CASE 2.2 Apple Inc. Evaluation of Client Business Risk MARKS. BEASLEY FRANK A. BUCKLESS STEVEN M. GLOVER. DOUGLAS F. PRAWITT LEARNING OBJECTIVES After completing and discussing this case you should be able to 11 Describe the implications of an audit client's 21 Identify and evaluate the factors important in business risk on the audit engagement assessing an audit client's business risk and risk 121 Describe the types of information relevant to of material financial misstatement evaluate an audit client's business risk INTRODUCTION Apple Inc. (Apple) is a worldwide provider of innovative technology products and services. Apple's products and services include iPhone, iPad, Mac", iPod", Apple TV, a portfolio of consumer and professional software applications, the iOS and OS X operating systems, iCloud", and a variety of accessory, service and support offerings. The Company also sells and delivers digital content and applications through the iTunes Store, App Store", iBooks Store", and Mac App Store. Net revenue for fiscal 2013 was $170.9 billion and net income was $37.0 billion. Apple's common stock is traded on the NASDAQ national market, and Apple is required to have an integrated audit of its consolidated financial statements and its internal control over financial reporting in accordance with the standards of the Public Company Accounting Oversight Board (United States). The Company's fiscal year is the 52 or 53-week period that ends on the last Saturday of September. As of the close of business on October 18, 2013, Apple had 899,738,000 shares of common stock outstanding with a trading price of $508.89. INFORMATION ABOUT THE AUDIT Your firm, Smith and Jones, PA., is in the initial planning phase for the fiscal 2014 audit of Apple for the year ended September 27, 2014. As the audit senior, you have been assigned responsibility for gathering and summarizing information necessary to evaluate Apple's business risk. Your firm's memorandum related to the client business risk evaluation has been provided to assist you with this assignment. Assume no material misstatements were discovered during the fiscal 2014 audit. Section 2: Understanding the Client's Business and Assessing Risk REQUIRED [1] Go to Apple's website (investor.apple.com) and explore the website. Click on the "SEC Filings link. Obtain the most recent SEC Form 10-K provided for Apple. Based on the information obtained from the website and your knowledge of the industry, prepare a memo discussing the following items: (a) Apple's: Sales Total assets Net income Number of employees Cash flow from operating activities [b] What are Apple's products? Id Who are Apple's competitors? Id Who are Apple's customers? [o] Who are Apple's suppliers? In How does Apple market and distribute its products? tal What is Apple's basic business strategy (cost leadership or differentiation) IN What are critical business processes for Apple given its basic business strategy (for example, supply chain management)? 1 What accounting information is associated with the critical business processes and how does Apple measure up on that information? D What accounting methods does Apple use to report the accounting information associated with critical business processes and what is the risk of material misstatement? This memo is to be used as a foundation document for the preliminary business risk assessment. In evaluating Apple's performance and assessing the risk of misstatement, please be sure to describe your reasoning. Your memo should be double-spaced and addressed to the partner for the engagement (your instructor). Your firm demands polished, concise, professional analyses and writing, Be thorough, but get to the issues without unnecessary verbiage. In describing your analyses and conclusions, please consider relatively short "punchy or to-the-point sentences. When appropriate, consider using bullet point listings. [2] Professional auditing standards provide guidance on the auditor's consideration of an entity's business risks. What is the auditor's objective for understanding an entity's business risks? Why does an auditor not have responsibility to identify or assess all business risks? Provide some examples of business risks associated with an entity that an auditor should consider when performing an audit Smith and Jones, PA. Memorandum: Business Risk Evaluation This memorandum provides a general framework for fim personnel when evaluating dient business risk for purposes of determining the nature, timing, and extent of audit procedures. Knowledge about the nature of the client's business activities and related business risks provides a basis for the auditor's assessment of the risk of material misstatement The auditor's assessment of the risk of material misstatement is used to determine the nature, timing, and extent of audit procedures. The intent of this memorandum is not to suggest that this framework must be followed on all audit engagements. The appropriateness of this framework must be determined on an engagement by engagement basis, using professional Judgement Client business risk is the risk that a client's business objectives will not be achieved. Business risk results from the interaction of internal and external business forces. Clients achieve business objectives by setting strategies and then designing and implementing processes to execute those strategies. Strategies represent the overal approaches used by management to achieve its business objectives. Business risk is reduced when the client etfectively aligns its business strategy and processes with the external business environment. Business risk is increased when the client does not effectively align its business strategy and processes with the external business environment or when new external business conditions emerge to weaken the alignment. The dynamic nature of today's business environment requires that clients do more than develop processes to execute their current business strategy. Clients must also develop processes to monitor the changing business environment and reorient their strategies and processes as environmental business conditions change. Clients must continually scan their business environments for changes that may threaten achievement of their business objectives. To assess the risk of material misstatement auditors must understand the client's current business Strategy and environment along with emerging business forces that may require reorientation of its current strategies and processes. A proper analysis of a client's business risk requires an understanding of the client's business strategy, the client's internal business processes, and emerging business forces. Important aspects of understanding each of these dimensions are discussed below. Understand Emerging Business Forces The starting point for performing a business risk analysis is to understand the external business environment in which the client operates. This analysis is an essential first step because it allows the auditor to properly frame the subsequent analysis of the client's strategy and internal business processes. Understanding the client's business environment enables the auditor to assess the sustainability of the client's business strategy and to identity crifcal business processes. External business forces influencing business risk are: . Customers - aspects to consider include size and number of customers in industry, availability of competitor products or services, similarity of competitor products or services, ability of customers to switch to competitor products or services, complementary/substitute products or services, and desired qualities features of products or services. . Competitors - aspects to consider include number and size of firms in industry, maturity of products or services in industry, production capacity of firms in industry, required capital investment to enter industry, availability access to distribution channels, and legal or regulatory barriers to industry. Suppliers - aspects to consider include number and size of suppliers in industry, number and size of customers for supplier products or services, relative importance of supplier products or services to client's products or services, similarity of supplier products or services, complementary substitute products or services, and cost of switching suppliers. Labor - aspects to consider include required competencies of employees, availability of employees, and other employment opportunities for employees. . Capital market - aspects to consider include availability of investors and creditors and alternative investment opportunities available to investors and creditors. Regulations - aspects to consider include nature of and changes to regulatory oversight and global differences in regulatory oversight Understand Business Strategy The next step in evaluating the client's business risk is to understand the client's strategy to gain a competitive advantage The sustainability of a client's competitive advantage is dependent on the external business environment. Changes in the external business environment may render the client's current business strategy ineffective. An understanding of the client's business strategy is also necessary to identity critical business processes for the client. Business strategies influencing business risk can be broadly categorized as: . Cost leadership -objective is to supply products or services at the lowest cost. Clients using this strategy have organizational structures and processes that promote cost control. These clients are primarily concerned with efficient production processes, lower input costs, lower overhead costs, and simple product design Differentiation -objective is to supply products or services that are unique on some dimension valued by customers. Dimensions clients may use to differentiate include product service quality product/service features, product/service variety, product/service image, product service support, or product/service delivery. Clients using this strategy have organizational structures and processes that promote creativity and innovation. These clients are primarily concerned with research and development, engineering, and or marketing capabilities. Regardless of the business strategy selected by a client, the other differentiation dimensions cannot be completely ignored. Clients focusing on cost leadership stl must have products that customers desire and thus cannot completely ignore the product/service dimensions valued by customers. Similarly, clients focusing on differentiation still need to deliver their products or services at a reasonable price. Evaluation of Internal Business Processes The final step in evaluating the dient's business risk is to understand and evaluate critical business processes. Success of a business strategy is not automatic. Business strategies fail because of changes in the external business environment andlar flawed client business processes. Clients must implement business processes that develop and maintain the core competencies necessary to execute the business strategy and sustain competitive advantage. Internal business processes influencing business risk are broadly categorized as: Control environment - organizational processes concerned with integrity and ethical values, commitment to competence, board of directors and audit committee oversight, management's philosophy and operating style, organizational structure, and assignment of authority and responsibility. Risk assessment - organizational processes concerned with identification and analysis of risks associated with achieving business objectives . Control activities - organizational processes concemed with the execution of business strategies and achievement of business objectives. This includes core business processes related to product/service development, production, marketing, distribution, employee relations, supplier relations, and customer relations - Information and communication system - financial and non-financial information concerned with the measurement of the progress toward achievement of business objectives. Monitoring system organizational process for evaluating the design, operation, and effectiveness of business processes CASE 2.2 Apple Inc. Evaluation of Client Business Risk MARKS. BEASLEY FRANK A. BUCKLESS STEVEN M. GLOVER. DOUGLAS F. PRAWITT LEARNING OBJECTIVES After completing and discussing this case you should be able to 11 Describe the implications of an audit client's 21 Identify and evaluate the factors important in business risk on the audit engagement assessing an audit client's business risk and risk 121 Describe the types of information relevant to of material financial misstatement evaluate an audit client's business risk INTRODUCTION Apple Inc. (Apple) is a worldwide provider of innovative technology products and services. Apple's products and services include iPhone, iPad, Mac", iPod", Apple TV, a portfolio of consumer and professional software applications, the iOS and OS X operating systems, iCloud", and a variety of accessory, service and support offerings. The Company also sells and delivers digital content and applications through the iTunes Store, App Store", iBooks Store", and Mac App Store. Net revenue for fiscal 2013 was $170.9 billion and net income was $37.0 billion. Apple's common stock is traded on the NASDAQ national market, and Apple is required to have an integrated audit of its consolidated financial statements and its internal control over financial reporting in accordance with the standards of the Public Company Accounting Oversight Board (United States). The Company's fiscal year is the 52 or 53-week period that ends on the last Saturday of September. As of the close of business on October 18, 2013, Apple had 899,738,000 shares of common stock outstanding with a trading price of $508.89. INFORMATION ABOUT THE AUDIT Your firm, Smith and Jones, PA., is in the initial planning phase for the fiscal 2014 audit of Apple for the year ended September 27, 2014. As the audit senior, you have been assigned responsibility for gathering and summarizing information necessary to evaluate Apple's business risk. Your firm's memorandum related to the client business risk evaluation has been provided to assist you with this assignment. Assume no material misstatements were discovered during the fiscal 2014 audit. Section 2: Understanding the Client's Business and Assessing Risk REQUIRED [1] Go to Apple's website (investor.apple.com) and explore the website. Click on the "SEC Filings link. Obtain the most recent SEC Form 10-K provided for Apple. Based on the information obtained from the website and your knowledge of the industry, prepare a memo discussing the following items: (a) Apple's: Sales Total assets Net income Number of employees Cash flow from operating activities [b] What are Apple's products? Id Who are Apple's competitors? Id Who are Apple's customers? [o] Who are Apple's suppliers? In How does Apple market and distribute its products? tal What is Apple's basic business strategy (cost leadership or differentiation) IN What are critical business processes for Apple given its basic business strategy (for example, supply chain management)? 1 What accounting information is associated with the critical business processes and how does Apple measure up on that information? D What accounting methods does Apple use to report the accounting information associated with critical business processes and what is the risk of material misstatement? This memo is to be used as a foundation document for the preliminary business risk assessment. In evaluating Apple's performance and assessing the risk of misstatement, please be sure to describe your reasoning. Your memo should be double-spaced and addressed to the partner for the engagement (your instructor). Your firm demands polished, concise, professional analyses and writing, Be thorough, but get to the issues without unnecessary verbiage. In describing your analyses and conclusions, please consider relatively short "punchy or to-the-point sentences. When appropriate, consider using bullet point listings. [2] Professional auditing standards provide guidance on the auditor's consideration of an entity's business risks. What is the auditor's objective for understanding an entity's business risks? Why does an auditor not have responsibility to identify or assess all business risks? Provide some examples of business risks associated with an entity that an auditor should consider when performing an audit Smith and Jones, PA. Memorandum: Business Risk Evaluation This memorandum provides a general framework for fim personnel when evaluating dient business risk for purposes of determining the nature, timing, and extent of audit procedures. Knowledge about the nature of the client's business activities and related business risks provides a basis for the auditor's assessment of the risk of material misstatement The auditor's assessment of the risk of material misstatement is used to determine the nature, timing, and extent of audit procedures. The intent of this memorandum is not to suggest that this framework must be followed on all audit engagements. The appropriateness of this framework must be determined on an engagement by engagement basis, using professional Judgement Client business risk is the risk that a client's business objectives will not be achieved. Business risk results from the interaction of internal and external business forces. Clients achieve business objectives by setting strategies and then designing and implementing processes to execute those strategies. Strategies represent the overal approaches used by management to achieve its business objectives. Business risk is reduced when the client etfectively aligns its business strategy and processes with the external business environment. Business risk is increased when the client does not effectively align its business strategy and processes with the external business environment or when new external business conditions emerge to weaken the alignment. The dynamic nature of today's business environment requires that clients do more than develop processes to execute their current business strategy. Clients must also develop processes to monitor the changing business environment and reorient their strategies and processes as environmental business conditions change. Clients must continually scan their business environments for changes that may threaten achievement of their business objectives. To assess the risk of material misstatement auditors must understand the client's current business Strategy and environment along with emerging business forces that may require reorientation of its current strategies and processes. A proper analysis of a client's business risk requires an understanding of the client's business strategy, the client's internal business processes, and emerging business forces. Important aspects of understanding each of these dimensions are discussed below. Understand Emerging Business Forces The starting point for performing a business risk analysis is to understand the external business environment in which the client operates. This analysis is an essential first step because it allows the auditor to properly frame the subsequent analysis of the client's strategy and internal business processes. Understanding the client's business environment enables the auditor to assess the sustainability of the client's business strategy and to identity crifcal business processes. External business forces influencing business risk are: . Customers - aspects to consider include size and number of customers in industry, availability of competitor products or services, similarity of competitor products or services, ability of customers to switch to competitor products or services, complementary/substitute products or services, and desired qualities features of products or services. . Competitors - aspects to consider include number and size of firms in industry, maturity of products or services in industry, production capacity of firms in industry, required capital investment to enter industry, availability access to distribution channels, and legal or regulatory barriers to industry. Suppliers - aspects to consider include number and size of suppliers in industry, number and size of customers for supplier products or services, relative importance of supplier products or services to client's products or services, similarity of supplier products or services, complementary substitute products or services, and cost of switching suppliers. Labor - aspects to consider include required competencies of employees, availability of employees, and other employment opportunities for employees. . Capital market - aspects to consider include availability of investors and creditors and alternative investment opportunities available to investors and creditors. Regulations - aspects to consider include nature of and changes to regulatory oversight and global differences in regulatory oversight Understand Business Strategy The next step in evaluating the client's business risk is to understand the client's strategy to gain a competitive advantage The sustainability of a client's competitive advantage is dependent on the external business environment. Changes in the external business environment may render the client's current business strategy ineffective. An understanding of the client's business strategy is also necessary to identity critical business processes for the client. Business strategies influencing business risk can be broadly categorized as: . Cost leadership -objective is to supply products or services at the lowest cost. Clients using this strategy have organizational structures and processes that promote cost control. These clients are primarily concerned with efficient production processes, lower input costs, lower overhead costs, and simple product design Differentiation -objective is to supply products or services that are unique on some dimension valued by customers. Dimensions clients may use to differentiate include product service quality product/service features, product/service variety, product/service image, product service support, or product/service delivery. Clients using this strategy have organizational structures and processes that promote creativity and innovation. These clients are primarily concerned with research and development, engineering, and or marketing capabilities. Regardless of the business strategy selected by a client, the other differentiation dimensions cannot be completely ignored. Clients focusing on cost leadership stl must have products that customers desire and thus cannot completely ignore the product/service dimensions valued by customers. Similarly, clients focusing on differentiation still need to deliver their products or services at a reasonable price. Evaluation of Internal Business Processes The final step in evaluating the dient's business risk is to understand and evaluate critical business processes. Success of a business strategy is not automatic. Business strategies fail because of changes in the external business environment andlar flawed client business processes. Clients must implement business processes that develop and maintain the core competencies necessary to execute the business strategy and sustain competitive advantage. Internal business processes influencing business risk are broadly categorized as: Control environment - organizational processes concerned with integrity and ethical values, commitment to competence, board of directors and audit committee oversight, management's philosophy and operating style, organizational structure, and assignment of authority and responsibility. Risk assessment - organizational processes concerned with identification and analysis of risks associated with achieving business objectives . Control activities - organizational processes concemed with the execution of business strategies and achievement of business objectives. This includes core business processes related to product/service development, production, marketing, distribution, employee relations, supplier relations, and customer relations - Information and communication system - financial and non-financial information concerned with the measurement of the progress toward achievement of business objectives. Monitoring system organizational process for evaluating the design, operation, and effectiveness of business processes