Question: Put together risk assessment? Sample
attached:
age of checks. 3. Verify who has access to safes (or locations where cash/checks are stored and determine if the person has a business reason for that access. Potential Testing ideas: 1. Interview employees on deposit procedures. 2. Select a sample of CR deposits and verify that they comply with IU policy. 6 8 Risk that cash/checks are not timely deposited or recorded. Failure to record cash receipts or delaying the recording of cash receipts allows cash receipts to be misappropriated without detection. Risk that revenue received is not being reconciled (cash/check/CC). Not reconciling revenue can lead to misappropriated or lost funds. Risk that department is not claiming of CC payments in FIS is not occurring timely. Potential Testing ideas: 1. Interviews with key employees on reconciliation procedures. 2. Ask to see a selected number of monthly reconciliations for each key revenue area ands review for proper procedures. 3. Review the IUIE detail transactions to determine that Dls are occurring daily for CC transactions (that they dept is not holding them and completing them weekly or monthly). 4. Obtain the merchant agreement and determine what the requirements are and verify the requirement to actual actions being performed. Potential Testing Ideas: 1. Review all documentation during testing for sensitive data. 2. Interview with key employees on sensitive data procedures. 9 Risk that Credit Card numbers or other sensitive data is being stored on spreadsheets or other invoices/documents. Risk that proper segregation of duties is 10 Potential Testing Ideas: 1. Discussions with key employees on job Page 2 of 3 not in place for revenue activities. duties. 2. Verify routing logs and/or key job responsibilities of each employee to ensure that segregation exists. Part I General Information gathering about Convenience Stores: You have been hired by a company that owns a chain of Convenience stores (similar to 7- Eleven, Road Ranger, and Casey's General Store). This company sells gasoline, high quality fresh coffees, selected grocery items, sandwiches and some hot food, soft drinks, snacks and a variety of pastries in its Company-operated retail stores. The company's objective is to be recognized as the preferred retailer for competitively priced gasoline products and grocery and food items customers want to obtain quickly, in a clean and courteous environment. In order to perform quality audit work, you must understand the industry in which the company operates. Minimally answer these questions (using short bullet points): 1) Define the industry that the company operates in? 2) What are the industry risks including (but not limited to): The economy? Competitors? Changing customer demands? Substitute products? Technology? Regulation? . . 3) Draw conclusions about the overall risk of the industry and which Three risks are the most important (i.e. which risks should we pay specific attention to during the audits). Part II Casey's General Stores' business risk: 1) Using the information in the annual report, proxy statement, and website Read the latest financial statements and related information. 2) Search the web for other information about Casey's General Stores and its senior officers and directors. Identify and explain the top three major industry risks and business risks facing Casey's General Stores Again, using bullet points. 3) List three areas of the Casey's operation that you would consider auditing based on risk. IU Internal Audit Audit Name Organizational Objective/Process Goal: Key Controls Adequacy of Control Design DO NOT Fill This Column in Monitoring/Testing Plan Potential Testing ideas: 1 Process Level Risks Risk that checks are not being endorsed properly upon receipt. 1. Interview cash handling employees concerning the process for endorsing checks. 3. Verify that the department's endorsement stamps location and propriety. Potential Testing ideas: 2. Determine who processes revenue for the department and follow up with appropriate people to ensure that University required training has been received. 2 3 Risk that the persons processing revenue have not taken the required training program provided by Treasury prior to processing revenue. Risk that unapproved vendor software for processing Credit Cards is being used or the software is being used in an unapproved manner. Risk that checks are improperly stored Potential Testing ideas: 1. Obtain a list from Treasury of approved CC software for the department and compare the list to actual software in use. 4 Potential Testing ideas: 1. Interview employees on storage and destruction of checks. 2. Verify locations of where money is stored and spot check these locations for
