Using the Zou Fencing Case, address the following in your paper (standard case and turn it in requirements apply).

• Discuss the key items auditors must consider when determining the design effectiveness of internal controlsANDwhen testing the operating effectiveness of internal controls.
• What sort of evidence must an auditor consider when testing the operating effectiveness of internal controls?
• In this case for each of the risk identified by the engagement team, determine if the evaluation of design was appropriate (explain why or why not).
• Also discuss whether engagement team appropriately evaluated each risk, justify your answer.

Case 21: ZOU's Fencing Controls Handout 1 Page 1 ZOU Fencing Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Risk #1 Identification of risk of material misstatement All orders shipped are not recorded as revenue Relevant assertion Completeness, Significant risk? Risk of material misstatement because of No. No. fraud? Control activity that addresses risk of material Control #1: Sales are automatically recorded and invoices are automatically generated upon the release of the order in the Warehouse K-Series System. Orders are not released until the goods have been confirmed for shipping misstatement in the system (which occurs when the goods are scanned as they are loaded in the shipping area). Does the control rely on information used in No. the control (or IUC)? If yes, list relevant information Will we obtain audit evidence of the accuracy and completeness of information used in the N/A control by testing controls? Is the control automated? Yes. Relevant application system (if we are testing Warehouse K System, which is subject to IT controls performed by management and tested within the IT controls information used in the control through tests of workpaper. controls or the control is automated) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The control is the automation of the invoicing of goods shipped as the system will automatically record revenues when goods are shipped from the warehouse (revenue generating activity), thus resulting in no shipped goods going unrecorded in the system that appropriately addresses the related risk of material misstatement and assertion. Tests of controls: evaluation of design 2. Automated control prevents errors from occurring as opposed to identifying them once they have occurred (preventive control). 3. Control operates at the transaction level and, as such, is sufficiently precise to mitigate the risk. 4. Control is performed on a continual basis and thus addresses the risk directly and for the period under audit. 5. There are no historical issues with the operation of the control and the control has not been modified in the period under audit. Risk Associated with the Control Not Higher Interim Procedures (test as of 9/30): 1. As this is an automated control, we will perform a test of one and follow one transaction through the system to make sure the system is operating effectively. Tests of controls: planned operating 2. In addition, we will verify the understanding through testing of general IT controls; i.e., program change controls effectiveness testing that there have been no changes to the control since the previous year. Rollforward Procedures: 1. Make inquiries of the controller and the IT manger to determine if any events have occurred that might impact the design or operation of the control (e.g., changes, additional risks, operating deficiencies) after our interim testing date If any significant changes are noted retest controlCase 21: ZOU's Fencing Controls Handout 1 Page 2 ZOU Fencing Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Risk #2 Identification of risk of material misstatement Relevant assertion Revenue is recorded for orders not shipped or fictitious sales Occurrence Significant risk? Risk of material misstatement because of Yes Yes fraud? Control activity that addresses risk of Control #2: The "Orders Shipped & Invoiced Report" is reviewed by the warehouse director on a daily basis for misstatement unusual items and specifically for invoices recorded that don't have corresponding shipping documents; evidenced Does the control rely on information used in by the warehouse director's initiale on the report which is maintained the control (or IUC)? If yes, list relevant Yes - The "Orders Shipped & Invoiced Report,"which details orders that were shipped and invoiced for a given information day. The report is automatically generated by the Warehouse K system. Because the operating effectiveness of the control is dependent upon the accuracy and completeness of the IPE, we Will we obtain audit evidence of the accuracy will test the controls around accuracy and completness. As the IPE is a system generated report, refer to our and completeness of information used in the testing of the company's IT general contols. In addition, we will test the controls around report logic, parameters, control by testing controls? and the source data. Is the control automated: Relevant application system (if we are testing No. information used in the control through tests of Warehouse K System, which is subject to IT controls and tested within the IT controls workpaper. controls and/or the control is automated ) On the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. The warehouse director has been with the company for over 10 years and has been acting in this current role for the last five. The warehouse director is in charge of overseeing operations at all five warehouses and directly supervises the warehouse managers. The director is knowledgeable of the business and focuses reviews on activity that seems unusual given the customer and quantities purchased. The review is directed to the identification of unusual trends and thus appropriately addresses the related risk of material misstatement and assertion. Tests of controls: evaluation of design 2. Control is performed on a daily basis. 3. Control identifies exceptions after they have occurred (i.e., its a detective control), yet given the frequency of performance, it would identify errors in a timely manner. 4. Although the control entails the review of daily revenue activity, it is done on a transaction by transaction basis, and as such it is sufficiently precise to mitigate the risk. 5. Control involves the judgment of the warehouse director since there is no specific threshold set. However, since all transactions are evaluated and ZOU Fencing has a cyclical business, the report results are predictable. Risk Associated with the Control Higher The OE testing of this control will be apportioned through the entire year and thus no rollforward procedures are needed since 3 of our selections were made within the last 2 weeks of December and no issues were noted with those or any selections made. The procedures made on the selections are as follows; 1. Select 25 days out of the year. Make sure a few selections are made within two weeks of the balance sheet date. Tests of controls: planned operating 2. For each day selected, obtain the "Orders Shipped & Invoiced Report" reviewed by the warehouse director. effectiveness testing Inspect the report for evidence of review by the warehouse director by noting comments, pencil markings, or email correspondence of follow up inquiries. Inquire of the warehouse director as to what he did to review each report. 3. Reperform the warehouse director's procedures by reviewing the report for any unusual transactions or invoices recorded that do not have corresponding shipping documents and investigate these transactions. 4. Determine whether there was timely evidence of review by the warehouse director (typically in the form of physical sign off by the warehouse director on the report and dated on the day following the report date).ZOU Fencing Inc. Account Scoping and Risk Assessment Account Balance and Disclosure: Revenue Class of Transaction: Recording Sales Rick #1 Identification of risk of material misstatement Orders shipped are not recorded accurately to actual quantities shipped and prices per Invoice do not reflect Relevant assertion nomued noking Significant risk? Risk of material misstatement because of No. No. Control activity that addresses risk of Control #3: On a monthly basis, the reporting package is reviewed and analyzed by the controller and presented misstatement and discussed at the operations review meeting. The Controller focuses on differences or amounts greater than $4 Ions greater than 15 percent from prior year actual or current budget. The controller documents Does the control rely on Information used In the control (or IUC)? If yes, list relevant Yes. . Monthly reporting package. Information 2. Budget. Monthly reporting packanz The monthly reporting package, which Includes revenue Information, Is generated by the assistant controller from the PeopleSoft general ledger using data query tools by sel cting certain data fields and defining calculations using the data. We tested the general IT controls (In particular program change controls) for completeness and accuracy. In addition, we will test the controls around report logic, parameters, and the source data. Budget: The CFO and CEO develop a budget annually In accordance with a set of defined budgeting procedures that require that the budget be "zero set" (L.e., determined on the basis of reasonable expectations of future events, rather than a percentage Increase over previously but system used for this process is Budgetpro. The CFO accordance with the established pr amounts have been determined In are based on reasonable expectations of future events. Upon Will we obtain audit evidence of the accuracy finallaation and app m, the Information is uploaded to and completeness of Information used In the PeopleSoft. The f n of the Budgetpro Information control by testing controls? versus the reports create soft to assure accuracy of the upload. P leSoft budget Information is Important since man spares the PAL, BS, and other activity budgets to the actual monthly actual performance as Ind activity. All budgets and forecasts are subject to several tiered reviews. The final budget is then presented In a slide deck to the CEO and CFO for final approval. According to the budgeting procedures, the budget cannot be reset once approved by the CEO. We plan to test the budget process and controls as follows: L. Obtain a copy of the original budget and gain an understanding of how it was prepared and how it is modified during the year for known changes. 2. We will Identify and test the controls around report logic, parameters, and the source data of the budget. 3. Verity that Budgetpro Information is tied out and reconciled to Peoplesoft. 4. Verity through review of board minutes that annual budget is approved by the CEO and CFO. Is this control automated? No. Relevant application system (If we are testing Budgetpro, which Is subject to IT controls and tested within the IT controls workpaper. Information used In the control entity through tests of controls or the control Is automated) In the basis of the following factors, we concluded that the control is appropriately designed to address the stated risk of material misstatement: 1. Control appropriately addresses the related risk of material misstatement and assertion since any unexpected variances would be detected by the controller's analysis of budget to actual. 2. The control Is detective and therefore Identifies exceptions after they have occurred, yet given that the control is performed on a monthly basis, It would detect errors In time to prevent material misstatement of the financial Tests of controls: evaluation of design statements. 3. The control Is sufficiently precise to detect a material misstatement In the revenue account (which is based on $5 million materiality threshold). 4. Management has defined quantitative thresholds for Investigating varlances. 5. The company's fina andal results have historically been consistent with budget. There are no significant changes planned In the current year to the company's business nor are there any external factors related to the Industry, regulatory environment, or economy that would be expected to Impact the company's current year financial results. Risk Associated with the Control Not Higher Interim Procedures Inquiry: 1. Inquire of the controller and assistant controller of the following: a. Explanation of the steps Involved In performing the control. b. Reports and other Information used, Including how such Information is used and from where it is obtained. C. Procedures performed when an exception or misstatement Is identified. d. Procedures performed when the Individual is absent. Tests of controls: planned operating c. Procedures performed with respect to unusual transactions. effectiveness testing f. Changes to controls during the perlod, Including changes In personnel who perform them Inspection: 2. Obtain the meeting minutes for two months and determine if the monthly package was appropriately discussed. Foronward Procedures: 1. Select a month from Q4 and perform the above procedures consistent with Interim.Case 13{19 ZGU's Fencing Controls ZDU Fencing Inc. [\"ZDU Fencing" or \"the Company") is a public company in the United States that les quarterly and annual reports with the SEC. ZDU Fencing has ve manufacturing facilities located in Missouri and produces and provides chain-link fencing to customers throughout the Midwest (specically, 1Wisconsin, Indiana, Michigan, IDhio, Illinois, and Iowa) via rail car. 201] Fencing sells chain-link fencing to customers under freight on board (FOB) shipping point terms. Therefore, revenue is recorded when goods are shipped from the respective warehouse. ZDU Fencing currently uses a sophisticated warehouse management system [the Warehouse KSeries System}, which allows the Company to (1} record sales upon shipment of goods out of the warehouse, (2) automatically price fence sales on the basis of standard pricing tables, and (3) generate multiple reports for the evaluation of ZCIIU Fencing's operations. Engagement Team Note: Materiality was determined to be $5 million. In planning the current year's audit, the engagement team obtained an understanding of the internal controls related to revenue. This understanding was done through the engagement team's walkthrough of the revenue process. As part of their walkthrough procedures the engagement team made inquiries of appropriate personnel, inspected relevant documentation and in certain cases observed the control performers performing the control procedures. As a result, the engagement team arrived at the conclusion that there have been no signicant changes in the revenue process since the prior year. Furthermore, the engagement team has determined that they will not be using the work of others for testing the operating effectiveness of controls related to revenue. The engagement team identied three risks of material misstatement relating to the recording of sales. For each risk identied, the team documented in the excerpted worksheet (see Handout 1) the control activity that addresses the risk of material misstatement, the evaluation of the design of that control activity, and the planned testing of operating effectiveness