Control and Accounting Information Systems Suggested Answers To Discussion Questions

Accounting Information
Systems
CHAPTER 7
CONTROL AND ACCOUNTING INFORMATION SYSTEMS
SUGGESTED ANSWERS TO DISCUSSION QUESTIONS
7.1 Answer the following questions about the audit of Springers Lumber & Supply
a. What deficiencies existed in the internal environment at Springers?
The "internal environment" refers to the tone or culture of a company and helps
determine how risk consciousness employees are. It is the foundation for all other
ERM components, providing discipline and structure. It is essentially the same thing
as the control environment in the internal control framework.
The internal environment also refers to management's attitude toward internal control,
and to how that attitude is reflected in the organization's control policies and
procedures. At Springer's, several deficiencies in the control environment are
apparent:
1. Management authority is concentrated in three family members, so there are

few, if any, checks and balances on their behavior. In addition, several other
relatives and friends of the family are on the payroll.
2. Since the company has a "near monopoly" on the business in the Bozeman area,
few competitive constraints restrain prices, wages, and other business practices.
3. Lines of authority and responsibility are loosely defined, which make it difficult
to identify who is responsible for problems or decisions.
4. Management may have engaged in "creative accounting" to make its financial
performance look better, which suggests a management philosophy that could
encourage unethical behavior among employees.
b. Do you agree with the decision to settle with the Springers rather than to
prosecute them for fraud and embezzlement? Why or why not?
Whether or not to settle with the Springers is a matter of opinion, with reasonable
arguments on both sides of the issue.
The reasons for reaching a settlement are clearly stated: the difficulty of
obtaining convictions in court, and the possible adverse effects on the
company's market position.
7-1
Ch. 7: Control and Accounting Information Systems
On the other hand, the evidence of fraud here seems strong. If this kind of
behavior is not penalized, then the perpetrators may be encouraged to do it
again, with future adverse consequences to society.
c. Should the company have told Jason and Maria the results of the high-level audit?
Why or why not?
Whether or not Jason and Maria should have been told the results of the high-level
audit is also a matter of opinion. The investigative team is apparently trying to keep
its agreement to maintain silence by telling as few people as possible what really
happened. On the other hand, Jason and Maria were the ones who first recognized
the problems; it seems only right that they be told about the outcome.
Many lessons may be drawn from this story.
1. Auditors should view the condition of an organization's control environment as

an important indicator of potential internal control problems.
2. Fraud is more easily perpetrated and concealed when many perpetrators are
involved, and especially when management is involved.
3. Purchasing and payroll are two areas that are particularly vulnerable to fraud.
4. Determining whether fraud has actually occurred is sometimes quite difficult,
and proving that it has occurred is even more difficult.
5. Frauds do occur, so auditors must always be alert to the possibility of fraud.
6. Auditors should not accept management's explanations for questionable
transactions at face value, but should do additional investigative work to
corroborate such explanations.
Systems
7.2 Effective segregation of duties is sometimes not economically feasible in a small

business. What internal control elements do you think can help compensate for this
threat?
Small companies can do the following things to compensate for their inability to implement
an adequate segregation of duties:
Effective supervision and independent checks performed by the owner/manager may

be the most important element of control in situations where separation of functions
cannot be fully achieved. In very small businesses, the owner-manager may find it
necessary to supervise quite extensively. For example, the manager could reconcile
the bank account, examine invoices, etc.
Fidelity bonding is a second form of internal control that is critical for persons
holding positions of trust that are not entirely controlled by separation of functions.
Document design and related procedures are also important to internal control in this
situation. Documents should be required with customer returns to encourage
customer audit.
Document design should include sequential prenumbering to facilitate subsequent
review.
Where appropriate, employees should be required to sign documents to acknowledge
responsibility for transactions or inventories.
In small organizations, management can use computers to perform some of the
control functions that humans perform in manual systems. For example, the
computer can:
Check all customer numbers to make sure they are valid

Automatically generate purchase orders and have a member of management or a
designated buyer authorize them.
7-3
7.3 One function of the AIS is to provide adequate controls to ensure the safety of
organizational assets, including data. However, many people view control procedures
as red tape. They also believe that, instead of producing tangible benefits, business
controls create resentment and loss of company morale. Discuss this position.
Well-designed controls should not be viewed as red tape because they can actually
improve both efficiency and effectiveness. The benefits of business controls are evident if
one considers the losses that frequently occur due to the absence of controls.
Consider a control procedure mandating weekly backup of critical files. Regular

performance of this control prevents the need to spend a huge amount of time and money
recreating files that are lost when the system crashes, if it is even possible to recreate the
files at all. Similarly, control procedures that require workers to design structured
spreadsheets can help ensure that the spreadsheet decision aids are auditable and that they
are documented well enough so that other workers can use them.
It is probably impossible to eliminate resentment or loss of morale among all employees,

but these factors may be minimized if controls are administered fairly and courteously.
Of course, there is a cost-benefit tradeoff in implementing internal controls. If an

organization has too many controls, this may justifiably generate resentment and loss of
morale among employees. Controls having only marginal economic benefit may be
rejected for this reason.
Another factor is the obtrusiveness of the controls. When the user sees no clear need or
purpose to a control it can appear to be there only to control them and little more than that.
When the user does not understand their purpose, controls can often provoke resentment.
Systems
7.4 In recent years, Supersmurfs external auditors have given clean opinions on its
financial statements and favorable evaluations of its internal control systems. Discuss
whether it is necessary for this corporation to take any further action to comply with
the SarbanesOxley Act.
The Sarbanes-Oxley Act of 2002 (SOX) applies to publicly held companies and their
auditors and was intended to prevent financial statement fraud, make financial reports more
transparent, provide protection to investors, strengthen the internal controls at public
companies, and punish executives who perpetrate fraud.
SOX has had a material impact on the way boards of directors, management, and
accountants of publicly held companies operate. It has also had a dramatic impact on
CPAs of publicly held companies and the audits of those companies.
As a result of SOX, Supersmurfs management and their audit committee must take a more
active role in the financial disclosure process. Some of the more prominent roles include:
Audit Committee
Audit committee members must be on the companys board of directors and be

independent of the company. One member of the audit committee must be a financial
expert.
Audit committees hire, compensate, and oversee any registered public accounting
firm that is employed
Auditors report to the audit committee and not management
Audit committees must pre-approve all audit and non-audit services provided by its
auditor
Management
The CEO and CFO at companies with more than $1.2 billion in revenue must prepare
a statement certifying that their quarterly and annual financial statements and
disclosures are fairly presented, were reviewed by management, and are not
misleading.
Management must prepare an annual internal control report that states
o Management is responsible for establishing and maintaining an adequate internal
control structure
o Management assessed the companys internal controls and attests to their
accuracy, including notations of significant defects or material noncompliance
found during their internal control tests.
o Auditors were told about all material internal control weaknesses and fraud
7-5
o Significant changes to controls after managements evaluation were disclosed and

corrected
Management must base its evaluation on a recognized control framework, developed
using a due-process procedure that allows for public comment. The report must
contain a statement identifying the framework used by management to evaluate
internal control effectiveness. The most likely framework is one of those formulated
by COSO and discussed in the chapter.
SOX also specifies that a companys auditor must attest to as well as report on
managements internal control assessment.
7.5 When you go to a movie theater, you buy a prenumbered ticket from the cashier.
This ticket is handed to another person at the entrance to the movie. What kinds of
irregularities is the theater trying to prevent? What controls is it using to prevent
these irregularities? What remaining risks or exposures can you identify?
There are two reasons for using tickets.
1. The theater is trying to prevent cashiers from stealing cash by providing greater
control over cash receipts. You cannot get into the theater without a ticket so you
never give cash to a cashier without insisting on a ticket. That makes it much harder
for a cashier to pocket cash.
2. Prenumbered tickets are also used so cashiers cannot give tickets to their friends. The
number of tickets sold at the cashier counter can be reconciled with the number of
tickets taken by the usher letting patrons into the theater.
Reconciling the cash in the register to the tickets sold and then reconciling the number of
tickets sold to the number collected by the ticket-taker helps prevent the theft of cash and
giving tickets away to friends.
Despite these controls, the following risks still exist:
The ticket-taker can let friends into the theater without tickets.
The ticket-taker may take money from theater patrons, pocketing the cash and letting
them enter without a ticket.
The cashier and the ticket-taker may collude in selling admittances without issuing
tickets and then split the proceeds.
Systems
7.6 Some restaurants use customer checks with prenumbered sequence codes. Each food
server uses these checks to write up customer orders. Food servers are told not to
destroy any customer checks; if a mistake is made, they are to void that check and
write a new one. All voided checks are to be turned in to the manager daily. How
does this policy help the restaurant control cash receipts?
The fact that all documents are prenumbered provides a means for accounting for their use
and for detecting unrecorded transactions. Thus, a missing check indicates a meal for
which a customer did not pay. Since each server has his or her own set of checks, it is easy
to identify which server was responsible for that customer.
This policy may help to deter theft (e.g., serving friends and not requiring them to pay for
the meal, or pocketing the customers payment and destroying the check) because a
reconciliation of all checks will reveal that one or more are missing.
7.7 Compare and contrast the following three frameworks: COBIT, COSO Integrated
Control, and ERM.
The COBIT Framework consolidates systems security and control standards into a single
framework. This allows management to benchmark security and control practices of IT
environments, users to be assured that adequate IT security and control exist, and auditors
to substantiate their internal control opinions and to advise on IT security and control
matters. The framework addresses control from three vantage points:
1. Business objectives, to ensure information conforms to and maps into business

objectives.
2. IT resources, including people, application systems, technology, facilities, and data.
3. IT processes, including planning and organization, acquisition and implementation,

delivery and support, and monitoring and evaluation.
COSOs Internal Control Framework is widely accepted as the authority on internal

controls and is incorporated into policies and regulations that control business activities.
However, it examines controls without looking at the purposes and risks of business
processes and provides little context for evaluating the results. It makes it hard to know
which control systems are most important, whether they adequately deal with risk, and
whether important controls are missing. In addition, it does not adequately address
Information Technology issues.
It has five components:
1. Control environment, which are the individual attributes, (integrity, ethical values,
7-7
competence, etc.) of the people in the organization and and the environment in which
they operate.
2. Control activities, which are control policies and procedures that help ensure that the
organization addresses risks and effectively achieves its objectives.
3. Risk assessment, which is the process of identifying, analyzing, and managing

organizational risk
4. Information and communication, which is the system that captures and exchanges the
information needed to conduct, manage, and control organizational operations.
5. Monitoring company processes and controls, so modifications and changes can be

made as conditions warrant.
COSOs Enterprise Risk Management Frameworkis a new and improved version of the
Integrated Control Framework. It is the process the board of directors and management use
to set strategy, identify events that may affect the entity, assess and manage risk, and
provide reasonable assurance that the company achieves its objectives and goals. The basic
principles behind ERM are:
Companies are formed to create value for their owners.
Management must decide how much uncertainty it will accept as it creates value.
Uncertainty results in risk and opportunity, which are the possibilities that something
negatively or positively affects the companys ability to create or preserve value.
The ERM framework can manage uncertainty as well as create and preserve value.
ERM adds three additional elements to COSOs IC framework:
1. Setting objectives
2. Identifying events that may affect the company
3. Developing a response to assessed risk.
The ERM framework takes a risk-based rather than a controls-based approach. As a result,
controls are flexible and relevant because they are linked to current organizational
objectives. The ERM model also recognizes that risk, in addition to being controlled, can
be accepted, avoided, diversified, shared, or transferred.
Because the ERM model is more comprehensive than the Internal Control framework, it
will likely become the most widely adopted of the two models.
Systems
7.8 Explain what an event is. Using the Internet as a resource, create a list of some of the
many internal and external factors that COSO indicated could influence events and
affect a companys ability to implement its strategy and achieve its objectives.
An event is an incident or occurrence emanating from internal or external sources that

affects implementation of strategy or achievement of objectives. An event can have a
positive or a negative impact.
By their nature, events represent uncertainty. An event may or may not occur. If it does
occur, it is hard to know when it will occur. Until it occurs, it may be difficult to determine
its impact on the company. When it occurs, it may trigger another event.
Events may occur individually or concurrently. Therefore, management must anticipate all
possible events, whether positive or negative, that might affect the company. It must also
determine which events are most and least likely to occur, and it must understand the
interrelationship of events.
The following table lists some of the many internal and external factors that COSO indicated
could influence events and affect a companys ability to implement its strategy and achieve its
objectives. Lists like these help management identify factors, evaluate their importance, and
examine those that can affect objectives. Identifying events at the activity and entity levels
allows companies to focus their risk assessment on major business units or functions and
helps align the companys risk tolerance and risk appetite.
COSOs Nine ERM Event Categories

EVENT CATEGORIES
External Factors Internal Factors
ECONOMIC INFRASTRUCTURE
Availability of capital; lower or higher costs Inadequate access to or poor allocation of
of capital capital
Rising or declining unemployment rates Availability and capability of company assets
Price movements upward or downward Complexity of systems
Ability to issue credit and possibility of
default
Concentration of competitors, customers, or
vendors
Presence or absence of liquidity
Movements in the financial markets or
currency fluctuations
Lower barriers to competitive entry,
resulting in new competitors
Mergers or acquisitions
Potential regulatory, contractual, or criminal
7-9
legal liability
NATURAL ENVIRONMENT PERSONNEL
Natural disasters such as fires, floods, or Workplace accidents, health or safety
earthquakes concerns
Emissions and waste Employees acting dishonestly or unethically
Energy restrictions or shortages Employee skills and capability
Restrictions limiting development Strikes or expiration of labor agreements
POLITICAL PROCESS
Election of government officials with new Process modification without proper change
political agendas management procedures
New laws and regulations Process execution errors
Public policy, including higher or lower taxes Poorly designed processes
Regulation affecting the companys ability to Suppliers cannot deliver quality goods on
compete time
SOCIAL TECHNOLOGY
Privacy Insufficient capacity to handle peak IT usages
Terrorism Data or system unavailability
Corporate citizenship Poor systems selection/development
Human resource issues causing production Inadequately maintained systems
shortages or stoppages
Changing demographics, social mores, family Security breaches
structures, and work/life priorities
Consumer behavior that changes products Inadequate data integrity
and services demand or creates buying
opportunity
TECHNOLOGICAL
New e-business technologies that lower
infrastructure costs or increase demand for
IT-based services
Emerging technology
Increased or decreased availability of data
Interruptions or downtime caused by external
parties
Systems
7.9 Explain what is meant by objective setting and describe the four types of objectives
used in ERM.
Objective setting, the second ERM component, is determining what the company hopes to
achieve. It is often referred to as the corporate vision or mission. The four types of
objectives used in ERM are:
1. Strategic objectives are high-level goals that align with the companys mission,
support it, and create shareholder value. Management should identify alternative
ways of accomplishing the strategic objectives, identify and assess the risks and
implications of each alternative, and formulate a corporate strategy.
2. Operations objectives deal with the effectiveness and efficiency of company

operations and determine how to allocate resources. They reflect management
preferences, judgments, and style and are a key factor in corporate success. They
vary significantly - one company decides to be an early adopter of technology,
another adopts technology when it is proven, and a third adopts it only after it is
generally accepted.
3. Reporting objectives help ensure the accuracy, completeness, and reliability of

company reports; improve decision-making; and monitor company activities and
performance.
4. Compliance objectives help the company comply with all applicable laws and
regulations.
Most compliance and many reporting objectives are imposed by external entities due
to laws or regulations. ERM provides reasonable assurance that reporting and
compliance objectives are achieved because companies have control over them.
However, the only reasonable assurance ERM can provide about strategic and
operations objectives is that management and directors are informed on a timely basis
of the progress the company is making in achieving them.
7-11
7.10 Discuss several ways that ERM processes can be continuously monitored and
modified so that deficiencies are reported to management.
1. Have a special team or internal auditing perform a formal or a self-assessment ERM

evaluation.
2. Supervise effectively, including training and assisting employees, correcting errors,

and overseeing employees who have access to assets.
3. Use Responsibility Accounting Systems such as budgets, quotas, schedules, standard

costs, and quality standards; reports comparing actual and planned performance; and
procedures for investigating and correcting significant variances.
4. Use risk analysis and management software packages to review computer and
network security measures, detect illegal access, test for weaknesses and
vulnerabilities, report weaknesses found, and suggest improvements.
5. Track purchased software to comply with copyrights and protect against software
piracy lawsuits. Companies should periodically conduct software audits. Employees
should be informed of the consequences of using unlicensed software. Track and
monitor mobile devices, as their loss could represent a substantial exposure. Also,
track who has them, what tasks they perform, the security features installed, and what
software is needed to maintain adequate system and network security.
6. Have periodic external, internal, and network security audits to assess and monitor
risk as well as detect fraud and errors.
7. Have a chief security officer (CSO), who is independent of the information system
function, be in charge of system security and report to the chief operating officer
(COO) or the CEO. Have a chief compliance officer (CCO), who reports to the same
people, be responsible for all compliance issues
9. Use forensic investigators, who specialize in fraud detection and investigation, help
with the financial reporting and corporate governance process. Most forensic
investigators received specialized training with the FBI, IRS, or other law
enforcement agencies. Investigators with the computer skills to ferret out fraud
perpetrators are in great demand.
10. Install fraud detection software to help ferret out fraud, such as illegal credit card use,
and notify forensic investigators when it is found.
11. Use a fraud hotline so people witnessing fraudulent behavior can report it
anonymously.
Systems
SUGGESTED SOLUTIONS TO THE PROBLEMS

7.1 You are an audit supervisor assigned to a new client, Go-Go Corporation, which is
listed on the New York Stock Exchange. You visited Go-Gos corporate headquarters
to become acquainted with key personnel and to conduct a preliminary review of the
companys accounting policies, controls, and systems. During this visit, the following
events occurred:
a. You met with Go-Gos audit committee, which consists of the corporate controller,
treasurer, financial vice president, and budget director.
b. You recognized the treasurer as a former aide to Ernie Eggers, who was convicted
of fraud several years ago.
c. Management explained its plans to change accounting methods for depreciation
from the accelerated to the straight-line method. Management implied that if your
firm does not concur with this change, Go-Go will employ other auditors.
d. You learned that the financial vice president manages a staff of five internal
auditors.
e. You noted that all management authority seems to reside with three brothers, who
serve as chief executive officer, president, and financial vice president.
f. You were told that the performance of division and department managers is
evaluated on a subjective basis, because Go-Gos management believes that formal
performance evaluation procedures are counterproductive.
g. You learned that the company has reported increases in earnings per share for
each of the past 25 quarters; however, earnings during the current quarter have
leveled off and may decline.
h. You reviewed the companys policy and procedures manual, which listed policies
for dealing with customers, vendors, and employees.
i. Your preliminary assessment is that the accounting systems are well designed and
that they employ effective internal control procedures.
j. Some employees complained that some managers occasionally contradict the
instructions of other managers regarding proper data security procedures.
k. After a careful review of the budget for data security enhancement projects, you
feel the budget appears to be adequate.
l. The enhanced network firewall project appeared to be on a very aggressive
implementation schedule. The IT manager mentioned that even if he put all of his
personnel on the project for the next five weeks, he still would not complete the
project in time. The manager has mentioned this to company management, which
seems unwilling to modify the schedule.
m. Several new employees have had trouble completing some of their duties, and they
7-13
do not appear to know who to ask for help.

n. Go-Gos strategy is to achieve consistent growth for its shareholders. However, its
policy is not to invest in any project unless its payback period is no more than 48
months and yields an internal rate of return that exceeds its cost of capital by 3%.
o. You observe that company purchasing agents wear clothing and exhibit other
paraphernalia from major vendors. The purchasing department manager proudly
displays a picture of himself holding a big fish on the deck of a luxury fishing boat
that has the logo of a major Go-Go vendor painted on its wheelhouse.
The information you have obtained suggests potential problems relating to Go-Gos
internal environment. Identify the problems, and explain them in relation to the
internal environment concepts discussed in this chapter
The underlined items correspond to one of the 7 elements of the internal environment
covered in the text.
a. You met with Go-Gos audit committee, which consists of the corporate
controller, treasurer, financial vice president, and budget director.
PROBLEM: Section 301 of the Sarbanes-Oxley Act of 2002 (SOX) applies to

publicly held companies and their auditors. It requires audit committee members to
be on the companys board of directors and to be independent of the company. That
is not the case at Go-Go Corporation.
SOLUTION: All members of the audit committee should be members of the Board
of Directors. They must also be independent of the company meaning none of the
audit committee can be employees. The audit committee is responsible for
overseeing the corporations internal control structure, its financial reporting
process, and its compliance with related laws, regulations, and standards. The
committee works closely with the corporations external and internal auditors. SOX
requires audit committees to be responsible for hiring, compensating, and overseeing
the auditors and for auditors to report all critical accounting policies and practices to
the audit committee.
b. You recognized the treasurer as a former aide to Ernie Eggers, who was
convicted of fraud several years ago.
PROBLEM: Because the position of corporate treasurer involves managing cash and
other financial assets, it is critical that the position be filled with someone of
unquestioned commitment to integrity and ethical values. This question presents
somewhat of a dilemma. Here are the two sides of that dilemma.
Systems
On the one hand, just because the treasurer worked for someone that turned out to be
dishonest does NOT mean the treasurer is dishonest as well. Everyone should be
judged on his or her own merits, not those of someone else. Therefore, you need to
be careful not to assume automatically that the treasurer is dishonest.
On the other hand, the fact that the treasurer has been an aide to someone convicted
of fraud should raise questions in your mind. You should approach all audits with the
requisite skeptical attitude. That skeptical attitude should be heightened due to his
past associations.
SOLUTION: Though you may not have specific information linking the corporate
treasurer to the prior fraud, this information should indicate a need to examine
carefully the corporation's human resource standards and personnel policies and
practices with respect to hiring.
c. Management explained its plans to change accounting methods for depreciation

from the accelerated to the straight-line method. Management implied that if
your firm does not concur with this change, Go-Go will employ other auditors.
PROBLEM: Why would a company want to move from an accelerated depreciation

method to one with a lower depreciation write-off? One reason is that it reduces
depreciation expense, thereby increasing net income and, potentially, the companys
stock price. Alternatively, they may be looking for a way to mask, or hide, other
company problems that will affect net income.
SOLUTION: The company should have a logical and defensible reason for changing
accounting methods, other than just to increase net income and the stock price. The
company may be willing to go to great lengths to "get their own way" with respect to
an important financial reporting matter. The commitment to ethics issue involves
questionable practices, desire to make the numbers, etc. If management does not
have a good reason for the desired change, company managements commitment to
integrity and ethical values should be carefully evaluated.
It is also possible that there is a problem with management's philosophy and operating
style. Managements philosophy and operating style relates to risk-taking propensity
and problems with philosophy and operating style are similar to carelessnessn or
recklessness.
It is important to note that management can be careless, yet ethical; they can also be
careful, yet unethical.
d. You learned that the financial vice president manages a staff of five internal
auditors.
7-15
PROBLEM: The internal audit function is not organizationally independent of the

accounting and finance functions.
SOLUTION: Organization structure and board of director requirements dictates that

internal audit should report directly to the audit committee of the board of directors
rather than the financial vice president.
e. You noted that all management authority seems to reside with three brothers,
who serve as chief executive officer, president, and financial vice president.
PROBLEM: The dominance of an organization's management by one or a few

individuals is an aspect of management's philosophy and operating style that might
indicate a problem with the internal environment, in that there may be a potential for
this small group to override the internal control system. Just because a family is run
by family members does not indicate there is a problem such as fraud but it does
make it easier to commit and that should be take into consideration.
SOLUTION: It is important to evaluate carefully this situation to determine if it

indeed presents an internal control weakness.
f. You were told that the performance of division and department managers is
evaluated on a subjective basis, because Go-Gos management believes that
formal performance evaluation procedures are counterproductive.
PROBLEM: This indicates a possible problem with management's human resource

standards and their methods of monitoring performance. Subjective evaluation
methods are often not be as effective in detecting problems or in identifying good
performance as objective measures, such as formal performance evaluation
procedures, that have been communicated to employees.
SOLUTION: It is important to evaluate carefully this situation to determine if it

indeed presents an internal control weakness.
g. You learned that the company has reported increases in earnings per share for
each of the past 25 quarters; however, earnings during the current quarter have
leveled off and may decline.
PROBLEM: Management's philosophy and operating style, as well as their

commitment to integrity and ethical values, can be tested when a company faces
declining earnings. When earnings per share decrease or when they do not meet
expectations, company stock can take a dive, sometimes a significant one. As a
result, a company may try and avoid earnings decreases when possible. The problem
comes when management uses questionable or even illegal means to prop up their
earnings.
Systems
SOLUTION: Because many frauds have been perpetrated to prop up earnings, this
significant fraud red flag must be investigated.
h. You reviewed the companys policy and procedures manual, which listed policies
for dealing with customers, vendors, and employees.
PROBLEM: One of the methods of assigning authority and responsibility is a

written and comprehensive policies and procedures manual. Go-Go has a written
policy and procedures manual, but it is incomplete. It is limited to only three areas:
policies for dealing with customers, vendors, and employees.
SOLUTION: A policies and procedures manual should contain much more than
what is indicated. The manual should explain proper business practices, describe the
knowledge and experience needed by key personnel, and list the resources provided
to carry out specific duties. It should spell out management policy with respect to
handling specific transactions and documents and the systems and procedures
employed to process those transactions. It includes the organizations chart of
accounts and sample copies of forms and documents. The manual should be a helpful
on-the-job reference for employees and a useful tool in training new employees.
i. Your preliminary assessment is that the accounting systems are well designed
and that they employ effective internal control procedures.
PROBLEM: Even though you believe that the accounting systems are well designed,
and that they employ effective internal control procedures, you cannot rely on that
belief. The most effective internal control systems and procedures can be negated by
a weak internal control environment, such as top management overriding the internal
controls. In other words, there is no evidence that the controls are effective or that
employees use and follow them.
SOLUTION: You cannot rely on the internal controls procedures being effective
until you test the controls.
j. Some employees complained that some managers occasionally contradict the

instructions of other managers regarding proper data security procedures.
PROBLEM: It does not appear that there is a clear line of authority and
responsibility for data security policies and procedures.
SOLUTION: Achieving adequate security and control over an organizations data

should be a top management priority. A companys organizational structure defines
7-17
its lines of authority, responsibility, and reporting and provides the overall framework
for controlling and monitoring its operations.
Management should assign authority and responsibility for business objectives, such
as data security, to specific departments and individuals and then hold them
accountable for achieving those objectives. Authority and responsibility are assigned
through formal job descriptions; employee training; and operating plans, schedules,
and budgets. A written policy and procedures manual can be an important tool for
assigning authority and responsibility.
k. After a careful review of the budget for data security enhancement projects, you
feel the budget appears to be adequate.
PROBLEM: This item does not appear to be a problem. Your careful review
indicates that the company appears to be allocating sufficient budget dollars to fund
the data security enhancement projects.
l. The enhanced network firewall project appeared to be on a very aggressive

implementation schedule. The IT manager mentioned that even if he put all of
his personnel on the project for the next five weeks, he still would not complete
the project in time. The manager has mentioned this to company management,
which seems unwilling to modify the schedule.
PROBLEM: The firewall implementation schedule is not feasible.
SOLUTION: Managements philosophy and operating style should be carefully

evaluated. Is management taking undue business risks to achieve its objectives? Is
management pressuring employees to achieve the desired results regardless of the
methods used to achieve them?
m. Several new employees have had trouble completing some of their duties, and
they do not appear to know who to ask for help.
PROBLEM: Employee training and support appear to be rather weak. Companies

that shortchange training are more likely to have more fraud and more security
breaches.
If the employees do not know who to turn to for help, the companys organizational
structure and methods of assigning authority and responsibility appear to be lacking
or unexplained.
SOLUTION: Good human resource standards require that training programs

familiarize new employees with their responsibilities; expected levels of performance
and behavior; and the company's policies and procedures, history, culture, and
operating style. On going training is needed to help employees tackle new
Systems
challenges, stay ahead of the competition, adapt to changing technologies, and deal
effectively with the evolving environment.
n. Go-Gos strategy is to achieve consistent growth for its shareholders. It also has
a policy not to invest in any project unless its payback period is no more than 48
months and yields an internal rate of return that exceeds its cost of capital by
3%.
PROBLEM: Go-Go's risk appetite, although aggressive, appears to be grounded in

solid capital budgeting principles. This item, therefore, does not appear to be a
problem
o. You observe that company purchasing agents wear clothing and exhibit other
paraphernalia from major vendors. The purchasing department manager
proudly displays a picture of himself holding a big fish on the deck of a luxury
fishing boat that has the logo of a major Go-Go vendor painted on its
wheelhouse.
PROBLEM: Gifts from vendors can unduly influence purchasing agents to buy more
goods from the gifting vendors. Purchasing decision should be free of this sort of
bias.
SOLUTION: Part of managements philosophy and operating style should be the

creation of an organizational culture that stresses integrity and commitment to ethical
values and competence. In doing so, management should develop clearly stated
human resource standards and policies that explicitly describe honest and dishonest
behaviors, often in the form of a written code of conduct (methods of assigning
authority and responsibility), and communicate them to employees.
These policies should especially cover issues that are uncertain or unclear, such as
conflicts of interest and the acceptance of gifts. For example, most purchasing agents
would agree that accepting a $5,000 bribe from a supplier is dishonest, but a weekend
fishing trip or clothing is not as clear-cut. The observations in the purchasing
department indicated that there could be a problem with favoring certain vendors.
7-19
7.2 Explain how the principle of separation of duties is violated in each of the following
situations. Also, suggest one or more procedures to reduce the risk and exposure
highlighted in each example.
a. A payroll clerk recorded a 40-hour workweek for an employee who had quit the
previous week. He then prepared a paycheck for this employee, forged her
signature, and cashed the check.
PROBLEM: Segregation of duties is violated here because the payroll clerk had the
ability to record time worked and to prepare the payroll check (custody). This
allowed the payroll clerk to both commit and conceal the fraud. The payroll clerk
ignored the authorization process or had the authority to authorize the payment.
SOLUTION: These three functions should be segregated. One person should

authorize payments, another should record the payments, a third should prepare the
check, and a fourth should sign it.
b. While opening the mail, a cashier set aside, and subsequently cashed, two checks
payable to the company on account.
PROBLEM: The cashier who opened the mail had custody of the cash. The cashier
opening the mail can pocket the checks and forge a signature, never giving the
authorized endorser a chance to be involved. For this reason, many companies have
the mail opened by two people or have those opening the mail videotaped.
SOLUTION: While the cashier can get away with this fraud for a few weeks or
months, the missing checks will eventually be noticed usually when the customer
complains because the cashier has no way to conceal the fraud (recording function).
An investigation would include an examination of the stolen checks and that could
lead to the cashier as the person cashing the checks. To be successful in the long
term, the cashier needs access to the recording function to indicate that customer
accounts are paid so that their complaints do not start an investigation.
c. A cashier prepared a fictitious invoice from a company using his brother-in-

laws name. He wrote a check in payment of the invoice, which the brother-in-
law later cashed.
PROBLEM: Segregation of duties is violated here because the cashier had the
ability to both write the check (custody) and approve the invoice for payment
(authorization).
SOLUTION: The functions of authorizing invoices for payment and preparing

checks for signature should be organizationally independent.
Systems
d. An employee of the finishing department walked off with several parts from the
storeroom and recorded the items in the inventory ledger as having been issued
to the assembly department.
PROBLEM: Employees can commit and conceal fraud when they have access to
physical inventory (custody) and to inventory records (recording).
SOLUTION: This can be prevented by restricting storeroom access to authorized

employees. Likewise, access to inventory records should be limited to authorized
employees. Where possible, no storeroom employee should have access to both the
physical inventory and the inventory records.
e. A cashier cashed a check from a customer in payment of an account receivable,

pocketed the cash, and concealed the theft by properly posting the receipt to the
customers account in the accounts receivable ledger.
PROBLEM: The cashier had custody of the checks and was responsible for posting
(recording) to the accounts receivable ledger.
SOLUTION: Custody of the checks and posting to the Accounts Receivable Ledger
should be organizationally independent. In addition, there should be an independent
reconciliation of the three items:
1. dollar amounts of the checks received
2. dollar amounts of the checks deposited in the bank
3. dollar amounts credited to customer accounts.
f. Several customers returned clothing purchases. Instead of putting the clothes

into a return bin to be put back on the rack, a clerk put the clothing in a
separate bin under some cleaning rags. After her shift, she transferred the
clothes to a gym bag and took them home.
PROBLEM: The clerk was authorized to accept the return, grant credit, and had
custody of the inventory. It is also possible that the clerk may have had responsibility
to record the returns, but did not do so to cover the theft.
SOLUTION: All purchase returns should be documented by preparing a customer

receipt and recording the return in a purchase returns journal. No cash or credit can
be given without the return being authorized by a supervisor and recorded in the data
files recorded in the cash register.
The purchase returns area should be kept clean and orderly so that returns cannot be
"hid" among excess returns. Employees should not be allowed to have gym bags or
other personal items that could conceal stolen items in work areas.
7-21
g. A receiving clerk noticed that four cases of MP3 players were included in a
shipment when only three were ordered. The clerk put the extra case aside and
took it home after his shift ended.
PROBLEM: The receiving clerk had custody of arriving goods, counted the goods,
and compared the count to a purchase order. The problem is that, while the receiving
clerk did not record the purchase order, she did have access to a document that
showed the amount ordered. This allows her to steal any excess items shipped
without having to record anything to conceal it.
SOLUTION: Purchase orders sent to the receiving area should not indicate how
many items or cases were ordered, thus helping ensure that all shipments are counted
and recorded. The purchasing department should reconcile items received against
items ordered.
h. An insurance claims adjuster had check signing authority of up to $6,000. The

adjuster created three businesses that billed the insurance company for work not
performed on valid claims. The adjuster wrote and signed checks to pay for the
invoices, none of which exceeded $6,000.
PROBLEM: The adjuster had authorization to add vendors to vendor master file,
authorization to write checks up to $6,000, and had custody of the signed the checks.
Apparently, the adjuster also had some recording duties (maintaining the vendor
master file).
SOLUTION: The functions of signing checks for invoices, approving vendors, and
maintaining the vendor master file should be organizationally independent. Payments
should not be made to anyone that is not on the approved vendor list. Controls should
be put into place to endure that employees cannot add an unauthorized or unapproved
vendor to the vendor master file.
i. An accounts payable clerk recorded invoices received from a company that he

and his wife owned and authorized their payment.
PROBLEM: The accounts payable clerk had recording duties and he authorized
payments.
SOLUTION: The functions of recording invoices and authorizing payments should

be organizationally independent.
In addition, vendors should only be allowed to purchase goods and services from
approved vendors. Controls should be put into place to endure that employees cannot
add an unauthorized or unapproved vendor to the vendor master file. The company
needs to establish policies and a code of conduct that prohibits conflicts of interest
Systems
and related party transactions, such as buying goods from a company in which you
have ownership interest.
j. A cashier created false purchase return vouchers to hide his theft of several
thousand dollars from his cash register.
PROBLEM: The cashier had recording (creating return vouchers), custody (cash in
the cash register), and authorization (authorize the return of goods) duties.
SOLUTION: These three duties should be performed by three separate people. A

cashier should only have custody duties. Cashiers and others with access to cash
should not be allowed to have recording or authorization duties. Cashiers should not
pay out on cash on purchase return vouchers until they are authorized by a supervisor.
k. A purchasing agent received a 10% kickback of the invoice amount for all
purchases made from a specific vendor.
PROBLEM: The purchasing agent has both recording (prepare the purchase order)
and authorization (select a vendor from a list of authorized vendors) duties. The
purchasing agent gets custody to cash when the vendor gives her the kickback.
SOLUTION: Purchasing agents should only be allowed to purchase goods and

services from approved vendors. Controls should be put into place to ensure that
employees cannot add an unauthorized or unapproved vendor to the vendor master
file.
Vendor performance with respect to reliability, quality of goods, and prices charged
should be tracked and periodically reviewed. Prices should periodically be compared
to those charged by other vendors to make sure they are fair, competitive, and
reasonable. Analytical procedures can be performed to track the percentage of
business a purchasing agent gives to vendors.
The company needs to establish policies and a code of conduct that prohibits conflicts
of interest, related party transactions, and kickbacks.
7-23
7.3 The following description represents the policies and procedures for agent expense
reimbursements at Excel Insurance Company.
Agents submit a completed expense reimbursement form to their branch manager at
the end of each week. The branch manager reviews the expense report to determine
whether the claimed expenses are reimbursable based on the companys expense
reimbursement policy and reasonableness of amount. The companys policymanual
states that agents are to document any questionable expense item and that the branch
manager must approve in advance expenditures exceeding $500.
After the expenses are approved, the branch manager sends the expense report to the
home office. There, accounting records the transaction, and cash disbursements
prepares the expense reimbursement check. Cash disbursements sends the expense
reimbursement checks to the branch manager, who distributes them to the agents.
To receive cash advances for anticipated expenses, agents must complete a Cash
Advance Approval form. The branch manager reviews and approves the Cash
Advance Approval form and sends a copy to accounting and another to the agent. The
agent submits the copy of the Cash Advance Approval form to the branch office
cashier to obtain the cash advance.
At the end of each month, internal audit at the home office reconciles the expense
reimbursements. It adds the total dollar amounts on the expense reports from each
branch, subtracts the sum of the dollar totals on each branchs Cash Advance
Approval form, and compares the net amount to the sum of the expense
reimbursement checks issued to agents. Internal audit investigates any differences.
Identify the internal control strengths and weaknesses in Excels expense
reimbursement process. Look for authorization, recording, safeguarding, and
reconciliation strengths and weaknesses. (CMA Examination adapted)
Systems
Strengths Weaknesses
Authorization
Excel has a formal statement of policies There is no limit on the agents total weekly
and procedures for agent reimbursements. expenditures or cash advances.
Expense reports must be approved by the Expense reimbursement checks are sent to the
Branch Manager prior to payment. Branch Manager for distribution rather than to the
agent. This allows the Branch Manager to submit a
fictitious expense reimbursement for a former agent
or one on vacation and then cash the check.
Recording
Accounting receives approved expense The Branch Manager does not retain a copy of
reports and cash advance forms. This expense reports or cash advances for audit
facilitates the correct recording of all purposes.
authorized transactions.
The expense report is not checked for mathematical
accuracy.
Safeguarding
Expense reimbursement checks are issued A copy of the Cash Advance Approval form should
by the cash disbursements department. be sent to the Branch Office Cashier so it can
compare it with the one submitted by the agent.
Cash disbursements are made only after Supporting documentation is not required for all
receipt of an approved expense report or expenditures.
Cash Advance Approval form.
Reconciliation
Internal Audit compares reimbursement There is no reconciliation of Branch Office
checks with expense report totals less cash Cashier disbursements with Cash Advance
advances in the home office. Approval forms.
Reconciliation differences are investigated.
7-25
7.4 The Gardner Company, a client of your firm, has come to you with the following
problem. It has three clerical employees who must perform the following functions:
a. Maintain the general ledger
b. Maintain the accounts payable ledger
c. Maintain the accounts receivable ledger
d. Prepare checks for signature
e. Maintain the cash disbursements journal
f. Issue credits on returns and allowances
g. Reconcile the bank account
h. Handle and deposit cash receipts
Assuming equal abilities among the three employees, the company asks you to assign
the eight functions to them to maximize internal control. Assume that these employees
will perform no accounting functions other than the ones listed.
a. List four possible unsatisfactory pairings of the functions
All five of the unsatisfactory pairings below involve custody of cash and a recording
function that would allow a fraud perpetrator to conceal a theft.
1. General ledger - cash receipts. With custody to cash, this person could steal
cash receipts and conceal the theft by recording a fictitious entry in the General
Ledger to credit (reduce) the balance of the cash account by the amount stolen.
2. Accounts receivable ledger - cash receipts. With custody to cash, this person
could steal cash receipts and conceal the theft by recording a fictitious entry in
the Accounts Receivable Subsidiary Ledger to reduce a customers accounts
receivable balance by the amount stolen.
3. Bank reconciliation - cash receipts. With custody to cash, this person could
steal cash receipts and conceal the theft by falsifying (recording) the bank
reconciliation.
4. Credits on returns and allowances - cash receipts. This person could
authorize (authorization) or record false credit memos (recording) to customers
who are making a payment and steal the customer payments (custody).
5. Accounts payable ledger - prepare checks for signature. A person with both
of these responsibilities could create fictitious payables (recording) and then
write and cash checks to pay them (custody).
6. Maintain accounts receivable - issue credit memos this combines
authorization and recording. A person with both of these responsibilities could
write off accounts for friends.
b. State how you would distribute the functions among the three employees.
Assume that with the exception of the nominal jobs of the bank reconciliation
Systems
and the issuance of credits on returns and allowances, all functions require an
equal amount of time.
Any distribution that avoids all of the above unsatisfactory combinations and spreads
the workload evenly is acceptable. The key is not to have anyone with both custody
and a recording function that could be used to conceal a theft. One such combination
is:
First employee accounts payable ledger, accounts receivable ledger, bank
reconciliations
Second employee general ledger, disbursements journal, credits on returns and
allowances
Third employee prepare checks for signature, cash receipts
7-27
7.5 During a recent review, ABC Corporation discovered that it has a serious internal
control problem. It is estimated that the impact associated with this problem is $1
million and that the likelihood is currently 5%. Two internal control procedures have
been proposed to deal with this problem. Procedure A would cost $25,000 and reduce
likelihood to 2%; procedure B would cost $30,000 and reduce likelihood to 1%. If
both procedures were implemented, likelihood would be reduced to 0.1%.
a. What is the estimated expected loss associated with ABC Corporations internal
control problem before any new internal control procedures are implemented?
Expected Loss = Risk * Exposure = 0.05 * $1,000,000 = $50,000
b. Compute the revised estimate of expected loss if procedure A were implemented,

if procedure B were implemented, and if both procedures were implemented.
Control Revised Reduction in Cost of Net

Procedure Risk Exposure Expected Expected Control(s) Benefit
Loss Loss (Cost)
A 0.02 $1,000,000 $20,000 $30,000 $25,000 $ 5,000
B 0.01 $1,000,000 $10,000 $40,000 $30,000 $10,000
Both 0.001 $1,000,000 $ 1,000 $49,000 $55,000 $(6,000)
c. Compare the estimated costs and benefits of procedure A, procedure B, and both
procedures combined. If you consider only the estimates of cost and benefit, which
procedure(s) should be implemented?
Considering only the estimated costs and benefits, procedure B should be implemented
because its net benefit is greater than A; it is also greater than both A and B together.
Care must be taken with these discussions, however, because the numbers used are
estimates. The net benefit figures are only as good as the estimates used to produce
them.
d. What other factors might be relevant to the decision
Another important factor to consider is how critical the $1,000,000 loss would be to
ABC Corporation.
If ABC is a multi-billion dollar corporation, then they can afford to evaluate this
matter strictly on the basis of estimated costs and benefits.
However, if ABC is a small corporation then a loss of this magnitude could

threaten their continued existence, and it may be worthwhile to incur extra costs
Systems
(as a form of insurance premium) to reduce the risk of loss to the smallest
possible level.
e. Use the Goal Seek function in Microsoft Excel to determine the likelihood of
occurrence without the control and the reduction in expected loss if the net
benefit/cost is 0. Do this for procedure A, procedure B, and both procedures together
Control Procedure A - Goal Seek-setup.
Control Procedure A - Goal Seek - solved.
7-29
Control Procedure B - Goal Seek-setup.
Control Procedure B - Goal Seek - solved.
Control Procedure Both - Goal Seek-setup.

Systems
Control Procedure Both - Goal Seek - solved.
7-31
7.6 The management at Covington, Inc., recognizes that a well-designed internal control
system provides many benefits. Among the benefits are reliable financial records that
facilitate decision making and a greater probability of preventing or detecting errors
and fraud. Covingtons internal auditing department periodically reviews the
companys accounting records to determine the effectiveness of internal controls. In
its latest review, the internal audit staff found the following eight conditions:
1. Daily bank deposits do not always correspond with cash receipts.
2. Bad debt write-offs are prepared and approved by the same employee.
3. There are occasional discrepancies between physical inventory counts and
perpetual inventory records.
4. Alterations have been made to physical inventory counts and to perpetual
inventory records.
5. There are many customer refunds and credits.
6. Many original documents are missing or lost. However, there are substitute
copies of all missing originals.
7. An unexplained decrease in the gross profit percentage has occurred.
8. Many documents are not approved.
For each of the eight conditions detected by the Covington internal audit staff:
a. Describe a possible cause of the condition.
b. Recommend actions to be taken and/or controls to be implemented that would
correct the condition. Adapted from the CMA Examination
Systems
# a. Possible Cause b. Recommendation to Correct Condition
1 Daily bank deposits do not always

correspond with cash receipts.
Timing difference between when cash is Make two deposits for each days receipts.
received and when deposited in the bank
- Cash is received after the days bank An employee who does not handle cash
deposit is prepared and sent to the receipts daily reconciles each days cash
bank. receipts per book with deposits per bank
- Bank credits bank deposits received
after a certain hour on the next day.
List cash received each day; compare it to daily
Cash receipts are being stolen cash deposits.
Have 2 people involved in cash receipts if

practical. If only one can be involved, video
tape the receipts process.
Have an employee who does not handle

receipts do all reconciliations.
2 Bad debt write-offs are prepared and

approved by the same employee.
Collusion between customers and the Require all bad debt write-offs to be approved
employee writing off the bad debts. by a second employee.
3 Occasional discrepancies between

physical inventory counts and
perpetual inventory records.
Unauthorized access to physical Limit physical and logical access to the

inventory and/or inventory records. inventory records to authorized employees.
Require that all adjustments to inventory

records be approved by a responsible official.
Inventory theft by employees Count all inventory when received at the

warehouse and at the storeroom; reconcile the
counts.
7-33
Count inventory to be shipped before it is

removed from the storeroom, when received by
shipping, and when shipped; reconcile counts.
Bar codes and RFID tags to facilitate counts
Hold storeroom employees responsible for all

inventory losses.
4 Alterations to physical inventory

counts and perpetual inventory
records
Unauthorized access to inventory Limit physical and logical access to the

records. inventory records to authorized employees.
Require that all adjustments to inventory

records be approved by a responsible official.
Fraud Examine physical inventory counts and

perpetual inventory records for evidence of
fraud
Terminate any employees that commit fraud
5 Many customer refunds and credits.
Collusion among customers, Segregate duties so refunds and credits are

salespersons, common carriers, and the authorized by responsible employees not
shipping and accounting departments of otherwise involved in sales, shipping, or
Covington. maintaining accounts receivable.
Poor product quality Fix production problems
6 Many original documents are missing

or lost. However, there are substitute
copies of all missing originals.
Failure to use pre-numbered documents. Use pre-numbered documents to facilitate the

control and identification of documents.
Fraud was perpetrated, original copies of Investigate all instances where originals are
the documents were destroyed, and they missing and photocopies are used.
were replaced by photocopies.
Systems
7 An unexplained decrease in the gross

profit percentage has occurred.
Granting unauthorized discounts or Require the approval of a responsible party

credits to customers. before granting customer discounts or credits.
Theft of inventory Count all inventory when received at the

warehouse and at the storeroom; reconcile the
counts.
-
- Count inventory to be shipped before it is
removed from the storeroom, when received by
shipping, and when shipped; reconcile counts.
Bar codes and RFID tags to facilitate counts
Hold storeroom employees responsible for all

inventory losses.
Customers given lower, preferential sales Require the approval of a responsible party
prices before granting preferential sales prices
Unrecorded sales Require the use of pre-numbered sales

documents and do not allow inventory to leave
the warehouse without an accompanying sales
document.
8 Many documents are not approved.
Lack of, misunderstanding of, or failure Prepare or update written procedures and train
to comply with written procedures. employees using the procedures
Hold employees responsible for not approving

documents
Fraud committed by bypassing the Examine unapproved documents for evidence

approval process of fraud
Terminate any employees that commit fraud
7-35
7.7 Consider the following two situations:
For the situations presented, describe the recommendations the internal auditors
should make to prevent the following problems. Adapted from the CMA Examination
Situation 1: Many employees of a firm that manufactures small tools pocket some of
the tools for their personal use. Since the quantities taken by any one employee are
immaterial, the individual employees do not consider the act as fraudulent or
detrimental to the company. The company is now large enough to hire an internal
auditor. One of the first things she did was to compare the gross profit rates for
industrial tools to the gross profit for personal tools. Noting a significant difference,
she investigated and uncovered the employee theft.
Implement and communicate through proper training a policy regarding the theft of
company goods and services and the repercussions associated with theft.
Allow employees to purchase tools at cost from the company.
Continue to compare the gross profit rates for industrial tools to the gross profit for
personal tools until the problem is resolved.
Discipline or terminate any employees not following the new policy
Institute better physical access controls over the tools to prevent theft
Situation 2: A manufacturing firms controller created a fake subsidiary. He then

ordered goods from the firms suppliers, told them to ship the goods to a warehouse
he rented, and approved the vendor invoices for payment when they arrived. The
controller later sold the diverted inventory items, and the proceeds were deposited to
the controllers personal bank account. Auditors suspected something was wrong
when they could not find any entries regarding this fake subsidiary office in the
property, plant, and equipment ledgers or a title or lease for the office in the real-
estate records of the firm
Implement a better segregation of duties. The company controller should not be able to
order goods, specify shipment locations, and authorize payment for inventory.
Require all inventory purchases to be initiated by the purchasing department.
Require all inventory payments to be supported by proper supporting documents such

as receiving reports signed by authorized personnel.
Require special authorization for shipments to locations not typically used.

Systems
7.8 Tralor Corporation manufactures and sells several different lines of small electric
components. Its internal audit department completed an audit of its expenditure
processes. Part of the audit involved a review of the internal accounting controls for
payables, including the controls over the authorization of transactions, accounting for
transactions, and the protection of assets. The auditors noted the following items:
1. Routine purchases are initiated by inventory control notifying the purchasing
department of the need to buy goods. The purchasing department fills out a
prenumbered purchase order and gets it approved by the purchasing manager.
The original of the five-part purchase order goes to the vendor. The other four
copies are for purchasing, the user department, receiving for use as a receiving
report, and accounts payable.
2. For efficiency and effectiveness, purchases of specialized goods and services are
negotiated directly between the user department and the vendor. Company
procedures require that the user department and the purchasing department
approve invoices for any specialized goods and services before making payment.
3. Accounts payable maintains a list of employees who have purchase order approval
authority. The list was updated two years ago and is seldom used by accounts
payable clerks.
4. Prenumbered vendor invoices are recorded in an invoice register that indicates the
receipt date, whether it is a special order, when a special order is sent to the
requesting department for approval, and when it is returned. A review of the
register indicated that there were seven open invoices for special purchases, which
had been forwarded to operating departments for approval over 30 days
previously and had not yet been returned.
5. Prior to making entries in accounting records, the accounts payable clerk checks
the mathematical accuracy of the transaction, makes sure that all transactions are
properly documented (the purchase order matches the signed receiving report and
the vendors invoice), and obtains departmental approval for special purchase
invoices.
6. All approved invoices are filed alphabetically. Invoices are paid on the 5th and
20th of each month, and all cash discounts are taken regardless of the terms.
7. The treasurer signs the checks and cancels the supporting documents. An original
document is required for a payment to be processed.
8. Prenumbered blank checks are kept in a locked safe accessible only to the cash
disbursements department. Other documents and records maintained by the
accounts payable section are readily accessible to all persons assigned to the
section and to others in the accounting function.
Review the eight items listed and decide whether they represent an internal control
strength or weakness
7-37
a. For each internal control strength you identified, explain how the procedure
helps achieve good authorization, accounting, or asset protection control.
b. For each internal control weakness you identified, explain why it is a weakness
and recommend a way to correct the weakness
Adapted from the CMA Examination
# a. Why it is a strength b. Why it is a weakness b. Recommendation to

correct weakness
1 User authorization means A purchase order copy should not be The receiving report is
the right materials and used as a receiving report unless the prepared after an
quantities will be ordered. quantities have been blanked out. independent count and
identification.
The use of pre-numbered
purchase orders allows all
POs to be accounted for.
2 The user/purchaser may not be trained Both the user and the
in purchasing techniques and could be purchasing agent should be
overcharged in the transaction. involved in negotiating with
the company.
2
It increases the potential for collusive The purchasing department
agreements. should approve orders before
the purchase, not before
payment is made.
3 Failure to properly maintain the list of Update the list as soon as a

authorized signatories renders it change in purchase
useless authorization occurs.
Payables clerk should be

required to use the list.
4 Numbering and recording Failure to follow-up on open invoices A periodic review and
process establishes good indicates an ineffective control due to follow-up of all open items.
control over invoices and a lack of follow-up.
helps ensure their recording
in accounting records.
5 The transaction audit helps

Systems
minimize errors and helps

ensure that only properly
authorized transactions are
recorded.
6 Paying monthly on only the 5th or 20th Approved, unpaid invoices

prevents payment of any invoice due should be filed by payment
on another date. due date first, and then
alphabetically.
6 Taking unearned cash discounts Pay suppliers on or before

causes additional paperwork when the discount date.
disputed by suppliers and creates
animosity. This policy may lead to Lost discounts should be
fewer discounts being offered. analyzed for cause and future
avoidance.
7 Proper separation of duties

exists
Requiring original
documents and cancelling
them after payment reduces
duplicate payments.
8 Proper protection of blank Unlimited access to cash disbursement A policy limiting access to
checks (locked safe only documents (other than blank checks) and physical protection of
accessible to cash permits unauthorized alteration of accounts payable documents
disbursements department payables documents. This could result and records should be
in a loss of control, a loss of established and monitored.
accountability, or a loss of assets - as
well as improper or inaccurate
accounting or destruction of records.
7-39
7.8 Lancaster Company makes electrical parts for contractors and home improvement
retail stores. After their annual audit, Lancasters auditors commented on the
following items regarding internal controls over equipment:
1. The operations department that needs the equipment normally initiates a
purchase requisition for equipment. The operations department supervisor
discusses the proposed purchase with the plant manager. If there are sufficient
funds in the requesting departments equipment budget, a purchase requisition is
submitted to the purchasing department once the plant manager is satisfied that
the request is reasonable.
2. When the purchasing department receives either an inventory or an equipment
purchase requisition, the purchasing agent selects an appropriate supplier and
sends them a purchase order.
3. When equipment arrives, the user department installs it. The property, plant, and
equipment control accounts are supported by schedules organized by year of
acquisition. The schedules are used to record depreciation using standard rates,
depreciation methods, and salvage values for each type of fixed asset. These rates,
methods, and salvage values were set 10 years ago during the companys initial
year of operation.
4. When equipment is retired, the plant manager notifies the accounting department
so the appropriate accounting entries can be made.
5. There has been no reconciliation since the company began operations between the
accounting records and the equipment on hand.
Identify the internal control weaknesses in Lancasters system, and recommend ways
to correct them. Adapted from the CMA Examination
Weakness Recommendation
1. No authorization form describing The purchase requisition should include an item
the item to be acquired, why it is description, why the item is needed, estimated costs
needed, expected costs, and and benefits, account code, useful life, depreciation
benefits. method, and management approval.
2. Equipment purchases over a certain Large sums of money can be spent on equipment.
amount are not reviewed and Large purchases should be approved by top
approved by top management. management
3. Purchase requisitions for fixed Authorized equipment acquisitions should be

Systems
assets are intermingled with processed using special procedures and purchase
requisitions for inventory, even orders.
though they are very different
purchases. This results in a lack of Copies of equipment purchase orders should be
control over the much more distributed to all appropriate departments so they can
expensive equipment acquisitions. be monitored.
4. No mention of pre-numbered Pre-numbered purchase requisitions and purchase

purchase requisitions or purchase orders should be used so that all documents can be
orders. accounted for.
5. Plant engineering is not inspecting Machinery and equipment should be subject to normal
machinery and equipment upon receiving routines. In addition, plant engineering
receipt. should inspect the machines to make certain the
correct item was delivered and that it was not
damaged in transit.
6. Equipment is not tagged and All new machinery and equipment should be assigned
controlled to prevent theft. a control number and tagged at the time of receipt.
7. Plant engineering is not helping Plant engineering should help with the equipment
with the equipment installations. installations to ensure expensive equipment is not
damaged.
8. Machinery and equipment Machinery and equipment accounting procedures,

accounting policies, including including depreciation, must be updated periodically
depreciation, have not been updated to reflect actual experience, changes in accounting
to make certain that the most pronouncements, and income tax legislation.
desirable methods are being used.
9. Equipment retirement schedules are Equipment retirement schedules, which provide

not reconciled periodically to information on asset cost and accumulated
general ledger control accounts. depreciation, should be reconciled to general ledger
control accounts at least yearly.
Periodically, a physical inventory of fixed assets

should be taken and reconciled to the equipment
retirement schedule and the general ledger control
account.
7-41
7.10 The Langston Recreational Company (LRC) manufactures ice skates for racing,
figure skating, and hockey. The company is located in Kearns, Utah, so it can be
close to the Olympic Ice Shield, where many Olympic speed skaters train.
Given the precision required to make skates, tracking manufacturing costs is very
important to management so it can price the skates appropriately. To capture and
collect manufacturing costs, the company acquired an automated cost accounting
system from a national vendor. The vendor provides support, maintenance, and
data and program backup service for LRCs system.
LRC operates one shift, five days a week. All manufacturing data are collected and
recorded by Saturday evening so that the prior weeks production data can be
processed. One of managements primary concerns is how the actual manufacturing
process costs compare with planned or standard manufacturing process costs. As a
result, the cost accounting system produces a report that compares actual costs with
standards costs and provides the difference, or variance. Management focuses on
significant variances as one means of controlling the manufacturing processes and
calculating bonuses.
Occasionally, errors occur in processing a weeks production cost data, which
requires the entire weeks cost data to be reprocessed at a cost of $34,500. The
current risk of error without any control procedures is 8%. LRCs management is
currently considering a set of cost accounting control procedures that is estimated to
reduce the risk of the data errors from 8% to 3%. This data validation control
procedure is projected to cost $1,000 per week.
a. Perform a cost/benefit analysis of the data-validation control procedures.
Without With Net

Control Control Difference
Process Process Expected
Cost of Production Data

Reprocessing $34,500 $34,500
Risk of Data
Errors 8% 3%
Expected Reprocessing
Costs $2,760 $1,035 $1,725
(Cost of Process * Risk)
Cost of Control Process $1,000 -$1,000
Net estimated
benefit/(loss) $725
Systems
b. Based on your analysis, make a recommendation to management regarding the

control procedure.
Since the process yields an estimated net weekly benefit of $725, LRC should
implement the control process.
c. The current risk of data errors without any control procedures is estimated to be
8%. The data control validation procedure costs $1,000 and reduces the risk to
3%. At some point between 8% and 3% is a point of indifferencethat is, Cost of
reprocessing the data without controls = Cost of processing the data with the
controls + Cost of controls. Use a spreadsheet application such as Excel Goal Seek
to find the solution
Solution: 6%
7-43
Without With Net

Control Control Difference
Process Process Expected
Cost of Production Data Reprocessing $34,500 $34,500
Risk of Data Errors 6% 3%
Expected Reprocessing Costs $2,035 $1,035 $1,000

(Cost of Process * Risk)
Cost of Control Process $1,000 -$1,000
Net estimated
benefit $0
Goal Seek Setup:

Systems
Goal Seek Solved:
7-45
7.11 Spring Water Spa Company is a 15-store chain in the Midwest that sells hot tubs,
supplies, and accessories. Each store has a full-time, salaried manager and an
assistant manager. The sales personnel are paid an hourly wage and a commission
based on sales volume.
The company uses electronic cash registers to record each transaction. The
salesperson enters his or her employee number at the beginning of his/her shift. For
each sale, the salesperson rings up the order by scanning the items bar code, which
then displays the items description, unit price, and quantity (each item must be
scanned). The cash register automatically assigns a consecutive number to each
transaction. The cash register prints a sales receipt that shows the total, any
discounts, the sales tax, and the grand total.
The salesperson collects payment from the customer, gives the receipt to the
customer, and either directs the customer to the warehouse to obtain the items
purchased or makes arrangements with the shipping department for delivery. The
salesperson is responsible for using the system to determine whether credit card sales
are approved and for approving both credit sales and sales paid by check. Sales
returns are handled in exactly the reverse manner, with the salesperson issuing a
return slip when necessary.
At the end of each day, the cash registers print a sequentially ordered list of sales
receipts and provide totals for cash, credit card, and check sales, as well as cash and
credit card returns. The assistant manager reconciles these totals to the cash register
tapes, cash in the cash register, the total of the consecutively numbered sales invoices,
and the return slips. The assistant manager prepares a daily reconciled report for the
store managers review.
Cash sales, check sales, and credit card sales are reviewed by the manager, who
prepares the daily bank deposit. The manager physically makes the deposit at the
bank and files the validated deposit slip. At the end of the month, the manager
performs the bank reconciliation. The cash register tapes, sales invoices, return slips,
and reconciled report are mailed daily to corporate headquarters to be processed with
files from all the other stores. Corporate headquarters returns a weekly Sales and
Commission Activity Report to each store manager for review.
Please respond to the following questions about Spring Water Spa Companys
operations: (CMA exam adapted)
a. The fourth component of the COSO ERM framework is risk assessment. What
risk(s) does Spring Water face?
Spring Water faces the risk of fraud and employee theft of merchandise and cash.
Spring Water also faces the risk of unintentional employee errors.
b. Control strengths in c. Type of d. Problems avoided/Risks mitigated by

Systems
Spring Waters sales/cash control the controls

receipts activity
1. All 15 stores use the same Proper -Difficulty in managing and auditing all stores
electronic, bar-code based authorization and in making system changes.
system for recording and of transactions -Barcodes automatically identifies item
controlling sales transactions. and activities. description, unit price, quantity.
- Ensures mechanical accuracy of all
transactions and recording processes.
-Automatic receipt generation helps ensure all
transactions are entered into system.
2. Transactions are sequentially Design and use -Minimizes employee error and theft.
numbered by the cash of documents -Minimizes undetected or lost invoices.
register. and records. -Provides an audit trail for invoices.
3. The cash receipts, checks, Independent -Reduces the risk of theft or fraud and
credit cards, sales returns, check. employee error.
and cash register tapes are
reconciled.
4. The bank deposit is prepared Segregation of -Reduces the risk of theft or fraud and
and deposited by the duties. employee error.
manager.
5. Segregating the sale of goods Segregation of -Customers not having access to goods
from the delivery of goods. duties. reduces shoplifting, customer/clerk collusion,
and other theft.
7-47
e. How might Spring Water improve its system of controls?
The bank reconciliation should be performed by someone other than the manager
who makes the deposits.
Sales people should never be allowed to authorize credit sales. At Spring Water,
the sales person authorizes credit purchases and approves payments made by check.
They also approve sales returns. This lack of separation of duties facilitates fraud.
In addition, since the sales person is paid a commission based on sales without
taking into account returns and collections, they have incentive to approve all credit
sales and accept all payments made by check without checking whether a customer
is credit worthy and/or whether the have sufficient funds available to cover their
check. They can also talk customers into buying more than they need and then
returning the items not needed.
Warehouse personnel should have electronic read-only access to daily sales orders
to control and facilitate customer order pick-up and/or delivery.
Warehouse personnel should scan-in the bar codes of all sales-return merchandise.
The manager or assistant manager should reconcile a sales return report from the
warehouse to the sales return report from the cash registers on the sales floor.
Systems
7.12 PriceRight Electronics (PEI) is a small wholesale discount supplier of electronic

instruments and parts. PEIs competitive advantage is its deep-discount, three-day
delivery guarantee, which allows retailers to order materials often to minimize in-
store inventories. PEI processes its records with stand-alone, incompatible computer
systems except for integrated enterprise resource planning (ERP) inventory and
accounts receivable modules. PEI decided to finish integrating its operations with
more ERP modules, but because of cash flow considerations, this needs to be
accomplished on a step-by-step basis.
It was decided that the next function to be integrated should be sales order
processing to enhance quick response to customer needs. PEI implemented and
modified a commercially available software package to meet PEIs operations. In an
effort to reduce the number of slow-paying or delinquent customers, PEI installed
Web-based software that links to the Web site of a commercial credit rating agency
to check customer credit at the time of purchase. The following are the new sales
order processing system modules:
Sales. Sales orders are received by telephone, fax, e-mail, Web site entry, or
standard mail. They are entered into the sales order system by the Sales
department. If the order does not cause a customer to exceed his credit limit, the
system generates multiple copies of the sales order.
Credit. When orders are received from new customers, the system automatically
accesses the credit rating Web site and suggests an initial credit limit. On a daily
basis, the credit manager reviews new customer applications for creditworthiness,
reviews the suggested credit limits, and accepts or changes the credit limits in the
customer database. On a monthly basis, the credit manager reviews the accounts
receivable aging report to identify slow-paying or delinquent accounts for potential
revisions to or discontinuance of credit. As needed, the credit manager issues credit
memos for merchandise returns based on requests from customers and forwards
copies of the credit memos to Accounting for appropriate account receivable
handling.
Warehousing. Warehouse personnel update the inventory master file for inventory
purchases and sales, confirm availability of materials to fill sales orders, and
establish back orders for sales orders that cannot be completed from stock on hand.
Warehouse personnel gather and forward inventory to Shipping and Receiving
along with the corresponding sales orders. They also update the inventory master
file for merchandise returned to Receiving.
Shipping and receiving. Shipping and Receiving accepts inventory and sales orders
from Warehousing, packs and ships the orders with a copy of the sales order as a
packing slip, and forwards a copy of the sales order to Billing. Customer inventory
returns are unpacked, sorted, inspected, and sent to Warehousing.
Accounting. Billing prices all sales orders received, which is done approximately 5
days after the order ships. To spread the work effort throughout the month,
7-49
customers are placed in one of six 30-day billing cycles. Monthly statements,
prepared by Billing, are sent to customers during the cycle billing period.
Outstanding carry forward balances reported by Accounts Receivable and credit
memos prepared by the credit manager are included on the monthly statement.
Billing also prepares electronic sales and credit memos for each cycle. Electronic
copies of invoices and credit memos are forwarded to Accounts Receivable for entry
into the accounts receivable master file by customer account. An aging report is
prepared at the end of each month and forwarded to the credit manager. The
general accounting office staff access the accounts receivable master file that reflects
total charges and credits processed through the accounts receivable system for each
cycle. General accounting runs a query to compare this information to the electronic
sales and credit memo and posts the changes to the general ledger master file.
(CMA exam adapted)
a. Identify the internal control strengths in PEIs system
The automated customer credit limit system suggests a new customer's credit limit on
a real-time basis. The Credit Manager establishes credit limits for new customers on
a daily basis so that new credit-worthy customers can have their orders filled in a
timely manner.
Real-time customer credit checks before orders are processed.
Monthly aging reports allow the credit manager to detect overdue and near overdue
accounts so that corrective action can be taken.
The credit manager creates credit memos that authorize returned merchandise but has
no recording responsibility.
Customers are not billed until an order has shipped.
Shipping and Receiving accept and inspect returned materials to assure the receipt
and identification of damaged materials and to limit credit returns.
Warehouse personnel confirm the availability of materials to fill orders and prepare
back-orders for sales orders that cannot be filled with current stock.
General Accounting posts changes to the general ledger master file after accessing the
accounts receivable master file, electronic sales, and credit memo files.
b Identify the internal control weaknesses in PEIs system, and suggest ways to correct
them.
Weakness 1: The Credit Department only checks the accounts receivable aging report at
Systems
month-end, which delays the identification of slow or non-paying customers for potential
credit status changes.
Correction: Revise the aging report process to produce an exception report whenever a
customer account is overdue. The exception report should automatically be sent to the
credit manager by email so that corrective action can be taken in a timely manner.
Weakness 2: Customer credit requests for sales returns are not compared to materials
received, which might result in credits to customer accounts for goods not returned or for
returned goods that are damaged.
Correction: Require the credit manager to receive an acknowledgement from Shipping

and Receiving that the goods were returned in good condition before issuing a credit
memo. In addition, Accounting should not process any credit memos without receiving a
report of goods received from Shipping and Receiving.
Weakness 3: Warehouse personnel have responsibility for updating inventory records for
purchases and sales that can lead to inventory shrinkage.
Correction: Create a purchasing function to update the inventory master file for
purchases. The update should not take place until Shipping and Receiving notify them that
the goods have been received.
Weakness 4: Receiving does not prepare a Returned Goods report.
Correction: Receiving should record all purchase returns and prepare a Returned Goods
report. This record should be used to create a daily report that should be sent to General
Accounting to compare with the purchase returns put back into the warehouse.
Weakness 5: Warehouse personnel have responsibility for updating inventory records for
purchase returns, which can lead to inventory shrinkage.
Correction: Have the warehouse create a daily purchases returned report for all returned
goods they receive from Receiving. This report should be sent to General Accounting for
comparison with a purchase return report prepared by Receiving.
Weakness 6: Inventory is not counted when received and then counted again when
received by the warehouse to prevent theft after items are received. In similar fashion,
inventory is not counted before leaving the warehouse, when received by shipping, and
when shipped. Those counts should be the same to ensure that inventory is not stolen
before it is shipped to the customer.
7-51
Correction: Count and compare inventory counts as inventory enters the company and as
it arrives in warehousing; likewise count and compare inventory counts as it leaves
warehousing and arrives at shipping.
Weakness 7: Billing is not done until 5 days after shipping.
Correction: Billing should be more prompt in billing for goods shipped. This gives
customers more time to put the bill through their bill paying process and pay for the goods
on time.
Systems
SUGGESTED SOLUTIONS TO THE CASES
7.1 Nino Moscardi, president of Greater Providence Deposit & Trust (GPD&T), received
an anonymous note in his mail stating that a bank employee was making bogus loans.
Moscardi asked the banks internal auditors to investigate the transactions detailed in
the note. The investigation led to James Guisti, manager of a North Providence
branch office and a trusted 14-year employee who had once worked as one of the
banks internal auditors. Guisti was charged with embezzling $1.83 million from the
bank using 67 phony loans taken out over a three-year period.
Court documents revealed that the bogus loans were 90-day notes requiring no
collateral and ranging in amount from $10,000 to $63,500. Guisti originated the loans;
when each one matured, he would take out a new loan, or rewrite the old one, to pay
the principal and interest due. Some loans had been rewritten five or six times.
The 67 loans were taken out by Guisti in five names, including his wifes maiden
name, his fathers name, and the names of two friends. These people denied receiving
stolen funds or knowing anything about the embezzlement. The fifth name was James
Vanesse, who police said did not exist. The Social Security number on Vanesses loan
application was issued to a female, and the phone number belonged to a North
Providence auto dealer.
Lucy Fraioli, a customer service representative who cosigned the checks, said Guisti
was her supervisor and she thought nothing was wrong with the checks, though she
did not know any of the people. Marcia Perfetto, head teller, told police she cashed
checks for Guisti made out to four of the five persons. Asked whether she gave the
money to Guisti when he gave her checks to cash, she answered, Not all of the time,
though she could not recall ever having given the money directly to any of the four,
whom she did not know.
Guisti was authorized to make consumer loans up to a certain dollar limit without
loan committee approvals, which is a standard industry practice. Guistis original
lending limit was $10,000, the amount of his first fraudulent loan. The dollar limit was
later increased to $15,000 and then increased again to $25,000. Some of the loans,
including the one for $63,500, far exceeded his lending limit. In addition, all loan
applications should have been accompanied by the applicants credit history report,
purchased from an independent credit rating firm. The loan taken out in the fictitious
name would not have had a credit report and should have been flagged by a loan
review clerk at the banks headquarters.
News reports raised questions about why the fraud was not detected earlier. State
regulators and the banks internal auditors failed to detect the fraud. Several reasons
were given for the failure to find the fraud earlier. First, in checking for bad loans,
bank auditors do not examine all loans and generally focus on loans much larger than
the ones in question. Second, Greater Providence had recently dropped its computer
services arrangement with a local bank in favor of an out-of-state bank. This
7-53
changeover may have reduced the effectiveness of the banks control procedures.
Third, the banks loan review clerks were rotated frequently, making follow-up on
questionable loans more difficult.
Guisti was a frequent gambler and used the embezzled money to pay gambling debts.
The banks losses totaled $624,000, which was less than the $1.83 million in bogus
loans, because Guisti used a portion of the borrowed money to repay loans as they
came due. The banks bonding company covered the loss.
The bank experienced other adverse publicity prior to the frauds discovery. First, the
bank was fined $50,000 after pleading guilty to failure to report cash transactions
exceeding $10,000, which is a felony. Second, bank owners took the bank private after
a lengthy public battle with the State Attorney General, who alleged that the bank
inflated its assets and overestimated its capital surplus to make its balance sheet look
stronger. The bank denied this charge.
1. How did Guisti commit the fraud, conceal it, and convert the fraudulent actions
to personal gain?
Commit: James Guisti, a trusted 14-year employee and manager of a Greater

Providence Deposit & Trust branch office, was authorized to make consumer loans
up to a certain dollar limit without loan committee approvals. He used this authority
to create 67 fraudulent 90-day notes requiring no collateral. As the scheme
progressed, he was able to bypass the loan committee approval as some of his loans
exceed his loan limit. Guisti was charged with embezzling $1.83 million from the
bank.
Conceal: He made the loans out to five people: his wife using her maiden name, his
father, two friends, and a non-existent person. To avoid detection, he made sure the
loans were performing and that they were never examined for non-payment. That is,
when the loans matured, he would take out a new loan, or rewrite the old one, to pay
the principal and interest due. He also kept the loans small to avoid the attention of
auditors, who examined loans much larger than those he was fraudulently originating.
Convert: He had a subordinate, customer service representative Lucy Fraioli, cosign

the checks. He then had another subordinate, head teller Marcia Perfetto, cash the
checks, and give him the money.
Systems
2. Good internal controls require that the custody, recording, and authorization
functions be separated. Explain which of those functions Guisti had and how the
failure to segregate them facilitated the fraud.
Authorization: Guisti was authorized to make consumer loans up to $10,000 (later

$15,000 and then $25,000) without loan committee approval. This authorization is
standard industry practice. He used this authority to create fraudulent loans.
As the scheme progressed, he was able to bypass loan committee approval for loans
that exceeded his loan limit. This is not standard industry practice and represents a
failure of bank internal controls.
Custody: Guisti was able to commit the fraud because he was able to obtain custody
of the checks used to extend the loans. He used his position as branch manager to get
his subordinates to cosign the checks and cash them.
Recording: Nothing in the case write-up indicates that Guisti had any recording
responsibilities. It appears that he used the banks normal recording processes: the
bank recorded the loans when created and the payments were appropriately recorded
when Guisti repaid them
3. Identify the preventive, detective, and corrective controls at GPD&T and discuss
whether they were effective.
Preventive: All bank loans exceeding Guists limit ($10,000, then $15,000 and then
$25,000) were supposed to be approved by a loan committee. This control was not
enforced or was not effective as Guisti was able to bypass it.
GPD&T segregated the functions of loan origination, authorization (a co-signer

needed on loans), and custody of cash (tellers). Guisti used his position of branch
manager to override the controls over co-signatures and check cashing.
Loan applications were to be accompanied by the applicants credit history report,

purchased from an independent credit rating firm. The loan taken out in the fictitious
name did not have that credit report and it should have been flagged by a loan review
clerk at the banks headquarters. This control was not enforced or was not effective
as Guisti was able to bypass it.
Greater Providence dropped its computer services arrangement with a local bank in
favor of an out-of-state bank. This may have reduced the effectiveness of the banks
control procedures.
7-55
Detective: State regulators and the banks internal auditors failed to detect the fraud.
Bank auditors do not examine all loans and focus on much larger loans than Guistis.
The banks loan review clerks were rotated frequently, making follow-up on
questionable loans more difficult.
Corrective: The bank bonded (an insurance policy on an employees honesty) its
employees. When the bank was defrauded, the banks bonding company covered the
loss. This control was effective in restoring the financial losses the bank experienced.
4. Explain the pressures, opportunities, and rationalizations that were present in

the Guisti fraud.
Pressures: Guisti was a frequent gambler and needed the money to pay gambling
debts.
Opportunities: As the Branch Manager, Guisti could override some internal controls
and unduly influence his subordinates not to comply with others.
Rationalization: No information is given on how or why Guisti rationalized his fraud
5. Discuss how Greater Providence Deposit & Trust might improve its control
procedures over the disbursement of loan funds to minimize the risk of this type
of fraud. In what way does this case indicate a lack of proper segregation of
duties?
Loan funds should generally not be disbursed in cash. Better control would be
established by depositing the funds in a checking account in the borrower's name or
by issuing a bank check to the borrower.
When cashing such a check, bank personnel should require identification containing
the borrower's photograph, and the borrower's signature on the check, and should
scan both the photograph and the signature to verify the borrower's identity.
In no case should one bank employee disburse cash to another for a loan to a third
party borrower without first verifying the existence and identity of the borrower.
Customer service representatives generally should not co-sign checks to borrowers

without first verifying their existence.
6. Discuss how Greater Providence might improve its loan review procedures at
bank headquarters to minimize its fraud risk. Was it a good idea to rotate the
assignments of loan review clerks? Why or why not?
Systems
A system should be in place at the bank's headquarters to maintain data on all

outstanding bank loans. This system should flag all loans that have been made in
excess of the loan officer's lending limit. The authenticity of these loans should be
scrutinized by internal auditors or other bank officials independent of the loan officer.
Disciplinary action should be taken when a loan officer extends a loan that is greater
than his loan limit.
Approved loans for which there is no credit report should be flagged and scrutinized.
Bank headquarters could send a letter to each new borrower thanking them for their
business. Individuals whose names had been used on loan documents without their
permission would be likely to question why they had received such a letter, while
letters mailed to fictitious borrowers would be returned as undeliverable. Either event
should trigger an investigation.
Rotating the assignments of loan review clerks may have made it more difficult for
the bank to detect this fraud. After it discovered the embezzlement, Greater
Providence changed its policy to require its loan review clerks to track a problem loan
until it is resolved.
7. Discuss whether Greater Providences auditors should have been able to detect
this fraud.
Audits are not guaranteed to detect fraud. It is too costly for auditors to examine
every loan, so they generally examine a systematically selected sample. It makes
sense for auditors to focus on larger loans, since that is where the greatest exposure is.
The case notes that Guisti was a former auditor. Therefore, he would have been very
familiar with the bank's control system and its audit procedures. He undoubtedly
made use of this knowledge in planning and carrying out his embezzlement scheme.
On the other hand, since the bank's central records were computerized, it should have
been a simple matter for auditors to find and examine every outstanding loan record
with questionable characteristics, such as:
Loan amounts in excess of the loan officer's lending limit

Short-term loans that had been rewritten several times.
If auditors had any indication that Guisti was heavily involved in gambling activities,
they should have examined his accounts very carefully. However, the case gives no
indication that the auditors were ever aware of Guisti's penchant for gambling.
7-57
8. Are there any indications that the internal environment at Greater Providence
may have been deficient? If so, how could it have contributed to this
embezzlement?
There are three indications of potential deficiencies in the bank's control environment.
Controls may have been deficient during the computer services changeover.
However, the fraud took place over a three-year period, and any problems relating
to the computer changeover should have taken much less than three years to
resolve.
The bank pled guilty to a felony three years prior to discovery of the fraud, which
was about the time the fraud began.
The state's charges of an inflated balance sheet suggest the possibility that the
integrity of the bank's management may be flawed, though there is certainly no
proof of this.
While one indicator of a deficient internal environment may be tolerable, three begins
to look like a pattern. Deficiencies in the bank's internal environment certainly could
have contributed to the embezzlement by enhancing the opportunity for fraud and by
fostering an attitude that dishonest behavior is somehow acceptable.

Control and Accounting Information Systems Suggested Answers To Discussion Questions

Uploaded by

Copyright:

Available Formats

Control and Accounting Information Systems Suggested Answers To Discussion Questions

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Control and Accounting Information Systems Suggested Answers To Discussion Questions

Uploaded by

Copyright:

Available Formats

Accounting Information

CONTROL AND ACCOUNTING INFORMATION SYSTEMS

SUGGESTED ANSWERS TO DISCUSSION QUESTIONS

a. What deficiencies existed in the internal environment at Springers?

1. Management authority is concentrated in three family members, so there are

Many lessons may be drawn from this story.

1. Auditors should view the condition of an organization's control environment as

7.2 Effective segregation of duties is sometimes not economically feasible in a small

Effective supervision and independent checks performed by the owner/manager may

Check all customer numbers to make sure they are valid

Consider a control procedure mandating weekly backup of critical files. Regular

It is probably impossible to eliminate resentment or loss of morale among all employees,

Of course, there is a cost-benefit tradeoff in implementing internal controls. If an

Audit committee members must be on the companys board of directors and be

o Significant changes to controls after managements evaluation were disclosed and

There are two reasons for using tickets.

Despite these controls, the following risks still exist:

1. Business objectives, to ensure information conforms to and maps into business

2. IT resources, including people, application systems, technology, facilities, and data.

3. IT processes, including planning and organization, acquisition and implementation,

COSOs Internal Control Framework is widely accepted as the authority on internal

It has five components:

3. Risk assessment, which is the process of identifying, analyzing, and managing

5. Monitoring company processes and controls, so modifications and changes can be

Companies are formed to create value for their owners.

ERM adds three additional elements to COSOs IC framework:

2. Identifying events that may affect the company

3. Developing a response to assessed risk.

An event is an incident or occurrence emanating from internal or external sources that

COSOs Nine ERM Event Categories

2. Operations objectives deal with the effectiveness and efficiency of company

3. Reporting objectives help ensure the accuracy, completeness, and reliability of

1. Have a special team or internal auditing perform a formal or a self-assessment ERM

2. Supervise effectively, including training and assisting employees, correcting errors,

3. Use Responsibility Accounting Systems such as budgets, quotas, schedules, standard

SUGGESTED SOLUTIONS TO THE PROBLEMS

do not appear to know who to ask for help.

PROBLEM: Section 301 of the Sarbanes-Oxley Act of 2002 (SOX) applies to

c. Management explained its plans to change accounting methods for depreciation

PROBLEM: Why would a company want to move from an accelerated depreciation

PROBLEM: The internal audit function is not organizationally independent of the

SOLUTION: Organization structure and board of director requirements dictates that

PROBLEM: The dominance of an organization's management by one or a few

SOLUTION: It is important to evaluate carefully this situation to determine if it

PROBLEM: This indicates a possible problem with management's human resource

SOLUTION: It is important to evaluate carefully this situation to determine if it

PROBLEM: Management's philosophy and operating style, as well as their

PROBLEM: One of the methods of assigning authority and responsibility is a

j. Some employees complained that some managers occasionally contradict the

SOLUTION: Achieving adequate security and control over an organizations data

l. The enhanced network firewall project appeared to be on a very aggressive

PROBLEM: The firewall implementation schedule is not feasible.

SOLUTION: Managements philosophy and operating style should be carefully

PROBLEM: Employee training and support appear to be rather weak. Companies

SOLUTION: Good human resource standards require that training programs

PROBLEM: Go-Go's risk appetite, although aggressive, appears to be grounded in

SOLUTION: Part of managements philosophy and operating style should be the

SOLUTION: These three functions should be segregated. One person should

c. A cashier prepared a fictitious invoice from a company using his brother-in-