ABC Retailers Inc. (ABC or the Company) is a U.S. public company that files quarterly and annual reports with the Securities and Exchange Commission (SEC) with a fiscal year end of August 31, 20X8. ABC is a leading retail chain operating more than 100 department stores across the continental United States. ABC department stores offer customers a variety of nationally advertised products, including clothing, shoes, jewelry, and other accessories. The Companys supply chain of products is managed through a single warehouse and distribution facility located in Kansas City, Missouri. ABC has a centralized accounting and finance structure at its corporate headquarters, where all processes and controls related to all significant account balances occur. ABC recognizes revenues from retail sales at the point of sale to its customers. Discounts provided to customers by the Company at the point of sale, including discounts provided in connection with loyalty cards, are recognized as a reduction in sales as the products are sold. Cost of goods sold for the Company primarily consist of inbound freight and costs relating to purchasing and receiving, inspection, depreciation, warehousing, internal transfer, and other costs of distribution. Case Facts Audit Issue On June 1, 20X8, the Accounts Payable (AP) Manager received an e-mail inquiry about the process required for a vendor to change its bank account information. The e-mail was sent from John Smith at a domain address listed as Watch-Makers. Watch Makers is a manufacturer that supplies ABC-branded watches to ABCs west region department stores. In addition, John Smith is the primary contact at Watch Makers with whom the Company typically interacts. The AP Manager responded to the e-mail request on June 15, 20X8, with the procedures required of the vendor, which include completing a vendor bank account request form. On June 20, 20X8, the AP Manager received a reply e-mail from John Smith at WatchMakers with a completed vendor bank account request form, which included John Smiths signature, new bank account information, and other related information. Upon receiving the vendor bank account request form, the AP Manager completed a separately required Vendor Change Form for internal processing. The Vendor Change Form is completed for new vendors or changes to existing vendors information, including bank account information. The AP Manager sent the completed Vendor Change Form to ABCs Assistant Controller, who reviewed and approved the request on June 24, 20X8. The bank account information was updated within the Vendor Master File on June 26, 20X8. Throughout the month of July 20X8, valid Watch Makers invoices were processed through the Companys accounts payable process, and the valid invoices were paid in accordance with the Companys process and controls for cash disbursements and wire Case 17-10: ABC Retailers Internal Controls Page 2 Copyright 2020 Deloitte Development LLC All Rights Reserved. transfers. On August 2, 20X8, the Company received an inquiry from Watch Makers about the expected timing of the $2 million in outstanding invoices. As a result of the direct interaction with Watch Makers employee John Smith, the Company determined that the previous vendor bank account change form was received from a fraudulent domain name with the intent to defraud the Company. The e-mail domain for Watch Makers is Watch Makers, with no hyphen, rather than Watch-Makers, with a hyphen. Both e-mails received from Watch-Makers were determined to be from a fraudulent source (that also fraudulently used John Smiths name in the e-mail). Because the bank account information for Watch Makers was changed (as a result of the June 1, 20X8, email request) approximately $2 million in payments was wired to an incorrect bank account. As noted above, there are two employees within the Company that were involved in processing and approving the Vendor Change Form. The Companys policy on bank account change requests was put into effect and communicated by ABCs Assistant Controller in a September 1, 20X7 e-mail that indicated that for each Vendor Change Form requesting a vendor bank account change, the accounts payable department was required to (1) obtain a previously processed and paid invoice from the vendor requesting the bank account change, (2) call the vendor using the contact information obtained from the prior invoice, (3) verify the authenticity of the requested bank account change request by directly contacting the vendor, and (4) include all relevant information obtained in steps (1) through (3) as an attachment to the Vendor Change Form. The Companys control description relating to the review of a Vendor Change Form by the Assistant Controller is not explicit regarding the specific attributes of the review. However, because the policy was distributed by the Assistant Controller and the Assistant Controller is also the control owner (e.g., performs the review), there is a presumption that the Assistant Controller would understand that as part of her review, she should evaluate whether the AP Manager obtained sufficient information to confirm the authenticity of the bank account change request.

Would the deficiency warrant disclosure in the Companys Form 10-K, Item 9A? If so, what information would the Company be expected to disclose?

What implications does the deficiency have on other direct or indirect controls?