INTRODUCTION OF THE CASE SUMMARY AND PLEASE TRY T ANSWER THIS ISSUE PLEASE

DESKTOP SOLUTIONS: AUDIT OF THE ST. LOUIS BRANCH In 1995 a team of auditors from the Internal Audit staff of Desktop Solutions Inc., an electronic distributor, audited the St. Louis branch of the Operations Group. Their audit report included the following overall judgment: In our opinion, the St. Louis branch's administrative process was unsatisfactory to support the attainment of branch business objectives. The auditors noted that many of the branch procedures were working effectively, but they found major deficiencies existed in the branch's equipment control and order entry processes. This case focuses on the areas of the audit that led to the unsatisfactory audit judgment. It describes what the auditors did, what they found, and how management responded. DESKTOP SOLUTIONS, INC. Desktop Solutions produced a broad line of printing and scanning systems for desktop printing applications. In 1995 the company's revenues were over $400 million (see Exhibit 1). The company's printers and scanners were available for rental or purchase. All rental plans in the United States included maintenance, service and parts. For equipment purchase, Desktop Solutions offered financing plans over two- to five-year periods with competitive interest rates. Some equipment was sold with trade-in privileges. The company also sold supplies, such as toner, developer, and paper. Desktop Solutions' worldwide marketing and sales organization marketed directly to end- user customers. The company also used some alternate channels, including retail stores, direct mail and sales agents. It also maintained worldwide networks of regional service centers (for servicing products) and distribution centers (for sales of parts and consumable supplies). OPERATIONS GROUP The Operations Group (OG) was the North American sales, marketing and service operation within Desktop Solutions' Operations Division. Within the OG the most important line organizations were the branches. They represented Desktop Solutions' direct interface with customer and were responsible for fulfilling all their equipment and servicing needs. Until the late 1980s the management of the branches in OG had been highly decentralized. The decentralized organization was abandoned in late 1980s and early 1990s in favor of a function type of organization, which allowed for more direct control over branch functions by regional headquarters. Under the function organization each branch was run by three parallel functional managers - a branch sales manager, a branch control manager (or branch controller), and a branch technical services manager - each of whom reported directly to the 2 respective function manager at the regional level (see Exhibit 2). The sales manager was responsible for all sales and leasing of Desktop Solutions product in the branch territory. The control manager was in charge of all the internal operating, administrative, and financial reporting systems, such as order entry, accounts receivable, equipment control, and personnel. The technical service manager was responsible for the installation, servicing, and removal of sold and leased equipment. The most difficult challenge with the new functional organization was maintaining good communication between personnel in the different functions of the branch. Frequent and effective communications were also important for achieving customer satisfaction, which was the most importance branch success factor. Good communications were required to ensure that equipment would be installed promptly, that billings would be accurate, and that problems would be resolved with a minimum of hassle. INTERNAL AUDIT Internal audit had been a centralized function at Desktop Solution since 1980. The function was centralized in order to increase auditor independence and to improve the professionalism of the staff. In 1995 the internal audit organization consisted of 15 people, headed by Steve Kruse, who reported to the chief financial officer, Scott Pepper. Two features of the Desktop Solutions Internal Audit (IA) organization were unique as compared with the internal audit groups in most corporations. First, the IA personnel had diverse backgrounds, and internal audit was not considered a career objective for most of them. The accounting/auditing personnel, who predominated on many corporate internal audit staffs, were in the minority, only three of the IA personnel were CPAs. The others were trained in a variety of discipline including engineering, marketing, computer science and liberal arts. Nine of the staff came into IA from outside Desktop Solutions. An initial assignment in IA was perceived as a good introduction to the company and a good training ground for moving into line operation. Most staff auditors did, in fact move into the operations side of the company after gaining a few years' IA experience. Second, the IA charter was very broad. The listing of 1A functions (see Exhibit 3) showed that IA was expected to be involved in the development, not just the testing, of operational and internal controls. Exhibit 4 describes the different types of audits the IA staff performed and the allocation of audit resources among them in 1995. Most of the audits were planned at headquarters, as part of the review of the company's controls. However, IA also received requests for services from line managers. In recent years the number of such requests had exceeded IA's capacity. Balancing the needs for regular audit cycles with the needs for special services requested was the difficult part in preparing the IA plan. Audit plans were approved by the audit committee of the board of directors, which was given regular progress reports throughout the year on each audit. After executing an audit IA staff gave formal presentations to senior line management detailing their results and recommendations. They also followed up at a later date to see if the deficiencies had been corrected and the recommendations had been implanted. AUDIT OF THE ST.LOUIS BRANCH The St. Louis branch was selected for audit in 1995 for three reasons. First, the 1995 Master Audit Plan called for a number of large branch audits. The St. Louis branch, which served customers in Missouri, Illinois, and Kansas, was one of the largest of OG's 52 branches. In 1995 it earned revenue of $7.6 million and had a sale/lease equipment inventory of 7,710 machines. Second, a 1993 audit of the St. Louis branch had uncovered deficiencies in branch equipment control, and IA management thought this would be a good time to verify if improvements had been implemented. And third, a new branch control manager (branch controller) was recently hired, and the audit would give the new control manager a chance to work with the auditors and learn about the branch's system and problems. The IA audit team and the new controller arrived at the St. Louis branch on the same day. The objective of the audit was to determine whether the branch administrative/control process were well defined, executed, and managed to ensure: (1) controlled and documented equipment movement and tracking; (2) timely accurate order entry; (3) proper customer billing and adjustment; and (4) effective collections activity. On the St. Louis audit, like most branch audit, the auditor focused most of their attention on equipment inventory and account receivable. These were the two largest branch balance sheet items, and both were under the direct control of the branch manager. EQUIPMENT CONTROL/BILLING Equipment control (EC) involved the tracking of equipment movement in and out of the branch's physical inventory and the simultaneous triggering of changes in customer billings. EC was critical to the branch's ability to schedule, deliver and install machines for Desktop Solutions customers, and to be paid for the equipment the customers used. The key control personnel in EC were the order administrators (OAS), the equipment administrator (EA), and the schedulers. The OAs were responsible for editing incoming orders, entering the orders into the computer system, keeping track of the orders after they were sent to scheduling, and processing the install transactions (install date, serial number, meter reads). The EA was responsible for the accuracy of inventory records, and the timely resolution of equipment discrepancies that delayed orders from being completed. The EA maintained the Non-Revenue Report (NRR), a computer-generated inventory listing (by equipment serial number) of all branch equipment not installed at a customer location. The NRR was updated daily with information about new installations and cancellations. At the beginning of the each month the EA took a physical inventory of all equipment at the warehouse, matched it with the NRR, and reconciled the differences. Equipment on the NRR not found at the warehouse was reclassified as uninventoriable (lost). If it was not found within 90 days the branch was charged for the net book value of the lost equipment. The process for cancellation and deinstallation of equipment was very similar. The schedule matched the orders with the equipment shown as available on the NRR. A target delivery date (ideally two days) was transmitted to the rigger who delivered the equipment (by serial number indicated). Exhibit 5 shows a simplified flowchart of the process used in the St. Louis branch for order-entry and installation of the high-end printing and scanning systems. Personnel in the control function of the branch played a central communication role, transmitting the order information from the sales representatives to the trigger (warehouse) personnel and branch technical service personnel. They also processed the information about installations so as to trigger the customer billing. Some low-end systems were delivered and installed by the sales representatives (reps). When this was done the equipment control process was simplified because the rep was responsible for delivering the order paperwork and the printer serial number to the OA for entry into the computer system. While their operations were quite similar, the branches used slightly different administrative processed and personnel roles. OG management elected not to use a detailed, centralized set of administrative processes for all branches. They preferred allowing the branch managers to tailor their branch's processes to the local conditions. AUDIT PROCEDURES The audit fieldwork at the St. Louis branch took a team of six auditors approximately two months to complete. Exhibit 6 describes the tested performed on the equipment control process. About 40% of the audit time was devoted to equipment control procedures. Initially the IA personnel conducted background interviews with key branch personnel. They also reviewed organization charts and prepared detailed flow charts of the order entry, scheduling and equipment control processes. This was done to understand how the branch operated, to determine the degree of compliance with company procedures, and to determine the efficiency of branch personnel. Potential problem areas were noted for special attention during the audit fieldwork. In addition to equipment control the auditors also tested several other areas, including customer billing for equipment, supplies and servicing (for accuracy and timeliness), price plan conversion (for compliance with company procedures), order entry and cancellation processes (for accuracy and efficiency), credit and collections, and order-to-installation time lag. Each of these areas represented a cycle or process activity that was important to the operation of a branch. FINDING - EQUIPMENT CONTROL The auditors found that management failed to define responsibilities clearly or hold the EA accountable for his performance. Branch management was not involved in the monitoring and maintenance of the equipment control process. And control management did not maintain effective contact with marketing and service management to ensure that the equipment control process was operating properly. Exhibit 7 describes some of the deficiencies found. However, the branch was rated very good in other areas, and the auditors noted that the However, the branch was rated very good in other areas, and the auditors noted that the negative impacts from the deficiencies in the equipment control area seemed to be effectively minimized. 5 Although the delayed equipment transaction processing contributed to incorrect billings and an increased rate of costly billing adjustments, overall the billing function was sufficiently well organized and controlled to be able to absorb the pressures generated. The billing adjustments reviewed were highly accurate, and resolution of customer inquiries was satisfactory. The credit and collection program was well administered; performance budgets were consistently met, and adjustment and write-off activity was well controlled. (Auditors' Note) RECOMMENDATIONS AND FOLLOW-UP On July 14, 1995 the audit team presented a final listing of the recommendations to the branch managers. Shortly thereafter they prepared a formal audit report to all OG management responsible for the St. Louis branch operations. In the audit report the auditors presented a list of 46 recommendations. Most of these were directed to the new branch control manager, and generally related to one or more of the following: 1. The reconciliation between the physical inventory and the inventory records (NRR) should be completed 2. The deficient equipment processes should be studied, refined, and documented. 3. The individuals involved in equipment control should be given clearly defined responsibilities, and be held accountable for the accuracy of the equipment reports and billings. Ultimate responsibility for correcting deficiencies rested with line management (branch manager), not with IA. Company policy required the branch managers to prepare an action plan to address each of the deficiencies and recommendations made in the audit report. The last written response to the auditors' recommendations came from the St. Louis branch control manager on December 15, 1996. He addressed each of the auditor's recommendations and noted that most of them had already been implemented. Company policy also required that someone independent of both IA and branch management be assigned to monitor progress in implementing the audit recommendations. In OG this was usually someone from the headquarters finance staff. REACTIONS Martha Sorensen (IA manager) reflected on the audit: The St. Louis branch had been recognized for some time as a problem branch. In most of the branches many of the systems and administrative procedures go back to the days when the branches were run by a single branch manager, and the branches that were not well run in those days tended not to get going well when we switch to the functional organization. So going into 6 6 the audit, we had a good idea we would find some problems, and the result of the audit confirmed this judgment. I hope we're now well on the way to getting the problems ironed out. Phil Phillips, Region 3 manager, responded to the disclosure of the St. Louis branch's ongoing equipment control problem: Exhibit 1 Summary income statement, Desktop Solution Inc. (S millions) Year Ended December 31 1994 1995 $228.1 156.6 387.7 $262.2 176.3 438.5 Operating revenue Rentals and services Sales Total operating revenues Cost and expenses Cost of rentals and services Cost of sales 101.6 77.9 116.2 80.6 25.9 1446 350.0 30.1 159.8 386.7 Research and development expenses Selling, administrative and general expenses Total cost and expenses Operating income Other income (deductions), net Income before income tax Income tax Income before outside shareholders' interests Outside shareholders' interest Income from continuing operations Discontinued operations Net income 37.6 (9.4) 28.2 7.8 20.4 51.3 (2.4) 49.4 13.6 35.8 5.9 29.9 3.5 16.9 2.6 $19.5 1.2 $31.1 Exhibit 2 Operations Group organization chart Operation Group Vice President Staff Function: Marketing Personnel Planning and Marketing Support Information System Region 1 Region 2 Region 3 Region 4 Region 5 Sales Control Technical Service Branch 1 Branch 3 Branch 2 Sales Control Technical Service Exhibit 3 Internal audit functions 1. Develop and implement a program of operational, financial, and information systems audits that best meet the requirements of the corporation; assure the integrity of operational and internal controls in protecting the assets of the company and improve operational effectiveness. 2. Assist corporate and operating unit management in identifying and developing operational, financial, and systems policies and procedures necessary to accomplish the goals and objectives of the corporation; evaluate activities through audit report findings and recommend actions to eliminate problems uncovered during audits. 3. Perform special audits in any functional area and for all levels of management as required. 4. Present the audit plan and related audit findings to the Audit Committee of the Board of Directors and corporate management. 5. Coordinate external audit activities and control-related audit fees. Ensure an optimum balance between internal and external audit work in fulfilling the basic audit objectives and obtaining annual certification of Desktop Solutions' consolidated financial statements. 6. Develop new concepts of auditing responsive to the changing business and technological environment within Desktop Solutions and maintain a professional staff skilled in the required disciplines. Exhibit 4 Audit types and 1995 plan for allocation of resources Control Environment Audits (24% of resources in 1995) Control Environment audits evaluate the organizational arrangements; financial planning and analysis, personnel policies and practices; and policy definition and communication within operating organizations. The objective is to assess the basis on which responsibility is assigned, accountability is determined, performance is measured, and overall specific controls are established. Business Entity Audits (39%) These are reviews of specific business cycle controls in a business entity such as a branch or small to medium subsidiary. Business Cycle Audits (17%) These are reviews of the seven business cycles as set forth in the Desktop Solution Compendium of Internal Controls to determine if the overall and individual cycle control objectives slated there are being met. The overall objectives tested are: authorization; accounting transaction processing and safeguarding of corporate assets. The cycle reviews will also include reviews of applicable control environment functions and tests of supporting computer controls. Financial Audits (11%) Financial audits, unless otherwise indicated, are in direct support of the support of the annual audit by our external auditors and represent independent evaluation for the purpose of attesting to the fairness, and reliability of the financial data. Systems Audit (8%) System audits are pre-implementation and post-implementation reviews and data center audits. Pre-implementation audits consider the integrity, control, performance, security and conformance with policies and standards of each system reviewed during the design and development process. Post-implementation audits determine whether cost and performance objectives are met and test the system's integrity, including controls, in its live environment. Audits of data centers assess overall performance and the date control function and address security, scheduling and utilization, control, documentation, organization, training and cost effectiveness. Exhibit 6 Audit tests performed on Equipment Control at the St Louis branch 1. Physical inventory. A total sample of 1387 equipment units was examined, including a complete (100%) examination of the units of one single product. The audit team recorded all the series numbers of the sample units found at the rigger (warehouse) and matched the numbers with those shown on the NRR. Serial numbers not matching up were given to the equipment administrator for reconciliation. 2. Scheduling process. The auditors examined the paperwork for a sample of 243 installations to see how the schedulers notified the riggers about what equipment to install. 3. Install lag test. A sample of 46 machines was examined for the timeliness of the steps in the order-to-install process, including how long the sales reps held on the orders before submitting them, how long the OAs took to enter the order directly, how long it took the schedulers to get the machine out to the customer site and then the delay before the technical service reps installed the machine, and how long the OAs take to enter the final install information correctly into the system to trigger the billing process. 4. Cancel lag test. A sample of 33 cancellations was examined for proper adherence to contract terms and cancellation policies. The auditors were looking to see if the customer cancellation notification policy was followed, if the stop billing date was appropriate, if the removal changes were correctly billed, and if the processing was done on a timely basis. 5. Low-volume copier installations. A sample of 23 low-volume copier installation was examined to see if transmission of information from the sales reps to the OAs was adequate. 6. Trails. A sample of 22 machines out for customer trial was tested for adherence to company duration guidelines and approval procedures. Exhibit 7 Partial list of internal audit findings at the St. Louis branch 1. The responsibilities of branch personnel were found to be slightly unusual in order entry and scheduling/equipment control. Some special order transactions (e.g maintenance agreement, price plan conversions) were processed by customer service assistants, not OAs. The OAs did not track order through the order-to-install process. And the information about installations and status changes went to the EA, instead of the scheduler, as at most other branches. 2. The physical inventory of 1387 mainframe and sorter units showed over 633 discrepancies when compared to the NRR. Seven weeks after the audit results were turned over to the branch, the EA had only reconciled 382 of these items, leaving 351 items unreconciled - 76 units potentially lost, 15 units potentially found, and 160 location and/or status discrepancies. At other branches, 95-100% of the inventory discrepancies 3. The scheduler had learned they could not rely on the NRR, so they kept their own equipment inventory records. They manually assigned serial number to incoming orders. To move equipment quickly they sometimes directed the rigger to deliver product directly from the receiving dock before the serial number had been recorded in the branch's inventory by the EA. They kept track of movement in or out the inventory based on information received from service personnel, but the auditors found that this listing was also inaccurate. 4. It took seven days on average from the date a machine was installed to the time the system recognized it as a valid install so that billing could begin. In addition, some documentation was missing, 3 of the 45 sampled had no credit approval, 3 had no service agreement, 4 had no valid installation date stamp. 5. The cancellation procedure was not working effectively. One hundred machines that had been returned by the customer and sent to refurbishing center had not been noted as canceled by the As, and this number had increased sharply in the prior three months. 6. The low-end printing equipment was not well controlled. Units to be delivered by the sales reps were taken from regular inventory, rather than from a special pool machines in "consignment to sales status. In nine cases (sample size approximately 39%), the sales reps did not send the serial numbers of the equipment to the OAs. In one case rigger tried to deliver a machine to a customer who had received his a week before from the sales representatives. 7. Of the machines out for customer trial only 3 of the 22 tested complied with company policy, and 5 had no approval signature. For four successful trial (i.e the customer wanted to keep the machine), the ending date was recorded improperly, resulting in 29 days of unbilled rental revenue. For eight unsuccessful trials, the removal was scheduled two days past the trial expiration. For trials were extended without approval. The average length past the normal trial duration was 17 days, while the average length past the extension deadline was 9.5 days. 8. Management failed to define responsibilities clearly or hold the EA accountable for his performance. Management did not get involved in the monitoring and maintenance of the equipment control process. Finally, control management did not maintain effective contact with marketing and service management to ensure that the equipment control process was operating properly as it affected those areas. No Issues Scenario Discussion/Alternatives Solution 1 are The functional organization not centralized for all of the branches. Therefore, there is a problem when the branches need to communicate with one another and there is barrier due to the organization. The equipment administrator took a physical inventory of all equipment at the warehouse, matched it with the Non-Revenue Report (NRR), and reconciled the differences only at thebeginning of each month. 2 3 3 The management does not hold the EA accountable when there was lots of inventory and charged the branch the net book value of the lost equipment if the equipment is not foundwithin 90 days DESKTOP SOLUTIONS: AUDIT OF THE ST. LOUIS BRANCH In 1995 a team of auditors from the Internal Audit staff of Desktop Solutions Inc., an electronic distributor, audited the St. Louis branch of the Operations Group. Their audit report included the following overall judgment: In our opinion, the St. Louis branch's administrative process was unsatisfactory to support the attainment of branch business objectives. The auditors noted that many of the branch procedures were working effectively, but they found major deficiencies existed in the branch's equipment control and order entry processes. This case focuses on the areas of the audit that led to the unsatisfactory audit judgment. It describes what the auditors did, what they found, and how management responded. DESKTOP SOLUTIONS, INC. Desktop Solutions produced a broad line of printing and scanning systems for desktop printing applications. In 1995 the company's revenues were over $400 million (see Exhibit 1). The company's printers and scanners were available for rental or purchase. All rental plans in the United States included maintenance, service and parts. For equipment purchase, Desktop Solutions offered financing plans over two- to five-year periods with competitive interest rates. Some equipment was sold with trade-in privileges. The company also sold supplies, such as toner, developer, and paper. Desktop Solutions' worldwide marketing and sales organization marketed directly to end- user customers. The company also used some alternate channels, including retail stores, direct mail and sales agents. It also maintained worldwide networks of regional service centers (for servicing products) and distribution centers (for sales of parts and consumable supplies). OPERATIONS GROUP The Operations Group (OG) was the North American sales, marketing and service operation within Desktop Solutions' Operations Division. Within the OG the most important line organizations were the branches. They represented Desktop Solutions' direct interface with customer and were responsible for fulfilling all their equipment and servicing needs. Until the late 1980s the management of the branches in OG had been highly decentralized. The decentralized organization was abandoned in late 1980s and early 1990s in favor of a function type of organization, which allowed for more direct control over branch functions by regional headquarters. Under the function organization each branch was run by three parallel functional managers - a branch sales manager, a branch control manager (or branch controller), and a branch technical services manager - each of whom reported directly to the 2 respective function manager at the regional level (see Exhibit 2). The sales manager was responsible for all sales and leasing of Desktop Solutions product in the branch territory. The control manager was in charge of all the internal operating, administrative, and financial reporting systems, such as order entry, accounts receivable, equipment control, and personnel. The technical service manager was responsible for the installation, servicing, and removal of sold and leased equipment. The most difficult challenge with the new functional organization was maintaining good communication between personnel in the different functions of the branch. Frequent and effective communications were also important for achieving customer satisfaction, which was the most importance branch success factor. Good communications were required to ensure that equipment would be installed promptly, that billings would be accurate, and that problems would be resolved with a minimum of hassle. INTERNAL AUDIT Internal audit had been a centralized function at Desktop Solution since 1980. The function was centralized in order to increase auditor independence and to improve the professionalism of the staff. In 1995 the internal audit organization consisted of 15 people, headed by Steve Kruse, who reported to the chief financial officer, Scott Pepper. Two features of the Desktop Solutions Internal Audit (IA) organization were unique as compared with the internal audit groups in most corporations. First, the IA personnel had diverse backgrounds, and internal audit was not considered a career objective for most of them. The accounting/auditing personnel, who predominated on many corporate internal audit staffs, were in the minority, only three of the IA personnel were CPAs. The others were trained in a variety of discipline including engineering, marketing, computer science and liberal arts. Nine of the staff came into IA from outside Desktop Solutions. An initial assignment in IA was perceived as a good introduction to the company and a good training ground for moving into line operation. Most staff auditors did, in fact move into the operations side of the company after gaining a few years' IA experience. Second, the IA charter was very broad. The listing of 1A functions (see Exhibit 3) showed that IA was expected to be involved in the development, not just the testing, of operational and internal controls. Exhibit 4 describes the different types of audits the IA staff performed and the allocation of audit resources among them in 1995. Most of the audits were planned at headquarters, as part of the review of the company's controls. However, IA also received requests for services from line managers. In recent years the number of such requests had exceeded IA's capacity. Balancing the needs for regular audit cycles with the needs for special services requested was the difficult part in preparing the IA plan. Audit plans were approved by the audit committee of the board of directors, which was given regular progress reports throughout the year on each audit. After executing an audit IA staff gave formal presentations to senior line management detailing their results and recommendations. They also followed up at a later date to see if the deficiencies had been corrected and the recommendations had been implanted. AUDIT OF THE ST.LOUIS BRANCH The St. Louis branch was selected for audit in 1995 for three reasons. First, the 1995 Master Audit Plan called for a number of large branch audits. The St. Louis branch, which served customers in Missouri, Illinois, and Kansas, was one of the largest of OG's 52 branches. In 1995 it earned revenue of $7.6 million and had a sale/lease equipment inventory of 7,710 machines. Second, a 1993 audit of the St. Louis branch had uncovered deficiencies in branch equipment control, and IA management thought this would be a good time to verify if improvements had been implemented. And third, a new branch control manager (branch controller) was recently hired, and the audit would give the new control manager a chance to work with the auditors and learn about the branch's system and problems. The IA audit team and the new controller arrived at the St. Louis branch on the same day. The objective of the audit was to determine whether the branch administrative/control process were well defined, executed, and managed to ensure: (1) controlled and documented equipment movement and tracking; (2) timely accurate order entry; (3) proper customer billing and adjustment; and (4) effective collections activity. On the St. Louis audit, like most branch audit, the auditor focused most of their attention on equipment inventory and account receivable. These were the two largest branch balance sheet items, and both were under the direct control of the branch manager. EQUIPMENT CONTROL/BILLING Equipment control (EC) involved the tracking of equipment movement in and out of the branch's physical inventory and the simultaneous triggering of changes in customer billings. EC was critical to the branch's ability to schedule, deliver and install machines for Desktop Solutions customers, and to be paid for the equipment the customers used. The key control personnel in EC were the order administrators (OAS), the equipment administrator (EA), and the schedulers. The OAs were responsible for editing incoming orders, entering the orders into the computer system, keeping track of the orders after they were sent to scheduling, and processing the install transactions (install date, serial number, meter reads). The EA was responsible for the accuracy of inventory records, and the timely resolution of equipment discrepancies that delayed orders from being completed. The EA maintained the Non-Revenue Report (NRR), a computer-generated inventory listing (by equipment serial number) of all branch equipment not installed at a customer location. The NRR was updated daily with information about new installations and cancellations. At the beginning of the each month the EA took a physical inventory of all equipment at the warehouse, matched it with the NRR, and reconciled the differences. Equipment on the NRR not found at the warehouse was reclassified as uninventoriable (lost). If it was not found within 90 days the branch was charged for the net book value of the lost equipment. The process for cancellation and deinstallation of equipment was very similar. The schedule matched the orders with the equipment shown as available on the NRR. A target delivery date (ideally two days) was transmitted to the rigger who delivered the equipment (by serial number indicated). Exhibit 5 shows a simplified flowchart of the process used in the St. Louis branch for order-entry and installation of the high-end printing and scanning systems. Personnel in the control function of the branch played a central communication role, transmitting the order information from the sales representatives to the trigger (warehouse) personnel and branch technical service personnel. They also processed the information about installations so as to trigger the customer billing. Some low-end systems were delivered and installed by the sales representatives (reps). When this was done the equipment control process was simplified because the rep was responsible for delivering the order paperwork and the printer serial number to the OA for entry into the computer system. While their operations were quite similar, the branches used slightly different administrative processed and personnel roles. OG management elected not to use a detailed, centralized set of administrative processes for all branches. They preferred allowing the branch managers to tailor their branch's processes to the local conditions. AUDIT PROCEDURES The audit fieldwork at the St. Louis branch took a team of six auditors approximately two months to complete. Exhibit 6 describes the tested performed on the equipment control process. About 40% of the audit time was devoted to equipment control procedures. Initially the IA personnel conducted background interviews with key branch personnel. They also reviewed organization charts and prepared detailed flow charts of the order entry, scheduling and equipment control processes. This was done to understand how the branch operated, to determine the degree of compliance with company procedures, and to determine the efficiency of branch personnel. Potential problem areas were noted for special attention during the audit fieldwork. In addition to equipment control the auditors also tested several other areas, including customer billing for equipment, supplies and servicing (for accuracy and timeliness), price plan conversion (for compliance with company procedures), order entry and cancellation processes (for accuracy and efficiency), credit and collections, and order-to-installation time lag. Each of these areas represented a cycle or process activity that was important to the operation of a branch. FINDING - EQUIPMENT CONTROL The auditors found that management failed to define responsibilities clearly or hold the EA accountable for his performance. Branch management was not involved in the monitoring and maintenance of the equipment control process. And control management did not maintain effective contact with marketing and service management to ensure that the equipment control process was operating properly. Exhibit 7 describes some of the deficiencies found. However, the branch was rated very good in other areas, and the auditors noted that the However, the branch was rated very good in other areas, and the auditors noted that the negative impacts from the deficiencies in the equipment control area seemed to be effectively minimized. 5 Although the delayed equipment transaction processing contributed to incorrect billings and an increased rate of costly billing adjustments, overall the billing function was sufficiently well organized and controlled to be able to absorb the pressures generated. The billing adjustments reviewed were highly accurate, and resolution of customer inquiries was satisfactory. The credit and collection program was well administered; performance budgets were consistently met, and adjustment and write-off activity was well controlled. (Auditors' Note) RECOMMENDATIONS AND FOLLOW-UP On July 14, 1995 the audit team presented a final listing of the recommendations to the branch managers. Shortly thereafter they prepared a formal audit report to all OG management responsible for the St. Louis branch operations. In the audit report the auditors presented a list of 46 recommendations. Most of these were directed to the new branch control manager, and generally related to one or more of the following: 1. The reconciliation between the physical inventory and the inventory records (NRR) should be completed 2. The deficient equipment processes should be studied, refined, and documented. 3. The individuals involved in equipment control should be given clearly defined responsibilities, and be held accountable for the accuracy of the equipment reports and billings. Ultimate responsibility for correcting deficiencies rested with line management (branch manager), not with IA. Company policy required the branch managers to prepare an action plan to address each of the deficiencies and recommendations made in the audit report. The last written response to the auditors' recommendations came from the St. Louis branch control manager on December 15, 1996. He addressed each of the auditor's recommendations and noted that most of them had already been implemented. Company policy also required that someone independent of both IA and branch management be assigned to monitor progress in implementing the audit recommendations. In OG this was usually someone from the headquarters finance staff. REACTIONS Martha Sorensen (IA manager) reflected on the audit: The St. Louis branch had been recognized for some time as a problem branch. In most of the branches many of the systems and administrative procedures go back to the days when the branches were run by a single branch manager, and the branches that were not well run in those days tended not to get going well when we switch to the functional organization. So going into 6 6 the audit, we had a good idea we would find some problems, and the result of the audit confirmed this judgment. I hope we're now well on the way to getting the problems ironed out. Phil Phillips, Region 3 manager, responded to the disclosure of the St. Louis branch's ongoing equipment control problem: Exhibit 1 Summary income statement, Desktop Solution Inc. (S millions) Year Ended December 31 1994 1995 $228.1 156.6 387.7 $262.2 176.3 438.5 Operating revenue Rentals and services Sales Total operating revenues Cost and expenses Cost of rentals and services Cost of sales 101.6 77.9 116.2 80.6 25.9 1446 350.0 30.1 159.8 386.7 Research and development expenses Selling, administrative and general expenses Total cost and expenses Operating income Other income (deductions), net Income before income tax Income tax Income before outside shareholders' interests Outside shareholders' interest Income from continuing operations Discontinued operations Net income 37.6 (9.4) 28.2 7.8 20.4 51.3 (2.4) 49.4 13.6 35.8 5.9 29.9 3.5 16.9 2.6 $19.5 1.2 $31.1 Exhibit 2 Operations Group organization chart Operation Group Vice President Staff Function: Marketing Personnel Planning and Marketing Support Information System Region 1 Region 2 Region 3 Region 4 Region 5 Sales Control Technical Service Branch 1 Branch 3 Branch 2 Sales Control Technical Service Exhibit 3 Internal audit functions 1. Develop and implement a program of operational, financial, and information systems audits that best meet the requirements of the corporation; assure the integrity of operational and internal controls in protecting the assets of the company and improve operational effectiveness. 2. Assist corporate and operating unit management in identifying and developing operational, financial, and systems policies and procedures necessary to accomplish the goals and objectives of the corporation; evaluate activities through audit report findings and recommend actions to eliminate problems uncovered during audits. 3. Perform special audits in any functional area and for all levels of management as required. 4. Present the audit plan and related audit findings to the Audit Committee of the Board of Directors and corporate management. 5. Coordinate external audit activities and control-related audit fees. Ensure an optimum balance between internal and external audit work in fulfilling the basic audit objectives and obtaining annual certification of Desktop Solutions' consolidated financial statements. 6. Develop new concepts of auditing responsive to the changing business and technological environment within Desktop Solutions and maintain a professional staff skilled in the required disciplines. Exhibit 4 Audit types and 1995 plan for allocation of resources Control Environment Audits (24% of resources in 1995) Control Environment audits evaluate the organizational arrangements; financial planning and analysis, personnel policies and practices; and policy definition and communication within operating organizations. The objective is to assess the basis on which responsibility is assigned, accountability is determined, performance is measured, and overall specific controls are established. Business Entity Audits (39%) These are reviews of specific business cycle controls in a business entity such as a branch or small to medium subsidiary. Business Cycle Audits (17%) These are reviews of the seven business cycles as set forth in the Desktop Solution Compendium of Internal Controls to determine if the overall and individual cycle control objectives slated there are being met. The overall objectives tested are: authorization; accounting transaction processing and safeguarding of corporate assets. The cycle reviews will also include reviews of applicable control environment functions and tests of supporting computer controls. Financial Audits (11%) Financial audits, unless otherwise indicated, are in direct support of the support of the annual audit by our external auditors and represent independent evaluation for the purpose of attesting to the fairness, and reliability of the financial data. Systems Audit (8%) System audits are pre-implementation and post-implementation reviews and data center audits. Pre-implementation audits consider the integrity, control, performance, security and conformance with policies and standards of each system reviewed during the design and development process. Post-implementation audits determine whether cost and performance objectives are met and test the system's integrity, including controls, in its live environment. Audits of data centers assess overall performance and the date control function and address security, scheduling and utilization, control, documentation, organization, training and cost effectiveness. Exhibit 6 Audit tests performed on Equipment Control at the St Louis branch 1. Physical inventory. A total sample of 1387 equipment units was examined, including a complete (100%) examination of the units of one single product. The audit team recorded all the series numbers of the sample units found at the rigger (warehouse) and matched the numbers with those shown on the NRR. Serial numbers not matching up were given to the equipment administrator for reconciliation. 2. Scheduling process. The auditors examined the paperwork for a sample of 243 installations to see how the schedulers notified the riggers about what equipment to install. 3. Install lag test. A sample of 46 machines was examined for the timeliness of the steps in the order-to-install process, including how long the sales reps held on the orders before submitting them, how long the OAs took to enter the order directly, how long it took the schedulers to get the machine out to the customer site and then the delay before the technical service reps installed the machine, and how long the OAs take to enter the final install information correctly into the system to trigger the billing process. 4. Cancel lag test. A sample of 33 cancellations was examined for proper adherence to contract terms and cancellation policies. The auditors were looking to see if the customer cancellation notification policy was followed, if the stop billing date was appropriate, if the removal changes were correctly billed, and if the processing was done on a timely basis. 5. Low-volume copier installations. A sample of 23 low-volume copier installation was examined to see if transmission of information from the sales reps to the OAs was adequate. 6. Trails. A sample of 22 machines out for customer trial was tested for adherence to company duration guidelines and approval procedures. Exhibit 7 Partial list of internal audit findings at the St. Louis branch 1. The responsibilities of branch personnel were found to be slightly unusual in order entry and scheduling/equipment control. Some special order transactions (e.g maintenance agreement, price plan conversions) were processed by customer service assistants, not OAs. The OAs did not track order through the order-to-install process. And the information about installations and status changes went to the EA, instead of the scheduler, as at most other branches. 2. The physical inventory of 1387 mainframe and sorter units showed over 633 discrepancies when compared to the NRR. Seven weeks after the audit results were turned over to the branch, the EA had only reconciled 382 of these items, leaving 351 items unreconciled - 76 units potentially lost, 15 units potentially found, and 160 location and/or status discrepancies. At other branches, 95-100% of the inventory discrepancies 3. The scheduler had learned they could not rely on the NRR, so they kept their own equipment inventory records. They manually assigned serial number to incoming orders. To move equipment quickly they sometimes directed the rigger to deliver product directly from the receiving dock before the serial number had been recorded in the branch's inventory by the EA. They kept track of movement in or out the inventory based on information received from service personnel, but the auditors found that this listing was also inaccurate. 4. It took seven days on average from the date a machine was installed to the time the system recognized it as a valid install so that billing could begin. In addition, some documentation was missing, 3 of the 45 sampled had no credit approval, 3 had no service agreement, 4 had no valid installation date stamp. 5. The cancellation procedure was not working effectively. One hundred machines that had been returned by the customer and sent to refurbishing center had not been noted as canceled by the As, and this number had increased sharply in the prior three months. 6. The low-end printing equipment was not well controlled. Units to be delivered by the sales reps were taken from regular inventory, rather than from a special pool machines in "consignment to sales status. In nine cases (sample size approximately 39%), the sales reps did not send the serial numbers of the equipment to the OAs. In one case rigger tried to deliver a machine to a customer who had received his a week before from the sales representatives. 7. Of the machines out for customer trial only 3 of the 22 tested complied with company policy, and 5 had no approval signature. For four successful trial (i.e the customer wanted to keep the machine), the ending date was recorded improperly, resulting in 29 days of unbilled rental revenue. For eight unsuccessful trials, the removal was scheduled two days past the trial expiration. For trials were extended without approval. The average length past the normal trial duration was 17 days, while the average length past the extension deadline was 9.5 days. 8. Management failed to define responsibilities clearly or hold the EA accountable for his performance. Management did not get involved in the monitoring and maintenance of the equipment control process. Finally, control management did not maintain effective contact with marketing and service management to ensure that the equipment control process was operating properly as it affected those areas. No Issues Scenario Discussion/Alternatives Solution 1 are The functional organization not centralized for all of the branches. Therefore, there is a problem when the branches need to communicate with one another and there is barrier due to the organization. The equipment administrator took a physical inventory of all equipment at the warehouse, matched it with the Non-Revenue Report (NRR), and reconciled the differences only at thebeginning of each month. 2 3 3 The management does not hold the EA accountable when there was lots of inventory and charged the branch the net book value of the lost equipment if the equipment is not foundwithin 90 days