You have worked with Zaird & Associates, CPAs, for a little more than a year and are beginning your second audit of Universal Air (UA). This year you even have an assistant reporting to you—Jane McClain.

Jane has come to you with a concern. She noticed that when sales are “booked” over the Internet an entry is made debiting a receivable account (from the credit card) and crediting sales. When a ticket is canceled, the only entry made is to a database that maintains specific flight information on seat availability. Jane has discovered that customers are e-mailed a “Canceled Reservation” form when this occurs. But no accounting journal entry is recorded, and no refund occurs until the customer requests (in writing) a refund. If the customer never requests the refund, the receivable is billed to the credit card and collected; when it is billed to the credit card, many customers complain and are given a refund, with an accompanying journal entry being made for the cancellation.

After analyzing the “Canceled Reservation” form, you note that it says nothing about requiring a written cancellation for a refund. UA’s controller responded to your inquiry about the policy of requiring a written request for a refund by indicating that the policy is presented on the website’s “business policies and procedures” section. Furthermore, the controller says that in total about two-thirds of the customers ask for and receive refunds, while one-third do not. She then states to you that “the other one-third must not be aware of the policy, or simply don’t care. What the heck, caveat emptor!”

At this point, you discussed the situation with Bill Radman, partner-in-charge of the audit. Subsequently, he made an inquiry of Zaird’s attorneys about the legality of the policy, and received a reply that while it is probably a questionable policy, they are unable to say it is illegal—in fact, it probably is not. Upon further investigation you find that this policy has been in existence for three years (since your first year on the audit) and neither you nor anyone else in your firm has identified it previously.

a. Is this a significant deficiency? Should it be reported to the audit committee?
b. Should it be reported elsewhere? Where? How?
c. What impact should this policy have on the audit?