Exam 8: Internal Controls and Control Risk

Which of the following duties would indicate a weakness in internal controls?

To comply with auditing standards, the auditor need not be concerned with all areas of internal control that apply to management. The auditor's primary concerns are with the system's ability to

Bravo Design had IMB consulting design a custom software system to record the job costs and sales in progress. What acquisition process did Bravo design follow?

FiddleWare Limited uses a purchased software package to handle the processing of its transactions. An important control that management should implement with respect to information systems is the

The accuracy of the results of the accounting system (account balances) is heavily dependent upon the

A) Describe the three basic concepts (assumptions) underlying the study of internal control and assessment of control risk. B) Describe the inherent limitations of internal control.

You, a PA, have been assigned as the in-charge auditor of a long-time audit client of your firm, Mikla Tool Inc. (MTI). MTI is owned by George Mikla, an experienced machinist. George established the business over 20 years ago, and it has grown into a $10-million-a-year business with an excellent reputation for high quality machined parts. MTI has regular clients in the automobile parts sector and in the healthcare sector. The company has recently begun producing parts for environmentally friendly products such as recycling containers. The business is versatile in dealing with a variety of metals as well as plastics, using both manually controlled and machine controlled (computerized) equipment. The following description is based on your review of prior files, and planning discussions with personnel at MTI. Equipment suppliers have helped MTI develop efficient operations by providing sample programs for standard operations and by providing training to employees. One of the suppliers unfortunately sent sample programs that had been infected by a virus. George's daughter, Tiffany, had to cleanse the servers and each of the machines of the malicious software. When contacted, the supplier did not know that the software was infected and apologized profusely. The company's four CAD/CAM terminals and printers are connected to the company's central local area network. The local area network is maintained by Toni Lee, the owner of a computer shop conveniently located three blocks away. All computer equipment, software, and supplies are now purchased from Mr. Lee, who is responsible for installing and maintaining equipment, upgrading software, and maintaining user profiles on the network. To reduce the amount of Mr. Lee's work as network administrator, he has set up passwords by function. There is one user identification code (userid) and password for accounting (shared by Tiffany, George, and the accounting clerk, Isabel). The plant supervisors share another userid that is used for production control and to initiate the time-keeping system every morning. A separate userid and password allowing for only enquiry into the job costing system has also been set up and can be used by all employees. A standard routine has been set up to back up the accounting systems. Either Tiffany or the accounting clerk inserts one of seven tape cartridges into the system at the end of the day (they are labelled with the day of the week), so that the company has a full set of accounting backups for the week. Tiffany keeps the backup files in her office. These are particularly important, since during the last office move, two years ago, the original software for the accounting system was misplaced. The network has two central servers, eleven user stations, and five printers. The user stations are set up as follows: four CAD/CAM, two time-keeping, two production planning and control, two accounting, and one for George. A good working relationship is extremely important for satisfying some of the company's larger customers. MTI has paid for computer equipment for each of the supervisors so that they have fully functioning computers at home. If a rush job requires weekend work, these senior personnel can work at home to get the necessary quoting or design work completed. Since the at-home systems are identical to the office systems, Mr. Lee simply copied the MTI systems to the home computers. Files can be easily taken home and then brought back to the office using thumb drives. It is understood that when times are slower, a day off can be taken to compensate for this weekend work. It has been almost 10 years since Tiffany arranged for the implementation of the network and the purchase of the standard integrated accounting packages (general ledger, order entry/accounts receivable, purchases/payable and payroll), and for the purchase of the job-costing and time-keeping systems. A variety of reports are printed daily, weekly, or monthly from the job-costing system. These reports are used for monitoring employee hours, the status of the jobs, the costs accumulated for particular jobs, and the work-in-progress inventory. The weekly report of hours from the job-costing system is approved by the production supervisors and is used as an input source for hours worked into the payroll system. The accounting clerk enters the hours into the accounting system so that weekly payroll cheques and reports can be produced. The accounting clerk handles most data entry. Tiffany is really pleased with their accounting clerk, Isabel, who has been with the company for three years. She insists that fate had a hand in getting Isabel working for MTI. Isabel had been "pounding the pavement," having recently immigrated, and had no Canadian business experience. Her accounting skills were rudimentary but she quickly learned the accounting software and has reorganized the filing systems. Tiffany considers her as indispensable. When Isabel goes on holiday, many things just don't get done! Tiffany can do the payroll in a pinch, but accounts payable and cash disbursements are always done by Isabel. If she's away, suppliers are simply told to wait, or Tiffany issues a manual cheque for recording later. Isabel is very good at clearing queries from suppliers and ensuring that new suppliers are set up properly. The purchasing supervisor and his staff rely on Isabel, as she checks the account allocation of purchases and makes any necessary corrections. Tiffany or George are signing officers, although Tiffany realizes that she checks supporting materials more thoroughly than George, who usually just queries Isabel verbally about larger purchases. In the past, MTI's audit has been entirely substantive. However, your partner has decided that with MTI's growth, it is time for the company to consider adding additional internal controls. Accordingly, he has asked you to draft a management letter to be addressed to George and Tiffany. Required: A) Prepare a draft management letter, clearly identifying the weaknesses (W), impact or implications of the weaknesses (I), and recommendations for improvement (R). [The following is a theory question that does not require examples from the case, although examples could be used.] B) Explain how the control environment and general IT (information technology) controls are related. Describe the impact of the control environment and of general IT controls on different types of application controls and on the audit process.

Paul is in the process of performing procedures to obtain the necessary understanding of the client's internal controls. As part of this process, Paul received from the client completed narratives, flowcharts, and internal control questionnaires. Paul can use this information from the client

It is important for the public accountant to consider the competence of the audit clients' employees because their competence bears directly and importantly upon the

The methods that management uses to supervise the entity's activities are called

The essence of an effectively controlled organization lies in the

An essential characteristic of the persons performing internal check procedures is

The first step for management in the risk assessment process is to identify factors that may increase risk, for example failure to meet prior objectives. Then, management will

A procedure that would most likely be used by an auditor in performing tests of control procedures that involve segregation of functions and that leave no transaction trail is

Each key control that the auditor intends to rely on must be supported by sufficient

The auditor may identify some risks that cannot be effectively tested by substantive tests alone. For example, when there are paperless transactions (perhaps using EDI - electronic data interchange). To address these risks, the auditor is required to

When the auditor identifies opportunities for the client to make operational improvements in the internal control system, it will be communicated to the client's audit committee in the

The Sarbanes Oxley Act has had consequences for many areas of corporate activities, including the following impact on the work of the auditor:

Dimple Leather is a chain of retail stores that sells leather clothing and accessories across Canada. Each store has point-of-sale equipment that is linked to a local server. At night, local accounting information is transmitted to the head office computer and any updates to prices or other adjustments are transferred to the local office. Required: Define the control environment. List the components of the control environment. For each component, provide an example of a control that might exist at Dimple Leather.

Internal controls can never be regarded as completely effective. Even if systems personnel could design an ideal system, its effectiveness depends on the