XYZ Inc. (XYZ or the Company) is a U.S. public company that files quarterly and annual reports with the Securities and Exchange Commission (SEC). XYZ is a leading online store serving customers in the United States. XYZ offers customers a variety of nationally advertised products, including clothing, appliances, electronics, and other items. The Companys supply chain is managed through a single warehouse and distribution facility located in Des Moines, Iowa.

XYZ has a centralized accounting and finance structure at its corporate headquarters, where all processes and controls related to all substantive account balances occur, including controls. XYZ deals with many vendors, and Cost of Goods Sold for the Company primarily consist of inbound freight and costs relating to purchasing and receiving, inspection, depreciation, warehousing, internal transfer, and other costs of distribution.

XYZ sells to their customers under freight on board (FOB) shipping point terms. Therefore, revenue is recorded when goods are shipped from the respective warehouse. XYZ currently uses a sophisticated warehouse management system (the Dewey, Cheatem, and How System), which allows the Company to (1) record sales upon shipment of goods out of the warehouse, (2) automatically price sales on the basis of standard pricing tables, and (3) generate multiple reports for the evaluation of XYZs operations.

Engagement Team Note:

Materiality was determined to be $4.35 million. In planning the current years audit, the engagement team obtained an understanding of the internal controls related to revenue. This understanding was done through the engagement teams walkthrough of the revenue process. As part of their walkthrough procedures the engagement team made inquiries of appropriate personnel, inspected relevant documentation and in certain cases observed the control performers performing the control procedures.

As a result, the engagement team arrived at the conclusion that there have been no significant changes in the revenue process since the prior year. Furthermore, the engagement team has determined that they will not be using the work of others for testing the operating effectiveness of controls related to revenue.

The engagement team identified three risks of material misstatement relating to the recording of sales. For each risk identified, the team documented in the excerpted worksheet (see Handout 1) the control activity that addresses the risk of material misstatement, the evaluation of the design of that control activity, and the planned testing of operating effectiveness.

In addition, the engagement team identified four risks of material misstatement relating to the cash disbursements process (see Handout 2). During their testing, the engagement team noted a control deficiency for Control C5C - The accounts payable department is required to complete the following for each Vendor Change Form requesting a bank account change:

The Companys control description regarding the Controllers review of the Vendor Change Form is not prescriptive regarding the specific attributes of the review. However, there is a presumption that the Controller would understand the primary objective of the control, which is to evaluate whether enough information was obtained by the AP Manager to confirm that the bank account change request was authentic.

Required:

1. What are the key considerations when evaluating the design of internal controls in conjunction with a financial statement audit?

2. What are the key considerations when testing of the operating effectiveness of internal controls in conjunction with a financial statement audit?

3. Does the Controllers failure to adequately review the Vendor Change Form represent a deficiency in the design or operating effectiveness of the control?

4. What are the key considerations when evaluating the severity of a deficiency in a control that directly addresses a risk of material misstatement?

5. Is the failure in the vendor request change form control indicative of a material weakness in internal control over financial reporting?

6. What are the key considerations in determining what additional audit evidence to obtain about controls operating during the roll-forward period?

7. For each of the three revenue risks identified by the engagement team, address the following: a. Was the engagement teams assessment of the evaluation of the design of each control appropriate (i.e., does the control identified by the team

address the specific risk of material misstatement and associated assertion)?

b. Was the engagement teams assessment of the risk associated with