CFE Case Name: PonyUp (PU)

ASSIGNMENT 2 TEMPLATE

NAME:

Pleaseinsert your name(s). No name (s), no mark.

In Assignment 1 you learned about the 'big picture' issues with accounting entities - we treat small owner-managed entities differently in a routine audit, and expect both a governance and IC system that STILL prevents and detects opportunity, pressure/incentive and rationalization and eliminates these in the entity where possible.The result of success, will be a tolerable level of avoidable risk of accounting fraud.In this assignment we will look at a few unique facts of this case to analyze the capability, competence, expertise of OWNER/TCWG to design, implement, monitor, oversee, evaluate and improve both a governance and IC system at PU.In addition, we analyze selected, specific facts that the CPA/External Auditor has already reported/documented for us in this case and how to search for relevant standards. This is another opportunity to improve the two types of narratives.Notice that unlike Assignment 1 we DO have specific case facts and the reason we do is that the CPA/External Auditor has documented them in his notes. You should remember this documentation too when you engage in the professional practice of a routine audit. It will assure you get your license, keep your license, stay out of court and out of jail because you will have a recorded trace you DID comply with professional standards and therefore have served the public interest AND upheld my profession's reputation.

Please use only this template all BOTH PonyUp (PU) and Team case assignments. This WORD version is the only format in which I will accept completed assignments. I will provide extensive feedback on your work for each assignment using the "Review, Track Changes, Show all Markup" function in WORD. The assignment is designed to guide your progression towards exploring/discovering relevant technical content and develop your skill at searching the Knotia database, and your ability to articulate your professional judgment by matching the issue in the case facts to the technical content in a brief written narrative.Please pay attention to how to cite a case fact AND cite technical content correctly. Both skills will be tested on your CFE and no marker will give you marks for cutting and pasting huge sections of technical content. You will get marks for the narrative.

In part 1, reply to the questions asked. In part 2 I have selected quotes and the search term but it is your task to complete the search, copy/paste the RELEVANT section and complete the narrative allocating responsibility.

HOW do I find correct CAS standards:In your own searches copy relevant content ONLY from the Handbook Pre-Auditor Reporting because the case facts say "the bank has approached your firm to conduct..." and you, as senior auditor have been asked by your firm to " an audit planning memo". Your firm has not yet accepted the engagement, which is the first audit for PU and being done because the bank asked PU for audited financial reports. Therefore, this is apre-auditorreport.Copy/paste your CAS from ONLY the pre-auditor report section of CAS.

Irrespective of the search terms you use,EXCLUDEROGC: 20Q..IFRS Conversions..., Crown Corporation Governance, Directors' and Officers' Indemnification..., IT Second edition, Pension Governance, Role in Pension Governance, Special Committees, .

HOW do I allocate responsibility? You checklist of activities the standards say benchmark good governance/IC.The case facts are actual performance. The gaps between what the standards say should be and the actual facts will be either governance or IC weaknesses which cause increased fraud risk.CAS by in large tells you what you, the External Auditor, must do during the routine audit in response to this risk.

1.Allocate responsibility for governance requires you use mandatory phrases.First PU is a small company with no BOD therefore you start with "OWNER/TCWG is responsible to fulfill..."do NOT deviate from this wording.Next you name the responsibility using either "governance" or "IC". The entire sentence will read either "OWNER/TCWG is responsible to fulfill the governance duty of..." and name the duty stated in the standardOR "OWNER/TCWG is responsible to fulfill the IC duty of..." and you name the duty stated in the standard. (Use the copy/paste function in WORD to reduce the time this takes).

2.To distinguish governance duties you will find the standard uses one or more of these keywords "assure/ensure, assess/self-assess, evaluate, monitor, oversee".You can use the find function in WORD to make sure you don't miss the word matching in the standards to your allocation of responsibility.With no keywords present the standard must refer to IC. I have put these words in bold in the Narrative;I have put the search term(s) in red to help you identify the consistent structure of the narrative.

3.Begin narratives regarding the CPA/External Auditor with "CPA/External Auditor is responsible to...". In these standards there is no distinction between governance and control activities but what a CPA/External auditor must do does differ when weaknesses are detected.Again, I have put the search terms in red to help you identify the consistent structure of the narrative.

4.Remember you must do one separate Narrative allocating responsibility for each and every subsection. Be detailed and use the vocabulary of the standards.

5.If there is NO standard relevant to the case quote with respect to the responsibility of the CPA/External auditor then the heading should read No relevant hits.

6.You must cite the section of the standard AND the subsection and follow the examples to do so correctly - do not invent new ways to cite the standards.I have underlined the correct form of a citation, please practice it.

HOW do I write the Narrative - LINKS?You created the analytical tool in the Narrative allocating responsibility. The content you copy/pasted depended on the content of the quote as it related to the search term(s). The LINKS narrative provides evidence you are right in identifying either a governance or IC weakness or both. The goal of the second narrative is to communicate how the case facts did raise your professional skepticsm.

1.Begin each statement in LINK to case facts with "The case facts indicate ...failures by the ownersto fulfill ..."The first blank names the failure as either governance or IC (remember governance is distinguished by the key words, state that key word after the word governance).You use the keyword in Narrative allocating responsibility to do so.

2.The next statement must relate the content of the case quote that raised your skepticism and alerted you to the weaknesses indicated by the case quote directly to the content of the relevant standard(s).You will benefit from doing each standard in order from columns 2 and 3 for OWNER/TCWG then move to column 4 for CPA/External Auditor.If you cannot link a standard to case quote content, then you have to delete the standard as irrelevant. This is evidence of your professional judgment.

3.Your search terms must appear in the LINKS narrative because this in fact, is the link you made between the case fact and the standard.

4.Do NOT mix up governance and IC (control activity) deficiencies together; keep them separate and analysis in an orderly way but be brief.

5.For CPA/External auditor start the LINK to case facts with "CPA/External Auditor, learning the facts of...

PART 1:Create original image on a PowerPoint slide of the relationship between capability, competence and expertise of the OWNER/TCWG or for larger companies of the BOD/TCWG based on what you have copy/pasted in A and B.Explain your image in, maximum,

PART 2Complete the narrative allocating responsibility and the narrative LINKS.

A

Direct quote(s) from the Case with citation

Section/subsection reference ANDsearch term(s)used in CoCo:capability,competencewith appropriate reference to section and subsection

Section/subsection reference ANDsearch term(s)used In ROGC:capability,competencewith appropriate reference to section and subsection

Section/subsection reference ANDsearch term(s)used in CAS:capability,competencewith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

"Pony-Up is bringing in a lot of cash, but it seems to go right back out again!...I know there are a lot of expenses in running a business, but there are so many that it is hard to keep up...."

Page 109, paragraph 7

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...

B

Direct quote(s) from the Case with citation

Section/subsection citation reference ANDsearch term(s)used In CoCo:expertisewith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used In ROGCexpertisewith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used In CASexpertisewith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

"Lori is the town veterinarian and runs her own practice."

Sarah manages a pet store called Animal Galaxy Inc. (Animal Galaxy), which specialized in premium foods and products for animals. She has a 20% stake in Animal Galaxy, with the remainder split equally between her brother and her sister-in-law, Megan. Megan is a co-owner in Animal Galaxy, she is not involved in its operations. She is a school teacher and teaches horse riding lessons in her free time.

"... Things have been hectic so far, and the owners have not had a lot of time to focus on the operations."

Page 109, paragraph 1,2,3.

Commitment

71Clearly defined authority, responsibility and accountability help ensure that critical decisions are made by qualified individuals. They help create the expectation that if an individual does not feel able to solve a problem, he or she will find someone with the necessary knowledge,expertiseand authority to effect coordination with others. This migration of decision-making may be formally documented in the organization's authorization policies (for example, a bank may have a policy for certain loan decisions to be made by certain officers), or it may be established informally through commonly acknowledged norms of behaviour and shared values.

Monitoring and Learning

Commitment

Are our principles of integrity and ethical values shared and practised?

Are people rewarded fairly according to the organization's objectives and values?

Do we clearly understand what we are accountable for, and do we have a clear definition of our authority and responsibilities?

Are critical decisions made by people with the necessaryexpertise, knowledge and authority?

Are levels of trust sufficient to support the open flow of information and effective performance?

ROGC, 20Q...CEO Succession

18. What is our role in coaching and developing the CEO?

Most boards conduct annual CEO performance reviews. It is not yet a common practice, however, for boards to hold ongoing discussions with their CEO about his or her development, although this is one of the most important roles a board can play in mentoring a CEO. Successful development coaching discussions with the CEO depend upon the board having enough diversity among its members for it to have sufficientexpertiseto provide coaching on any significant issue the CEO is likely to encounter.

20Q...Governance Committee

7. What is the governance committee's role in building an effective board?

The governance committee plays a central role in building and managing the board's effectiveness through its responsibility for attracting, evaluating, developing and retiring directors.

Organizations and their needs change over time. The governance committee should develop a strategy to anticipate these changes and manage and adjust the board's composition as necessary so the board continues to have the collectiveexpertiseand chemistry it requires to carry out its responsibilities effectively.

To build its board composition strategy, the governance committee needs to confirm:

the board's role in strategy and risk oversight for the organization;

the aggregateexpertiseand knowledge required of the board;

the skills, competencies,expertiseand relationships required of individual directors, and the board's priorities regarding those skills and the trade-offs among them...

CAS 220:Assignment of Engagement Teams (Ref: Para.14)

A11.An engagement team includes a person usingexpertisein a specialized area of accounting or auditing, whether engaged or employed by the firm, if any, who performs audit procedures on the engagement. However, a person with suchexpertiseis not a member of the engagement team if that person's involvement with the engagement is only consultation. Consultations are addressed in paragraphs18,A22and A23.

A12.When considering the appropriate competence and capabilities expected of the engagement team as a whole, the engagement partner may take into consideration such matters as the team's:

Understanding of, and practical experience with, audit engagements of a similar nature and complexity through appropriate training and participation.

Understanding of professional standards and applicable legal and regulatory requirements.

Technicalexpertise, includingexpertisewith relevant information technology and specialized areas of accounting or auditing.

Knowledge of relevant industries in which the client operates.

Ability to apply professional judgment.

Understanding of the firm's quality control policies and procedures.

CAS 315:Objectives and Strategies and Related Business Risks (Ref: Para.11(d))

A39.Examples of matters that the auditor may consider when obtaining an understanding of the entity's objectives, strategies and related business risks that may result in a risk of material misstatement of the financial statements include:

Industry developments (a potential related business risk might be, for example, that the entity does not have the personnel orexpertiseto deal with the changes in the industry).

CAS 540: Developing a point estimate or range

A91.The auditor may develop a point estimate or a range in a number of ways, for example, by:

Using a model, for example, one that is commercially available for use in a particular sector or industry, or a proprietary or auditor-developed model.

Further developing management's consideration of alternative assumptions or outcomes, for example, by introducing a different set of assumptions.

Employing or engaging a person with specializedexpertiseto develop or execute the model, or to provide relevant assumptions.

Making reference to other comparable conditions, transactions or events, or, where relevant, markets for comparable assets or liabilities.

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...

C

Direct quote(s) from the Case with citation

Section/subsection citation reference ANDsearch term(s)used In CoCo:safeguardwith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used In ROGC:safeguardwith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used In CAS:safeguardwith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

"Sarah noted that there seem to be fewer controls at PonyUp than she is used to at Animal Galaxy..."

Once Megan and I both signed different cheques to pay the same computer supplier. When we called the supplier to ask for a refund, he told us he had sold us two computers, although we have only one in the office."

Page 109, paragraphs 4, 7

CoCo - Nature of Control

6Control comprises those elements of an organization (including its resources, systems, processes, culture, structure and tasks) that, taken together, support people in the achievement of the organization's objectives. These objectives may fall into one or more of the following general categories.

Effectiveness and efficiency of operationsincludes objectives related to an organization's goals, such as customer service, thesafeguardingand efficient use of resources, profitability and meeting social obligations. This includes thesafeguardingof the organization's resources from inappropriate use or loss and ensuring that liabilities are identified and managed.

Capability

Design and integration

96Other control activities may be performed solely to increase the assurance of reliable performance, such as measures forsafeguardingassets through safes, alarm systems, passwords and so on. These activities usually cost time and money, and restrict people's autonomy. The decision to add control activities should take into account costs, benefits, and what residual risks are acceptable.

ROGC 20Q...Codes of Conduct

Topics that may be included in Codes of Conduct

The following topics (listed in alphabetical order) are typical of those found in Codes of Conduct. This is not intended to be an exhaustive list but may be helpful when reviewing the content of a Code. Except in the largest organizations, Codes will rarely cover such an extensive number of topics....

32.Safeguardingassets and responding to thefts or misappropriation

CAS 200

Ethical Requirements Relating to anAudit of Financial Statements (Ref: Para.14)

CA16.In the case of an audit engagement it is in the public interest and, therefore, required by the relevant independence and other ethical requirements, that the auditor be independent of the entity subject to the audit. The relevant independence and other ethical requirements describe independence as comprising both independence of mind and independence in appearance. The auditor's independence from the entitysafeguardsthe auditor's ability to form an audit opinion without being affected by influences that might compromise that opinion. Independence enhances the auditor's ability to act with integrity, to be objective and to maintain an attitude of professional skepticism. [In ISA 200 the first and second sentences state: In the case of an audit engagement it is in the public interest and, therefore, required by the IESBA Code, that the auditor be independent of the entity subject to the audit. The IESBA Code describes independence as comprising both independence of mind and independence in appearance.]

Relevant Ethical Requirements

dependence

11.The engagement partner shall form a conclusion on compliance with independence requirements that apply to the audit engagement. In doing so, the engagement partner shall: (Ref: Para.A5)...

(c)Take appropriate action to eliminate such threats or reduce them to an acceptable level by applyingsafeguards, or, if considered appropriate, to withdraw from the audit engagement, where withdrawal is possible under applicable law or regulation. The engagement partner shall promptly report to the firm any inability to resolve the matter for appropriate action. (Ref: Para.A6-A7)

Threats to Independence (Ref: Para.11(c))

A6.The engagement partner may identify a threat to independence regarding the audit engagement thatsafeguardsmay not be able to eliminate or reduce to an acceptable level. In that case, as required by paragraph11(c), the engagement partner reports to the relevant person(s) within the firm to determine appropriate action, which may include eliminating the activity or interest that creates the threat, or withdrawing from the audit engagement, where withdrawal is possible under applicable law or regulation.

Considerations Specific to Public Sector Entities

A7.Statutory measures may providesafeguardsfor the independence of public sector auditors. However, public sector auditors or audit firms carrying out public sector audits on behalf of the statutory auditor may, depending on the terms of the mandate in a particular jurisdiction, need to adapt their approach in order to promote compliance with the spirit of paragraph11. This may include, where the public sector auditor's mandate does not permit withdrawal from the engagement, disclosure through a public report, of circumstances that have arisen that would, if they were in the private sector, lead the auditor to withdraw.

CAS 240

Opportunities

Certain characteristics or circumstances may increase the susceptibility of assets to misappropriation. For example, opportunities to misappropriate assets increase when there are the following:...

Inadequate internal control over assets may increase the susceptibility of misappropriation of those assets. For example, misappropriation of assets may occur because there is the following:...

Inadequate physicalsafeguardsover cash, investments, inventory, or fixed assets.

CAS 260

Auditor Independence

17.In the case of listed entities, the auditor shall communicate with those charged with governance:...

(b)...; and(ii)The relatedsafeguardsthat have been applied to eliminate identified threats to independence or reduce them to an acceptable level. (Ref: Para.A21-A23)

Auditor Independence (Ref: Para.17)

A21.The auditor is required to comply with relevant ethical requirements, including those pertaining to independence, relating to financial statement audit engagements.⁹

A22.The relationships and other matters, andsafeguardsto be communicated, vary with the circumstances of the engagement, but generally address:

(a)Threats to independence, which may be categorized as: self-interest threats, self-review threats, advocacy threats, familiarity threats, and intimidation threats; and

(b)Safeguardscreated by the profession, legislation or regulation,safeguardswithin the entity, andsafeguardswithin the firm's own systems and procedures.

CAS 315

Controls Relevant to the Audit

A70.Internal control oversafeguardingof assets against unauthorized acquisition, use, or disposition may include controls relating to both financial reporting and operations objectives. The auditor's consideration of such controls is generally limited to those relevant to the reliability of financial reporting.

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...

D

Direct quote(s) from the Case with citation

Section/subsection citation reference ANDsearch term(s)used in CoCo:cheque, invoice, authorizewith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used in ROGC:cheque, invoice, authorizewith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s)used in CAS:cheque, invoice, authorizewith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

"...Mrs Devanney is always getting me to sign cheques. Sometimes I don't see the related invoice, but I know Mrs. Devanney will have it...All three of us are able to sign cheques and only one signature is require which sometimes gets confusing. Once Megan and I both signed different cheques to pay the same computer supplier. When we called the supplier to ask for a refund, he told us he had sold us two computers, although we have only one in the office."

Page 109, paragraph 7

Guidance on Control

PURPOSE

More detailed objectives

2Sometimes the "cascading" of objectives from the overall level to the local level will follow the organization's hierarchy. For example, the chief financial officer will hold the controller responsible for the integrity of financial information to support decision-making; the controller will hold the accounts receivable group responsible for the accurate recording ofinvoicesand receipts to customer accounts, and so on. In other cases, the cascading will follow supplier / customer relationships between teams, departments or work units. Sometimes a local unit will need information or supporting action from more senior levels of the organization in order to achieve its objectives. Then, the "cascade" flows upwards in the hierarchy, in that local objectives drive the objectives and actions of more senior levels.

Capability

C5Control activities should be designed as an integral part of the organization, taking into consideration its objectives, the risks to their achievement, and the inter-relatedness control elements.

Design and integration

98Examples of common control activities include observing, comparing, approving, reporting, coordinating, checking, analyzing,authorizing, reconciling, supervising, reviewing, segregating, and following-up. Control activities are not limited to traditional accounting processes. For example, a hospital will provide secure storage for dangerous drugs, and a chemical company will balance bulk liquid chemicals to records periodically as part of its routine inventory control system.

No relevant hits

CAS 330

Tests of Controls

Designing and Performing Tests of Controls (Ref: Para.8)

A23.In addition, the auditor may design a test of controls to be performed concurrently with a test of details on the same transaction. Although the purpose of a test of controls is different from the purpose of a test of details, both may be accomplished concurrently by performing a test of controls and a test of details on the same transaction, also known as a dual-purpose test. For example, the auditor may design, and evaluate the results of, a test to examine aninvoiceto determine whether it has been approved and toprovide substantive audit evidence of a transaction. A dual-purpose test is designed and evaluated by considering each purpose of the test separately.

CAS 505

Designing Confirmation Requests (Ref: Para.7(c))

A4.Factors to consider when designing confirmation requests include:...

The ability of the intended confirming party to confirm or provide the requested information (for example, individualinvoiceamount versus total balance).

CAS 240

Examples of Circumstances that Indicate the Possibility of Fraud

The following are examples of circumstances that may indicate the possibility that the financial statements may contain a material misstatement resulting from fraud.

Discrepancies in the accounting records, including:

Transactions that are not recorded in a complete or timely manner or are improperly recorded as to amount, accounting period, classification, or entity policy.

Unsupported or unauthorized balances or transactions.

Last-minute adjustments that significantly affect financial results.

Evidence of employees' access to systems and records inconsistent with that necessary to perform theirauthorizedduties.

Tips or complaints to the auditor about alleged fraud.

CAS 315

A105.Application controls are manual or automated procedures that typically operate at a business process level and apply to the processing of transactions by individual applications. Application controls can be preventive or detective in nature and are designed to ensure the integrity of the accounting records. Accordingly, application controls relate to procedures used to initiate, record, process and report transactions or other financial data. These controls help ensure that transactions occurred, areauthorized, and are completely and accurately recorded and processed. Examples include edit checks of input data, and numerical sequence checks with manual follow-up of exception reports or correction at the point of data entry.

Additional Hits Found

CAS 500

Definitions

.For purposes of the CASs, the following terms have the meanings attributed below:

(a)Accounting records - The records of initial accounting entries and supporting records,such as checks and records of electronic fund transfers;invoices; contracts; the general and subsidiaryledgers, journal entries and other adjustments to the financial statements that are not reflected in journal entries; and records such as work sheets and spreadsheets supporting cost allocations, computations, reconciliations and disclosures.

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...

E

Assignment 1,

Direct quote(s) from the Case with citation

Section/subsection citation reference ANDsearch term(s) .....used In CoCowith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s.....)used In ROGCwith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

..."To maintain the horses' health, PonyUp's policy states that a horse should not be ridden for more than three hours per day.

Megan noted that some horses seemed tired and that one had definitely been ridden for more than three hours that day. Megan checked the schedule, and only one three-hour session had been scheduled for that horse, so she concluded it must have been an anomaly."

Page 113, paragraph 2, 3

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...

Assignment 1,

Direct quote(s) from the Case with citation

Section/subsection citation reference ANDsearch term(s) .....used In CoCowith appropriate reference to section and subsection

Section/subsection citation reference ANDsearch term(s.....)used In ROGCwith appropriate reference to section and subsection

Narrative Allocation of Responsibility section by section, subsection by subsection.

Narrative LINKS to case facts

"Receptionist - The receptionist collects all payments made on site and hands them over to Mrs. Devanney for deposit and updating of the records. Since a horse can be ridden for a three-hour session per day, a calendar is maintained that shows the riding schedule for each horse. Occasionally, Mrs. Devanney asks the receptionist to collect money from a rider who is not listed on the schedule. When this occurs, the money is collected and a note is made for Mrs. Devanney. The receptionist has been instructed not to make the note directly on the schedule "so as not to confuse things."

Page 114, point 11, paragraph 5

CoCo

OWNER/TCWGis responsible to fulfill the ...duty to...

ROGC

OWNER/TCWGis responsible to fulfill the ...duty to...

CAS

CPA/External Auditoris responsible to...

LINKS

The case facts indicate ...failures by the ownersto fulfill ...

CPA/External Auditor, learning the facts of...must...