CASE 5.6 Sarbox Scooter, Inc.

Scoping and Evaluation Judgments in the Audit of Internal Control over Financial Reporting MARK S. BEASLEY FRANK A. BUCKLESS STEVEN M. GLOVER DOUGLAS F. PRAWITT

LEARNING OBJECTIVES

After completing and discussing this case you should be able to

[1] Understand the complexities of auditing internal control over financial reporting in an integrated audit required by PCAOB Auditing Standard No. 5

[2] Identify significant accounts for an integrated audit

[3] Identify significant locations or business units for an integrated audit

[4] Apply an evaluation methodology to determine the likelihood and magnitude of control deficiencies

[5] Appreciate the judgment needed to evaluate control deficiencies

INTRODUCTION

Section 404 of the Sarbanes-Oxley Act of 2002 requires public companies to report on the effectiveness of their internal control over financial reporting. Section 404 also requires companies to hire an auditor to perform an "integrated audit" involving both a traditional financial statement audit and an audit of internal control over financial reporting. PCAOB Audit Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements (AS5), provides guidance for the audit of internal control and requires the auditor to obtain sufficient competent1 evidence about the effectiveness of controls for all relevant assertions related to all significant accounts in the financial statements. Before an auditor can identify which controls to test, some important audit decisions need to be made. Some of these decisions are listed below. Identify Significant Accounts. Significance is determined by applying quantitative and qualitative measures of materiality to the consolidated financial statements.

Identify Relevant Financial Statement Assertions. For each significant account, relevant assertions are identified by considering the assertions that have a meaningful bearing on whether the account is fairly stated. Relevant assertions are those assertions (one or more) related to significant accounts that, if inaccurate, present a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated.

Identify Significant Processes and Major Classes of Transactions. The auditor must understand relevant processing procedures involved in the flow of transactions for significant accounts. The controls auditors will test reside within the significant transaction processes (e.g., sales and collection cycle, period-end financial reporting process). 1 PCAOB Auditing Standards refer to sufficient "competent" evidence, while AICPA Auditing Standards refer to sufficient "appropriate" evidence. The case was prepared by Mark S. Beasley, Ph.D. and Frank A. Buckless, Ph.D. of North Carolina State University and Steven M. Glover, Ph.D. and Douglas F. Prawitt, Ph.D. of Brigham Young University, as a basis for class discussion. Sarbox is a fictitious company. All characters and names represented are fictitious; any similarity to existing companies or persons is purely coincidental. Once significant accounts, relevant assertions, and significant processes have been identified, the auditor identifies the controls to test. Determining the location where testing will occur is not always a simple decision. Significant accounts at the consolidated company level are an aggregation of the accounts at the company's various business units, which may be geographically dispersed across several locations. For example, consolidated accounts receivable is the aggregation of the accounts receivable balances at each of the company's individual business units (i.e., locations, divisions, or subsidiaries). Thus, another important logistical decision the auditor must make for each significant account is to determine which business units to visit in order to test the controls pertaining to the account. AS5 does not require the auditor to visit all of a company's business units or locations. Rather, AS5 requires the auditor to gather sufficient competent evidence for each significant account at the consolidated level in order to support his or her opinion regarding management's assertion about the effectiveness of internal control over financial reporting. To illustrate, suppose a company has ten different business units, each of which has accounts receivable. Assuming accounts receivable is deemed to be a significant account at the consolidated company level, the auditor might appropriately decide to test controls over accounts receivable at the company's six largest locations, representing 75 percent of the total consolidated receivables balance. Part A of this case asks you to identify significant accounts and to determine which locations you would visit to perform tests of controls for Sarbox Scooter, Inc., a hypothetical manufacturer of scooters and mini-motorcycles. Completing the requirements of Part A will require you to exercise judgment to determine which accounts would be considered significant. Part B of this case, which can be completed independently of Part A, asks you to evaluate the likelihood and magnitude of control deficiencies as defined and required by AS5. When a deficiency is deemed to be a material weakness, the auditor issues an adverse opinion with respect to the effectiveness of a company's controls over financial reporting. Approximately 17 percent of the first wave of companies required to comply with Section 404 (known as "accelerated filers") received an adverse audit opinion in early 2005 due to material weaknesses. That number has dropped to less than 5 percent in recent years. BACKGROUND Sarbox Scooter, Inc. manufactures and distributes pocket bikes and scooters internationally. Sarbox Scooter has operations in the U.S., Mexico, and Europe. Pocket bikes (also known as "minimotos," "mini GP's" or "pocket rockets") are miniature GP "Grand Prix" racing motorcycles. Approximately one-fourth the size of a regular motorcycle, pocket bikes are accurate in detail and proportion to world-class GP bikes. Common features include the following: small two-stroke gas engines (between 40 - 50 cubic centimeters in size), front/rear disc brakes, racing tires, a sturdy light weight aluminum or aluminum alloy frame, and the look and feel of a real GP racing motorcycle. Pocket bikes are built for racing and intended for use on speedways, go-kart tracks, or closed parking lots. Pocket bike racing is very popular in Europe and Japan and is becoming increasingly popular in the U.S. Traditional scooters have been a kid favorite for many years. However, the craze for motorized scooters took off in the early 2000's and is spreading worldwide. While Sarbox Scooters carries a line of traditional non-motorized scooters, the company specializes in gas and electric powered scooters. Sarbox Scooter was founded in 2005 and is headquartered in Basking Bridge, New Jersey. The company is one of the leading manufacturers of pocket bikes and motorized scooters. Sarbox Scooter's vision is to be the world's premier pocket bike and motorized scooter manufacturer and distributor. In line with this vision, Sarbox Scooter is striving to increase brand share by 1% each year for the next five years, to 30% of the market for motorized scooters. However, competition in the industry is intense and is based on price, quality, and aesthetics. In the last year, several competitors with strong brand recognition (e.g., Schwinn) have demonstrated renewed interest in the motorized scooter market with expensive ad campaigns. Sarbox Scooter's customer base consists primarily of dealerships both domestically and internationally. Sales to the dealerships account for approximately 90% of Sarbox Scooter's annual sales. The remaining 10% of sales come from bulk orders sold directly to rental agencies and vacation resorts. Sarbox Scooter's business units are divided by geographical region into the U.S., Mexico and Europe. The U.S. region is further sub-divided into five business units: Northeast, Southeast, Central, Southwest and Northwest. The international business units have individual finance directors who report to Warwick Schawb (CFO) at the Basking Bridge headquarters. The Mexico Finance Director recently resigned following deep scrutiny from Sarbox Scooter's internal audit team of his control, monitoring, and reporting practices. All of the individual business units have sales directors and manufacturing plant managers. Sarbox Scooter's computer systems are located within data centers at each regional business unit. All financial statement consolidations and "roll ups" from the business units are performed at headquarters. The company was able to synchronize revenue recording and reporting for all of its business units on the same accounting software systems for the first time in 2012. The company continued to progress in the areas of corporate governance and social responsibility by strengthening the Board of Directors via the addition of a highly respected business leader, Morris Graybeard, Chairman and Chief Executive Officer of the Rubio Company. Sarbox Scooter has also bolstered its internal audit function by hiring Jenna Jaynes, formerly the head of internal audit at a large international food distributor. You are an auditor with Sarbox Scooter's external audit firm, Delmoss Watergrant LLP. Sarbox Scooter has been an audit client since it went public in 2007. Because Sarbox Scooter's corporate shares are publicly traded, the audit will be an integrated audit in accordance with AS5, including both an audit of internal control over financial reporting and a financial statement audit. Section 404 of the Sarbanes-Oxley Act of 2002 and related rulings of the Securities and Exchange Commission (SEC) require management to assess and evaluate the effectiveness of its internal control over financial reporting. Management must identify significant accounts and locations for testing. While management will provide the auditors with documentation of its risk assessment, controls, and testing, auditing standards require the auditor to independently evaluate the design and operating effectiveness of controls for each of the components of internal control that relate to relevant assertions for all significant accounts and disclosures in the financial statements. Furthermore, the auditors must independently identify each significant process over each major class of transactions and test controls at enough significant locations to obtain sufficient competent evidence regarding the effectiveness of internal controls over financial reporting. In forming your judgments, you will consider the background information above, Sarbox Scooter's financial statements, and Delmoss Watergrant's audit policies.

REQUIRED -

PART A [1] According to AS5:

[a] What should the auditor consider when determining whether an account should be considered significant?

[b] What qualitative factors might cause an account that is otherwise relatively small quantitatively to be considered significant?

[c] What qualitative factors might cause an account that is greater than materiality to be considered not significant?

[2] Referring to Delmoss Watergrant's policy for identifying significant accounts (see Appendix A) as well as Sarbox Scooter's consolidated balance sheet and income statement, answer the following questions: [a] Determine a planning materiality threshold to use to identify significant accounts for Sarbox Scooter. Please show your work and justify judgments. [b] At a consolidated financial statement level, are there accounts on Sarbox Scooter's financial statements that are greater than planning materiality that should not be considered significant? Please justify your response. [c] Identify two accounts, at the consolidated level, that are not quantitatively significant, but that should be deemed significant due to qualitative factors. Provide the qualitative factors you considered. [d] Which Sarbox Scooter business units (geographic locations), if any, would not be considered quantitatively significant? Which business units (locations) have specific risks that would render the unit significant regardless of its quantitative size? [e] If you had to eliminate or scope out one entire business unit (geographic location), which unit would it be? Please justify your response and include both quantitative and qualitative reasons for doing so.

[3] Auditing standards require the identification and testing of entity-level controls. What are examples of entity-level controls? What are the auditor's responsibilities with respect to evaluating and testing a client's period-end financial reporting process?

REQUIRED -

PART B (CAN BE COMPLETED INDEPENDENTLY OF PART A) [1] What are the definitions of a control deficiency, significant deficiency, and material weakness as contained in AS5? Which, if any, of these deficiency categories must the external auditor include in the audit report?

My questions are in bold. Please provide reference if used other thanthe information I provided.