please i would like the answers for this case study ( internal audit )

CASE 1 = The payroll system interfices with the general ledgor You are the internal audit senior rexponsible for conductsystem. ing an assurance engagement of the XYZ Company pay- = XYZ has established a separate peyroll imprest roll process. This procnss has not bece andited for three acoount for the processing of payroll cheds. Amounts years and, as such, is due in the normal audit cycle. There are deposited in this acooont from the company's genhave been no significant changes since the previous andit, eral acoount to cower any checks presented against the that is, there were no system changes, no reorganiration imprest acoount each day. of personnel, and no substantive procedural changes. = Certain non-payroll items are dedocted from the payHowever, during the last assarance engagernent, the roll checks, inchuding: internal aadit functioa identified several observations, some of which were considered significant. The signifcant observations related tor - Employee loans to eover the cont of eitra benefits of compuer purchases. Information pertaining to employees heaving the comrContributions to long-term retitement plans. pany was not communicated to the IT department, nesulting in extended delays before those employees" - Contribetions to charitable organimations, roch as systems rights were terminated. the United Way. - Hours paid to nonewempt employeer were not sup- Contrihutions to political action cemmittees (PMCr) ported by approved timesherts. - Payroll expenses and the related pwroll accruals are - Amounts withbeld for eniployees were not consistent conaidered material to the coenpany:with elections made by employeek. Based on the above information, perform the following - The possibility existed that phantom (ghost) employeer steps to condoct a payroll assuranoe eagagernent. could be included in the payroll without detection. A. Determine at least four paynoll department objecthes that would be relevant to this engrgement. Payroll management implemented actions to address all B. Create a list of potential risk scenarios for each rignificant obvervations and the internal audit function objective condacted limited follow-up procedures to validate that C. Based on the identified riak scenarion, define and the planned actions were completed. This is the first andit assess the key payroll risks since the follow-up procedures were completed. 1. You will need to make asoumptions regarding impact and likelihood for this assemenent. Docu- The following is pertinent information to the payroll ment the asumptions made assurance engagement: 2. Also, make assumptions about and document = XYZ employs approximately 4,400 employees. process-level management'w risk tokerancelevile. Appraximately 2,700 of those employees are salaried, the rest are hourly. D. Document a potential process flow in a detailed flowchart. Malke sure that this flowchart identifies Eimployees are paid birieckby. key risks and controls and has at kast one potential design inadequacy - Hourly employees eam pay at straight time for the first 80 hours in a biweekly pay period, time and a half for E. Develop potential key performance indicators for the neat 20 hours in a pay period, and double time for the process you docamented in step D. any hoars eweeding 100 hours in a pay period. R. Identify which contruls are considened key controls. As part of this analyeis, document your ascumptions - The company utilites a widely used and market tested regarding the effectiveness of entity-level controls payroll package (Pryhight) for processing of all payroll and bow wuch cootrols affert the pwivroll procesetransactions. level controls, if at all. C. Link the kry controls to the identified risks. H. Prepare a Risk and Control Matrix to cover the appropriate information from steps C through G. Conclude on the overall design adequacy of the payroll process. 1. Create a test plan for gathering cvidence regarding the operating effectiveness of all key controls. J. Develop potential test results of testing for all tests conducted. Make sure to identify at least two observations related to the operating effectiveness of key controls. K. Add the results of steps I and J above to the Risk and Control Matrix. Document your conclusions on the effectiveness of control operation. L. Develop observations based on the engagement results that outline the criteria, condition, cause, and effect for each observation