mu1 practice exam

INTERNAL AUDITING & CONTROLS [MU1] PRACTICE EXAMINATION #2

(Updated to the 2013/2014 Module Notes)

MU1

Before starting to write the examination, make sure that it is complete and that there are no printing defects. This examination consists of 6 pages. There are 4 questions for a total of 100 marks.

READ THE QUESTIONS CAREFULLY AND ANSWER WHAT IS ASKED.

To assist you in answering the examination questions, CGA-Canada includes the following glossary of terms.

Glossary of Assessment Terms

Adapted from David Palmer, Study Guide: Developing Effective Study Methods (Vancouver: CGA-Canada, 1996). Copyright David Palmer. Calculate Mathematically determine the

amount or number, showing formulas used and steps taken. (Also Compute)

Compare Examine qualities or characteristics that resemble each other. Emphasize similarities, although differences may be mentioned.

Contrast Compare by observing differences. Stress the dissimilarities of qualities or characteristics. (Also Distinguish between)

Criticize Express your own judgment concerning the topic or viewpoint in question. Discuss both pros and cons.

Define Clearly state the meaning of the word or term. Relate the meaning specifically to the way it is used in the subject area under discussion. Perhaps also show how the item defined differs from items in other classes.

Describe Provide detail on the relevant characteristics, qualities, or events.

Design Create an outcome (e.g., a plan or program) that incorporates the relevant issues and information.

Determine Calculate or formulate a response that considers the relevant qualitative and quantitative factors.

Diagram Give a drawing, chart, plan or graphic answer. Usually you should label a diagram. In some cases, add a brief explanation or description. (Also Draw)

Discuss This calls for the most complete and detailed answer. Examine and analyze carefully and present both pros and cons. To discuss briefly requires you to state in a few sentences the critical factors.

Evaluate This requires making an informed judgment. Your judgment must be shown to be based on knowledge and information about the subject. (Just stating your own ideas is not sufficient.) Cite authorities. Cite advantages and limitations.

Explain In explanatory answers you must clarify the cause(s), or reasons(s). State the “how” and “why” of the subject. Give reasons for differences of opinions or of results.

Identify Distinguish and specify the important issues, factors, or items, usually based on an evaluation or analysis of a scenario.

Illustrate Make clear by giving an example, e.g., a figure, diagram or concrete example.

Interpret Translate, give examples of, solve, or comment on a subject, usually making a judgment on it.

Justify Prove or give reasons for decisions or conclusions.

List Present an itemized series or tabulation. Be concise. Point form is often acceptable.

Outline This is an organized description. Give a general overview, stating main and supporting ideas. Use headings and sub-headings, usually in point form. Omit minor details.

Prove Establish that something is true by citing evidence or giving clear logical reasons.

Recommend Propose an appropriate solution or course of action based on an evaluation or analysis of a scenario.

Relate Show how things are connected with each other or how one causes another, correlates with another, or is like another.

Review Examine a subject critically, analyzing and commenting on the important statements to be made about it.

State Clearly provide a position based on an evaluation, e.g., Agree/Disagree, Correct/Incorrect, Yes/No. (Also Indicate)

Summarize Give the main points or facts in condensed form, like the summary of a chapter, omitting details and illustrations.

Trace In narrative form, describe progress, development, or historical events from some point of origin

PEMU1#2 Page 1 of 6

CGA-CANADA

INTERNAL AUDITING & CONTROLS [MU1] PRACTICE EXAMINATION #2

(Updated to the 2013/2014 Module Notes) Marks Time: 4 Hours

Note: The questions in this examination test the knowledge, skills, and professional values demonstrated in this course. Marks are given for reasoned and persuasive arguments, and for clarity and impact of presentation. You must provide practical illustrations for the use of concepts and analytical methods in the circumstances described in each question. Read the specific requirements of each question carefully, and ration your time across all questions.

24 Question 1

Select the best answer for each of the following unrelated items. Answer each of these items in your examination booklet by giving the number of your choice. For example, if the best answer for item (a) is (1), write (a)(1) in your examination booklet. If more than one answer is given for an item, that item will not be marked. Incorrect answers will be marked as zero. Marks will not be awarded for explanations.

Note: 2 marks each a. Which of the following is one of the three alternative approaches that can be used for performance

auditing?

1) Reporting on management systems and practices 2) Audit reporting on financial statements 3) Audit reporting on cost/benefit effectiveness 4) Audit reporting on the merit of government policies b. What are the three components of a comprehensive audit in the public sector?

1) An attest audit, a compliance audit, and a performance audit 2) An attest audit, an operational audit, and a performance audit 3) A compliance audit, an operational audit, and an IT audit 4) An IT audit, an operational audit, and a performance audit c. Which of the following is a specific standard for the performance of internal audit work?

1) Internal auditors should provide sufficient support to the work performed by external auditors. 2) Internal auditors should follow up to ascertain that appropriate action is taken on reported audit

findings. 3) The chief audit executive should establish a program for selecting and developing the human

resources of the internal audit department. 4) The chief audit executive should establish plans to carry out the responsibilities of the internal

audit department.

Continued...

PEMU1#2 Page 2 of 6

d. Which of the following is an example of a control consisting of both a manual and an automated procedure?

1) Data entry to the general ledger. A user enters data into the general ledger software application and the system will block the user from entering non-numeric data into the amount field.

2) Accounts payable update to general ledger. A report is produced indicating that the update was successful and is then reviewed to ensure that it was completed successfully.

3) Validation of username and password. A user enters login information and the system will validate before access is granted.

4) Input validation. A programmer inserted an input control to ensure that the debits and credits contained in a journal entry are equal.

e. Among the following standards, which is a specific standard for the management of the internal

auditing department?

1) Internal auditors should use a standard audit plan for each audit. 2) The chief audit executive should coordinate internal and external audit efforts. 3) The chief audit executive should ensure that the technical proficiency and educational background

of internal auditors are appropriate for the audits to be performed. 4) The internal auditing department should possess or obtain the knowledge, skills, and disciplines

needed to carry out its audit responsibilities. f. Which of the following risk categories must be considered in an information technology (IT)

environment?

1) Information, inherent, and residual risks 2) Information, specific, and technological risks 3) Inherent, specific, and technological risks 4) Inherent, residual, and specific risks g. The product of an internal audit is an audit report. The effectiveness of the internal audit department

will be judged largely on the quality and value of the audit report. Which of the following best describes a good audit report?

1) An audit report that provides the basis for follow-up 2) An audit report that includes only observations 3) An audit report that emphasizes negative findings 4) An audit report that provides only an opinion h. When conducting a fraud investigation, which of the following should not be taken into consideration

by the internal auditor?

1) Informing senior management 2) Reporting on the fraud investigation 3) Informing all employees in the department where the fraud has occurred 4) Being alert to indications of the existence of fraud i. Which of the following are steps to be followed in the examination phase of an internal audit?

1) Prepare audit program, examine and test operations and transactions, analyze audit results 2) Examine and test operations and transactions, analyze audit results, complete and review audit

files 3) Prepare audit program, analyze audit results, complete and review audit files 4) Determine the appropriate evidence required, examine and test operations and transactions,

summarize audit findings

Continued...

PEMU1#2 Page 3 of 6

j. Which of the following lists includes terms that all describe different types of audit interviews?

1) Preliminary, management, follow-up, and exit 2) Preliminary, fact-gathering, networking, and exit 3) Research, fact-gathering, follow-up, and exit 4) Preliminary, fact-gathering, follow-up, and exit k. Which of the following is not a prerequisite to be met before the internal auditor can consider using

computer-assisted audit techniques?

1) The information to be analyzed must be stored in computer records. CAATs can be used only where the record-keeping is computerized.

2) Computer facilities must be available, and appropriate software to perform the CAATs must either be available or can be developed cost-effectively.

3) The auditor must have the technical competence to perform the audit procedures or can supervise the specialist who carries out the computer-assisted procedures.

4) The auditor must obtain permission from the Chief Information Officer (CIO) to access the required data.

l. Accountability is a relationship based on the obligation to demonstrate and take responsibility for

performance in light of agreed-upon expectations. In what type of business is accountability the most important?

1) Manufacturing businesses 2) Partnerships 3) Government organizations 4) Limited partnerships

26 Question 2 You are a CGA and the controller of Magnisson Electrical Limited. The company sells a variety of consumer electrical parts across North America with annual sales exceeding $15 million. The company maintains two offices in Canada and employs more than 65 people. Throughout the past year the company has had difficulty processing orders on time due to shortages in stock availability. This was puzzling as the company has minimum safety levels for inventory and the IT system automatically re-orders items as needed. Investigation revealed that payments to suppliers were being delayed and as a consequence shipments were being held back. However, Magnisson had never experienced any cash flow problems and sales growth had only increased marginally over the past 5 years. There is the possibility that stock is being diverted for personal use by staff. As a result of the noted problems and questions raised by your limited investigation, you feel that Magnisson should hire an internal auditor and thus create an internal audit department. You approach the vice-president (VP) of Finance & Operations of the company, Frank Stewart, with your findings and proposed solution. He responds: “I don’t understand how this can happen. Part of your responsibilities is to run the daily operations and ensure that our budget variances are correct, yet we seem to be experiencing cash flow problems and stock shortages. The company already has an external auditor; why would I need to hire an internal auditor?” He suggests that if you think hiring an internal auditor is the best solution to deal with the company’s problems, then you should write a memo to him and the board of directors in which you address his concerns. He wants you to contrast the respective roles and the differences between an internal auditor and an external auditor. He would also like to know if the internal auditor would be responsible for issues relating to fraud. Finally, he would like you to describe the main phases of an internal audit and their purpose.

Continued...

PEMU1#2 Page 4 of 6

After a few moments, the VP says: “You know, if we do hire an internal auditor, I may just have the right person for the job. My brother-in-law was an internal auditor. He’s been out of work for a while but I think he would be a perfect fit. I don’t think he would have any problem reporting exclusively to me. I’ll call him and, if the board approves, we can hire him right away and save human resources the trouble of having to search for a candidate.” Required

16 a. Write the requested memo to the VP and the board of directors. 4 4 marks will be awarded for clarity, logic, and persuasiveness.

6 b. Separate from your memo, identify and explain any ethical issues in this case. In addition, evaluate the

VP’s proposed reporting structure for the internal auditor with respect to independence and objectivity.

16 Question 3

Dr. Tom owns a private health clinic that serves a high volume of patients. The patients are primarily ages 18 to 28 and common health services are vaccinations, physicals, and various tests for pregnancies, allergies, and diseases. The clinic employs 15 doctors and an administrative staff of 10 people. The administrative staff includes one clinic manager and two supervisors. All administrative staff members report to the clinic manager. The clinic has a debit/credit card machine to process electronic payments from patients not covered by health insurance. Any cash collected for payments is given to the clinic manager who makes weekly deposits along with the debit/credit card receipts. The clinic manager also reconciles the bank account on a monthly basis. Dr. Tom is very busy but has complete trust in the clinic manager and has delegated all administrative and financial duties to her with no verification ever conducted on his part. Recently, while the clinic manager was away on her first vacation in many years, one of the supervisors identified a pattern of unusual transactions while reconciling the previous month’s bank account. It seems that there were a number of refunds to a few debit and credit cards with no matching purchase. She notified Dr. Tom of her findings. Dr. Tom was confused as there is an office policy forbidding the use of the credit/debit card machine for cash withdrawals. He made some enquiries and discovered that every administrative staff member has access to and a working knowledge of the debit/credit card machine. Dr. Tom has asked you, in your capacity as an internal audit expert, to analyze the data available and inform him of your findings. You have asked your assistant to perform a preliminary analysis of the data file received from the bank that contains details of the debit and credit card transactions for the month of August. Other files are the employee file and the employee schedule file. File containing details of debit and credit card transactions — table named “Sales_Trx”: IDNO: Unique reference number assigned by the bank TRDATE: Original date of transaction TRTIME: Original time of transaction TRAMT: Amount of transaction PAYTYP: Payment type 1. Debit card 2. Credit card CARDNO: Card number used in transaction RETREFIDNO: If transaction is a return, this field will reference the IDNO of the original

purchase. This field is optional (that is, returns can be processed with no reference number entered) and by default is set to a series of zeroes, that is, “00000.”

Continued...

PEMU1#2 Page 5 of 6

Employee file — table name “Employee_info”: EMPNO: Employee number EMPNAME: Employee last name EMPFTNAME: Employee first name DOB: Employee date of birth ADDRESS1: Employee street address ADDRESS2: Employee municipality of residence HIREDATE: Employee hiring date Employee schedule file — table name “Employee_schedule”: REFNODUTY: Unique reference number of the assignment EMPNO: Employee number STARTDATE: Date assignment started ENDDATE: Date assignment ended EXHIBIT 3-1 Step 1:

Command: EXTRACT RECORD IF TRAMT < 0 TO “Refunds” OPEN Step 2:

Primary table — “Refunds”, Secondary table — “Sales_Trx” Command: JOIN PKEY RETREFIDNO FIELDS IDNO TRDATE TRTIME TRAMT PAYTYP RETREFIDNO SKEY IDNO WITH CARDNO TO “Refunds_with_Purchase” OPEN PRESORT SECSORT

REFUNDS WITH PURCHASE

IDNO TRDATE TRTIME TRAMT PAYTYP CARDNO RETREFIDNO 54555 August 8, 2013 08:55 –$450.00 2 6198 3067 4687 00000 54619 August 11, 2013 13:41 $106.59 2 5505 6544 5487 00000 54623 August 11, 2013 13:44 –$106.59 2 5505 6544 5487 54619 54824 August 13, 2013 10:56 $176.45 2 5505 7468 4358 00000 54826 August 13, 2013 11:05 –$176.45 2 6198 3067 4687 54824 55306 August 14, 2013 17:05 –$200.00 1 7645 5405 6487 00000 55321 August 18, 2013 16:58 –$125.00 1 7645 5405 6487 00000

Required

6 a. Identify three preliminary conclusions you can draw from the results shown in Exhibit 3-1. 4 b. Explain two additional analyses that your assistant should perform using the information contained in

the files to obtain other indicators to help you plan your audit. 6 c. Based on the information available, recommend three additional controls or procedures that Dr. Tom

should implement to improve his operations.

Continued...

PEMU1#2 Page 6 of 6

34 Question 4 You are a CGA and have been recently hired to set up an internal audit department at an agriculture company, Greenlee Inc. The company has developed a reputation for high quality products. This has contributed to an increase in sales from $3 million four years ago to just over $10 million in the current year. Due to this rapid growth, the company has expanded its operations much quicker than originally anticipated by management. The president, Janice, feels that adequate controls have not been put in place to match the growth the company has experienced. As your first mandate, Janice wants you to audit the systems and practices associated with the production process. The president’s main concern is regarding the production of Greenlee’s scientifically engineered seeds. She is concerned that despite the majority of orders being filled on time there are cost overruns and potential issues with respect to the quality of the seeds produced. Your preliminary work has determined that the production of each batch of seeds takes up to five days. All production costs are recorded weekly in a computerized record system under the responsibility of Jin, the production manager. Jin informed you that since Greenlee employs a variance analysis process for evaluating production efficiency, the information in his system is completely independent of the main accounting system. The process of reviewing product costs includes an analysis of actual versus budgeted cost as established by Jin. Variance analysis is performed and reported to Jin on a quarterly basis. In addition, Janice has indicated that during this period of rapid growth, the company has not updated its quality control methods nor increased the frequency of tests to adapt to higher volume and increasingly complex production runs. Janice is concerned that these issues could have an effect on Greenlee’s profitability as well as on the company’s reputation. Prior to conducting the audit, Janice would like you to write a memo to address any risks you have identified in your preliminary work. In particular, identify the audit criteria and indicate the procedures you would use to test the production process for each operational activity:

1. Production costs 2. Time budgeting 3. Product quality

In addition, explain the objectives of the audit report that you will issue at the end of your work, as well as a list of its contents. Required

30 Write the memo to Janice addressing all the requirements that she would like explained.

Note: 4 4 additional marks will be awarded for clarity, logic, and persuasiveness.

END OF EXAMINATION

100

PSMU1#2 Page 1 of 10

CGA-CANADA

INTERNAL AUDITING & CONTROLS [MU1] SUGGESTED SOLUTIONS #2

(Updated to the 2013/14 Module Notes)

Marks Time: 4 Hours

Note: The questions in this examination have been set to test the knowledge, skills, and professional values demonstrated in this course. The emphasis is much more on a reasoned and persuasive argument, on clarity and impact of presentation, and responding specifically to the case or situation presented, than on the mere recall of material from the Module Notes or readings.

24 Question 1

Note: 2 marks each

Sources:

a. 1) Topic 10.5 (Level 2) b. 1) Topic 10.5 (Level 2) c. 2) Topic 2.1 (Level 1) d. 2) Topic 7.6 (Level 1) e. 2) Topic 2.6 (Level 1) f. 3) Topic 7.3 (Level 1) g. 1) Topic 6.2 (Level 1) h. 3) Topic 5.10 (Level 1) i. 2) Topic 5.1 (Level 1) j. 4) Topic 6.1 (Level 2) k. 4) Topic 5.5 (Level 1) l. 3) Topic 10.1 (Level 1)

Continued...


26 Question 2

Source: Topics 1.5, 1.9, 2.3, 4.1, and 5.9 (Level 1)

20 a. (4) Internal auditing versus external auditing:

• The internal auditor is generally an employee of the firm, whereas the external auditor is always an outside contractor.

• The internal auditor reports to management, and the external auditor reports to the shareholders. • The internal auditor’s activities are forward-looking and have a much broader focus than those of

the external auditor, who focuses primarily on financial statements, which reflect past transactions. • The external auditor reviews financial records periodically, but the internal auditor is interested in

the day-to-day operations and the processes behind them. Note: 2 marks for each point to a maximum of 4 marks

(4) Roles and responsibilities regarding the deterrence and detection of fraud:

• Management, including its line and accounting personnel, has the primary responsibility for preventing and detecting fraud. However, management needs assistance from the internal auditor.

• The responsibility for identifying all risks and reducing identified risks to an acceptable level is that of management, not of the internal (or external) auditors. In its risk management and control processes, management should consider the risk of fraud along with other risks and should implement operational controls to reduce the risk of fraud to within the organization’s risk limits.

• Management also has the responsibility (in its operation of controls) to have controls in place to detect fraud if it does occur. Unfortunately, not all fraud can be detected.

Note: 2 marks for each valid point to a maximum of 4 marks

(8) The main phases of an internal audit and their purposes:

Planning phase

In the planning phase of the internal auditing process, the auditor must decide what needs to be audited and how frequently. This phase results in long-term and short-term (annual) audit plans, and plans for specific audit engagements. An audit program is a detailed plan of tasks to be performed during the audit to assess the quality of management systems and practices in the organization and obtain sufficient evidence to support their conclusions. Key aspects of the audit plan, such as criteria, should be agreed to by the auditee.

Examination phase

In this phase, internal auditors perform specific audits by following audit programs developed during the planning phase. The next steps involve analyzing audit results, completing and reviewing audit files, and organizing the material to be used in the reporting phase. In an internal audit, the auditor must take steps to keep the auditee informed of progress and emerging issues.

Reporting phase

Auditors summarize what has been accomplished during the audit and inform higher-level management and other interested parties. Auditors decide what should be reported to management of the audited unit and to senior management in the organization. They prepare draft and final audit reports, discuss findings and recommendations with management, obtain their comments, and distribute the reports.

Continued...


Monitoring phase

In this phase, monitoring by the internal auditor is required to determine whether management has implemented measures to correct deficiencies identified in the audit. The result of the monitoring phase is usually a follow-up report.

Note: 2 marks for each phase Sample solution Note: Candidates will provide different solutions. Here is a sample that would be acceptable. MEMORANDUM

Date: March 1, 20XX To: Frank Stewart, Vice President of Finance & Operations Cc: Members of the Board of Directors From: John Smith, CGA Re: Hiring an internal auditor At your request, this memo addresses your concerns and questions following a preliminary

investigation into production problems. The report is intended to respond to those questions and to highlight the reasons why the hiring of an internal auditor could be a viable solution. The contents of the report include contrasting the respective roles of internal and external auditors, specifically identifying the traditional roles and responsibilities relating to the prevention and detection of fraud and describing the main phases of an internal audit.

In general, internal auditors are employees of the company, whereas external auditors are outside

contractors. Provided that the internal auditor’s role within the organization has been clearly defined to maintain independence, there would be a distinct advantage as the auditor would have a better working knowledge of the operations. The external auditor’s scope would be limited to reviewing financial records periodically, whereas an internal auditor would focus on the day-to-day operations and the processes behind them. In the context of the production problems our company is currently experiencing, there would be significant value added in having a continuous review of the operations. In addition, an internal auditor’s activities are forward-looking and have a much broader focus than those of the external auditor, whose primary concern is the financial statements, which reflect past transactions.

With respect to the issue of fraud, it must be clear that management, including accounting personnel,

have the primary responsibility for preventing and detecting fraud. Traditionally, internal auditors provide assistance to management in support of the latter. The responsibility for reducing identified risks to an acceptable level is that of management and not the internal auditor. Identified risks are usually but not limited to the result of work performed by the internal auditor. The risk management process should inherently consider the risk of fraud and implement necessary controls to mitigate any possible occurrences. The controls, put in place by management, should detect fraud if indeed it does occur. Unfortunately, not all fraud can be detected. An internal auditor’s work can make significant contributions to the risk management process.

Continued...


In hiring a qualified internal auditor, we can expect to have in place a process for auditing the controls of our company and evaluating their effectiveness. This process consists of a series of phases which are standard for internal audits. The first phase is planning. In the planning phase of the internal auditing process, the auditor must decide what needs to be audited and how frequently. This phase results in long-term and short-term (annual) audit plans, and plans for specific audit engagements. Each engagement will have an audit program, which is a detailed plan of tasks to be performed during the audit to assess the quality of management systems and practices in the organization and obtain sufficient evidence to support their conclusions.

The second phase is examination. In this phase, internal auditors perform specific audits by following

audit programs developed during the planning phase. The next steps involve analyzing audit results, completing and reviewing audit files, and organizing the material to be used in the reporting phase.

The third phase is reporting. Internal auditors summarize what has been accomplished during the audit

and inform higher-level management and other interested parties. They prepare draft and final audit reports, discuss findings and recommendations with management, obtain their comments, and distribute the reports.

The fourth phase is monitoring. In this phase, monitoring by the internal auditor is required to

determine whether management has implemented measures to correct deficiencies identified in the audit. The result of the monitoring phase is usually a follow-up report.

I trust that this memo has addressed all of your questions and to the extent possible outlined what

benefits and work we could expect should the company hire an internal auditor. The advantages of the audit process would add value and provide a continuous feedback loop for the effectiveness of the company’s controls and processes. This would be of extreme importance in helping diagnose production as well as other problems that our company is currently experiencing or may encounter in the future.

Note: 4 marks for clarity, logic, and persuasiveness.

6 b. (4) Ethical consideration:

• A member of senior management (the VP) is ignoring a conflict of interest and making a decision that may not be in the best interest of the employer.

• The VP should avoid being directly involved in the hiring process if the candidate is an individual who would place the VP in a conflict of interest; should this individual be hired, the VP must report his conflict of interest to the board of directors to ensure transparency.

(2) Independence and objectivity:

• Independence permits auditors to render the impartial judgments essential to the proper conduct of audits. Auditors must be able to carry out their work freely and objectively. Auditors are independent when they are free from conditions that threaten objectivity or the appearance of objectivity.

• The chief audit executive usually reports directly to upper management, ideally the chief executive officer (but often the vice-president of finance) and the audit committee of the board of directors, in order to ensure independence.

Continued...


16 Question 3 Source: Topics 5.6, 7.5, and 9.2 (Level 1)

6 a. Preliminary conclusions:

• There are three refunds with no matching purchases, all of which are round figures. • Of the three refunds noted above, two have been refunded to the same card number. • On August 13, a refund is made to a different card number than the one that was charged only

nine minutes earlier. • The refund on August 13 is made to the same card number as the first unmatched refund. • A purchase and refund to the same card on the same date and close to the same time is not an issue. • Timing of three refunds noted above was either at the beginning or end of the work day. • All observations point to a possible fraud that needs to be investigated further.

Note: 2 marks for each point to a maximum of 6 marks

4 b. Recommendations for additional analysis:

• Verify the employee records and employee schedule file to determine who was working on the dates when questionable refunds occurred

• Perform the same analysis for other sales periods to determine if this was an isolated incident or if other questionable refunds have occurred in the past

• Verify previous sales records to determine if refunds were processed to the same card numbers identified in the preliminary analysis


6 c. Recommendations for additional controls:

• Create segregation of duties with respect to the deposits and bank reconciliation • Limit access to the debit/credit card machine to a few administrative staff member with seniority • Reconcile sales records to cash and debit/credit receipts on a daily basis • Dr. Tom should request and review reports regarding reconciled sales data on a daily basis to ensure

all revenues are being properly recorded and received • Ensure employees take their allotted vacation, which will give replacements the opportunity to

identify any intentionally hidden problems (if any exist) • Require the signature of a supervisor for each refund request • Ensure that the system records the employee number of the person initiating the transaction


Continued...


34 Question 4 Source: Topics 3.1, 5.2, 6.2, 6.4, and 8.6 (Level 1)

6 Identified risks:

• Variance analysis performed on a quarterly basis does not address the issue of cost overruns in a timely manner. The maximum time for the production of a batch of seeds is approximately five business days; therefore several batches would be produced before any corrective action would be taken.

• Management depends on cost variance analysis reports for decision making. The budgeted costs established by Jin are not independently verified for accuracy and reasonability. There is a risk that management makes decisions based on unreliable information.

• The record-keeping system used by Jin is independent of the main accounting system. There is a risk that information contained in Jin’s systems is incomplete and/or inaccurate.

• Methods to test quality control may be out of date and insufficient to handle the current volume of seeds produced. Inefficiencies in quality control can damage the company’s reputation and adversely affect profitability.

Note: 2 marks for each point to a maximum of 6 marks.

8 Acceptable audit criteria for each operational activity:

Product costs

• Roles and responsibilities for monitoring product costs against projected costs should be clearly defined. • All costs associated with the production of a given product should be clearly identified. • Cost overruns should be immediately flagged and analyzed. Time budget for producing products

• Roles and responsibilities for ensuring orders are filled within the given time period should be clearly defined.

• Product runs that are over the allotted time budget should be identified in a timely manner and corrective action should be taken.

• Post-production analysis should be conducted to determine reasons why a product’s time budget was not respected (whether it required more time or significantly less time to meet an order request).

Product quality

• Roles and responsibilities for continuously testing products for quality control should be clearly defined. • Product quality testing should be conducted on a routine basis. • Reports on quality control (regardless of impact) should be submitted to the appropriate level of

management on a regular basis. Note: 2 marks allocated for each acceptable criterion to a maximum of 8 marks; candidates must identify at least one criterion from each section.

Continued...


8 Acceptable audit procedures for each operational activity:

Product costs

• Obtain organizational chart that lists employees and overall department duties • Conduct interviews with department staff to identify individual task responsibilities • Review standard costs for accuracy • Review procedure for analyzing cost overruns • Identify cost overruns throughout the period under review and select a sample to determine if supporting

documentation is available as evidence that an analysis indeed did occur Time budget for producing products

• Obtain organizational chart that lists employees and overall department duties • Conduct interviews with department staff to identify individual task responsibilities • Identify production runs where the time budget was not respected throughout the period under review

and select a sample to test if it was discovered in a timely manner, if any corrective action was taken, and if a post-production analysis was conducted

Product quality

• Obtain organizational chart that lists employees and overall department duties • Conduct interviews with department staff to identify individual task responsibilities • Request supporting documentation as evidence of quality control tests • Request supporting documentation as evidence that reports on quality control were submitted to

management Note: 2 marks allocated for each acceptable procedure to a maximum of 8 marks; candidates must identify at least one procedure from each section.

4 Purpose and functions of an internal audit report:

• The end-product of an internal audit is the audit report. Developing, obtaining approvals for, and issuing the report is the most important phase of the internal audit process. No matter how well the auditor has planned and conducted the audit, how significant the observations, or how much the organization’s effectiveness and efficiency could be improved by implementing the auditor’s recommendations, the audit will not serve its purpose if the report is of substandard professional quality and fails to motivate management to correct the noted deficiencies.

• An internal audit report should accomplish four important objectives:

1. Document the results of audit work. The report should summarize the scope, nature, and extent of the audit work performed; the evidence obtained; and the auditor’s observations, conclusions, and recommendations. In effect, it should summarize the audit work done and the auditor’s findings.

2. Provide a framework for management action. The audit report is often viewed as an evaluation of current operational practices and the performance of various organizational units or functions. It shows which areas are operating well and which need improvement, identifying causes and effects of deficiencies. It also recommends actions that management should take. It should motivate management to take action, or satisfy senior management and the board of directors that no action is required, and why.

Continued...


3. Present the auditee’s views. Usually, managers of audited units agree with the auditor on all important points in the report. However, auditees sometimes want to mention mitigating circumstances or clarify an issue. If the auditee disagrees with the auditor’s observations or recommendations, the auditee should be allowed to express opposing views, stating his or her reasons. This method helps senior management by providing a basis for deciding what actions to take. It indicates that the audit reporting process is fair and unbiased.

4. Provide a basis for follow-up. The report provides a basis for following up on audit recommendations to determine whether management has adequately considered the auditor’s recommendations and implemented appropriate corrective action.

Note: 1 mark for each objective

4 Contents of an internal audit report:

Typically, audit reports contain the following information, presented in this order:

1. Background information. Brief description of the operations of the department or unit being audited 2. Purpose and scope of the examination. Outlines the extent of the audit work and what has been

subject to review 3. Summary of major observations. List of important observations that should be of primary concern to

auditees (usually included in executive summaries to senior management) 4. Detailed observations and recommendations. In addition to the major observations, this is a more

complete listing of all observations, which includes a recommended course of action to be taken by the auditees with a given time frame.

5. Management comments. Management’s response to the identified observations and recommendations 6. Conclusions (may not appear as a separate section) 7. Acknowledgment Note: 1 mark for each point to a maximum of 4 marks

Sample solution Note: Candidates will provide different solutions. Here is a sample that would be acceptable. MEMORANDUM Date: March 1, 20XX To: Janice Chin, President From: John Smith, CGA Re: Risks, audit criteria and procedures, and explanation of final audit report Further to your request, the internal audit department has prepared this memo to address several of your concerns. This memo will list the risks facing Greenlee identified by preliminary analysis, audit criteria and procedures to be used as a basis of testing the production process, and a brief explanation of the objectives and a list of contents of the final audit report. Primary among your concerns was the identification of risks that could adversely affect the company. The internal auditor uses risk assessment in the planning of audits. It requires identification of relevant risk factors and an assessment of their relative significance. Our audit priorities will be determined in part by the results of the risk assessment.

Continued...


The result of our preliminary work indicates a risk to the company’s reputation as a result of ineffective quality control for the production of seeds. Another risk arises from the lack of reliable cost controls and timely reporting to management. Variance analysis is currently performed on a quarterly basis. The implication is that several production runs would take place before any variance analysis would be performed. Should there be any cost issues, they would not be discovered until several batches of seeds would have been produced. If variance analysis was performed on a more frequent basis then any problems with cost overruns would be identified on a timely basis and solutions could be implemented immediately, thus limiting any potential reduction in profitability. When using a budgeted cost method to perform variance analysis, care must be taken to ensure the accuracy and reliability of the budgeted amounts. Assigning inaccurate actual costs to batches of seeds produced will result in unreliable reporting to management. In addition to the risks noted above, there is also the issue of quality control. Policies regarding the methods used for quality testing and the frequency of these tests have not been updated to keep pace with increased production. The company’s reputation has been dependent on producing high quality agricultural products. If product quality decreases, this could have a direct effect on the company’s profitability and any potential future sales growth. Benchmarking with other operations and companies of a similar size is a viable solution to determine what methods of quality control would best serve Greenlee. An audit program is a detailed plan of tasks to be performed during the audit. The program outlines the relationship between audit objectives and criteria and the procedures used for testing actual performance against the criteria. To address your request, we have identified the following criteria to be used in an audit of the production process. In auditing product costs, roles and responsibilities for monitoring product costs should be clearly defined. All costs associated with the production of a batch of seeds should also be clearly defined. With respect to time budgets for production, roles and responsibilities for ensuring orders are filled within the given time period should be clearly defined. Product runs that are over the allotted time budget should be identified in a timely manner and corrective action must be taken. In auditing controls regarding product quality, the criteria would be roles and responsibilities for continuously testing products for quality control. These roles and responsibilities should be clearly defined and product quality should be verified on a routine basis. All of the previously mentioned audit criteria would require various procedures to test against their performance. Procedures include obtaining the organizational chart that lists employees and their respective duties, as well as conducting interviews with staff to identify individual task responsibilities. We must verify the accuracy of the budgeted costs used. Samples over the period under review should be selected and supporting documentation obtained as evidence that cost overruns and time budget overruns are identified in a timely manner and reported to the appropriate level of management. We must verify the existence of quality control tests and their timing by obtaining supporting documentation and confirm that reports were submitted to management. The final output of the audit is the internal audit report. It is important that this report be clear and concise and motivates management to take corrective actions against any identified deficiencies. A report should accomplish four important objectives. The first objective is to summarize the scope, nature and extent of audit work performed. It should indicate the auditor’s conclusions and recommendations. The second objective is to provide a framework for management action. The report indicates which areas within a company are operating well and which need improvement. For example, in the production process there could be deficiencies with the cost method used for unit costs. The report should stress to management that this is a problem, state the reason(s) why it is a problem and provide a recommendation to address this issue. The third objective of the report is to present the auditee’s response to all important points that were identified. The auditee might have insight into mitigating circumstances regarding an issue. The report allows for the auditee to present an opposing view if they should disagree with a recommendation. This allows management to make better decisions regarding any potential corrective actions to be taken. The fourth objective of the report is to provide a basis for follow-up to ensure that management has adequately considered the auditor’s recommendations and implemented the appropriate corrective action.

Continued...


The audit report will contain background information, such as a brief description of the production department. It will also include the purpose and scope of the audit, which is the extent of the audit work to be performed. It will summarize the major observations that will be of primary concern to Greenlee, followed by a listing of more detailed observations and recommended courses of action to be taken within a given time frame. In addition, the report will contain management’s response to the identified observations and recommendations. Finally, the report will contain a conclusion of the entire audit as well as an acknowledgement of acceptance of its findings by management. I trust the above information has addressed your questions to a satisfactory level. As evidenced by preliminary findings, an audit of the production process will produce a number of important observations. Addressing these issues should add value to Greenlee’s operations and contribute to ensuring that the company remains profitable. With the cooperation of management, the ongoing audit process will add tremendous value to Greenlee and ensure that controls in place are effective and efficient. Note:

4 marks for clarity, logic, and persuasiveness.

END OF SOLUTIONS

100

mu1 practice exam

Documents