Case Study 2: Auditing the Compliance and Ethics Program from Internal Auditing: Assurance & Advisory Services, 4th Edition 2017 by the Internal Audit Foundation

Given the growth in SHRs salesforce around the world, as well as management pressures to continue sales growth during more dif cult economic times, the internal audit function decided to include an audit of the companys gift exchange policy in the annual internal audit plan. The objective of this audit is to evaluate compliance with the policy and recommend improvements that may help to ensure ongoing compliance in the future.

SHRs Gift Exchange Policy is summarized below:

Creating and maintaining good relationships with our customers, suppliers, and business partners are important to SHRs success. The occasional exchange of gifts, meals, and entertainment of small value are a common business practice meant to provide a legitimate opportunity to interact, create goodwill, and establish trust.

However, it is important to use good business judgment when determining the appropriateness of gifts, meals, or entertainment. Business gifts that are extravagant or would in uence behavior are inappropriate and should not be given or accepted. An inappropriate gift might cloud objectivity and decision-making. The exchange of gifts given with the intent to bribe, make a kickback, or place undue in uence are illegal and not the way SHR conducts business.

An appropriate business-related gift is:

Of moderate value, whether given or received. Something that will not embarrass or discredit the company. Not made in cash or cash equivalent such as checks, money orders, stock, and similar items.

Gifts, meals, or entertainment that you receive that have an actual or estimated value of over US $500 must be reported to the CCO.

1. Based on your review of the policy above, what would you consider the strong points of the policy and what, if any, shortcomings did you notice?

2. Develop key steps to test compliance with the Gift Exchange Policy. Specically, outline key procedures that might be performed to test the design adequacy and operating effectiveness of controls related to this policy.