Understanding, Evaluating, and Monitoring Internal Control Systems: A Case and Spreadsheet Based Pedagogical Approach
This paper describes a case approach for teaching internal control evaluation (ICE) using an Excel spreadsheet patterned after software from Grant Thornton LLP (Grant) named INFOCUS. Although INFOCUS is not used or supported anymore by Grant, it was used for many years in training and development for ICE theory and application at the firm. Grant allows use of their software and approach for classroom use. From a conceptual pedagogy perspective, this approach is still applicable to current practice standards and guidelines for ICE and provides a systematic application to help students take the role of an auditor to document the accounting system, document the controls, select key controls, and make the preliminary control risk assessment. The case and spreadsheet application can also be applied to the COSO 2013 Framework focusing mostly on Risk Assessment, Control Activities, and Monitoring Activities to internal control systems. The spreadsheet application can accommodate cases that provide differing company sizes and levels of automated control environments for internal audit and management perspectives. This case and spreadsheet application provides students an opportunity to deeply understand and analyze the accounting processes, the internal controls, and the interrelationships between the processes and controls. Exposure to such a case and spreadsheet application helps prepare students to successfully complete internal control evaluations in the “real world.”ABSTRACT
INTRODUCTION
Passage of the 1977 Foreign Corrupt Practices Act (FCPA) was the first step in a series of federal regulatory actions to increase the quality and quantity of internal control reliability assessments for large public corporations (Stachowski 1994; Waggoner 1991). Professional pronouncements require that internal control evaluations (ICEs) be made for each financial statement assertion applied to each account for which the auditor plans to rely on controls (AICPA 1988; PCAOB 2007). In addition, increased competition in the market for assurance services has given audit firms an incentive to find more cost-effective methods to assess the reliability of information systems, particularly after the enactment of the Sarbanes Oxley Act of 2002 (“SOX”).
SOX Section 404 requires public companies to provide well-documented evidence that their internal control systems are adequate and a statement that the external auditors have issued an attestation report on management's assessment of their internal control system. SOX section 404 also requires that management undertake monitoring activities (COSO 1992, 2013 (Ramamoorti and Sonnelitter 2011) to ensure that internal control systems continue to operate effectively over time. The latest COSO (2013) framework lists seventeen principles, broken up into categories of Control Environment, Risk Assessment, Control Activities, Communication and Information, and Monitoring Activities. The PCAOB initially adopted Auditing Standard No. 2 (AS2) (see PCAOB 2005) as the standard for auditors and company management to comply with Section 404 of SOX. Then in July of 2007, the Securities and Exchange Commission approved Auditing Standard No. 5 (AS5) (PCAOB 2007) to replace AS2.
AS5 provides the professional standards and related performance guidance for independent auditors to attest to, and report on, management's assessment of the effectiveness of internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act of 2002. In June of 2006, the COSO issued additional guidance for auditors performing audits of smaller public companies (COSO 2006). In addition to direct standards for external auditors, these pronouncements have high impact on internal auditors and management in relation to designing, implementing, evaluating, and monitoring internal controls within their respective organizations. SOX Section 404(b) has also had a great deal of influence for designing, documenting, evaluating, and monitoring internal controls in governmental entities (AGA 2007), not-for profit entities, and smaller, private companies (Reed et al. 2006; Savich 2006).
Internal controls that are well-designed and operating effectively can help prevent and deter fraud. The Association of Certified Fraud Examiners' (ACFE) Report to the Nations (2016) notes in its executive summary that smaller companies have higher vulnerability to fraud risk arising from non-existent or weak internal control systems and procedures. Arens and Elder (2006) document seventy years of historical fraud-regulatory reaction and the impact of audit requirements and education related to each fraud case studied. They conclude that the auditing environment after SOX demands that auditing education help students develop: (1) greater understanding of risk assessment, (2) forensic accounting skills, (3) ability to understand and document controls and link controls to assertions and audit evidence, and (4) competence to deal with corporate governance and other PCAOB requirements. The following case and spreadsheet application allows students to apply the COSO 2013 Framework focusing mostly on Risk Assessment, Control Activities, and Monitoring Activities to internal control systems. This case and spreadsheet application also provides students an opportunity to deeply understand and analyze the accounting processes, the internal controls, and the interrelationships between the processes and controls. Exposure to such a case and spreadsheet application helps prepare students to successfully complete internal control evaluations in the “real world.”
LEARNING OBJECTIVES
Upon completion of this case, students should be able to document and evaluate an entity's internal control structure. Specifically, students will document and evaluate the accounting processes and controls and make a preliminary or planned Control Risk Assessment (CRA). Students should also be able to take the approach as if they were a consultant for improving the internal control structure of Ownco, Inc. and document a situation in which the controls would provide an “ideal” set of controls given the limitations of a small company.
COMPUTERIZED INTERNAL CONTROLS EVALUATION (ICE) CASE
Scenario: You are the senior auditor on the audit for Ownco, Inc. Previously, you have used the narration of accounting processes and controls. Our audit firm is updating the documentation of the accounting processes, controls and control risk assessment of the revenue cycle this year using the Internal Control Evaluation (ICE) Spreadsheet tool that you will receive from your supervisor (teacher). You have been assigned to complete these audit tasks. The following is the company background information, as well as the sales stream and cash receipts stream transaction processing narratives for Ownco, Inc.
Background - Understanding of the Control Environment
Ownco, Inc. (Ownco) manufactures plastic fishing worms at one location (Running Water, Arkansas). Ed Jones, its sole owner, manages Ownco. Jones is responsible for marketing, purchasing, hiring and approving major transactions. He has a good understanding of the business and the industry in which it operates. Jones believes that hiring experienced personnel is particularly important because there are no layers of supervisory personnel and thus, because of limited segregation of duties, few independent checks of employees' work. Jones has a moderate-to-conservative attitude toward business risks. The company has demonstrated consistent profitability, and because Jones considers lower taxes to be as important as financial results, he has a conservative attitude toward accounting estimates.
Jones and Pat Willis, the bookkeeper, readily consult with our firm on routine accounting questions, including the preparation of accounting estimates (tax accrual, inventory obsolescence, or bad debts).
Family members compose the company's board of directors. The board does not monitor the business or the owner-manager's activities.
Pat Willis performs most of the significant accounting functions while Chris Ross, Ed Jones' secretary, opens the mail including checks received. The company hired Willis ten years ago. She has a working knowledge of accounting basics, and we have no reason to question her competence. Willis regularly consults with our firm on unusual transactions, and history shows that it is rare for adjustments to arise from errors in the processing of routine transactions.
The owner-manager, Ed Jones, carefully reviews computer-generated financial reports, such as reports on receivables aging, and compares revenues and expenses with prior years' performance. He also monitors the terms of the long-term debt agreement that require certain financial statement ratios and compensating balances. Based on our firm's experience with the client, we have noted that management override of internal controls is NOT a concern.
Ownco uses late model, Windows-based, networked, microcomputers. The company uses a basic accounting software package (QuickBooks) that provides for three users. The source code is not available for this software. A network printer was purchased with the computers. The network maintenance and setup is outsourced to Digital Tech, Inc. and is properly controlled so that only Willis, Ross and Jones have access to the accounting system. Digital Tech, Inc. provided our firm with a copy of a CPA's report on the effectiveness of its controls over the privacy of the information it processes for Ownco, Inc. Our firm also has been granted “reports only” access (cannot edit or change any transactions) to Ownco's QuickBooks Pro™ accounting system. The backup for the accounting and company files is also done automatically and regularly, and stored offsite by Digital Tech, Inc. For the computer controls, Jones is set as the master administrator of the accounting system, with Willis as the company administrator. That means that Jones can change who has access to any part of the accounting system while Willis has access to all the accounting system processes. Ross only has access to cash receipts recording but does not have access to the general ledger, cash disbursements, nor purchases. From an audit perspective, the computer environment is determined to be simple (not complex) and IT audit is not necessary. The IT environment does not provide any concerns from an audit perspective about the computer accounting software and related computerized accounting controls. Our completed Computer Processing Overview questionnaire follows.
Computer Processing Overview (for Evaluation of IT General Controls):
Company as a Whole:
-
Is a third party service organization used to process all transactions involving computer processing? No
-
Are the client's computers in a dedicated physical area or facility? No
-
Is there a separate IT Department? No
-
Can separate users access the system concurrently? Yes
Is access control software used to restrict access to the production programs? Yes
Is access control software used to restrict access to the data files? Yes
Are reports generated by such software reviewed by management? Yes
Revenue Accounting Cycle:
-
Are transactions for this cycle processed by a third party service organization? No
-
Is this application PC-based? Yes
-
Does the client have the source code for the computer program used in this accounting cycle? No
-
Do multiple applications share the same database files? No
-
Are there real-time updates to files when transactions are entered? Yes
-
Are telecommunications or networks used in this accounting cycle? Yes
○Is physical access to computers controlled? No
○ Is the use of computers controlled by password? Yes
○ Are passwords protected and changed on a regular basis? Yes
○ Are system user rights transaction or application specific? Yes
-
Does the software in this accounting cycle generate transactions or pass information to other transaction cycles? Yes
-
Is there significant loss of visible audit trail in the accounting cycle? No
-
Have there been any hardware or software malfunctions which resulted in a loss of data in this accounting cycle? No
Ownco, Inc. Employees:
Amos, John, Warehouse picker
Deal, Robert, Warehouse picker
Jones, Ed, Owner-manager
Ross, Chris, Secretary of Ed Jones
Tanner, Jeff, Shipping clerk
Trout, Jack, Warehouse supervisor
Various, Sales representatives
Willis, Pat, Bookkeeper
Sales Stream in Revenue Cycle:
Sales in the current year ending September 30, 20XX were approximately $10,300,000. The number of transactions was approximately 35,000. At the time a sale is made, the sales representative enters information such as customer name and number, shipping and inventory description, stock number, and price on a four-part, pre-numbered sales order (SO) form. Written explanations of price variances are attached.
The owner-manager (Ed Jones) reviews each SO for pre-numbered sequence and proper price, approves the extension of credit to the customer, and signs the sales order. The bookkeeper receives SO copy No. 1. The warehouse, the sales representative, and the customer receive the additional copies. Mr. Jones reviews sales orders after the fact on return from being away from the office.
The bookkeeper receives approved SO copy No. 1 from the owner-manager and files them numerically, pending receipt of the shipping report.
Upon receipt of SO copy No. 2, Jack Trout, the warehouse supervisor, ensures that the owner-manager has signed the SO and then has the warehouse pickers, John Amos and/or Robert Deal, pull the goods and prepare the shipping report.
The shipping clerk, Jeff Tanner, receives the shipping report, SO copy No. 2, and the pulled goods from the warehouse. Jeff Tanner verifies that the goods agree with the SO and the shipping report, initials the shipping report, prepares the goods for shipment and ships the goods. The bookkeeper receives the shipping report and matches it with SO copy No. 1. Copies also go to the customer and to the warehouse supervisor (for filing in the warehouse department). The bookkeeper enters stock number, quantity, prices, and customer information into the microcomputer.
The computer prints sales invoices. The bookkeeper matches computer-generated sales invoices with sales orders and shipping reports for completeness. The bookkeeper also investigates unmatched sales orders and shipping reports monthly. The customer receives the original sales invoice (including a breakaway remittance advice).
The matched sales order, shipping report, and sales invoice are stapled together and filed by sales invoice number.
At the end of the day, transactions are posted to the cumulative sales master file, the accounts receivable master file, and the general ledger. The owner-manager reviews sales reports and shipping reports weekly. The owner-manager reviews the aged trial balance twice monthly, and he follows up on past due accounts. The owner-manager pays particular attention to accounts over thirty days past due.
Customers receive statements each month. The statements request the customers contact Mr. Jones, the owner-manager, for any disputed balances.
The bookkeeper reconciles the accounts receivable subsidiary ledger and cumulative sales master file with the appropriate general ledger accounts monthly.
Cash Receipts Stream in Revenue Cycle
Chris Ross, the secretary, receives all checks and remittance advices. She prepares a complete listing of all checks received. She retains the original list, and gives a copy to Pat Willis, the bookkeeper, along with the checks and remittance advices.
Willis prepares the bank deposit and adds the account code to each item listed on the listing of checks received. She makes the bank deposit, and then gives Ross a copy of the deposit slip, receipted by the bank. Ross then compares the deposit slip with the original list of checks. Willis enters customer and cash receipts information into the microcomputer using the listing of checks with account codes. Willis runs the program that updates the accounts receivable master file and cash receipts file daily. Transactions are posted to the general ledger at the same time. The cash receipts journal, subledgers, and general ledger are printed on demand. Willis compares the computer-generated accounts receivable subsidiary ledgers with the general ledger control account monthly. Willis also prepares the bank reconciliation monthly, which Jones reviews.
Materials and Instructions
View the following videos:
Internal Control Structure Concepts PowerPoint video.mp4
Transaction Errors and Management Assertions PowerPoint video.mp4
Download and use the Excel spreadsheet, Ownco1.xlsx, to document and complete your internal control evaluation assignment. Documentation for the sales stream in the revenue cycle is already mostly completed and found in the Ownco1.xlsx Excel spreadsheet.
Also, download and view the following videos to help you complete the assignment:
-
Ownco Assignment Overview and Data File.mp4
-
Documenting Accounting Processes for Ownco Case Excel Version.mp4
-
Documenting Controls Part 1 for Ownco Case Excel Verstion.mp4
-
Documenting Controls Part 2 for Ownco Case Excel Version.mp4
-
Select Key Controls and Make Preliminary CRA for Ownco Case Excel Version.mp4
-
Documenting Ideal Controls for Ownco Case Excel Version.mp4 (for Part II)
Required
Objective: Part I Actual: Learn how to document and evaluate an entity's internal control structure.
-
ICE Step 1, evaluation of internal control environment, has been done. It has been determined that management override is not an issue and the computer processing for this small company provides enough foundation for reliance on computerized accounting controls. In the Ownco1.xlsx spreadsheet relate the sales stream information to the documentation about the sales stream found on Ownco1.xlsx. The sales stream is a model or pattern you can use to help you document the cash receipts stream.
-
Document the accounting processes, controls, and make your preliminary Control Risk Assessment (CRA) using the Excel file Ownco1.xlsx for the cash receipts stream:
-
ICE Step 2: Document the accounting processes in the cash receipts stream: Using the flowchart screen and Excel's flowcharting tools, add the cash receipts stream process symbols to the revenue cycle overview flowchart you believe are necessary to adequately document the cash receipts accounting processes. (Use the sales stream flowchart as a model for how to complete the overview flowchart.) Document only the processes, not the controls. Also, in the process and control summary worksheet list each accounting process you added to the overview flowchart and fill out the columns about personnel performing each process and whether the process is manual or computerized.
-
ICE Step 3: Document the controls in the cash receipts stream. Make sure to include the accounts receivable general ledger (AR GL) because it is in both the Sales and Cash Receipts stream. Using the Process and Controls Summary tab in the Ownco1 worksheet, fill in the table based on the Sales and Cash Receipts narration concerning the controls. The columns are as follows:
-
Control name(s) (if any controls exist) for each process.
-
Management Assertion(s) for each control.
-
Person(s) performing control.
-
Is the control preventive or detective?
-
How is the control documented?
-
Compensating control (if any) - A compensating control is a control later in the overall processing that “compensates for” the lack of any controls for a particular process.
-
Location of each compensating control – What accounting process does the compensating control protect?
A list of controls and the list of management assertions and the related descriptions of the controls and assertions are found in other worksheet tabs in the Ownco1 spreadsheet. Make sure you complete all the columns for the controls.
-
-
ICE Step 4a: Make Preliminary CRA. Using the column for key controls in the Processes and Controls Summary worksheet tab, identify key controls for the cash receipts stream. Then review the key controls on the sales stream and make changes as you deem appropriate. Make sure you mark in the Process and Control Summary worksheet which controls you plan to rely on and test (i.e., which controls you select as key controls.).
-
ICE Step 4b: Using the CRA worksheet tab, record the risk category you believe is appropriate given your documentation of the accounting processes and controls. Make a preliminary CRA on the Cash Receipts stream. The Sales stream is done as an example, but you may want to review it and change it if you wish based on your evaluation of the documentation. Your CRA will include the management assertions Existence / Occurrence, Completeness, Valuation-Gross, (Valuation-Net is not needed since we are not reviewing controls for allowance for doubtful accounts nor sales returns and sales discounts) combined into a management assertion group.
-
Finally, write a separate paragraph in a Word document for both the Cash Receipts stream and Sales stream, respectively, explaining the reasons you chose the CRA levels for each stream. Base your CRA levels on your understanding of the ICE structure as documented by:
-
The accounting processes (designed well to mitigate errors in the accounting system)
-
The control procedures and management assertions covered by each control (overall coverage)
-
The number and placement of key controls that are in place
-
The missing key controls
-
Segregation of duties
Hand in Part I “Actual” Ownco documentation by uploading your Excel and Word files for the assignment in the online course management system. Save the files with an “A” and your last name and first initial. (The A stands for “Actual.”) Make sure your name is in the worksheet somewhere as the preparer.
Objective: Part II Ideal: Take the approach as if you were a consultant for improving the internal control structure of Ownco, Inc. Document a situation in which the controls would provide an “ideal” set of controls given the limitations of a small company.
Using the documentation files from Part I, update your set of controls to a set of controls that would be ideal. That is, provide for an ideal set of controls that would support “Limited or Low” control risk assessment without hiring new staff. Save your previous “actual” file as a new file with an “I” and your last name and first initial. (The “I” stands for “Ideal.”) Make sure your name is in the worksheet somewhere as the preparer. Also, include a document that outlines how to improve segregation of duties including separation of:
Authorization of transactions
Recording transactions
Custody of assets
Person performing control does not perform the process
Your write-up should not only include a discussion of principles regarding segregation of duties, but also be specific as to how segregation of duties was improved for this Ownco case. It might be most helpful to write a paragraph about each of the above parts of segregation of duties, and tell specific things Ownco, Inc. can do to improve its segregation of duties given the limitations of a small company.
Hand in “Ideal” Ownco documentation through an attached file in the online course management system. Name the file starting with an “I” then your last name and your first initial. Be sure to also hand in your segregation of duties write-up in a Word file.
The spreadsheet is patterned after an internal control documentation approach and software called INFOCUS developed by Grant Thornton LLP.
ASSURANCE OF LEARNING
Over two semesters, forty-eight students at a western university completed the case and a pre/post test. A pretest and posttest was implemented to measure whether the assignment contributes to students' learning about internal control principles and application of those principles. The pretest and posttest included ten multiple-choice questions, with questions differing between the two tests but covering the same topics. The quizzes also included a matching question in which students matched five scenarios to control risk ranking of each of the five scenarios. The pretest used sales stream scenarios while the posttest used cash receipts stream scenarios. The different questions for the pretest and posttest were given to avoid possible “testing practice effects” (U.S. Department of Education 2006). The students significantly increased their ability to evaluate internal controls. Their average score increased from 44% to 62% (p-value < .001). These results suggest that the students learned more about internal control evaluation by completing the case.
Contributor Notes
A teaching note and electronic files are available for use with this case. If you are a member of the AIS Educator Association, please go to http://www.aiseducators.com and follow the links for the AIS Educator Journal. If you are not a member of the Association, please contact the lead author directly at the address provided above to obtain these materials. Please provide a means for verifying your credentials as a faculty member so that we may protect the integrity of the solutions materials.