Imagine that you work as an internal auditor for a company that owns several pharmacies throughout the city. Based on your audit plan, the first cycle to audit will be revenue. The first thing you do is document the processes related to receiving and processing the various sources of income. On your initial visit, you were able to observe the following:
Once customers have the items to purchase, they head to the register, where a clerk processes the sale. The pharmacy has three cash registers, but does not have an employee who specifically works as a cashier at each one. This provides flexibility in the operation because, of the three employees that the business has, one can collect at any of the cashiers when available. By not having to leave a single person as a cashier, the cashier can focus on providing more direct customer service, refilling merchandise on the shelves, and even assisting in receiving or dispatching merchandise from the store.
At the beginning of the shift, the assistant manager is in charge of preparing the three cash registers for operation. He collects, in the store office with the administrative officer on duty, the money for change (petty cash) that each cash register will have. The boxes contain $80.00 each in bills of different denominations and coins. The supervisor signs a log indicating that he receives the money from each cash register and places it at the point of sale in the store.
Pharmacies accept payments in cash or with debit or credit cards. Most transactions are made with cash. The clerk receives the customer's cash, gives him the change, and issues a receipt for the purchase.
Credit card sales are made in the usual way. The clerk swipes the card and gets online approval from the card issuer at the time of sale. The customer then signs the credit card slip, which he places in the cash register drawer. The customer receives a purchase receipt and a copy of the credit card receipt.
A new payment method that has been recently implemented is the use of QR codes to carry out electronic transactions without the need to use cash or cards. Once the cashier registers the purchase at the register, he uses the automatic payment terminal, enters the amount and waits for the customer to scan the QR code. Then, he communicates via bluetooth with the terminal registering the payment. Once the payment is processed by the terminal, the cashier completes the transaction at the cash register and delivers the electronic payment receipt and the cash register receipt to the customer.

At the end of the day, the supervisor closes each vending terminal and generates the cash register transaction report. Then, return the cash registers containing the collected cash, debit and credit card receipts, and the cash register transaction report to the administrative officer in the manager's office. The supervisor signs a register certifying that he delivered the cash drawers.
The administrative officer is in charge of balancing the boxes. First, he counts the cash from the sales made and then adds the debit and credit card sales. This already includes the transactions that were made with the QR code, since they are processed as electronic debits. On the other hand, the officer is also in charge of closing the electronic terminals. First, he prints a receipt for the transactions processed, compares them to those processed by the cash register, notes any discrepancies, and transfers the electronic deposits to the bank. Using a stand-alone computer, the officer records the total sales amounts in the sales journal and in the general ledger cash and sales accounts. Then, he prepares a deposit slip which will be used to deposit the cash. The money, along with the deposit slip, remains locked in the manager's office. At the end of the day the manager or assistant manager goes to the bank and deposits the cash through the night deposit section.

2. Analyze the threats and physical risks of internal control in this system. Base your answer on the six (6) categories of physical control activities specified in the COSO (Committee of Sponsoring Organizations of the Treadway) internal control model: transaction authorization, segregation of duties, supervision, accounting records, access control, and independent verification.