1. How hasyour knowledge of the world of auditing and your impression of auditors changed since you enrolled in this course?

2. An accountant in the Bursar's Office of SJSU was disturbed by the changes made by management as a result of a recent internal audit. The changes were never fully explained to the accountant. Changes included the following items:

•New responsibilities were assigned to the accountant regarding the quarterly accrual of investment income.
•The accountant is now required to prepare monthly reconciliations of cash receipts and disbursements.
•The accountant will no longer have access to the security vault, the petty cash fund and the incoming mail.
•The accountant's work will be periodically review by department director.

The accountant has expressed dissatisfaction with these changes to his supervisor because they represent a constraint and dilution of job responsibilities and an indication of a lack of trust. Currently, the recommendations have not been fully implemented.

You have recently been placed in charge of the university's operational auditing department. Please discuss how you would follow-up with the Bursar's Office and this accountant to get these recommendations fully implemented.

3. San Jose Municipal Utility District Case.

The Situation

The following scenario describes the landscaping operations of the fictitious San

Jose Municipal Utility District, SJ-MUD.

I. Selection of the Business Process for Review:

The San Jose Municipal Utility District provides water for this Northern California city of one million residents. It takes great pride in its operating efficiency and its image within the community. Last year, SJ-MUD won an award from the city for its beautiful grounds. The District's directors would like to make it a two-peat.

Recently, the vice president of operations noted that the sprinklers at the headquarters building had been running when he arrived at work at
7:30 am, when he left for lunch, when he returned from lunch, and when he left to go home at 6:00 pm. He was concerned about water usage and the attentiveness of the landscaping staff.He contacted the internal audit staff and the Director of Auditing agreed to begin an exam immediately.

II. Audit Preparation:

A. Tentative audit objectives.

Determine whether more water is being used this year, on the average, per day, than last year when the company won its first award.

B. Tentative scope of the audit.

1. Sprinklers at all offices and branches throughout the city.
2. Time cards for the lawn maintenance crew.
3. Monthly water bills from November of last year through August of this year.

C. Audit team.

The Director of Auditing assigned one of his two audit managers as a one-man team for the audit. The audit manager's expertise lay in computerized accounting systems. The director's reasoning was that the sprinkler system is computerized.

D. Risk considerations

Risk considerations were not discussed for this review.

III. Preliminary survey and Analysis of Internal Controls:

The assigned audit manager went out on the grounds and spoke with one of the groundskeepers, who said the way the sprinkling was scheduled was crazy. He said he couldn't possibly get all the mowing done because the sprinklers were started and stopped at odd hours throughout the day and night. The audit manager examined the time cards and found that the groundskeeper was a part-time employee who worked four days per week from 7am to noon. The audit manager also discovered that the water bills for four of the months this year were approximately five percent greater, on the average, than for last year. He determined from this preliminary information that the controls over the sprinkler system were inadequate.

IV. Expanded Tests:

The audit manager concluded that he had enough information from the preliminary survey and the analysis of controls to make the necessary recommendations. He did not perform any additional work.

V. Reporting:

The audit manager issued the following report and sent it to the vice president and to the chief groundskeeper for the company.

"After a thorough investigation of the company's sprinkler system, the internal auditing department recommends that all company lawn sprinklers be regulated to run during the summer months from 4:30 am to 6:30 am daily and from 7:30 pm to 8:30 pm every other day.

"This plan will reduce the number of hours of sprinkler service by 10 percent, still provide daily watering, and allow proper lawn care and maintenance by grounds crews.

"We recommend that these changes be documented in writing and posted on the maintenance shop doors immediately."

The report was signed by the audit manager.

VI. Follow-up:

The following week the audit manager sent a new junior staff auditor to the maintenance shop to check to see that the new policies had been posted on the door. They had been posted, and the audit manager sent a memo to the vice president saying that the lawn sprinkler problem had been resolved.

VII. Evaluations:

No evaluations were performed.

Required: Critically evaluate the quality of this review in terms of each of the nine-steps in the traditional audit process.

4. As Steve delves into each of his auditors' work to determine the sources of some errors that have come to his attention, he discovers that Paul, one of his brightest young staff auditors, has made some mistakes in his audit working papers. He calls him into his office to confront him, hoping not only to "take him down a peg or two," but also to put him up as an object lesson for the other auditors, whom he thinks are getting too careless in their work.

As Steve begins his talk with Paul, he wastes no time in coming to the point. "I've been going over your work, and it looks like you've made some mistakes." Paul is take aback, embarrassed, and incredulous, since he considers himself one of the best auditors in the department. Steve then accuses him of taking shortcuts in his work and being generally irresponsible and careless.

As Paul protests, Steve confronts him further with the audit test results reported in the papers and tells him, "You ought to know better than this! I won't stand for work like this going out of here. You just see that it doesn't happen again, you hear?"

After Paul apologizes begrudgingly, still not understanding how the mistakes could have happened, Steve simply says, "Okay. Now get back to work. Remember our reporting deadline on Thursday."

Required: Analyze this communications encounter. How would you diffuse the situation and get Steve and Paul back on the same page?

5. Value-Added Auditor Case.

Joanne was happy to receive a call from Robert. She was starting to think that in her new role as internal audit manager for a midsize manufacturing company, building a relationship with the chief information officer (CIO) was going to be difficult. Her invitations to meet were always turned down because Robert was fire-fighting in his enterprise resource planning (ERP) projects, and he had told her that he did not go out for lunch, either.

But now he was calling, and maybe she could explain her value-added approach to internal auditing. She knew that leading-edge audit departments were working closely with information technology (IT) groups at their companies, helping manage risk and build controls into new systems before they were rolled out. She had also been preaching to her staff, whether financial/operational or IT, that they should always be looking for opportunities to add value to their clients' operations.

However, Robert quickly burst her balloon. After a brief, cordial greeting, he let out his anger. "Joanne, you need to keep your auditors under control! They are actively sabotaging my projects and the relationships with my users. Instead of sticking to auditing, they are writing code and telling users to use their reports instead of the ones from the ERP system we are installing. Surely, you don't condone this. Isn't it a control weakness if users rely on homegrown reports and code instead of the reliable, vendor-supported standard reports in the ERP package?"

Joanne tried valiantly to respond: "Robert, which project are you talking about? Maybe the auditor is just trying to help." The CIO responded abruptly that he was referring to the ERP implementation in the Scotland plant. Joanne knew that Andy, her senior IT auditor, was in Scotland performing a pre-implementation controls review on that system. The go-live date was coming up in about a month and, in his last status report, Andy had explained that he was working with the local project team reviewing controls and test plans.

"Robert, if what you say is true-and I have no reason to doubt you-I will talk to Andy. The only explanation I can think of is that he saw an opportunity to use his skill with the ERP report writer to provide some value-added service to the local users."

This response only inflamed Robert's anger. "What is this obsession with ‘value-add' from internal auditors? Your predecessor was always trying to do my job for me, as well. You know, I checked your charter and it says you can't do this." Robert quoted from the charter: "‘The chief audit executive and staff of the internal audit department are not authorized to (a) perform any operational duties for the organization or its affiliates or (b) direct the activities of any organization employee not employed by the internal audit department.'

"Your employee is out of control and operating outside his charter, and I expect you to stop him," Robert demanded before hanging up the phone.

Joanne caught her breath and then called Andy. Thirty minutes later, she had the real story: Andy had found a control weakness in the ERP system-there was no report that showed changes to sales price data. He and the users had talked to the IT department about this finding and were told that it would have to be put on the list for the next release of the software in six months. Rather than adopting the traditional audit role and simply "writing it up," Andy had spent 25 minutes developing a report using the ERP software's report writer. He was proud of his initiative and the response from the users. They were grateful for his help and were planning to write Joanne a letter of appreciation.

Required: What is the best way for Joanne to approach this situation? Consider the Internal Audit Department, Andy, Robert and Joanne, herself, in your answer. Note the issues we discussed with respect to a consulting engagement.