Case 2: Geiszler Fencing Inc.
Geiszler Fencing Inc. (Geiszler Fencing or the Company) is a public company in the United States. It is required to file quarterly and annual reports with the SEC. Geiszel Fencing has six manufacturing facilities located in Missouri and produces and provides chain-link fencing to customers throughout the Midwest (Wisconsin, Indiana, Michigan, Ohio, Illinois, and Iowa) via rail car.
Geiszler Fencing sells fencing to customers using free on board (FOB) shipping point terms. Therefore, revenue is recorded when goods leave the respective warehouse. Geiszler Fencing currently uses a sophisticated warehouse management system (the Warehouse F-Series System), which allows the Company to (1) record sales upon shipment of goods out of the warehouse, (2) automatically price fence sales on the basis of standard pricing tables, and (3) generate multiple reports for the evaluation of Geiszler Fencings operations.
Engagement Team Note:
Materiality was determined to be $4 million. At year-end, the engagement team evaluated the internal controls related to revenue. The team used inquiry of appropriate personnel and consideration of the results of other audit procedures including: (1) updating the risk assessment procedures (including the understanding of internal control) and substantive procedures, (2) considering the result of the entitys monitoring of controls (or our testing of the entitys monitoring of controls), and (3) obtaining an update on the status of the entitys remediation of any significant deficiency or material weakness identified as of the interim date.
As a result, the engagement team arrived at the conclusion that there have been no significant changes to controls in the period after their interim testing. Furthermore, the engagement team has determined that they will not be using the work of others for testing the operating effectiveness of controls related to revenue.
The engagement team identified three risks of material misstatement relating to the recording of sales. For each risk identified, the team documented in the working papers (see Geiszler Inc. Working Papers 6-1, 6-2 and 6-3) the control activity that addresses the risk of misstatement, the evaluation of the design of that control activity, and the planned testing of operating effectiveness.
Geiszler Fencing Requirements:
1. What are the key considerations when evaluating the design and testing of the operating effectiveness of internal controls in conjunction with a financial statement audit? Include considerations in determining what additional audit evidence to obtain about controls that were operating during the rollforward period.
2. For each of the three revenue risks identified by the engagement team in working papers 6-1, 6-2 and 6-3, address the following:
a. Was the engagement teams assessment of the evaluation of the design of the controls appropriate (i.e., does the control identified by the team address the specific what could go wrong for each risk)?
b. Were the teams interim and rollforward planned procedures to test the operating effectiveness of controls appropriate?
Working paper 6-1 Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of misstatement ("what could go wrong") All orders shipped are not recorded as revenue. Relevant assertion Completeness. Significant risk? No. Risk of material misstatement because of fraud? No. Control #1: Sales are automatically recorded and invoices are automatically generated upon the release of the order in the Warehouse K-Series System. Orders are not released until the goods have been Control activity that addresses risk of misstatement confirmed for shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). Does the control rely on information produced by the entity (or IPE)? No. If yes, list relevant information Will we obtain audit evidence of the accuracy and completeness of N/A information produced by the entity by testing controls or by performing procedures directly on the information? Is the control automated? Yes. Relevant application system (if we are testing information produced Warehouse F System, which is subject to IT controls performed by management and tested within the IT controls workpaper. by the entity through tests of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement:1. The control is the automation of the invoicing of goods shipped as the system will automatically record revenues when goods are shipped from the warehouse (revenue generating activity), thus resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion.2. Automated control Tests of controls: evaluation of design prevents errors from occurring as opposed to identifying them once they have occurred (preventive control).3. Control operates at the transaction level and, as such, is sufficiently precise to mitigate the risk.4. Control is performed on a continual basis and thus addresses the risk directly and for the period under audit.5. There are no historical issues with operation of the control and the control has not been modified in the period under audit. Interim Procedures (test as of 9/30): 1. Contact the Director of Customer Service and obtain detailed explanation of how control operates.2. View samples of the shipping request.3. Verify that understanding through testing of general IT controls; i.e., program change controls that there have been Tests of controls: planned operating effectiveness testing no changes to the control since the previous year. Rollforward Procedures: 1. Make inquiries of the controller and the IT manger to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted, retest control. Significant risk? Yes. Risk of material misstatement because of fraud? Yes. Control #2: The "Orders Shipped & Invoiced Report" is reviewed by the warehouse director on a daily Control activity that addresses risk of misstatement basis for unusual items and reasonableness; evidenced by the warehouse director's initials on the report, which is maintained. Does the control rely on information produced by the entity (or IPE)? Yes - The "Orders Shipped & Invoiced Report," which details orders that were shipped and invoiced for If yes, list relevant information a given day. The report is automatically generated by the Warehouse F system. Because the operating effectiveness of the control is dependent upon the accuracy and completeness of Will we obtain audit evidence of the accuracy and completeness of the IPE, we will test the controls around accuracy and completness. As the IPE is a system generated information produced by the entity by testing controls or by report, refer to our testing of the company's IT general contols. In addition, we will test the controls performing procedures directly on the information? around report logic as well as the internal controls around the source data. Is the control automated? No. Warehouse F System, which is subject to IT controls and tested within the IT controls workpaper. Relevant application system (if we are testing information produced by the entity through tests of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The warehouse director has been with the company for over 10 years and has been acting in this current role for the last five. The warehouse director is in charge of overseeing operations at all five warehouses and directly supervises the warehouse managers. The director is knowledgeable of the business and focuses reviews on activity that seems unusual given the customer and quantities purchased. The review is directed to the identification of unusual trends and thus appropriately addresses the related risk of material misstatement and assertion. 2. Control is Tests of controls: evaluation of design performed on a daily basis. 3. Control identifies exceptions after they have occurred (i.e., its a detective control), yet given the frequency of performance, it would identify errors in a timely manner. 4. Although the control entails the review of daily revenue activity, it is done on a transaction by transaction basis, and as such it is sufficiently precise to mitigate the risk. 5. Control involves the judgment of the warehouse director since there is no specific threshold set. However, since all transactions are evaluated and Geiszler Fencing has a cyclical business, the report results are predictable. In addition, the warehouse director has been employed by the company for 10 years. Tests of controls: planned operating effectiveness testing Interim Procedures (test as of 9/30): 1. Discuss the performance of the control procedure with the warehouse director. 2. Select 15 days out of the year. 3. Obtain the "Orders Shipped & Invoiced Report" reviewed by the warehouse director. 4. Determine whether the reports were signed off by the warehouse director and dated on the day following the report date. Rollforward Procedures: 1. Make inquiries of management and the process owner of the control activity to determine if any events that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) have been identified after our interim testing date. Is the control automated? No. Relevant application system (if we are testing information produced b No. On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement:1. Control appropriately addresses the related risk of material misstatement and assertion since any unexpected variances would be detected by the controller's analysis of budget to actual.2. The control is detective and therefore identifies exceptions after they have occurred, yet given that the control is performed on a monthly basis, it would detect errors in time Tests of controls: evaluation of design to prevent material misstatement of the financial statements.3. The control is sufficiently precise to detect a material misstatement in the revenue account (which is based on $5 million materiality threshold).4. Management has defined quantitative thresholds for investigating variances.5. The company's financial results have historically been consistent with budget. There are no significant changes planned in the current year to the company's business nor are there any external factors related to the industry, regulatory environment, or economy that would be expected to impact the company's current year financial results. Interim Procedures: Inquiry: 1. Inquire of the controller and assistant controller of the following: a. Explanation of the steps involved in performing the control. b. Reports and other information used, including how such information is used and from where it is obtained. c. Procedures performed when an exception or misstatement is identified. d. Procedures performed when the individual is absent. e. Tests of controls: planned operating effectiveness testing Procedures performed with respect to unusual transactions. f. Changes to controls during the period, including changes in personnel who perform them. Inspection: 2. Obtain the meeting minutes for two months and determine if the monthly package was appropriately discussed. Rollforward Procedures: 1. Select a month from Q4 and perform the above procedures consistent with interim. Working paper 6-1 Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of misstatement ("what could go wrong") All orders shipped are not recorded as revenue. Relevant assertion Completeness. Significant risk? No. Risk of material misstatement because of fraud? No. Control #1: Sales are automatically recorded and invoices are automatically generated upon the release of the order in the Warehouse K-Series System. Orders are not released until the goods have been Control activity that addresses risk of misstatement confirmed for shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). Does the control rely on information produced by the entity (or IPE)? No. If yes, list relevant information Will we obtain audit evidence of the accuracy and completeness of N/A information produced by the entity by testing controls or by performing procedures directly on the information? Is the control automated? Yes. Relevant application system (if we are testing information produced Warehouse F System, which is subject to IT controls performed by management and tested within the IT controls workpaper. by the entity through tests of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement:1. The control is the automation of the invoicing of goods shipped as the system will automatically record revenues when goods are shipped from the warehouse (revenue generating activity), thus resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion.2. Automated control Tests of controls: evaluation of design prevents errors from occurring as opposed to identifying them once they have occurred (preventive control).3. Control operates at the transaction level and, as such, is sufficiently precise to mitigate the risk.4. Control is performed on a continual basis and thus addresses the risk directly and for the period under audit.5. There are no historical issues with operation of the control and the control has not been modified in the period under audit. Interim Procedures (test as of 9/30): 1. Contact the Director of Customer Service and obtain detailed explanation of how control operates.2. View samples of the shipping request.3. Verify that understanding through testing of general IT controls; i.e., program change controls that there have been Tests of controls: planned operating effectiveness testing no changes to the control since the previous year. Rollforward Procedures: 1. Make inquiries of the controller and the IT manger to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted, retest control. Significant risk? Yes. Risk of material misstatement because of fraud? Yes. Control #2: The "Orders Shipped & Invoiced Report" is reviewed by the warehouse director on a daily Control activity that addresses risk of misstatement basis for unusual items and reasonableness; evidenced by the warehouse director's initials on the report, which is maintained. Does the control rely on information produced by the entity (or IPE)? Yes - The "Orders Shipped & Invoiced Report," which details orders that were shipped and invoiced for If yes, list relevant information a given day. The report is automatically generated by the Warehouse F system. Because the operating effectiveness of the control is dependent upon the accuracy and completeness of Will we obtain audit evidence of the accuracy and completeness of the IPE, we will test the controls around accuracy and completness. As the IPE is a system generated information produced by the entity by testing controls or by report, refer to our testing of the company's IT general contols. In addition, we will test the controls performing procedures directly on the information? around report logic as well as the internal controls around the source data. Is the control automated? No. Warehouse F System, which is subject to IT controls and tested within the IT controls workpaper. Relevant application system (if we are testing information produced by the entity through tests of controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The warehouse director has been with the company for over 10 years and has been acting in this current role for the last five. The warehouse director is in charge of overseeing operations at all five warehouses and directly supervises the warehouse managers. The director is knowledgeable of the business and focuses reviews on activity that seems unusual given the customer and quantities purchased. The review is directed to the identification of unusual trends and thus appropriately addresses the related risk of material misstatement and assertion. 2. Control is Tests of controls: evaluation of design performed on a daily basis. 3. Control identifies exceptions after they have occurred (i.e., its a detective control), yet given the frequency of performance, it would identify errors in a timely manner. 4. Although the control entails the review of daily revenue activity, it is done on a transaction by transaction basis, and as such it is sufficiently precise to mitigate the risk. 5. Control involves the judgment of the warehouse director since there is no specific threshold set. However, since all transactions are evaluated and Geiszler Fencing has a cyclical business, the report results are predictable. In addition, the warehouse director has been employed by the company for 10 years. Tests of controls: planned operating effectiveness testing Interim Procedures (test as of 9/30): 1. Discuss the performance of the control procedure with the warehouse director. 2. Select 15 days out of the year. 3. Obtain the "Orders Shipped & Invoiced Report" reviewed by the warehouse director. 4. Determine whether the reports were signed off by the warehouse director and dated on the day following the report date. Rollforward Procedures: 1. Make inquiries of management and the process owner of the control activity to determine if any events that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) have been identified after our interim testing date. Is the control automated? No. Relevant application system (if we are testing information produced b No. On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement:1. Control appropriately addresses the related risk of material misstatement and assertion since any unexpected variances would be detected by the controller's analysis of budget to actual.2. The control is detective and therefore identifies exceptions after they have occurred, yet given that the control is performed on a monthly basis, it would detect errors in time Tests of controls: evaluation of design to prevent material misstatement of the financial statements.3. The control is sufficiently precise to detect a material misstatement in the revenue account (which is based on $5 million materiality threshold).4. Management has defined quantitative thresholds for investigating variances.5. The company's financial results have historically been consistent with budget. There are no significant changes planned in the current year to the company's business nor are there any external factors related to the industry, regulatory environment, or economy that would be expected to impact the company's current year financial results. Interim Procedures: Inquiry: 1. Inquire of the controller and assistant controller of the following: a. Explanation of the steps involved in performing the control. b. Reports and other information used, including how such information is used and from where it is obtained. c. Procedures performed when an exception or misstatement is identified. d. Procedures performed when the individual is absent. e. Tests of controls: planned operating effectiveness testing Procedures performed with respect to unusual transactions. f. Changes to controls during the period, including changes in personnel who perform them. Inspection: 2. Obtain the meeting minutes for two months and determine if the monthly package was appropriately discussed. Rollforward Procedures: 1. Select a month from Q4 and perform the above procedures consistent with interim
