Part B - entity-level controls over the company's ethics program Study the scenario presented below about SHR Corporation's.

SHR Corporation has a reputation of sound ethical conduct. In recent years, however, the company has not had to deal with an economic downturn, the level of new competition it is now facing, or the decreasing profitability it has experienced during the first two quarters of 2018.

Three years ago, the company put in place a comprehensive, written code of conduct (the Code) that is applicable to directors, management, and employees. The Code is posted on the organization's website and intranet. All new employees receive a copy of the Code when they are hired and participate in orientation training that includes coverage of the Code. Some minor revisions were made to the Code during the first few months after its introduction, but no changes have been made since then.

A whistleblower program that includes an anonymous hotline was put in place last year for employees and third parties to report suspected violations of the Code. The vice president of internal audit and her direct reports monitor the whistleblower hotline and report suspected violations of the Code to appropriate levels of management and/or the audit committee. Calls on the anonymous hotline have been infrequent, with very few suspected Code violations of a significant nature being reported to senior management or the audit committee.

The internal audit function (internal auditing) recently surveyed senior management and the audit committee regarding the company's ethics program and conducted follow-up interviews with the audit committee chair and selected members of the senior management team. These procedures produced the following information:

The audit committee's charter does not include an explicit provision for overseeing senior management's ethical conduct or monitoring its adherence to prescribed internal control policies and procedures. The audit committee chair is confident, however, that any misconduct on the part of senior management would come to light via the company's whistleblower program and the committee's quarterly meetings with the vice president of internal audit.

The senior management team informally holds each other accountable for complying with the Code.

Senior management believes that it clearly conveys the importance of ethical conduct and compliance with the Code via emails, webcasts, and town hall meetings.

Senior management's assessed level of inherent ethical misconduct risk has remained consistently low over the past three years. Internal audit separately surveyed a sample of managers and employees regarding the company's ethics programs and received responses from 75 percent of the survey recipients. This survey produced the following information:

All company personnel are required to certify in writing on an annual basis that they understand and are in compliance with the Code. Follow-up procedures performed by internal audit indicated that 80 percent of managers and 90 percent of employees submitted the fiscal 2017 certification.

50 percent of the respondents said that they referred to the Code one or more times during 2017. 4

Managers commonly discuss business ethics during employee performance evaluations, but written performance evaluation standards do not include ethical conduct criteria. No formal provisions exist for rewarding personnel who demonstrate sound ethical behavior or for disciplining those who demonstrate unethical behavior.

Managers and employees are unenthusiastic about using the anonymous whistleblower hotline, largely because they see no evidence that appropriate actions will be taken to address unethical conduct.

Periodic ethics training is encouraged but not required. The company offers no ethics training in-house, other than that provided to new employees.

Managers and employees in general believe that senior management is ethical. They also believe, however, that senior management does very little to inform them about the company's ethical policies. Less than 50 percent of the respondents could recall hearing or reading anything about business ethics from senior management during the first six months of 2018. A smaller percentage was aware of senior management's "ethics is good business" statement in the 2017 annual report.

One manager included a written comment in his survey response indicating a perception that senior management appears to be preoccupied with the lackluster performance results the company is achieving.

Required of Part B:

a. Identify the strengths and weaknesses in SHR Corporation's entity-level controls over the company's ethics program. Be sure to consider both governance and management-oversight controls. Propose specific recommendations to rectify the weaknesses noted. Based on the information provided, formulate an overall conclusion about the effectiveness of SHR's entity-level controls over its ethics program.

b. Discuss how the entity-level controls relating to the company's ethics program might affect senior management's decisions given the nature of the risks the company now faces. Provide some examples.

c. Discuss how the entity-level controls relating to the company's ethics program might affect managers' and employees' behavior at the business process level. Provide some examples.

d. Discuss how SHR's entity-level controls over the company's ethics program may impact your subsequent audit of controls over the company's purchases and accounts payable process. More specifically, discuss how your conclusion would affect your:

1. Professional skepticism.

2. Assessment of process-level inherent risks.

3. Approach to evaluating the design adequacy of process-level controls.

4. Inclination to perform direct tests of transactions in search of indirect evidence to support your conclusion about the design adequacy and operating effectiveness of process-level controls.