CASE 1: INTERNAL CONTROL

------------------------------------------------------------------------------------------------------------------------------------------

Richoco Company's procedures related to the sales and cash receipts functions as presented below:

SALES

Richoco Company is a small wholesaler of plumbing supplies and sells its products to retail stores and construction contractors. Richoco does not accept orders on-line. All customer orders are received through the mail.

Three individuals within the company are involved with billing customers and processing cash receipts: Sam Smith, a front-office administrative assistant; Doctor Jones, an accounts receivable clerk; and Chris Matthews, the treasurer. The duties completed by these employees are listed below. This a complete list of the duties performed related to billing and cash receipts:

Sam Smith is responsible for opening any incoming mail. Any purchase orders received in the mail from customers are sent by Smith to Doctor Jones. Usually, the company receives about 16-18 purchase orders each day.

When Doctor Jones receives the purchases orders from Smith, Jones immediately prepares a sale invoice form (a paper document) that has five copies that the company labels as copies A, B, C, D & E. Jones distributes the copies of the invoice as follows:

Copy A is the copy that will be sent to the customer (to bill the customer) after the goods are shipped. Jones waits until the notice of shipment has been received from the shipping department before sending copy A to the customer.

Copy B is the copy used by the accounts receivable clerk, Jones, to update the accounting records. This copy stays in the accounts receivable department.

Copies C and D are both sent to the shipping department

Copy E is sent to the warehouse as authority to retrieve items from the shelves and send them to the shipping department.

The warehouse personnel retrieve the items ordered from the warehouse shelves using copy E of the sales invoice and take them to the shipping department. If merchandise is not available, no 'backorder' is processed. Instead, Richoco Company expects the customer to place another order when they realize that not all merchandise ordered was included in the shipment.

A three-part bill of lading (BOL) is prepared by the shipping department. One copy is retained by the shipping department; one copy is given to the truck driver picking up the goods; and one copy is sent to the customer. The shipping department prepares the BOL based upon the items received from the warehouse.

The shipping department packages the items in appropriate boxes or containers. Copy D of the sales invoice is included with the shipment (in the box) and serves as the packing slip for the shipment.

The goods are picked up by the trucking company. The truck driver is given one copy of the BOL. The company's copy of the BOL is filed numerically in the shipping department.

After shipment has occurred, the shipping department sends the customer's copy of the BOL and Copy C of the sales invoice to Doctor Jones in the Accounts Receivable Department.

When Jones receives the customer copy of the BOL and Copy C of the sales invoice from the shipping department, Jones completes copies A and B of the sales invoice. Jones numbers the invoice, inserts the quantities shipped, unit prices and discounts, and calculates the extensions and the total invoice amount. Jones staples copies B and C of the sales invoice together.

Copy B of the sales invoice is used by Jones to enter the sales transaction in to the computer system. Jones enters the quantities, prices, discounts and general ledger accounts. The computer computers the extensions and total amount. Jones compares the extensions and invoice total to Copy A of the invoice.

Doctor Jones mails the customer's copy of the BOL and Copy A of the sales invoice to the customer.

Jones staples copies B and C of the invoice together, and files these in numerical order in the sales invoice file.

CASH RECEIPTS

Sam Smith is responsible for opening the mail each day. (Cash is not received in the mail; only checks.) Smith separates the checks received from customers, along with any remittance advices and customer correspondence, from the other mail. The checks and related documentation are given to Doctor Jones in accounts receivable.

Jones examines each check and related documentation received from the customer to determine if enough information is available to record the transaction in the computerized accounting system.

Jones restrictively endorses the checks ("For Deposit only to the account of Richoco Company" is stamped on the back of each check.) The checks are given to Chris Matthews, the treasurer. Matthews prepares the bank deposit and takes the deposit to the bank on a daily basis.

Using the customer's remittance advices and other correspondence, Jones enters the cash receipts transactions into the computerized accounting system.

If a customer took deductions when making payment (e.g. advertising allowances, freight, etc), Doctor

Jones must follow-up with the customer to determine if the deductions were legitimate. If deductions taken by the customer were viewed by Jones to be legitimate, Jones prepares the appropriate credit memo and records it in the computer system. Any deductions which Jones does not believe were legitimate (and therefore, not settled by the use of a credit memo) are turned over to the sales manager to follow-up on and settle.

At the end of each month, Jones prints an aged accounts receivable trial balance. Jones reconciles the total of the trial balance to the accounts receivable control account in the general ledger.

SPECIFIC REQUIREMENT:

CASE 1:

1. Document understanding of the internal control using a NARRATIVE FORMAT.
2. Evaluate internal control.
3. Follow the suggested internal control questionnaire (ICQ).
4. Identify the internal control deficiencies, if any.
5. Based on your observation, what is the assessment level of Control Risk (CR)?
6. Propose recommendation to improve internal control deficiencies.

CASE 2: INTERNAL CONTROL CONFLICT

------------------------------------------------------------------------------------------------------------------------------------------

DEF Company is a large automotive dealer company operating in the field of automobile retailing that is owned by a big Holding Group Company XYZ. DEF Company buys cars from distributors of well-known brands and sells them to customers as the authorized dealer. DEF Company also provides after-sales service, spare parts and second-hand services for many automobile brands. The company has 7 branches throughout the Country. The company prioritizes customer satisfaction, and relies on its years of expertise.

DEF Company employs around 380 people and has an annual turnover of about P100million.

The Company doesn't have an Internal Audit department. But the Group Holding Company XYZ (total employee of 2000 people with consolidated annual turnover of P4 billion) has an internal audit department (4 qualified internal auditors working for the department) that audits 17 group companies based on their risk-based audit planning for their audit assignments.

DEF Company has an Audit Committee.

Incident / Case:

Auto Parts Department's Stock Planner (will be referred to as Stock Planner throughout this document) whose main duty is to plan the procurement of auto parts and to place purchase orders based on approved plan) was accused of stealing expensive parts and selling them personally in the street market. This came to management's attention through informal internal whistleblowing (one employee said that a friend of his saw the Stock Planner doing something not right).

The Management informed the Audit Committee. The Audit Committee asked the Group Internal Audit (will be referred to as Internal Audit throughout this document) to evaluate the whistleblowing information.

At the start of their investigation, Internal Audit deactivated all system access rights of the Stock Planner and asked Company management to send him on annual leave. Internal Audit interrogated the Stock Planner several times outside the company premises and investigated all his previous years' dealings looking for all possible ways for him to cheat.

Internal Audit findings noted that this person was involved in several different fraudulent activities at the same time.

It also became quite apparent that there were serious weaknesses in the Company's Internal Control System, grouped under the following three headings: (1) unapplied operational process controls;(2) ineffective financial controls; and(3) deactivated system controls.

As soon as the internal audit work was finalized the results were reported to the DEF Management, DEF Audit Committee and Group Holding Company XYZ (who is a shareholder of the DEF Company appointing some board directors).

The main findings related to the Stock Planner's fraudulent activities are as reported in the internal auditors' report:

------------------------------------------------------------------------------------------------------------------------------------------

INTERNAL AUDIT REPORT

Summary Report on Auto Parts Fraud Company DEF

PART I: FINANCIAL IMPACT OF THE FRAUD (I) AMOUNT THAT COULD BE CALCULATED UNTIL NOW:

1. Parts taken out of the inventory and the related amount were invoiced without the knowledge of the customers, receivable sitting as open item in the system: P50,801

2. Amount that was invoiced, signed with a fake stamp and collected from the customer in cash that was not posted in company accounts: P14,146

3. Parts taken out of the inventory on the basis of open job orders but not physically present anywhere in the warehouse: P36,396 (at cost)

4. Parts that were reserved in the system in the name of a customer but physically not present anywhere in the warehouse: P30,814 (at cost)

5. Amount that was borrowed from the company but not paid back: P6,500

6. Product code modifications made over 4 years (changing product codes of expensive auto parts stolen from the warehouse to paint product codes, an uncountable (liquid) product category) P408,537*

7. Some auto parts taken out of the warehouse with unauthorized/unapproved job orders P55,934

TOTAL CALCULATED AMOUNT: P603,128

* Examples for parts whose product codes were changed to paint are as follows: expensive accessories sold at the Boutique (P22,200), steel tire rim (P24,050), tyres (P11,100), injector (P6,660), Screen & Mirrors (P18,500), headlamps (P6,013), hydraulic suspension & compressor (P8,048), arm-rest tool (P4,625), indicator panel (P4,255), refrigerator (P2,775), cabrio-type car ceiling (P5,365)

------------------------------------------------------------------------------------------------------------------------------------------

PART II: DEFICIENCIES NOTED

(I) UNAPPLIED OPERATIONAL PROCESS CONTROLS:

Other Service managers confirmed that physical access to the Parts Warehouse is not restricted and that even the workshop employee could enter to the warehouse without any control.

Periodic stock counts are not performed on a regular basis.

Open job orders are not reviewed by appropriate manager on a periodic basis.

Discounts given on parts are not reviewed by appropriate manager on a periodic basis.

Material movement vouchers are not reviewed by appropriate manager on a periodic basis.

Exception reports such as overrides/changes to master data like product code changes are not reviewed by appropriate manager on a periodic basis.

Aftersales department has worked with unapproved customers on an open account basis instead of cash basis.

Aftersales insurance receivables are not followed up for collection on a timely basis by the respective operations manager.

------------------------------------------------------------------------------------------------------------------------------------------

(II) INEFFECTIVE FINANCIAL CONTROLS:

Periodic customer reconciliations are not performed.

Nobody from Finance participates in the stock-counts

Open account follow-up is not performed effectively and on time. Problematic situations are not escalated to the management.

-----------------------------------------------------------------------------------------------------------------------------------------

(III) DEACTIVATION OF SOME SYSTEM CONTROLS:

Service employee who is authorized to issue invoices has access to make changes in customer master data (including creating a new customer). The system allows changes to master data even if there has been a transaction posted over this customer.

During invoicing, changes/overrides can be made to default customer group discounts field and customer information flowing from the master data and log reports are not created to review such overrides.

CASE 2:

1. As an external auditor, will you consider assessing the control risk at a high level?
2. Is the reliance on the work of internal auditor enough to support your assessment in number 1?
3. What are the possible conflict and its impact to the internal control?
4. What would you recommend the management about this conflict?
5. Propose a program / policy to address the issues