last picture is part of risk#3

For each of the three revenue risks identified by the engagement team, address the following:

a. Was the engagement teams assessment of the evaluation of the design of each control appropriate (i.e., does the control identified by the team address the specific risk of material misstatement and associated assertion)

b. Was the engagement teams assessment of the risk associated with each control appropriate?

c. Was the teams interim planned procedures to test the operating effectiveness of each control appropriate considering the risk associated with the control?

d. Was the teams roll-forward planned procedures to test the operating effectiveness of each control appropriate considering the risk associated with the control

+ D Page view A Read aloud Add text | Draw V Highlig Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement Relevant assertion Significant risk? Risk #1 All orders shipped are not recorded as revenue. Completeness. No. No. Risk of material misstatement because of fraud? Control activity that addresses the risk of material misstatement Control #1: Sales are automatically recorded, and invoices are automatically generated upon releasing the order in the Warehouse SELLANDSHIP System. Orders are not released until the goods have been confirmed for shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). No. Does the control rely on information used in the control (or IUC)? If yes, list relevant information N/A Will we obtain audit evidence of the accuracy and completeness of the information used in the control by testing controls? Is the control automated? Yes. Relevant application system (if we are testing Warehouse SELLANDSHIP System, which is subject to IT controls performed by management and tested within the information used in the control through tests of IT controls workpaper. controls or the control is automated) Tests of controls: evaluation of design Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The control is the automation of the invoicing of goods shipped as the system will automatically record revenues when goods are shipped from the warehouse (revenue-generating activity). Thus, resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion. 2. Automated control prevents errors from occurring instead of identifying them once they have occurred (preventive control). 3. The control operates at the transaction level and, as such, is sufficiently precise to mitigate the risk. 4. The control is performed continually and thus addresses the risk directly and for the period under audit. 5. There are no historical issues with the control operation, and the control has not been modified in the period under audit. Risk Associated with the Control Not Higher Interim Procedures (test as of 9/30): 1. We will verify the understanding by testing general IT controls to assess if there have been any changes to the control since the previous year. 2. In addition, we will perform standard sample testing of any program changes to the control to ensure the control is operating effectively. Tests of controls: planned operating effectiveness testing Roll forward Procedures: 1. Make inquiries of the controller and the IT manager to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted retest control. SIMONS Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement Risk #2 Revenue is recorded for orders not shipped or fictitious sales. Relevant assertion Occurrence Significant risk? Yes Yes Risk of material misstatement because of fraud? Control activity that addresses the risk of misstatement Control #2: The "Orders Shipped & Invoiced Report" is reviewed by the warehouse director on a daily basis for unusual items and specifically for invoices recorded that don't have corresponding shipping documents; evidenced by the warehouse director's initials on the report and maintained by the director. Yes - The "Orders Shipped & Invoiced Report," which details orders that were shipped and invoiced for a given day. The report is automatically generated by the Warehouse SELLANDSHIP system Does the control rely on information used in the control (or IUC)? If yes, list relevant information Will we obtain audit evidence of the accuracy and completeness of information used in the control by testing controls? Because the control's operating effectiveness depends on the accuracy and completeness of the IPE, we will test the controls around accuracy and completeness. As the IPE is a system-generated report, refer to our testing of the company's IT general controls. In addition, we will test the controls around report logic, parameters, and the source data. Is the control automated? No. Relevant application system (if we are testing Warehouse SELLANDSHIP System, which is subject to IT controls and tested within the IT controls workpaper. information used in the control through tests of controls and/or the control is automated) Tests of controls: evaluation of design Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The warehouse director has been with the company for over six years and has been acting in this current role for the last four. The warehouse director oversees operations at the warehouse and directly supervises the warehouse managers. The director is knowledgeable of the business and focuses reviews on activity that seems unusual given the customer and quantities purchased. The review is directed to the identification of unusual trends and thus appropriately addresses the related risk of material misstatement and assertion. 2. Control is performed daily. 3. Control identifies exceptions after they have occurred (i.e., it's a detective control), yet given the frequency of performance, it would identify errors promptly. 4. Although the control entails the review of daily revenue activity, it is done on a transaction-by-transaction basis, and as such it is sufficiently precise to mitigate the risk. 5. Control involves the judgment of the warehouse director since there is no specific threshold set. However, since all transactions are evaluated and SIMONS has a cyclical business, the report results are predictable. Risk Associated with the Control Higher Tests of controls: planned operating effectiveness testing The OE testing of this control will be apportioned through the entire year, thus no roll forward procedures are needed since some of our selections were made between 09/15 and 11/01. In addition, no issues were noted with those or any selections made. The procedures made on the selections are as follows: 1. Select 30 days out of the year. Make sure a few selections are made between 09/15 and 11/01. 2. For each day selected, obtain the "Orders Shipped & Invoiced Report" reviewed by the warehouse director. Inspect the report for evidence of review by the warehouse director by noting comments, pencil markings, or email correspondence of follow up inquiries. Inquire of the warehouse director as to what he did to review each report 3. Reperform the warehouse director's procedures by reviewing the report for any unusual transactions or invoices recorded that do not have corresponding shipping documents and investigate these transactions. 4. Determine whether there was timely evidence of review by the warehouse director (typically in the form of physical sign off by the warehouse director on the report and dated on the day following the report date). 2 A Ncau drug 3 SIMONS Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement RISKS Orders shipped are not recorded accurately to actual quantities shipped, and prices per invoice do not reflect approved pricing Relevant assertion Accuracy. No. Significant risk? Risk of material misstatement because of fraud? No. Control activity that addresses the risk of misstatement Does the control rely on information used in the control (or IUC)? If yes, list relevant information Control #3: On a monthly basis, the reporting package is reviewed and analyzed by the controller and presented and discussed at the operations review meeting. The Controller focuses on differences or amounts greater than $4.45 million or fluctuations greater than 15 percent from prior year actual or current budget. The controller documents the results of any follow up. Yes. 1. Monthly reporting package. 2. Budget Monthly reporting package: The monthly reporting package, which includes revenue information, is generated by the assistant controller from the SAP general ledger using data query tools by selecting certain data fields and defining calculations using the data. We tested the general IT controls (in particular program change controls) for completeness and accuracy. In addition, we will test the controls around report logic, parameters, and the source data. Budget: The CFO and CEO develop a budget annually in accordance with a set of defined budgeting procedures that require that the budget be "zero set" (.e., determined based on reasonable expectations of future events, rather than a percentage increase over previously budgeted amounts). The application system used for this process is SAP. The CFO and CEO review the budget to confirm that the budgeted amounts have been determined in accordance with the established procedures and are based on reasonable expectations of future events. Upon finalization and approval of the budgets and forecasts within the SAP system, the information is uploaded to SAP. The financial analysis team then performs a tie-out and reconciliation of the SAP information versus the reports created in SAP to assure accuracy of the upload. SAP budget information is important since management compares the P&L, BS, and other activity budgets to the actual monthly actual performance as indicators of unusual activity. All budgets and forecasts are subject to several tiered reviews. The final budget is then presented in a slide deck to the CEO and CFO for final approval. According to the budgeting procedures, the budget cannot be reset once approved by the CEO. Will we obtain audit evidence of the accuracy and completeness of information used in the control by testing controls? We plan to test the budget process and controls as follows: 1. Obtain a copy of the original budget and gain an understanding of how it was prepared and how it is modified during the year for known changes. 2. We will identify and test the controls around report logic, parameters, and the source data of the budget. 3. Verify that SAP information is tied out and reconciled to SAP. 4. Verify through review of board minutes that annual budget is approved by the CEO and CFO. No. Is the control automated? Relevant application system (if we are testing SAP, which is subject to IT controls and tested within the IT controls workpaper. information used in the control entity through tests of controls or the control is automated) Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. Control appropriately addresses the related risk of material misstatement and assertion since any unexpected variances would be detected by the controller's analysis of budget to actual. 2. The control is detective and therefore identifies exceptions after they have occurred. Given that the control is performed monthly, it would detect errors in time to prevent material misstatement of the financial statements. Tests of controls: evaluation of design 3. The control is sufficiently precise to detect a material misstatement in the revenue account (which is based on $4.25 million materiality threshold). 4. Management has defined quantitative thresholds for investigating variances. 5. The company's financial results have historically been consistent with budget. There are no significant changes planned in the current year to the company's business nor are there any external factors related to the industry, regulatory environment, or economy that would be expected to impact the company's current year financial results. Risk Associated with the Control Not Higher Risk Associated with the Control Not Higher Interim Procedures: Inquiry: 1. Inquire of the controller and assistant controller of the following: a. Explanation of the steps involved in performing the control. b. Reports and other information used, including how such information is used and from where it is obtained. C. Procedures performed when an exception or misstatement is identified. d. Procedures performed when the individual is absent. e. Procedures performed with respect to unusual transactions. f. Changes to controls during the period, including changes in personnel who perform them. Inspection: 2. Obtain the meeting minutes for four months and determine if the monthly package was appropriately discussed. Tests of controls: planned operating effectiveness testing Roll forward Procedures: 1. Select a month from Q4 and perform the above procedures consistent with interim. + D Page view A Read aloud Add text | Draw V Highlig Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement Relevant assertion Significant risk? Risk #1 All orders shipped are not recorded as revenue. Completeness. No. No. Risk of material misstatement because of fraud? Control activity that addresses the risk of material misstatement Control #1: Sales are automatically recorded, and invoices are automatically generated upon releasing the order in the Warehouse SELLANDSHIP System. Orders are not released until the goods have been confirmed for shipping in the system (which occurs when the goods are scanned as they are loaded in the shipping area). No. Does the control rely on information used in the control (or IUC)? If yes, list relevant information N/A Will we obtain audit evidence of the accuracy and completeness of the information used in the control by testing controls? Is the control automated? Yes. Relevant application system (if we are testing Warehouse SELLANDSHIP System, which is subject to IT controls performed by management and tested within the information used in the control through tests of IT controls workpaper. controls or the control is automated) Tests of controls: evaluation of design Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The control is the automation of the invoicing of goods shipped as the system will automatically record revenues when goods are shipped from the warehouse (revenue-generating activity). Thus, resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion. 2. Automated control prevents errors from occurring instead of identifying them once they have occurred (preventive control). 3. The control operates at the transaction level and, as such, is sufficiently precise to mitigate the risk. 4. The control is performed continually and thus addresses the risk directly and for the period under audit. 5. There are no historical issues with the control operation, and the control has not been modified in the period under audit. Risk Associated with the Control Not Higher Interim Procedures (test as of 9/30): 1. We will verify the understanding by testing general IT controls to assess if there have been any changes to the control since the previous year. 2. In addition, we will perform standard sample testing of any program changes to the control to ensure the control is operating effectively. Tests of controls: planned operating effectiveness testing Roll forward Procedures: 1. Make inquiries of the controller and the IT manager to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date. If any significant changes are noted retest control. SIMONS Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement Risk #2 Revenue is recorded for orders not shipped or fictitious sales. Relevant assertion Occurrence Significant risk? Yes Yes Risk of material misstatement because of fraud? Control activity that addresses the risk of misstatement Control #2: The "Orders Shipped & Invoiced Report" is reviewed by the warehouse director on a daily basis for unusual items and specifically for invoices recorded that don't have corresponding shipping documents; evidenced by the warehouse director's initials on the report and maintained by the director. Yes - The "Orders Shipped & Invoiced Report," which details orders that were shipped and invoiced for a given day. The report is automatically generated by the Warehouse SELLANDSHIP system Does the control rely on information used in the control (or IUC)? If yes, list relevant information Will we obtain audit evidence of the accuracy and completeness of information used in the control by testing controls? Because the control's operating effectiveness depends on the accuracy and completeness of the IPE, we will test the controls around accuracy and completeness. As the IPE is a system-generated report, refer to our testing of the company's IT general controls. In addition, we will test the controls around report logic, parameters, and the source data. Is the control automated? No. Relevant application system (if we are testing Warehouse SELLANDSHIP System, which is subject to IT controls and tested within the IT controls workpaper. information used in the control through tests of controls and/or the control is automated) Tests of controls: evaluation of design Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The warehouse director has been with the company for over six years and has been acting in this current role for the last four. The warehouse director oversees operations at the warehouse and directly supervises the warehouse managers. The director is knowledgeable of the business and focuses reviews on activity that seems unusual given the customer and quantities purchased. The review is directed to the identification of unusual trends and thus appropriately addresses the related risk of material misstatement and assertion. 2. Control is performed daily. 3. Control identifies exceptions after they have occurred (i.e., it's a detective control), yet given the frequency of performance, it would identify errors promptly. 4. Although the control entails the review of daily revenue activity, it is done on a transaction-by-transaction basis, and as such it is sufficiently precise to mitigate the risk. 5. Control involves the judgment of the warehouse director since there is no specific threshold set. However, since all transactions are evaluated and SIMONS has a cyclical business, the report results are predictable. Risk Associated with the Control Higher Tests of controls: planned operating effectiveness testing The OE testing of this control will be apportioned through the entire year, thus no roll forward procedures are needed since some of our selections were made between 09/15 and 11/01. In addition, no issues were noted with those or any selections made. The procedures made on the selections are as follows: 1. Select 30 days out of the year. Make sure a few selections are made between 09/15 and 11/01. 2. For each day selected, obtain the "Orders Shipped & Invoiced Report" reviewed by the warehouse director. Inspect the report for evidence of review by the warehouse director by noting comments, pencil markings, or email correspondence of follow up inquiries. Inquire of the warehouse director as to what he did to review each report 3. Reperform the warehouse director's procedures by reviewing the report for any unusual transactions or invoices recorded that do not have corresponding shipping documents and investigate these transactions. 4. Determine whether there was timely evidence of review by the warehouse director (typically in the form of physical sign off by the warehouse director on the report and dated on the day following the report date). 2 A Ncau drug 3 SIMONS Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Identification of risk of material misstatement RISKS Orders shipped are not recorded accurately to actual quantities shipped, and prices per invoice do not reflect approved pricing Relevant assertion Accuracy. No. Significant risk? Risk of material misstatement because of fraud? No. Control activity that addresses the risk of misstatement Does the control rely on information used in the control (or IUC)? If yes, list relevant information Control #3: On a monthly basis, the reporting package is reviewed and analyzed by the controller and presented and discussed at the operations review meeting. The Controller focuses on differences or amounts greater than $4.45 million or fluctuations greater than 15 percent from prior year actual or current budget. The controller documents the results of any follow up. Yes. 1. Monthly reporting package. 2. Budget Monthly reporting package: The monthly reporting package, which includes revenue information, is generated by the assistant controller from the SAP general ledger using data query tools by selecting certain data fields and defining calculations using the data. We tested the general IT controls (in particular program change controls) for completeness and accuracy. In addition, we will test the controls around report logic, parameters, and the source data. Budget: The CFO and CEO develop a budget annually in accordance with a set of defined budgeting procedures that require that the budget be "zero set" (.e., determined based on reasonable expectations of future events, rather than a percentage increase over previously budgeted amounts). The application system used for this process is SAP. The CFO and CEO review the budget to confirm that the budgeted amounts have been determined in accordance with the established procedures and are based on reasonable expectations of future events. Upon finalization and approval of the budgets and forecasts within the SAP system, the information is uploaded to SAP. The financial analysis team then performs a tie-out and reconciliation of the SAP information versus the reports created in SAP to assure accuracy of the upload. SAP budget information is important since management compares the P&L, BS, and other activity budgets to the actual monthly actual performance as indicators of unusual activity. All budgets and forecasts are subject to several tiered reviews. The final budget is then presented in a slide deck to the CEO and CFO for final approval. According to the budgeting procedures, the budget cannot be reset once approved by the CEO. Will we obtain audit evidence of the accuracy and completeness of information used in the control by testing controls? We plan to test the budget process and controls as follows: 1. Obtain a copy of the original budget and gain an understanding of how it was prepared and how it is modified during the year for known changes. 2. We will identify and test the controls around report logic, parameters, and the source data of the budget. 3. Verify that SAP information is tied out and reconciled to SAP. 4. Verify through review of board minutes that annual budget is approved by the CEO and CFO. No. Is the control automated? Relevant application system (if we are testing SAP, which is subject to IT controls and tested within the IT controls workpaper. information used in the control entity through tests of controls or the control is automated) Based on the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. Control appropriately addresses the related risk of material misstatement and assertion since any unexpected variances would be detected by the controller's analysis of budget to actual. 2. The control is detective and therefore identifies exceptions after they have occurred. Given that the control is performed monthly, it would detect errors in time to prevent material misstatement of the financial statements. Tests of controls: evaluation of design 3. The control is sufficiently precise to detect a material misstatement in the revenue account (which is based on $4.25 million materiality threshold). 4. Management has defined quantitative thresholds for investigating variances. 5. The company's financial results have historically been consistent with budget. There are no significant changes planned in the current year to the company's business nor are there any external factors related to the industry, regulatory environment, or economy that would be expected to impact the company's current year financial results. Risk Associated with the Control Not Higher Risk Associated with the Control Not Higher Interim Procedures: Inquiry: 1. Inquire of the controller and assistant controller of the following: a. Explanation of the steps involved in performing the control. b. Reports and other information used, including how such information is used and from where it is obtained. C. Procedures performed when an exception or misstatement is identified. d. Procedures performed when the individual is absent. e. Procedures performed with respect to unusual transactions. f. Changes to controls during the period, including changes in personnel who perform them. Inspection: 2. Obtain the meeting minutes for four months and determine if the monthly package was appropriately discussed. Tests of controls: planned operating effectiveness testing Roll forward Procedures: 1. Select a month from Q4 and perform the above procedures consistent with interim