Assignment

CASE: Sarbox Scooter, Inc.

Scoping and Evaluation Judgments in the Audit of Internal Control over Financial Reporting by MARK S. BEASLEY, FRANK A. BUCKLESS, STEVEN M. GLOVER and DOUGLAS F. PRAWITT.

LEARNING OBJECTIVES

After completing and discussing this case you should be able to

[1] Understand the complexities of auditing internal control over financial reporting in an integrated audit required by PCAOB Auditing Standard No. 5

[2] Identify significant accounts for an integrated audit

[3] Identify significant locations or business units for an integrated audit

[4] Apply an evaluation methodology to determine the likelihood and magnitude of control deficiencies

[5] Appreciate the judgment needed to evaluate control deficiencies

INTRODUCTION

Section 404 of the Sarbanes-Oxley Act of 2002 requires public companies to report on the effectiveness of their internal control over financial reporting. Section 404 also requires companies to hire an auditor to perform an "integrated audit" involving both a traditional financial statement audit and an audit of internal control over financial reporting. PCAOB Audit Standard No. 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements (AS5), provides guidance for the audit of internal control and requires the auditor to obtain sufficient competent1 evidence about the effectiveness of controls for all relevant assertions related to all significant accounts in the financial statements. Before an auditor can identify which controls to test, some important audit decisions need to be made. Some of these decisions are listed below.

- Identify Significant Accounts. Significance is determined by applying quantitative and qualitative measures of materiality to the consolidated financial statements.

- Identify Relevant Financial Statement Assertions. For each significant account, relevant assertions are identified by considering the assertions that have a meaningful bearing on whether the account is fairly stated. Relevant assertions are those assertions (one or more) related to significant accounts that, if inaccurate, present a reasonable possibility of containing a misstatement or misstatements that would cause the financial statements to be materially misstated.

- Identify Significant Processes and Major Classes of Transactions. The auditor must understand relevant processing procedures involved in the flow of transactions for significant accounts. The controls auditors will test reside within the significant transaction processes (e.g., sales and collection cycle, period-end financial reporting process).

REQUIRED - PART A

[1] According to AS5:

[a] What should the auditor consider when determining whether an account should be considered significant?
[b] What qualitative factors might cause an account that is otherwise relatively small quantitatively to be considered significant?
[c] What qualitative factors might cause an account that is greater than materiality to be considered not significant?

[2] Referring to Delmoss Watergrant's policy for identifying significant accounts (see Appendix A) as well as Sarbox Scooter's consolidated balance sheet and income statement, answer the following questions:

[a] Determine a planning materiality threshold to use to identify significant accounts for Sarbox Scooter. Please show your work and justify judgments.

[b] At a consolidated financial statement level, are there accounts on Sarbox Scooter's financial statements that are greater than planning materiality that should not be considered significant? Please justify your response.

[c] Identify two accounts, at the consolidated level, that are not quantitatively significant, but that should be deemed significant due to qualitative factors. Provide the qualitative factors you considered.

[d] Which Sarbox Scooter business units (geographic locations), if any, would not be considered quantitatively significant? Which business units (locations) have specific risks that would render the unit significant regardless of its quantitative size?

[e] If you had to eliminate or scope out one entire business unit (geographic location), which unit would it be? Please justify your response and include both quantitative and qualitative reasons for doing so.

[3] Auditing standards require the identification and testing of entity-level controls. What are examples of entity-level controls? What are the auditor's responsibilities with respect to evaluating and testing a client's period-end financial reporting process?

REQUIRED - PART B (CAN BE COMPLETED INDEPENDENTLY OF PART A)

[1] What are the definitions of a control deficiency, significant deficiency, and material weakness as contained in AS5? Which, if any, of these deficiency categories must the external auditor include in the audit report?

[2] Referring to Delmoss Watergrant's policy for evaluating control deficiencies (see Appendix B), determine if the following three deficiencies represent a control deficiency, a significant deficiency, or a material weakness. Please consider each case separately and justify your answers.

[a] Sarbox's revenue recognition policy requires that all non routine sales (i.e. sales to clients other than dealerships) receive authorization from management in order to verify proper pricing and terms of sale. However, after examining a sample of non routine sales records you find that this control is not closely adhered to and that sales representatives offered discounts or altered sales terms that were not properly recorded in Sarbox's records. As a result, in instances when the control is not followed the recorded sales prices tend to be too high and/or terms are not correctly reflected in the sales invoice and the customers complain. In some situations, customers have cancelled orders due to the over-billing or changed sales terms. Non routine sales represent about 10% of Sarbox's sales revenue. From your sample testing of the authorization control, you find that the control doesn't operate 4% of the time, with an upper bound of 9% (i.e., based on your sample, you can be 95% confident that the exception rate does not exceed 9%).

[b] While examining Sarbox's period-end financial reporting process, you discover that revenue has been recognized on orders that were received and completed, but not yet shipped to the customer. No specific goods were set aside for these orders; however, there is sufficient inventory on hand to fill them. Also, you observe that some orders were shipped before being recorded as sales, so that your best estimate of total revenue cutoff error at year-end was approximately $2.3 million.

[c] Sarbox Scooter requires that all credit sales to new customers or to customers with a current balance over their pre-approved credit limit be approved by the credit manager prior to shipment. However, during peak seasons this policy is not strictly followed in order to accommodate the need of both the company and its customers to have orders processed rapidly. Because of these findings, you estimate that the allowance for doubtful accounts is materially understated. While the client does not dispute that the authorization control was not operating effectively during peak seasons, the client has pointed out compensating controls that it feels should reduce the magnitude of the deficiency below a material weakness. The first compensating control is that an accounts receivable aging schedule is reviewed each quarter by management and accounts that are older than 180 days are written-off. Also, management distributes a list of companies that default or fail to pay on time to all sales staff on a monthly basis to prohibit such companies from making additional purchases on credit.

PROFESSIONAL JUDGMENT QUESTION

It is recommended that you read the Professional Judgment Introduction found at the beginning of this book prior to responding to the following question.

[3] How might the overconfidence tendency affect management's assessment of the likelihood and magnitude of potential misstatement from an observed control deficiency? If the auditor believes that management's assessment is biased by overconfidence, how might the auditor help management recalibrate their assessment?