Simons Inc. (SIM or the "Company") is a U.S. public company that files quarterly and annual reports with the Securities and Exchange Commission (SEC). SIM is a leading online store serving customers in the United States, which also has some brick-and-mortar stores in the Western USA. SIM offers customers a variety of products, including office supplies, tools, appliances, electronics, and other items. SIM's supply chain is managed through a single warehouse and distribution facility located in Des Moines, Iowa. SIM has a centralized accounting and finance structure at its corporate headquarters, where all processes and controls related to all substantive account balances occur, including controls. SIM deals with many vendors, and Cost of Goods Sold for the Company primarily consist of inbound freight and costs relating to purchasing and receiving, inspection, depreciation, warehousing, internal transfer, and other costs of distribution. SIM sells to their customers under freight on board (FOB) shipping point terms. Therefore, revenue is recorded when goods are shipped from the respective warehouse. SIM currently uses a sophisticated warehouse management system (SELLANDSHIP) which allows the Company to (1) record sales upon shipment of goods out of the warehouse, (2) automatically price sales based on standard pricing tables, and (3) generate multiple reports for the evaluation of SIM's operations. Engagement Team Note: Materiality was determined to be $4.40 million. In planning the current year's audit, the engagement team obtained an understanding of the internal controls related to revenue. This understanding was done through the engagement team's walkthrough of the revenue process. As part of their walkthrough procedures the engagement team made inquiries of the appropriate personnel, inspected relevant documentation, and in some instances, observed the control performers performing the control procedures. As a result, the engagement team arrived at the conclusion that there have been no significant changes in the revenue process since the prior year. Furthermore, the engagement team has determined that they will not be using the work of others for testing the operating effectiveness of controls related to revenue. The engagement team identified three risks of material misstatement relating to the recording of sales. For each risk identified, the team documented in the excerpted worksheet (see Handout 1) the control activity that addresses the risk of material misstatement, the evaluation of the design of that control activity, and the planned testing of operating effectiveness. Audit Issue In addition, the engagement team identified four risks of material misstatement relating to the cash disbursement process (see Handout 2). During their testing, the engagement team noted a control deficiency for Control C5C - The accounts payable department is required to complete the following for each Vendor Change Form requesting a bank account change: On July 1, 20X9, the Accounts Payable (AP) Manager received an e-mail inquiry about the process required for a vendor to change its bank account information. The e-mail was sent from Joe Williams at a domain address listed as "Appliance-Designers."

ppliance Designers is a manufacturer that supplies Simons-branded appliances to Simons West region stores. In addition, Joe Williams is the primary contact at Appliance Designers with whom the Company typically interacts. The AP Manager responded to the e-mail request on July 15, 20X9, with the procedures required of the vendor, which include completing a vendor bank account request form. On July 20, 20X9, the AP Manager received a reply e-mail from Joe Williams at "Appliance- Designers" with a completed vendor bank account request form, which included Joe Williams' signature, new bank account information, and other related information. Upon receiving the vendor bank account request form, the AP Manager completed a separately required Vendor Change Form for internal processing. The Vendor Change Form is completed for new vendors or changes to existing vendors' information, including bank account information. The AP Manager sent the completed Vendor Change Form to Simons Assistant Controller, who reviewed and approved the request on July 24, 20X9. The bank account information was updated within the Vendor Master File on July 26, 20X9. Throughout the month of August 20X9, valid Appliance Designers invoices were processed through the Company's accounts payable process, and the valid invoices were paid in accordance with the Company's process and controls for cash disbursements and wire transfers. On September 2, 20X9, the Company received an inquiry from Appliance Designers about the expected timing of the $5 million in outstanding invoices. As a result of the direct interaction with Appliance Designers' employee Joe Williams, the Company determined that the previous vendor bank account change form was received from a fraudulent domain name with the intent to defraud the Company. The e-mail domain for Appliance Designers is "Appliance Designers," with no hyphen, rather than "Appliance- Designers," with a hyphen. Both e-mails received from "Appliance-Designers" were determined to be from a fraudulent source (that also fraudulently used Joe Williams's name in the e-mail). Because the bank account information for Appliance Designers was changed (because of the July 1, 20X9, e-mail request) approximately $5 million in payments was wired to an incorrect bank account. As noted above, there are two employees within the Company that were involved in processing and approving the Vendor Change Form. The Company's policy on bank account change requests was put into effect and communicated by Simons Assistant Controller, in an October 1, 20X8, e-mail that indicated that for each Vendor Change Form requesting a vendor bank account change, the accounts payable department was required to (1) obtain a previously processed and paid invoice from the vendor requesting the bank account change, (2) call the vendor using the contact information obtained from the prior invoice, (3) verify the authenticity of the requested bank account change request by directly contacting the vendor, and (4) include all relevant information obtained in steps 1 through 3 as an attachment to the Vendor Change Form. The Company's control description relating to the review of a Vendor Change Form by the Assistant Controller is not explicit regarding the specific attributes of the review. However, because the policy was distributed by the Assistant Controller, who is also the control owner (e.g., performs the review), there is a presumption that the Assistant Controller would understand that as part of her review, she should evaluate whether the AP Manager obtained sufficient information to confirm the authenticity of the bank account change request.

Required 1. What are the relevant key considerations when evaluating the design of internal controls in conjunction with a financial statement audit? 2. What are the relevant key considerations when testing the operating effectiveness of internal controls in conjunction with a financial statement audit? 3. What are the relevant key considerations when formulating a definition of professional skepticism? 4. What are the relevant key considerations in determining what additional audit evidence to obtain about controls operating during the roll-forward period? 5. What are the relevant key considerations in determining if confirmations are required to be used in a financial statement audit? If so, under what circumstances should they be used? If used, what are the steps? 6. What are the relevant key considerations when evaluating the severity of a deficiency in a control that directly addresses a risk of material misstatement? 7. Does the Controller's failure to adequately review the Vendor Change Form represent a deficiency in the design or operating effectiveness of the control? Explain your answer with relevant guidance. 8. Is the vendor request change form failure indicative of a material weakness in internal control over financial reporting? Explain your answer with relevant guidance. 9. Would the deficiency warrant disclosure in the Simons Form 10- K? If so, what information would the Company be expected to disclose? 10. For each of the three revenue risks identified by the engagement team, address the following: a. Was the engagement team's assessment of the evaluation of the design of each control appropriate (i.e., does the control identified by the team address the specific risk of material misstatement and associated assertion)? b. Was the engagement team's assessment of the risk associated with each control appropriate? c. Was the team's interim planned procedures to test the operating effectiveness of each control appropriate considering the risk associated with the control? d. Was the team's roll-forward planned procedures to test the operating effectiveness of each control appropriate considering the risk associated with the control?