Controls:

[I recommend starting with the questions and then reading the relevant portions from the E-mail

E-mail from Partner: Hi Team, I hope all is well. Thank you for drafting all those questions to ask the CEO & CFO. I and Mike have asked your and other questions are we received the following information: Looks like much of my initial details were correct regarding the BOD and their relationship with the CEO and his family. A. GENERAL CONTROL ENVIRONMENT: The company has a business performance control whereby the CFO prepares a summary report of how the company performed in terms of sales, account receivables collected and written-off, expenses from budgets are compared to actual expenses, analysis of PP&E and related depreciation expense. This business performance report is reviewed by the CEO quarterly (Control 1). a. Another control is around preparation of the quarterly 10Q and annual 10K report. The Controller along with the 3 accountants will prepare these reports every quarter and at the end of the year. The CFO reviews these reports and reviews for accuracy and these reports are finally sent to the CEO for approval. (Control 2) Once the CEO approves the reports are filed with the SEC. b. At the end of every quarter and year end after the 10Q and 10K the CEO & CFO meet with the Board of Directors to update them on the performance of the company and answer any questions. c. The Board of Directors meets on a quarterly basis. (Control 3). d. Barry Dallas serves as the Chief compliance officer and is in charge of writing the companies policies around operations (how the company operates), and checking to make sure that employees and the company adhere to the policies, and is expected to provide an annual update to the CEO and Board of Directors (Control 4). e. Although Barry holds this position part time and spends most of his time managing the IT service business for a few large customers. Also Barry seems to be busy and when we asked to share a copy of the policies and his summary report he shared what appeared to be a policy manual that was several years old and he cant remember the last time the CEO or BOD asked him to provide an update on compliance matters.

f. The CEO sends occasional e-mails that also to reinforce any recent issues or findings. For example the CEO showed me an e-mail he recently sent reminding staff that they are not permitted to take office supplies like pens or Keurig cups home for personal use as this is a violation of company policy. B. SALES PROCESS: All sales are processed in house at the Time Square office by a team of 5-10 people. All sales for IT services go through their website, App, or on a rare occasion by phone.The companys website/app results in the creation of a purchase order. All purchase orders are then manually entered into an excel spreadsheet that is stored on a shared drive (Control 6a).The sales team can also download a total sales reports from the App and Website which summarizes all electronic sales for the day/week/month and compare to the spreadsheet maintained (Control 6b), but because of time restrictions this isnt performed regularly. (Both the App and Website are hosted on the Amazon cloud (AWS).) Its not clear whether this is covered by a SOC 1 report over AWS. Four copies of the sales order are then created for each purchase order (Control 7). One copy is filed away in a shared drive folder, two copies are sentto the accounts receivable department for credit approval along with the original purchase order, and one copy is sent to the customer. The accounts receivable department performs a manual review of the sales order based on credit score/history of past payments/etc. (Control 8a) and then can approve or reject the sales order. If approved the Acct Rec dept. stamps the 2 copies of the sales order electronically as approved and sends one copy of the approved sales order to the sales department. If rejected then the 2 copies of the sales order are electronically stamped as rejected and one copy is sent to the sales dept. The Sales department files away the remaining copy of the approved/rejected sales order in an electronic folder(Control 8b). The Acct Rec dept. files its copy of the approved/rejected sales order and the original purchase order in its own electronic folder(Control 8c).

C. RECEIVABLES/CASH PROCESS: The account receivables department consists of 3-5 people who track all the account receivables, approve giving credit to customers, determine credit limits for customers, track payments received from customers, send bills to customers, receive cash and wires from customers in bank stmt. a. This department also manages payment, tracking of expenses, and preparing expense reports for review of the controller. They keep track of invoices that are received by mail or e-mail in an excel file. This happens throughout the day on a needed basis but at least once daily (Control 9). The company has a checkbook that is maintained in a locked drawer all 3-5 staff members have access to this key and any person can prepare the check, they also have virtual access to their bank account where they can use Zelle, or other payment options to make electronic payments. These payments are made throughout the day as needed but at least once daily (Control 10a). All 3-5 employees are authorized to sign checks for approval, no other employees from other departments can sign or approve checks or access the bank account via the bank Website. Annually the employees access to this is renewed or removed based on employees coming in and out of the department. The last review of employees with proper access was performed in January (Control 10b). Any payments above $1M require approval by the CFO. This is performed on a need basis as payments this large are not common. There were four instances of this approval during the year (Control 10c). A log is kept of all checks/wires prepared, whoever prepares the check is supposed to update the log, the log is kept in a shared drive all employees can access. This checklist is supposed to be updated at the end of each day but is performed at least once weekly. (Control 11). In busy times the log can get behind, and needs to be updated at the end of the month to be kept accurate.

b. This department also prepares monthly bank reconciliations (Control 12). This department also manages any checks for payments of account receivable that are received by using a special P.O. box (Control 13).

c. The head of this department was recently fired for violating some company policies related to using money for personal expenses.

d. (continued from above) The department also uses the approved sales order to record the receivable in an excel spreadsheet and uses this spreadsheet to keep track of account receivables afterwards (future payments by customer or additional credit issued), a new tab is created for new customers, and a summary tab is created (Control 14).

D. MARKETING PROCESS: Marketing team handles all sales and consists of interns, a few new hires, the team is 5 people and the company hires outside advertising companies to manage marketing. The head of marketing is an experienced professional who used to work in sales.

E. PAYROLL PROCESS: The company has outsourced processing of salaries expense to ADP. ADP provides a SOC 1 report over controls used to calculate salaries and make the appropriate payments. The SOC 1 has a clean opinion according to the Treasurer/Controller, who says they review this report annually (Control 5).

F. HR PROCESS: The company has outsourced HR function to indeed.com for finding new employees. Each department can hire more people as needed when people quit or there is a need for more staff, this request needs approval from the CFO/CEO and must be reported to ADP. a. New Hires complete a new hire package that is sent to Indeed. b. All new hires have to read the company policy manual when hired, and are assigned a new hire buddy that shows them their job/role. The office secretary works with building security to get them an office key/badge. The Secretary puts in a request to Amazon Cloud service and the internal IT office to get them a laptop and access to all the company software. There is one secretary another secretary recently quit but a replacement has not been found in the last 2 months.

G. INVENTORY PROCESS: The company has an R&D team in the US and in India that works on updates to the software and devices that the company sells. Consultants are hired as needed with CEO approval as necessary.

a. Manufacturing is outsourced whenever possible, and the company outsources shipping, storage and delivery of devices to Amazons Supplier service. Although the company does have some manufacturing facilities that the company owns, including all related equipment inside the facilities. As equipment reaches the end of its useful life it is sold for scrap, and new equipment is purchased as needed. The Chief operating officer (COO) Jeffries Fricky is in charge of manufacturing. The COO also oversees the inventories process as well and provides inventory reports to the accounting team which calculates cost of goods sold, and ending inventory using the FIFO method.

Frankie Georgiou | Partner Queens College Auditors LLP 65-30 Kissena Blvd. Flushing, NY 11367

Recent Event On March, 2020, Technology, Inc. had $139,690 in notes payable, $180,579 in accounts payable, and $2 million in long term debt. As a result of lower sales as a result of the COVID shutdown, the company was not be able to pay this all of these liabilities when their portion came due in April 2020 and the company ended up in default. However upon further investigation it was noted the shortfall was primarily caused by missing $3,600,000 in the cash account. Upon investigation it was determined that four employees had written checks to be paid for the same expense and for the debt that was coming due as everyone was working from home and did not communicate with others. The multiple payments in a short period of time caused an over withdrawal of cash. This was caught when some of the checks/wires bounced and when the CFO performed a bank reconciliation when he returned from vacation overseas. He was on vacation during the week these checks were written and did not approve them, even though some were in excess of $1 million. It was also determined that no one was completing the log for control 11 on a daily basis. It was determined that Control 9, 10a, 10b, and 11 may not have been executed correctly. Key Controls Some of the key controls the company has are: Control 9- Invoices received are kept track of using an excel file. (See above for more details.) Control 10a- a checkbook is maintained in a locked drawer Electronic access to the Bank Accounts website is also restricted. Three to five staff members from the department have access to the physical and electronic website. This helps prevent unauthorized access to the companys cash. (See above for more details.) Control 10b- Access by employees to the drawer and the bank website is reviewed annually. (See above for more details.) Control 10c- Any payments above $1M require approval by the CFO. (See above for more details.)

Control 11- A log is kept of all check/wire payments. (See above for more details.) Questions for Student to answer: 10) Did controls 9, 10a, 10b, & 11 work effectively during the year?

Control 9 Control 10a Control 10b Control 10c Control 11 A) YES A) YES A) YES A) YES A) YES B) No B) No B) No B) No B) No

11) Are controls 9, 10a, 10b, & 11 preventive or detective controls?

Control 9 Control 10a Control 10b Control 10c Control 11 A) Preventive A) Preventive A) Preventive A) Preventive A) Preventive B) Detective B) Detective B) Detective B) Detective B) Detective

12) Are controls 9, 10a, 10b, & 11 manual, automated, or IT dependent manual control? (a) Manual, (b) Automated, or (c) IT Dependent Manual? Control 9 Control 10a Control 10b Control 10c Control 11 A) Manual A) Manual A) Manual A) Manual A) Manual B) Automated B) Automated B) Automated B) Automated B) Automated C) IT Dependent Manual C) IT Dependent Manual C) IT Dependent Manual C) IT Dependent Manual C) IT Dependent Manual

13) Is the failure in the control(s) indicative of an (a) Control Deficiency; (b)Significant deficiency; (c) A Material Weakness? Explain why briefly. (Compare the potential error to the materiality you calculated above, think about severity and likely hood of the control deficiency, see the PPT slides for more details on making this determination.) 13.__________________________________________________________________________________ _____________________________________________________________________________________