might contain more or &ewer dollars than actuall! paid 8per pa!roll data9. Simple errors in cost anal!ses might occur. 5& possible, obtain a total o& labor charged to cost accounting ;obs or processes, and reconcile to total wages reported on ?ederal ?orm *$1. ?or detailsA Select a sample o& labor cost anal!ses, and reconcile to the pa!roll register &or the same period.

%.'%

Obtaining a %Sufficient% &nderstanding of Internal Control 2artin is not correct in asserting that 3//S re,uires reviews and tests o& control in all audits. Reviews and obtaining and documenting an understanding are necessar!, and Pones ma! not be suggesting that no work at all be done on becoming ac,uainted with the clients< internal control. 2artin has overlooked the common-sense 8and 3//S9 idea that tests o& controls need to be done onl! on those controls on which the auditor believes to be strong to reduce the initial control risk assessment. 2artin appears to be proposing that i& a partner wishes to extend the substantive procedures and Hact as i& the control risk were high,H he should be &ree to do so. @nder 3//S, this is .T. 1his is a common problem in practice. 2an! small-client audits ma! be accomplished through extensive substantive procedural work, making up &or little or no work on control. 1he trade-o&& is the time and cost involved in per&orming test o& control work against the reduction in substantive procedure work. 5& the latter cannot be reduced much under an! circumstances, then a lot o& work on internal control ma! be uneconomical.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1$

%.''

$raud Opportunities 1he discussion could take several directions, including some or all o& the &ollowingA 1. 2aterial Meakness. 1he &acts seem to suggest Ha condition in which speci&ic control &eatures 8&ew or none are described9 or the degree o& compliance with them do not reduce to a relativel! low level the risk that errors or &rauds in amounts that could be material to the &inancial statements ma! occur and not be detected within a timel! period b! emplo!ees in the normal course o& per&orming their assigned &unctions.H 3ault has authorit! and in&luence over too man! interrelated activities. Lothing he does seems to be sub;ect to review or supervision. 4e even is able to exclude the internal auditor. /n identi&ication o& the potential &rauds will illustrate the misdeeds he can perpetrate almost single-handedl!. ". Potential &rauds includeA a. b. 3ault can collude with customers to rig low bids and take kickbacks, thereb! depriving the compan! o& legitimate revenue. 3ault can direct purchases to &avored suppliers, pa! unnecessaril! high prices and take kickbacks. 4e might even set up a controlled dumm! compan! to sell overpriced materials to the compan!. Lo competitive bidding control prevents these activities. 3ault, through the control o& ph!sical inventor!, can 8i9 remove materials &or himsel& and 8ii9 manipulate the inventor! accounts to conceal shortages. 3ault can order truck shipping services &or his own purposes and cause the charges to be paid b! the compan!. 3ault can manipulate the customer billing 8similar to a above9 to deprive the compan! o& legitimate revenue while taking an unauthori=ed commission or kickback.

c. d. e. #.

/lmost ever! desirable characteristic o& good internal control has been circumventedA a. b. Segregation o& ?unctional Responsibilities. 3ault has authori=ation and custodial responsibilities. /uthori=ation, Supervision. 3ault is apparentl! sub;ect to no supervision or review. 1he accounting sta&& is probabl! powerless to challenge transactions because o& Simon<s apparent approval o& 3ault<s powers. Controlled /ccess. 1he whole situation gives 3ault access to necessar! papers, records, and assets to carr! out his one-man show. Periodic Comparison. Lo one else apparentl! has an! access to the materials inventor! in order to conduct an actual count &or comparison to the book value 8recorded accountabilit!9 o& the inventor!.

c. d.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1%

%.'(

IC" Items: Errors t'at Could Occur from Control (ea)nesses* Kuestions 8abbreviated9 1. ". #. $. %. '. (. ). *. 1+. 11. 1". 1#. 1$. 1%. 1'. 1(. 1). 1* "+. "1. Emplo!ees paid b! checkQ Special pa!roll bank account usedQ 4ours o& &ictitious emplo!ee. 5ndependent pa!roll check signersQ 5ndependent bank statement reconciliationQ Pa!roll emplo!ees rotated, take vacations and bondedQ 1imekeeping independent o& pa!rollQ Mage rates approvedQ Deduction authori=ations signed b! emplo!eesQ 4ours and cost distribution approved b! supervisorQ 1ime clock usedQ Pa!roll sheet signed and approvedQ Personnel department reports emplo!ees terminated to pa!roll departmentQ Pa!roll compared to personnel &ilesQ 5ndependent check distributionQ @nclaimed wages controlledQ .ccasional surprise pa!o&& b! internal auditorsQ Personnel department reports emplo!ees hired to pa!roll departmentsQ Pa!roll checks prenumberedQ Se,uence checkedQ Kuali&ied person track retirementQ /ctuar! emplo!edQ /ssumptions reviewedQ Cost records reconciled to pa!rollQ Possible Error or ?raud 1. ". #. $. %. '. (. ). *. Errors in withholding, rate. :ank reconciliation errors. ?ictitious emplo!ees. @nauthori=ed pa!ments. ?ictitious emplo!ees, incomplete accounting. ?ictitious emplo!ees. ?ictitious emplo!ees or hours. @nauthori=ed rates, improper rates. 5ncorrect deductions. 4ours overcharged 8&ictitious hours9

1+. 5ncorrect hours claimed and paid. 11. @nauthori=ed emplo!ees, hours or rate. 1". 1erminated emplo!ees paid and another cashes checks 8?ictitious emplo!ee9 1#. ?ictitious emplo!ees. 1$. ?ictitious emplo!ees. 1%. 5mproper cashing o& checks. 1'. ?ictitious emplo!ees. 1(. @nauthori=ed emplo!ee paid. 8?ictitious emplo!ee9 1). 1*. "+. "1. "". "#. "$. "%. Checks issued and not recorded. Retirement obligations incorrect. Retirement amounts incorrect. 5ncomplete accounting>usuall! cost records not complete. @ndetected errors and &rauds 8all o& the above9. .ver7underreporting. 2isclassi&ied debits in accounts. /ccounting and classi&ication errors.

"". Periodic audit o& pa!roll b! internal auditorsQ "#. Reconciliation with tax reportsQ "$. Classi&ication instructionsQ "%. Review b! accounting o&&icerQ

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1'

%.')

+aplan CPA E am Simulation--Control (ea)nesses C E B Sales are made to bu!ers who are not good credit risks. 3oods are shipped to customers but later prove to be the incorrect ,uantit!. 5nvoices are properl! prepared and mailed to the correct customers but posted to the accounts o& di&&erent customers. 3oods are shipped to customers based on sales orders, but no record is ever made o& the sale and no invoice is ever sent to the customer. Sales invoices are prepared and mailed but not recorded in the Sales Pournal. 3oods are shipped to customers without ever having received a sales order. 1o boost net income, sales invoices are prepared and mailed to &ake addresses &or sales that never occurred.

A E -

%.'*

+aplan CPA E am Simulation--Internal Control Components 1. C :! having the receptionist open the cash receipts7remittances 8instead o& the accounts receivable clerk9, Southland has demonstrated a good example o& segregation o& duties. Segregation o& duties &orms part o& the total control activities at Southland. 1he lockbox s!stem is an example o& the sa&eguarding o& assets. Sa&eguarding o& assets is a ph!sical control and &orms part o& the total control activities at Southland. 1he changes implemented in the internal control s!stem during the current !ear are an example o& monitoring. 2onitoring assesses the ,ualit! o& the internal control e&&ectiveness over time and implements changes when necessar!. 2anagement s philosoph! and operating st!le is a control environment &actor. Proper authori=ation b! the credit manager &orms part o& the total control activities at Southland. 5t is an example o& segregation o& duties. ?or instance, the sales manager would not be setting the credit limits &or new customers due to the potential con&lict situation. 5ndividual and detailed ;ob descriptions &orm part o& the control environment. 1he ;ob descriptions speci&icall! relate to the delegation o& authorit!. /ccounting s!stems that are designed to generate reports would clearl! &orm part o& the internal controls over the in&ormation and communication s!stem. /ctive participation b! the board o& directors is a component o& the control environment 8delegation o& authorit! and responsibilit!9. 1he 51 manager s actions are an example o& risk assessment. Risk assessment re&ers to a compan! s abilit! to anticipate potential misstatements 8such as the lack o& integration between certain components o& Southland s accounting s!stem9 and work to prevent them be&ore the! occur.

*. #.

C E

$. %.

/ C

'. (. ). "

/ D / :

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1(

%.(+

+aplan CPA E am Simulation--Internal control and tec'nolog!

C A

/n upper boundar! established &or processing purposes. 81ransactions over a certain dollar limit re,uire &urther veri&ication, &or example.9 /n internal reconciliation o& data within the computer to make certain that it is legitimate. 8Checks are issued onl! to actual emplo!ees, &or example. 1his could be done b! crossre&erencing the master emplo!ee &ile.9 / total o& the number o& transactions to be processed. / total derived &rom some element o& the data being processed. 1otal would have some meaning or importance. 81otal sales, &or example.9 / total derived &rom some element o& the data being processed that would not normall! be totaled. 1otal is onl! computed &or control purposes and is not necessaril! meaning&ul. 81otal o& emplo!ee social securit! numbers, &or example.9

. E

%.(1

+aplan CPA E am Simulation / 0eportable conditions 1oA Partner, PU2 ?romA 2anager, PU2 Sub;ectA Reportable Conditions, Signi&icant De&iciencies, and 2aterial Meaknesses / reportable condition is a signi&icant de&icienc! in the design or &unction o& internal control that could adversel! a&&ect the organi=ation s abilit! to record, process, summari=e, and report &inancial data. Significant deficiencies are de&ined as conditions that could adversel! a&&ect the organi=ation s abilit! to initiate, record, process, and report &inancial data in the &inancial statements. 1he de&icienc! would provide a more than remote possibilit! o& a misstatement that is more than inconsequential would not be prevented or detected. Examples includeA /bsence o& appropriate segregation o& duties. /bsence o& appropriate reviews and approvals o& transactions. Evidence o& &ailure o& control procedures. Evidence o& intentional management override o& control procedures b! persons in authorit! to the detriment o& control ob;ectives

/ material 1ea)ness in internal control is de&ined as a condition that results in more than a remote likelihood o& a material misstatement o& the &inancial statements. :e&ore Sarbanes .xle!, /@ #"% re,uired us to communicate reportable conditions to the audit committee through a report, either orall! 8with the discussion documented in the working papers9 or in a written letter to the audit committee. 5n the report, we were not re,uired to identi&! whether a reportable condition was actuall! a material weakness. Low, because 6akeland is a public compan!, we are re,uired to &ollow the Sarbanes-.xle! act, which re,uires us to identi&! signi&icant de&iciencies and material weakness and report them in writing to the audit committee.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1)

APPEN*I( 5&A T+e Pa,roll C,-le OL!TION "OR REVIE# CHEC$POINT

%./1 1he &unctions in a personnel and pa!roll c!cleA %/." Personnel and labor relations - hiring and &iring 8/uthori=ation9 Supervision - approval o& work time 8/uthori=ation9 1imekeeping and cost accounting - pa!roll preparation and cost accounting 8Recordkeeping9 Pa!roll accounting - check preparation and related pa!roll reports 8Custod! o& cash9 Check signing 8Custod!9 Pa!roll distribution - actual custod! o& checks and distribution to emplo!ees 8Custod! o& Cash9

5n a pa!roll s!stem, the &unctional responsibilities which should be separated includeA 1. ". #. $. %. Personnel or 6abor Relations Department Supervision 1imekeeping and Cost /ccounting Pa!roll /ccounting Pa!roll Distribution

%./.#

Mhen emplo!ees are terminated, the! should be interviewed b! the personnel department, who can then remove them &rom the pa!roll &iles. Separation o& responsibilit! &or handing out pa!checks &rom authori=ation and record-keeping can reduce the incentive &or supervisors to keep terminated emplo!ees on the pa!roll. 6abor cost anal!ses also reduce incentives &or supervisors to have too man! emplo!ees listed in their departments. ?inall!, M-"s should be sent directl! to the emplo!ee<s home so the! can spot an! &ictitious wages. a. / Hwalk throughH o& a personnel and pa!roll transaction would include discussions with each person handling personnel and pa!roll records. 1he &ollowing illustrates the steps and documents collected. Steps 4iring--personnel department Deductions--personnel dept. 1imekeeping Shops Cost distribution /ccounts pa!able Cash disbursement b. .ocument(s) Collected /uthori=ation to hire and rate assignment Personnel &orms, emplo!ee authori=ation &or deductions 8e.g., M-$ &orm9 Clock card Production time ticket 6abor distribution work sheet Pa!roll voucher Pa!roll checks

%./.$

5& the pa!roll is processed b! computer, the clock cards and production time tickets would be traced to batch control in the timekeeping and production departments, to data preparation 8ke!ing to machine sensible &orm9, to edit and validation error reports and other computer output indicating control and &inall! to computer prepared checks, labor distribution reports and summar! general ledger entries.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-1

%/.%

5mportant in&ormation in emplo!ee<s personnel &ilesA Emplo!ment application :ackground investigation report Lotice o& hiring Pob classi&ication with pa! rate authori=ation /uthori=ations &or deductions 8e.g. health insurance, li&e insurance, retirement contribution, union dues, M-$ &orm &or income tax exemptions9 1ermination notice Prevent or detect pa!ment to a &ictitious emplo!eeA b. Pa!checks prepared onl! &or persons with emplo!ment authori=ation &rom the personnel department. Pa!checks prepared onl! &or persons with approved work attendance, time. Pa!checks distributed onl! in person to persons identi&ied as emplo!ees 8or b! electronic trans&er to validated emplo!ee bank accounts9. Pa!roll register or list re-approved b! supervisor a&ter pa!checks are prepared or distributed.

%/.'

a.

Emplo!ees are expected to complain i& the! are not paid 8C9.

%/.(

1he common errors and &rauds in the personnel and pa!roll c!cle are 819 recorded emplo!ee transactions are not valid 8&ictitious emplo!ee9, 8"9 recorded attendance transactions are not valid 8&ictitious hours9, and 8#9 incorrect cost accounting classi&ication &or labor. /uditors look &or separation o& duties, proper authori=ations and good reconciliations to prevent or correct these errors or &rauds. /uditors should be alert to a supervisor having too man! incompatible responsibilities 8e.g., hiring, authori=ation o& hours, authori=ation o& pa! rate, distribution o& pa! checks and dismissal--onl! authori=ation o& hours is a proper responsibilit!9.

OL!TION "OR %!LTIPLE&CHOICE '!E TION

%/.) c. Correct 1he pa!roll department should be independent o& the personnel department, which would be responsible &or authori=ing all pa!roll rate changes &or the emplo!ees o& the entit!. / supervisor would be authori=ed, however, to initiate re,uests &or rate increases &or supervised emplo!ees. 1he personnel department provides the authori=ation &or pa!roll-related transactions, e.g., hiring, termination, and changes in pa! rates and deductions. / generali=ed program would not be su&&icientl! sophisticated to test this procedure. 5n a manual pa!roll s!stem, a paper trail o& documents would be created to provide audit evidence that controls over each step in processing were in place and &unctioning. .ne element o& a computer s!stem that di&&erentiates it &rom a manual s!stem is that a transaction trail use&ul &or auditing purposes might exist onl! &or a brie& time or onl! in computer-readable &orm. 1his ma! be true, but there is not enough in&ormation about built-in controls. 1his is a real-time s!stem as records are updated when emplo!ees record their time.

%/.* %/.1+

a. a. b.

Correct 5ncorrect Correct

c. d.

5ncorrect 5ncorrect

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-"

%/.11

a. b. c. d.

5ncorrect 5ncorrect Correct 5ncorrect Correct

1he pa!roll clerk has access to recording and custod!. @nclaimed pa! should be given to the 1reasurer. @nder a cash pa!roll s!stem, the receipt signed b! the emplo!ee is the onl! document in support o& pa!ment. 1he signed receipt is essential to veri&! proper pa!ment. 1his would not be applicable to cash pa!roll. / &ollow-up o& unclaimed checks ma! result in identi&ication o& &ictitious or terminated emplo!ees, thus eliminating an emplo!ee s opportunit! to claim a pa!check belonging to a terminated emplo!ee. 1he unclaimed checks should then be turned over to a custodian so the internal audit &unction does not assume operating responsibilities. .rdinaril!, the auditor examines the endorsements on pa!roll checks while obtaining an understanding o& and testing the pa!roll c!cle, which includes consideration o& clock cards. 1he voucher s!stem does not pertain to pa!roll. 1his is a possibilit!, but answer a is better. /s part o& the cash audit, the auditor would normall! onl! examine checks returned with the cut-o&& bank statement. 1est o& accruals would not involve examination o& cancelled pa!checks. 5n considering whether transactions actuall! occurred, the auditor is most concerned about the proper separation o& duties between the personnel department 8authori=ation9 and the pa!roll department 8processing the transactions9. 1his relates to completeness. 1his relates to valuation. 1his would not provide evidence about occurrence o& pa!roll transactions. 1he pa!roll department assembles pa!roll in&ormation, which is a recording &unction. Custod! o& assets, such as unclaimed pa!roll checks is incompatible with record keeping.

%/.1"

d.

%/.1#

a. b. c. d.

Correct 5ncorrect 5ncorrect 5ncorrect Correct

%/.1$

a.

b. c. d. %/.1% c.

5ncorrect 5ncorrect 5ncorrect Correct

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-#

OL!TION "OR E(ERCI E ) PROBLE% ) AN* I%!LATION

%/.1' Controls o2er .epartmental 3abor Cost in a 4ob-Cost S!stem a. Compare aspects o& control with which the labor-cost report proposal complies and examples &rom the case to support each o& the aspects citedA 1. ". #. $. %. '. (. ). *. b. Proposal is &lexible and widel! applicable. Example>it can be used &or all t!pes o& ;obs. Proposal should be economical. Example>data re,uired are generall! available and most calculations are made currentl!. Proposal &ocuses attention at the proper organi=ational level. Example>the department is the basis &or the report. Proposal emphasi=es a signi&icant cost element. Example>labor is a ma;or element o& cost. Proposal provides &or ,uantitative evaluation. Example>;ob estimates act as standards. Proposal provides &or a comparison o& actual results to standard to ascertain deviations. Example>actual labor costs incurred b! the department are compared to estimates. Proposal provides &or an independent part! to make the comparison. Example>an accounting clerk makes the comparison. Proposal emphasi=es exception reporting. Example>onl! signi&icant variances are sent to the production manager. Proposal recommends corrective actions to go to someone who can take actions. Example >the recommendations are sent to the production manager.

Common aspects o& control with which the departmental labor-cost control method does not compl! and examples &rom the case to support each o& the aspects citedA 1. ". #. $. %. '. (. Proposal &ails to re&lect the nature and needs o& the activit!. Example>the appropriate comparison should be b! ;ob, not department<s total. Proposal &ails to consider on-the-spot action. Example>no mention is made o& possible responses within departments when variances arise. 2ost ;obs are completed within the two-week pa!roll period. Proposal &ails to provide speci&ic criteria &or identi&!ing problems. Example>the accounting clerk is given little guidance in determining whether a signi&icant variance exists. Proposal &ails to re&lect organi=ational pattern>emphasi=ing where responsibilit! &or action lies. Example>department &oremen do not receive a cop! o& the report when signi&icant deviations occur. Proposal &ails to provide &or prompt investigation. Example>investigation depends on the assistant controller<s available time. Proposal &ails to consider changed conditions. Example>no mention is made o& an! considerations given to the estimation process or revisions. Proposal &ails to consider all possible causes. Example>no indication is given that costs other than labor were considered

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-$

%/.1(

5a6or 0is)s in Pa!roll C!cle Pa!roll C!cle Risk /ssertion

Pa!ing &ictitious Hemplo!eesH Existence, emplo!ees exist .verpa!ing &or time or production Daluation o& pa!roll amounts, proper inventor!, cost o& goods sold, and expense amounts 5ncorrect accounting &or costs and expenses %/.1) Presentation and disclosure, incorrect classi&ication, inconsistent disclosure

Pa!roll Aut'ori7ation in a Computer S!stem /uthori=ation takes place when a computer is involved. 4owever, since authori=ation is an important control activit!, the point8s9 o& authori=ation should be determined. /uthori=ation o& pa!roll transactions cannot be determined without understanding the complete &low o& transaction processing 8manual and computer9. 1he &ollowing could be points in the &low where authori=ation takes placeA Mhen the computer application program is written 8and approved9 to accept certain emplo!ee codes and to compute the gross pa!roll and the net amount. Mhen the &oreman initials the time card. 8/lternativel!, the time ma! be automaticall! entered &rom a time clock into the computer &iles without &oreman initials>then the emplo!ee clocking in and out is the authori=ation.9 Mhen pa!roll batches o& time cards are totaled and submitted to data conversion. Mhen the time cards are ke! punched or opticall! scanned. Mhen the pa!roll programs are run using the time clock transactions and the pa!roll master &ile. Mhen the signature plate is installed on the printer and checks are printed. Mhen the pa! rate is entered into the emplo!ee master &ile.

%/.1*

Audit Simulation: Pa!roll Processed b! a Ser2ice Organi7ation 1his discussion ,uestion brings up the auditors< responsibilit! when pa!roll is processed b! a service bureau, a common occurrence in man! smaller businesses. 1he main point is that the audit control concerns are the same wherever the data is processed. ?ollowing are some o& the discussion points that have come up in the past use o& this ,uestion. /udit planning will re,uire determination o& whether a report is available &rom the service bureau, prepared b! independent auditors 8service auditors9. .& particular interest is whether the service auditor<s report covers Hdesign onl!H or covers both Hdesign and certain tests o& controls.H Mhen a service bureau is used, client personnel are responsible &or user input and output control, e.g., authori=ation, completeness 8batching9, reconciliation o& input controls to output. Speci&ic contractual agreements o& control responsibilities between the client and the service bureau need to be examined and evaluated. 3eneral controls are the responsibilit! o& the service bureau, e.g., s!stem and program documentationB backup &or computer processing, data &iles, documentation and sta&&B and restrictions over access to computer e,uipment, data &iles and programs. Service bureau processing re,uires increased emphasis on client procedures &or veri&!ing continuing authorit!, completeness and accurac! o& master &ile. Service bureau processing re,uires increased emphasis on error correction and resubmission procedures. 0 1he 2c3raw-4ill Companies, 5nc., "++( %-%

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

%/."+

Audit Simulation: Pa!roll Audit Procedures, Computers, and Sampling a. /udit procedures>.btain a sample o& weekl! batches o& time cards and recalculate the totals o& labor hours and social securit! numbers. 6abor hour data distributed b! the cost accounting department ma! serve as a cross-check. 1hese control totals should then be compared to the pa!roll register totals &or the same period 8and to control totals obtained a&ter ke!board entr!, i& available9. Deviation rate>the expected deviation rate should be =ero. /lthough some input errors might occur, the! should be detected and corrected using the control totals &or labor hours and social securit! numbers. 1olerable rate>since pa!roll costs probabl! represent a signi&icantl! large cost item in a manu&acturing compan!, the tolerable rate might be ,uite low, sa! "G or #G. Sample items>the sample items should be &rom appropriate populationsB in this case, either the batches as described above, the #++ emplo!ee &iles or each emplo!ee<s weekl! pa!roll 8%" x #++ N 1%,'++ worker7week pa!ments9. Sample si=e &actor>includeA expected deviation rate, tolerable deviation rate, risk o& assessing control risk too low, and the population si=e 8i& small9. b. Select personnel &iles at random and compare the authori=ed ;ob classi&ication and pa! rate to the union contract and to the data base 8tape or cards9 that contains the table used in computer memor!. 1his procedure !ields evidence that the internal computer table is accurate. :! reviewing documented changes in the table, its contents throughout the period under audit ma! be reviewed. Extract a sample o& names-classi&ications-rates &rom the table itsel& and vouch these to the personnel &iles to detect errors o& commission in the table. 1o determine whether rates are actuall! used properl!, the auditor ma! test the computer application with simulated transactions or he7she ma! audit HaroundH the calculations b! vouching pa!roll register output to time cards and personnel &iles, and b! retracing samples &rom time cards and personnel &iles &orward to the pa!roll register. 1hese procedures di&&er &rom a completel! manual s!stem onl! with respect to the need to test the ade,uac! o& the machine-stored rate table and in the test data application. .therwise, the procedures are e,uall! applicable to a manual s!stem &or preparing the pa!roll.

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-'

%/."1

Pa!roll #ests of Controls Procedure Sample o& Clock CardsA Lote supervisors< approval. 1race to periodic pa!roll registers. Sample o& Pa!roll Register EntriesA Douch hours paid to clock cards and supervisors< approval. Recalculate gross pa!, deductions, net pa! Recalculate pa!roll registers. Examine canceled pa!roll checks and endorsements. Douch periodic pa!roll totals to pa!roll bank account trans&er vouchers and deposit. 1race pa!roll entries to F1D records. Reconcile F1D records with total pa!rolls. 1race pa!roll to management reports and to general ledger. E2idence 2issing approval deviation Mrong hours deviation. Mrong emplo!ee deviation. Mrong hours deviation. 2issing approval deviation 5naccurate pa! calculation deviation. 5naccurate pa!roll summar! deviation. 5naccurate check amt. deviation 5nvalid endorsement deviation. 5naccurate pa!roll trans&er deviation. 2issing pa!roll trans&er deviation. 5ncomplete update deviations. 5naccurate pa!roll 8tax return9 deviation. /ccounting incomplete deviation /ccounting incomplete deviation

McGraw-Hill/Irwin /uditing and /ssurance Services, 6ouwers et al., "7e

0 1he 2c3raw-4ill Companies, 5nc., "++( %-(