Chapter 1

Auditing and Internal Control

Review Questions
1.

What is the purpose of an IT audit?

Response: The purpose of an IT audit is to provide an independent assessment of some
technology- or systems-related object, such as proper IT implementation, or controls over
computer resources. Because most modern accounting information systems use IT, IT plays a
significant role in a financial (external audit), where the purpose is to determine the fairness and
accuracy of the financial statements.
2.
Discuss the concept of independence within the context of a financial audit. How is
independence different for internal auditors?
Response: The auditor cannot be an advocate of the client, but must independently attest to
whether GAAP and other appropriate guidelines have been adequately met. Independence for
internal auditors is different because they are employed by the organization, and cannot be as
independent as the external auditor. Thus internal auditors must use professional judgment and
independent minds in performing IA activities.
3.
What are the conceptual phases of an audit? How do they differ between general
auditing and IT auditing?
Response: The three conceptual phases of auditing are:
i. Audit planning,
ii. Tests of internal controls, and
iii. Substantive tests.
Conceptually, no difference exists between IT auditing and general auditing. IT auditing is
typically a subset of the overall audit; the portion that involves computer technology is the subset.
4.

Distinguish between the internal and external auditors.

Response: External auditors represent the interests of third-party stakeholders in the
organization, such as stockholders, creditors, and government agencies. External auditing is
conducted by certified public accountants who are independent of the organizations
management. Internal auditors represent the interests of management. Internal auditing tasks
include conducting financial audits, examining an operations compliance with legal obligations,
evaluating operational efficiency, detecting and pursuing fraud within the firm, and conducting IT
audits. External auditors also conduct IT audits as a subset of financial audits.
5.

What are the four primary elements described in the definition of auditing?
Response:
a. auditing standards
b. systematic process
c.management assertions and audit objectives
d. obtaining evidence
6.

Explain the concept of materiality.

Response: Materiality refers to the size of the effect of a transaction. From a cost-benefit
point of view, a threshold is set above which the auditor is concerned with the correct recording
and effects of transactions. Rather than using standard formulas, auditors use their professional
judgment to determine materiality.

7.
How does the Sarbanes-Oxley Act of 2002 affect managements responsibility for
internal controls?
Response: The Sarbanes-Oxley Act (S-OX) specifically holds management responsible for
internal controls. S-OX requires an annual report on internal controls that is the responsibility of
management; external auditors must attest to the integrity of the report. Management must assess
the effectiveness of the internal control structure and procedures for financial reporting as of the
end of the most recent fiscal year and identify any control weaknesses. An attestation by external
auditors reports on managements assessment statement.
8.

What are the four broad objectives of internal control?

Response:
a. to safeguard the assets of the firm
b. to ensure the accuracy and reliability of accounting records and information
c. to promote efficiency in the firms operations
d. to measure compliance with managements prescribed policies and procedures
9.
What are the four modifying assumptions that guide designers and auditors of
internal control systems?
Response: Management responsibility, reasonable assurance, methods of data processing,
and limitations.
10.

Give an example of a preventive control.

Response: Locked doors, passwords, and data-entry controls for each field (e.g., range
checks).
11.

Give an example of a detective control.

Response: A log of users, a comparison with computer totals and batch totals.

12.

Give an example of a corrective control.

Response: Manual procedures to correct a batch that is not accepted because of an incorrect
social security number. A clerical worker would need to investigate and determine either the
correct hash total or the correct social security number that should be entered. A responsible party
is then needed to read exception reports and follow up on anomalies.
13.

What are the five internal control components described in the COSO framework?
Response:
a. Control Environment
b. Risk Assessment
c. Information and Communication
d. Monitoring
e. Control Activities

14. What are the six broad classes of control activities defined by COSO?
Response: The six broad classes of control activities defined by COSO are:
a. transaction authorization,
b. segregation of duties,
c. supervision,
d. accounting records,
e. access control, and
f. independent verification.

15.

Give an example of independent verification.

Response:
a. the reconciliation of batch totals at periodic points during transaction processing
b. the comparison of physical assets with accounting records
c. the reconciliation of subsidiary accounts with control accounts
d. reviews by management of reports that summarize business activity
e. periodic audits by independent external auditors
f. periodic audits by internal auditors
16.

Differentiate between general and application controls. Give two examples of each.
Response: General controls apply to a wide range of exposures that systematically threaten
the integrity of all applications processed within the IT environment. Some examples of general
controls would be controls against viruses and controls to protect the hardware from vandalism.
Application controls are narrowly focused on risks within specific systems. Some examples of
application controls would be a control to make sure that each employee receives only one
paycheck per pay period and a control to ensure that each invoice gets paid only once.
17.

Distinguish between tests of controls and substantive testing.

Response: The tests of controls phase involves determining whether internal controls are in
place and whether they function properly. The substantive testing phase involves a detailed
investigation of specific account balances and transactions.
18.

Define audit risk.

Response: Audit risk is the probability that the auditor will render an unqualified (clean)
opinion on financial statements that are, in fact, materially misstated.
19. Distinguish between errors and irregularities. Which do you think concern auditors
the most?
Response: Errors are unintentional mistakes whereas irregularities are intentional misrepresentations to perpetrate a fraud or mislead the users of financial statements. Errors are a
concern if they are numerous or sizable enough to cause the financial statements to be materially
misstated. All processes that involve human actions are highly susceptible to some amount of
human error. Computer processes should contain errors only if the programs are erroneous, if
systems operating procedures are not being closely and competently followed, or if some unusual
system malfunction has corrupted data. Errors are typically much easier to uncover than
misrepresentations. Thus auditors typically are more concerned about whether they have
uncovered any and all irregularities. Also, due to SAS No. 99 and Sarbanes-Oxley, auditors are
much more concerned with fraud (irregularities) than before.
20. Distinguish between inherent risk and control risk. How do internal controls affect
inherent risk and control risk, if at all? What is the role of detection risk?
Response: Inherent risk is associated with the unique characteristics of the business or
industry of the client. Firms in declining industries are considered to have more inherent risk than
firms in stable or thriving industries. Auditors cannot reduce inherent risk, which is not affected
by internal controls. Even in a system protected by excellent controls, financial data can be
misstated.
Control risk is the likelihood that the control structure is flawed because internal controls
are either absent or inadequate to prevent or detect errors in the accounts. Auditors assess the
level of control risk by performing tests of internal controls. Internal control does, however,
directly impact control risk. The more effective the internal controls that are in place, the lower
the level of assessed control risk.

Detection risk is the risk that auditors are willing to take that errors not detected or
prevented by the control structure will also not be detected by the auditors. Typically, detection
risk will be lower for firms with higher inherent risk and control risk.
21.

What is the relationship between tests of controls and substantive tests?

Response: The relationship between tests of controls and substantive tests is directly related
the auditors risk assessment. The stronger the internal controls, the less substantive testing
the auditor must do.
22.

SOX contains many sections. Which sections does this chapter focus on?
Response: This chapter concentrates on internal control and audit responsibilities pursuant
to SOX Sections 302 and 404.
23.

What control framework does the PCAOB recommend?

Response: The PCAOB recommends the use of COSO as the framework for control
assessment.
24. COSO identifies two broad groupings of information system controls. What are
they?
Response: The two broad groupings of information system controls identified by COSO
are application controls and general controls.
25.

What are the objectives of application controls?

Response: The objectives of application controls are to ensure the validity, completeness,
and accuracy of financial transactions.
26.

Give three examples of application controls?

Response: Examples include:
a. A cash disbursements batch-balancing routing that verifies the total payments to vendors
reconciles with the total postings to the accounts payable subsidiary ledger.
b. An account receivable check digit procedure that validates customer account numbers
on sales transactions.
c. A payroll system limit check that identifies employee time card records with reported
hours work in excess of the predetermined normal limit.
27.

Define general controls.

Response: General controls apply to all systems. They are not application specific.
General controls include controls over IT governance, the IT infrastructure, security and access to
operation systems and databases, application acquisition and development, and program changes.
28.

What is the meaning of the term attest services?

Response: The attest service is an engagement in which a practitioner is engaged to issue a
written communication that expresses a conclusion about the reliability of a written assertion that
is the responsibility of another party (SSAE No. 1, AT Sec. 100.01).
29.

List four general control areas.

Response: The following are examples of general control areas:
a. It Govenance controls,
b. Security (data management controls),
c. Security (operating system and network controls),
d. systems development and program change controls,

Discussion Questions
1.

Discuss the differences between the attest function and advisory services.
Response: The attest service is defined as an engagement in which a practitioner is engaged
to issue, or does issue, a written communication that expresses a conclusion about the reliability
of a written assertion that is the responsibility of another party. The following requirements apply
to attestation services:
Attestation services require written assertions and a practitioners written report.
Attestation services require the formal establishment of measurement criteria or their
description in the presentation.
The levels of service in attestation engagements are limited to examination, review, and
application of agreed-upon procedures.
Advisory services are professional services offered by public accounting firms to improve
their client organizations operational efficiency and effectivness. The domain of
sdvisory services is intentionally unbounded so that it does not inhibit the growth of future
services that are currently unforeseen. As examples, advisory services include actuarial
advice, business advice, fraud investigation services, information system design and
implementation, and internal conrol assessments for compliance with SOX.

2.
A CPA firm has many clients. For some of its clients, it relies very heavily on the work
of the internal auditors, while for others it does not. The amount of reliance affects the fees
charged.
How can the CPA firm justify the apparent inconsistency of fees charged in a competitive
marketplace?
Response: The CPA firms reliance on the work of the internal auditors depends on the
structure of the organization and to whom the internal auditors report. If they do not report
directly to the board of directors, then their positions may be compromised. Further, the quality
and type of work conducted by the internal auditors will affect external auditors reliance.
3.
Accounting firms are very concerned that their employees have excellent
communication skills, both oral and written. Explain why this requirement is so important
by giving examples of where these skills would be necessary in each of the three phases of an
audit.
Response: During the planning phase of an audit, oral communication skills are used in
interviews. Written communication skills are needed for recording the results of interviews and
during observation and systems documentation reviews. In the tests of controls and substantive
testing phases, oral communication skills are important when working with the clients
employees. Written communication skills are then vital in summarizing the results of tests.
4.
Explain the audit objectives of existence or occurrence, completeness, rights and
obligations, valuation or allocation, and presentation and disclosure.
Response:
The existence or occurrence assertion affirms that all assets and equities contained in the
balance sheet exist and that all transactions in the income statement actually occurred.
The completeness assertion declares that no material assets, equities, or transactions have
been omitted from the financial statements.
The rights and obligations assertion maintains that assets appearing on the balance sheet
are owned by the entity and that the liabilities reported are obligations.
The valuation or allocation assertion states that assets and equities are valued in

accordance with generally accepted accounting principles and that allocated amounts
such as depreciation expense are calculated on a systematic and rational basis.
The presentation and disclosure assertion alleges that financial statement items are
correctly classified (e.g., long-term liabilities will not mature within one year) and that
footnote disclosures are adequate to avoid misleading the users of financial statements.
5.
How has the Foreign Corrupt Practices Act of 1977 had a significant impact on
organization management?
Response: The FCPA of 1977 requires that all companies registered with the Securities and
Exchange Commission maintain an appropriate system of internal controls. Internal controls
typically directly impact the organizational structure and segregation of functions.
6.

Discuss the concept of exposure and explain why firms may tolerate some exposure.
Response: An exposure is the absence or weakness of an internal control. Sometimes costbenefit analysis may indicate that the additional benefits of an internal control procedure may not
exceed the costs. Thus, the firm may decide to tolerate some control risk associated with a
particular exposure.
7.
If detective controls signal errors, why shouldnt they automatically make a
correction to the identified error? Why are separate corrective controls necessary?
Response: For any detected error, more than one feasible corrective solution may exist, and
the best course of action may not always be obvious. Thus, linking an automatic response to a
detective control may worsen a problem by applying an inappropriate corrective action.
8.
Most accounting firms allow married employees to work for the firm. However, they
do not allow an employee to remain working for them if he or she marries an employee of
one of their auditing clients. Why do you think this policy exists?
Response: The accounting firm must retain its independence from its clients. The auditor
must not have the opportunity to collude, in any fashion, with any employees of its client.
Having one spouse working for the client and the other working for the accounting firm would
compromise the independence of the accounting firm.
9.
Discuss whether a firm with fewer employees than there are incompatible tasks
should rely more heavily on general authority then specific authority.
Response: Small firms with fewer employees than there are incompatible tasks should rely
more heavily on specific authority. More approvals of decision by management and increased
supervision should be imposed in order to compensate some for the lack of separation of duties.
10. An organizations internal audit department is usually considered to be an effective
control mechanism for evaluating the organizations internal structure. The Birch
Companys internal auditing function reports directly to the controller. Comment on the
effectiveness of this organizational structure.
Response: Having the internal auditing function report to the controller is unacceptable. If
the controller is aware of/or involved in a fraud or defalcation, then he/she may give false or
inaccurate information to the auditors. The possibility that the auditors may lose their jobs if they
do not keep certain matters quiet also exists. Further, the fraud may be occurring at a level higher
than the controller, and the controller may fear losing his/her job if the matter is pursued. The best
route is to have the internal auditing function report directly to the audit committee.

11. According to COSO, the proper segregation of functions is an effective internal

control procedure. Comment on the exposure (if any) caused by combining the tasks of
paycheck preparation and distribution to employees.
Response: If a payroll employee were to prepare a paycheck for a nonexistent employee
(perhaps under an alias or in the name of a relative), which is known as ghost employee fraud,
and this employee also has the task of distributing the checks, then no one would be the wiser. On
the other hand, if the checks go directly to another person, who then distributes the paychecks, the
extra check should be discovered.
12.

Discuss the key features of Section 302 of SOX.

Response: Section 302 requires that corporate management (including the CEO) certify
quarterly and annually their organizations internal controls over financial reporting. The
certifying officers are required to:
a. have designed internal controls, and
b. disclose any material changes in the companys internal controls that have occurred
during the most recent fiscal quarter.
13.

Discuss the key features of Section 404 of SOX.

Response: Section 404 requires the management of public companies to assess the
effectiveness of their organizations internal controls over financial reporting and provide an
annual report addressing the following points:
a. a statement of managements responsibility for establishing and maintaining adequate
internal control,
b. an assessment of the effectiveness of the companys internal controls over financial
reporting,
c. a statement that the organizations external auditors has issued an attestation report on
managements assessment of the companies internal controls,
d. an explicit written conclusion as to the effectiveness of internal control over financial
reporting, and
e. a statement identifying the framework used by management to conduct their assessment
of internal controls.
14. Section 404 requires management to make a statement identifying the control
framework used to conduct its assessment of internal controls. Discuss the options in
selecting a control framework.
Response: The SEC has made specific reference to the Committee of the Sponsoring
Organizations of the Treadway Commission (COSO) as a recommended control framework.
Furthermore, the PCAOBs Auditing Standard No. 5 endorses the use of COSO as the framework
for control assessment. Although other suitable frameworks have been published, according to
Standard No. 5, any framework used should encompass all of COSOs general themes.
15. Explain how general controls impact transaction integrity and the financial reporting
process.
Response: Consider an organization with poor database security controls. In such a
situation, even data processed by systems with adequate built-in application controls may be at
risk. An individual who can circumvent database security may then change, steal, or corrupt
stored transaction data. Thus, general controls are needed to ensure accurate financial reporting.

16. Prior to SOX, external auditors were required to be familiar with the client
organizations internal controls, but not test them. Explain.
Response: Prior to SOX, auditors had the option of not relying on internal controls in the
conduct of an audit and therefore did not need to test them. Instead, auditors could focus
primarily on substantive tests. Under SOX, management is required to make specific assertions
regarding the effectiveness of internal controls. To attest to the validity of these assertions,
auditors are required to test the controls.
17. Does a qualified opinion on managements assessment of internal controls over the
financial reporting system necessitate a qualified opinion on the financial statements?
Explain.
Response: No. Auditors are permitted to simultaneously render a qualified opinion on
managements assessment of internal controls and render an unqualified opinion on the financial
statements. Therefore, it is technically possible for auditors to determine that internal controls
over financial reporting are weak, but conclude through substantive tests that the weaknesses do
not cause the financial statements to be materially misrepresented.
18. The PCAOB Standard No. 5 specifically requires auditors to understand transaction
flows in designing their tests of controls. What steps does this entail?
Response: In order to be in compliance with PCAOB Standard No. 5 auditors must do the
following:
a. select the financial accounts that have material implications for financial reporting,
b. identify the application controls related to those accounts, and
c. identify the general controls that support the application controls.
19.

What fraud detection responsibilities (if any) does SOX impose on auditors?
Response: Standard No. 2 places new responsibility on auditors to detect fraudulent
activity. The standard emphasizes the importance of controls designed to prevent or detect fraud
that could lead to material misstatement of the financial statements. Management is
responsibility for implementing such controls and auditors are expressly required to test them.

Problems
1.
Audit Committee (CMA 6898 3-3)
Micro Dynamics, a developer of database software packages, is a publicly held company whose
stock is traded over the counter. The company recently received an enforcement release
proceeding through an SEC administrative law judge that cited the company for inadequate
internal controls. In response, Micro Dynamics has agreed to establish an internal audit function
and strengthen its audit committee.
A manager of the internal audit department has been hired as a result of the SEC
enforcement action to establish an internal audit function. In addition, the composition of the
audit committee has been changed to include all outside directors. Micro Dynamics has held its
initial planning meeting to discuss the roles of the various participants in the internal control and
financial reporting process. Participants at the meeting included the company president, the chief
financial officer, a member of the audit committee, a partner from Micro Dynamics external
audit firm, and the newly appointed manager of the internal audit department. Comments by the
various meeting participants are presented below.

President: We want to ensure that Micro Dynamics complies with the SECs enforcement
release, and that we dont find ourselves in this position again. The internal audit department
should help to strengthen our internal control system by correcting the problems. I would like
your thoughts on the proper reporting relationship for the manager of the internal audit
department.
CFO: I think the manager of the internal audit department should report to me since much of the
departments work is related to financial issues. The audit committee should have oversight
responsibilities.
Audit committee member: I believe we should think through our roles more carefully. The
Treadway Commission has recommended that the audit committee play a more important role in
the financial reporting process; the duties of todays audit committee have expanded beyond the
rubber-stamp approval. We need to have greater assurance that controls are in place and being
followed.
External audit firm partner: We need a close working relationship among all of our roles.
The internal audit department can play a significant role in monitoring the control systems on a
continuing basis and should have strong ties to your external audit firm.
Internal audit department manager: The internal audit department should be more involved
in operational auditing, but it also should play a significant monitoring role in the financial
reporting area.
Required:
a.
Describe the role of each of the following in the establishment, maintenance, and
evaluation of Micro Dynamics system of internal control.
i. Management
ii. Audit committee
iii. External auditor
iv. Internal audit department
b. Describe the responsibilities that Micro Dynamics audit committee has in the financial
reporting process.
Response:
a.
i. Management has the overall responsibility for protecting company assets and, therefore,
for establishing, maintaining, and evaluating the internal control system.
ii. The audit committees primary responsibility involves assisting the board of directors in
carrying out its responsibilities as they relate to the organizations accounting policies, internal
control, and financial reporting practices. The audit committee assists management and the board
in fulfilling their fiduciary and accountability responsibilities, and it helps maintain a direct line
of communication between the board and the external and internal auditors.
iii. The external auditor reviews the organizations control structure, including the control
environment, accounting systems, and control procedures, in order to assess the control risks for
financial statement assertions. In addition, the external auditor would inform the company of any
material weaknesses found during the review.
iv. The internal audit department performs both operational and financial audits to
determine compliance with established policies and procedures and reports its findings and

recommendations to management or the audit committee for evaluation and corrective action.
The internal audit department may also assist the external auditors with their review of the
internal control system.
b. The responsibilities of the Micro Dynamics audit committee in the financial reporting process
include
Obtaining assurance that the organizations control system is adequate and effective to
identify risk and exposure, and that the financial disclosures made by management
reasonably reflect the financial position, results of operations, and changes in cash flow.
Reviewing the progress of the audit and the final audit findings.
Acting as a liaison between the auditors and the board of directors.
2.
Role of Internal Auditor (CMA 1290 4-Y8)
Leigh Industries has an internal audit department consisting of a director and four staff auditors.
The director of internal audit, Diane Bauer, reports to the corporate controller, who receives
copies of all internal audit reports. In addition, copies of all internal audit reports are sent to the
audit committee of the board of directors and the individual responsible for the area of activity
being audited.
In the past, the companys external auditors have relied on the work of the internal audit
department to a substantial degree. However, in recent months, Bauer has become concerned that
the objectivity of the internal audit function is being affected by the non-audit work being
performed by the department. This possible loss of objectivity could result in more extensive
testing and analysis by the external auditors. The percentage of non-audit work performed by the
internal auditors has steadily increased to about 25 percent of the total hours worked. A sample of
five recent non-audit activities follows.
One of the internal auditors assisted in the preparation of policy statements on internal
control. These statements included such things as policies regarding sensitive payments
and the safeguarding of assets.
Reconciling the bank statements of the corporation each month is a regular assignment of
one of the internal auditors. The corporate controller believes this strengthens the internal
control function because the internal auditor is not involved in either the receipt or the
disbursement of cash.
The internal auditors are asked to review the annual budget each year for relevance and
reasonableness before the budget is approved. At the end of each month, the corporate
controllers staff analyzes the variances from budget and prepares explanations of these
variances. These variances and explanations are then reviewed by the internal audit staff.
One of the internal auditors has been involved in the design, installation, and initial
operation of a new computerized inventory system. The auditor was primarily concerned
with the design and implementation of internal accounting controls and conducted the
evaluation of these controls during the test runs.
The internal auditors are sometimes asked to make the accounting entries for complex
transactions as the employees in the accounting department are not adequately trained to
handle such transactions. The corporate controller believes this gives an added measure
of assurance to the accurate recording of these transactions.
Required:
a.
Define objectivity as it relates to the internal audit function.
b.
For each of the five non-audit activities presented, explain whether the objectivity of
Leigh Industries internal audit department has been materially impaired. Consider each situation
independently.
c.
The director of internal audit reports directly to the corporate controller. Does this reporting

relationship affect the objectivity of the internal audit department? Explain your answer.
d.
Would your evaluation of the five situations in Question b change if the director of internal
audit reported to the audit committee of the board of directors? Explain your answer.
Response:
a.
The internal auditor must have and maintain objectivity, which implies no subordination of
judgment to another and arises from an independent mental attitude that views events on a factual
basis without influence from feelings, prejudice, opinions, or interests.
b.
i. The internal auditors objectivity is not impaired by the preparation of policy statements
on internal control. The preparation of policy statements to guide others in the development and
implementation of internal controls is a responsibility of the internal audit staff.
ii. The internal auditors objectivity is impaired. In order to maintain objectivity, the
auditor should not perform operational assignments that are included as part of the independent
evaluation and verification of a proper system of internal control. Separation of duties must be
maintained.
iii. Objectivity is not impaired in the review of the budget for relevance and reasonableness
if the internal auditor has no responsibility for establishing or implementing the budget. However,
the review of variances and explanations would impair objectivity as this is an area that would
normally be reviewed during an operational audit.
iv. Objectivity is impaired to the extent that the internal auditor has been involved in the
design and installation of internal accounting controls because there will be little confidence in
audit findings issued by the individual who designed and installed the system being audited.
v. The preparation of accounting records will materially impair the internal auditors
objectivity by involving the auditor in day-to-day operations.
c.
i. This reporting relationship adversely affects the objectivity of the internal audit
Department. The corporate controller is responsible for the accounting system and related
operational transactions. The internal audit staff is responsible for the independent and objective
review and examination of the accounting system and related operational transactions.
Independence and objectivity may not exist because the internal audit staff is responsible for
reviewing the work of the corporate controller, the person to whom it reports.
ii. No, the responses for Question b would not be affected by the internal audit staff
reporting to an audit committee rather than the corporate controller. In order to maintain
objectivity, the internal audit staff should refrain from performing non-audit functions such as
management decision-making, design and installation of systems, record keeping, or operational
duties.
3.
Segregation of Function (CMA 1288 3-22)
An effective system of internal control includes the segregation of incompatible functions.
Some of the examples presented represent incompatible duties. Comment on the specific risks
(if any) that are caused by the combination of tasks.
a.
The treasurer has the authority to sign checks but gives the signature block to the assistant
treasurer to run the check-signing machine.
b.
The warehouse clerk, who has the custodial responsibility over inventory in the warehouse,
may authorize disposal of damaged goods.
c.
The sales manager, who works on commission based on gross sales, approves credit and
has the authority to write off uncollectible accounts.
d.
The shop foreman submits time cards and distributes paychecks to employees.
e.
The accounting clerk posts to individual account receivable subsidiary accounts and
performs the reconciliation of the subsidiary ledger and the general ledger control account.
Response:
a.
No risks due to combination of tasks. The treasurer is responsible for having custody of the

assets. The treasurer is not responsible for either authorizing or recording the transaction. By
delegating the task of signing the checks to the assistant treasurer, no violation of the principle of
the separation of functions occurs because the assistant treasurer does not authorize or record
transactions either.
b.
This situation is in violation because the warehouse clerk has custodial responsibility as
well as authorization of transactions. The potential risk is that the clerk may use the authorization
power to record the disposal of stolen goods as damaged goods.
c.
This situation is in violation because the sales manager has the power of credit
authorization as well as accounts receivable record keeping. The potential risk is that the manager
may approve credit to a friends or relatives business and then write off the account as bad.
d.
This situation is in violation because the time clerk has record keeping tasks as well as
asset custody. The potential risk is that the time clerk may neglect to record the termination of an
employee and proceed to keep the paychecks for him/herself.
e.
This situation is in violation because the accounting clerk both records transactions and
verifies the accuracy of the recording. The purpose of reconciliation is to verify that the two sets
of records are equivalent. The risk is that the accounting clerk may conceal errors or cover up
balances that do not equal because of embezzlement of funds.
4.
Segregation of Duties (CMA 1288 3-23)
Explain why each of the following combinations of tasks should, or should not, be separated to
achieve adequate internal control.
a.
Approval of bad debt write-offs and the reconciliation of accounts payable subsidiary
ledger and the general ledger control account.
b.
Distribution of payroll checks to employees and approval of sales returns for credit.
c.
Posting of amounts from both the cash receipts and cash disbursements journals to the
general ledger.
d.
Distribution of payroll checks to employees and recording cash receipts in the journal.
e.
Recording cash receipts in the journal and preparing the bank reconciliation.
Response:
a.
These two tasks do not need to be separated because no conflict exists between writing off
bad debts (asset-accounts receivable) and reconciling accounts payable (liability).
b.
These two tasks do not need to be separated because they are independent of one another.
c.
In neither case does the employee have access to the assets; therefore no danger exists.
d.
These two tasks do not need to be separated because they are independent of one another.
e.
These tasks should be separated. The employee records the transactions and has access to
assets. To allow the employee to verify the accuracy of the records would allow her or him to
cover up any money embezzled by doctoring the bank reconciliation.
5.
Internal Control (CMA Adapted 1289 3-4)
Oakdale, Inc., is a subsidiary of Solomon Publishing and specializes in the publication and
distribution of reference books. Oakdales sales for the past year exceeded $18 million, and the
company employed an average of 65 employees. Solomon periodically sends a member of its
internal audit department to audit the operations of each of its subsidiaries, and
Katherine Ford, Oakdales treasurer, is currently working with Ralph Johnson of Solomons
internal audit staff. Johnson has just completed a review of Oakdales investment cycle and
prepared the following report.
General
Throughout the year, Oakdale has made both short-term and long-term investments in securities;
all securities are registered in the companys name. According to Oakdales bylaws, long-term

investment activity must be approved by its board of directors, while short-term investment
activity may be approved by either the president or the treasurer.
Transactions
Oakdale has a computer link with its broker; thus, all buy and sale orders are transmitted
electronically. Only individuals with authorized passwords may initiate certain types of
transactions. All purchases and sales of short-term securities in the year were made by the
treasurer. In addition, two purchases and one sale of long-term securities were executed by the
treasurer. The long-term security purchases were approved by the Board. The president, having
online authorization access to all transactions, was able to approve a sale of a long- term security.
The president is given access to authorize all transactions engaged in by the firm. Because the
treasurer is listed with the broker as the companys contact, all revenue from these investments is
received by this individual, who then forwards the checks to accounting for processing.
Documentation
Purchase and sales authorizations, along with brokers advices, are maintained in an electronic
file with authorized access by the treasurer. Brokers advice is received verbally on the phone,
and this advice is noted on a broker advice form. This form is filed by the treasurer. The
certificates for all long-term investments are kept in a safe deposit box at the local bank; only the
president of Oakdale has access to this box. An inventory of this box was made, and all
certificates were accounted for. Certificates for short-term investments are kept in a locked metal
box in the accounting office. Other documents such as long-term contracts and legal agreements
are also kept in this box. There are three keys to the box held by the president, treasurer, and the
accounting manager. The accounting managers key is available to all accounting personnel,
should they require documents kept in this box. Certificates of investments may take up to four
weeks to receive after the purchase of the investment. An electronic inventory list is kept
perpetually. The data are keyed in by accounting personnel who receive a buy/sale transaction
sheet from the treasurer. The president, treasurer, and accounting manager all have passwords to
access and update this inventory list. The accounting managers password is know by two of the
accounting supervisors in case the inventory list needs to be updated when the accounting
manager is not available.
Documentation for two of the current short-term investments could not be located in this box; the
accounting manager explained that some of the investments are for such short periods of time that
formal documentation is not always provided by the broker.
Accounting Records
Deposits of checks for interest and dividends earned on investments are recorded by the
accounting department, but these checks could not be traced to the cash receipts journal
maintained by the individual who normally opens, stamps, and logs incoming checks. These
amounts are journalized monthly to an account for investment revenue. Electronic payments for
investment purchases are authorized by the treasurer. If the amount is in excess of
$15,000, an authorization code given by the treasurer or president is necessary.
Each month, the accounting manager and the treasurer prepare the journal entries required
to adjust the short-term investment account. There was insufficient backup documentation
attached to the journal entries reviewed to trace all transactions; however, the balance in the
account at the end of last month closely approximates the amount shown on the statement
received from the broker. The amount in the long-term investment account is correct, and the
transactions can be clearly traced through the documentation attached to the journal entries. No
attempts are made to adjust either account to the lower of aggregate cost or market.
Required:
To achieve Solomon Publishings objective of sound internal control, the company believes the
following four controls are basic for an effective system of accounting control.

Authorization of transactions
Complete and accurate record keeping
Physical control
Internal verification

a.
Describe the purpose of each of the four controls listed above.
b.
Identify an area in Oakdales investment procedures that violates each of the four controls
listed above.
c.
For each of the violations identified, describe how Oakdale can correct it.
Response:
a.
The purpose of each of the four controls follows.
Authorization of transactions is required to adequately safeguard assets against fraud and
illegal transactions and provide a level of internal control. A formal system of transaction
authorizations allows the commitment of company resources in accordance with
management goals and objectives. Transactions must be executed according to the terms
of their general or specific authorizations, by responsible personnel acting within the
scope of their prescribed authority and responsibility.
Complete and accurate record keeping is necessary to assure that prompt, timely, and
accurate recording of transactions or economic events occurs. Companies must make and
keep books, records, and accounts that, in reasonable detail, accurately reflect the
transactions and dispositions of assets. Furthermore, the recording of transactions is
necessary to permit preparation of financial statements in conformity with GAAP.
Physical controls relate to safeguarding assets, documents, and records to prevent their
loss, destruction, or alteration.
Internal verification refers to the independent review of the accuracy and propriety of
another partys work, and the testing of the recorded accountability for assets as
compared to existing assets at reasonable time intervals.
b. and c.
Violation
The sale of long-term securities based on the
presidents approval when the board of
directors approval is required violates
authorization procedures.
All diffidence and interest checks are received
by the treasurer and forwarded to the
accounting department; no entry is made in the
cash receipts book. It is, therefore, not possible
to determine if all interest and dividend checks
have been received and deposited.

The balance in the accounts as of the end of the

month closely approximated the amounts
shown on the brokers statements.

Proposed Correction
Implement formalized procedures (in addition
to the companys bylaws) reinforcing the
policy that only the board of directors can
authorize long-term security purchases, and
sales.
All checks should be forwarded to the group
that normally opens, stamps and logs incoming
checks, and the checks should be recorded in
the cash receipts book at the time of receipt.
The interest and dividend checks (entries)
should be reconciled by the accounting
department to the monthly brokers statements.
These statements should be kept on file to
assure that all checks have been received,
deposited, and accounted for.
The accounting department must undertake the
reconciliation of the differences and implement
appropriate procedures to assure that the

The treasurer has the authority to buy and sell

securities, receives revenue, and makes journal
entries related to securities.
Access to short-term securities is unrestricted
in the accounting department.

accounts and the brokerage statements are

reconciles monthly.
Strengthen internal control so that the treasurer
does not have conflicting duties.
The short-term securities should be placed in a
restricted facility such as a bank safe deposit
box or a company safe.
Access to short-term securities should be
limited to a few responsible personnel and two
people should be present each time the
securities are accessed. Additionally, a logbook should be maintained to record any
disposition of securities.

6.
Internal Control (CMA 1290 4-2)
Arlington Industries manufactures and sells component engine parts for large industrial
equipment. The company employs over 1,000 workers for three shifts, and most employees work
overtime when necessary. Arlington has had major growth in its production and has purchased a
mainframe computer to handle order processing, inventory management, production planning,
distribution operations, and accounting applications. Michael Cromley, president of Arlington,
suspects that there may be internal control weaknesses due to the quick implementation of the
computer system. Cromley recently hired Kathleen Luddy as the internal control accountant.
Cromley asked Luddy to review the payroll processing system first. Luddy has reviewed
the payroll process, interviewed the individuals involved, and compiled the flowchart shown on
page 38 in the text. The following additional information concerns payroll processing.
The personnel department determines the wage rate of all employees at Arlington.
Personnel starts the process by sending an authorization form for adding an employee to
the payroll to Marjorie Adams, the payroll coordinator. After Adams inputs this
information into the system, the computer automatically determines the overtime and
shift differential rates for the individual, updating the payroll master files.
Arlington uses an external service to provide monthly payroll tax updates. The company
receives a magnetic tape every month, which the data processing department installs to
update the payroll master file for tax calculations.
Employees at Arlington use a time clock to record the hours worked. Every Monday
morning, Adams collects the previous weeks time cards and begins the computerized
processing of payroll information to produce paychecks the following Friday. Adams
reviews the time cards to ensure that the hours worked are correctly totaled; the system
will determine whether overtime has been worked or a shift differential is required.
All the other processes displayed on the flowchart are performed by Adams. The system
automatically assigns a sequential number to each payroll check produced. The checks
are stored in a box next to the computer printer to provide immediate access. After the
checks are printed, Adams uses an automatic check-signing machine to sign the checks
with an authorized signature plate that Adams keeps locked in a safe.
After the check processing is completed, Adams distributes the checks to the employees,
leaving the checks for the second- and third-shift employees with the appropriate shift
supervisor. Adams then notifies the data processing department that she is finished with
her weekly processing, and data processing makes a backup of the payroll master file to
magnetic tape for storage on the tape shelves in the computer room.

Required:
By referring to the information in Problem 6 and the flowchart, identify and describe:
a.
Five different areas in Arlingtons payroll processing system where the system controls are
inadequate.
b.
Two different areas in Arlingtons payroll processing system where the system controls are
satisfactory.
Response:
a.
Five different areas in Arlington Industries payroll processing system where the system
controls are inadequate are
The payroll processing system violates the principle of segregation of duties. The same
individual verifies the time cards, inputs payroll information into the master file, prints
the checks, machine-signs the checks, distributes the checks, and prepares the payroll
journal entry, which may lead to corruption.
There is no authorization of employees time cards by a supervisor or other objective party,
such as a timekeeper.
The payroll checks are not pre-numbered nor are they properly stored. As a result, there is
no audit trail to verify check usage.
There is no control over the machine-signing of checksno control of the signature plate
by a second party or use of a log to record activity.
The data processing department appears to have full access to the payroll files and checks,
which could lead to sensitive payroll information being leaked.
b.
Two different areas in Arlington Industries payroll processing system where the system
controls are satisfactory are
The personnel department determines the wage rate and initiates the setup of payroll
records, which is a good example of segregation of duties.
A backup of the master file is made after each weekly processing of the payroll.
7. Evaluation of Controls
Gaurav Mirchandaniis is the warehouse manager for a large office supply wholesaler.
Mirchandaniis receives two copies of the customer sales order from the sales department. He
elects the goods from the shelves and sends them and one copy of the sales order to the shipping
department. He then files the second copy in a temporary file. Mirchandaniis retrieves the sales
orders from the temporary file and updates the inventory subsidiary ledger from a terminal in his
office. At that time, he identifies items that have fallen to low levels, selects a supplier, and
prepares three copies of a purchase order. Once copy is sent to the supplier, one is sent to the
accounts payable clerk, and one is files in the warehouse. When the goods arrive from the
supplier, Mirchandaniis reviews the attached packing slip, counts and inspects the goods, places
them on the shelves, and updates the inventory ledger to reflect the receipt. He then prepares a
receiving report and sends it to the accounts payable department.
Required:
a.
Prepare a systems flowchart of the procedures previously described.
b.
Identify any control problems in the system.
c.
What sorts of fraud are possible in this system?

Responses:
a.

b.

The following segregation of functions problems exist:

1. Mirchandaniis is the warehouse manager (asset custody) and is responsible for updating
the inventory subsidiary ledger (record keeping).
2. Mirchandaniis determines what should be ordered (authorization) and the places the
order (transaction processing).

c.

The following frauds could result from these control weaknesses:

i. Kickback fraudSince Mirchandaniis selects the supplier and also places the order, he
could order inventory that is not needed or that is above market price from a supplier with whom
he has a personal fraudulent arrangement. In exchange, the supplier pays a kickback to the
warehouse manager.
ii. Vendor fraudMirchandaniis authorizes, orders, and receives the goods; he could
establish himself as a vendor and process fraudulent transactions.
iii. Theft of inventoryMirchandaniis can simply remove the assets from the warehouse,
sell them, and adjust the inventory records. A reconciliation between the physical inventory on
hand and the records would indicate no discrepancies.
8. Evaluation of Controls
Matt Demko is the loading dock supervisor for a dry cement packaging company. His work crew
is composed of unskilled workers who load large transport trucks with bags of cement, gravel,
and sand. The work is hard, and the employee turnover rate is high. Employees record their
attendance on separate time cards. Demko authorizes payroll payments each week by signing the
time cards and submitting them to the payroll department. Payroll then prepares the paychecks
and gives them to Demko, who distributes them to his work crew.
Required:
a.
Prepare a systems flowchart of the procedures described here.
b.
Identify any control problems in the system.
c.
What sorts of fraud are possible in the system?

a.

b.

The following segregation of functions problem exists:

Demko authorizes the transaction (signs and submits timecards) and has asset custody (he
distributes the checks to employees).
c.

The following frauds could result from these control weaknesses:

i. Kickback fraudDemko permits employees to inflate the hours worked and approves
payment. The employee then splits the excess pay with the supervisor as a kickback.
ii. Nonexistent employee fraudAfter an employee leaves the company, the supervisor
continues to submit timecard for him. When the paychecks are distributed to Demko, he keeps the
ones for the terminated employees and cashes them by forging their names.

PROJECTS
1. Visit a Web site for one of the audit professional organizations. Find the answers to the
following questions:
a. What relevant certification(s) is (are) supported by the organization? What is the cost to take
the certification exam?
b. What requirements does the organization have for continuing education requirements?
c. How does the organization support IT auditors? Be specific.
d. What publications are provided by the organization? How does the publication relate to
IT audits?
e. What services are provided by the organization to its members?
f. Where is the closest chapter?
g. Does a student membership program exist for the organization? If so, what is the cost for
student members?
Response:
Certifications
ContEd
Support IT
Publications
Service
Closest Chapter
Students

AICPA
CPA, CITP
40 hr: 8 = A&A/
year
CITP, IT section,
SAS, seminars,
training
Newsletter, JoA
Cont. Educ.,
seminars, local
chapters
<Depends>
Yes: $30

ISACA
CISA
Avg. 40 hr/year

IIA
CIA
Avg. 40 hr/ year

ACFE
CFE
Avg. 20 hr/ year

Cobit, tools,
books, seminars,
training
ISC Journal,
Blobal
Communiqu
Cont. Educ.,
seminars, local
chapters
<Depends>
Yes: $25

eSAC, tools,
books, seminars,
training
Internal Auditor

Tools, books,
seminars, training

Cont. Educ.,
seminars, local
chapters
<Depends>
Yes: $30

Newsletter, White
papers, Annual
report
Cont. Educ.,
seminars, local
chapters
<Depends>
Yes: $25

2.
Financial frauds such as Enron, WorldCom, and Adelphia led to the passage of the
Sarbanes-Oxley Act 2002. Using the Internet, find answers to the following questions about
changes being made regarding audit committees in SOX:
a.
Describe a requirement for audit committees in SOX.
b.
Describe a requirement for internal controls in SOX.
c.
How do these changes affect IT auditors?
d.
How do these changes affect internal auditors?
e.
How do these changes affect financial auditors?
Response:
a.
i. Financial expertise by at least one member of audit committee.
ii. Members must be outsiders (independence factor).
iii. Audit committee hires external auditors and sets audit fees.
iv. Responsible for whistle-blowing system, tips, and complaints system
b.

i. Report by management on internal controls annually.

ii. Disclosure on material weaknesses in internal controls.

c.
i. IT auditors will probably be involved in evaluating the internal controls for
managements annual report.
ii. IT auditors may interact more with audit committee on significant errors, frauds, or other
matters.
d.
i. Internal auditors will most likely be the first choice of management to provide the annual
report. It will probably need to be done well before the end of the fiscal year in order to allow
time for the organization to respond to any material weaknesses found in the evaluation, thus
giving the organization time to correct the weakness and NOT have to disclose it.
ii. Internal auditors will probably interact more with the audit committee, especially =on
significant errors, all frauds, tips and complaints, and whistle-blower reports.
e.

i. Financial auditors will be hired by the audit committee in the future.

ii. Financial auditors will have their audit fees set by the audit committee and not
management.
iii. Financial auditors will not be able to provide certain services and the audit/assurance.
iv. Financial auditors will be expected to interact with the Audit Committee when
disagreements occur between external auditors and management regarding the application of
GAAP.
v. In some cases, public accounting firms may be hired to provide the annual evaluation of
internal controls.