QUESTION

You are a team member engaged on the external audit of Client Ltd, a manufacturer and supplier of specialised equipment. You are completing interim audit work at the company for the financial year ending 30 April 2007.

Information about the business

Client Ltd maintains a substantial inventory of the component parts which it uses for product assembly. Some of these components have significant value. The products are assembled on a just-in-time basis. Component inventory is kept in a secure centralised warehouse and is distributed to manufacturing facilities to meet production requirements as and when customer orders are received. You are satisfied that there are sound physical security measures in place to prevent unauthorised personnel and vehicles from gaining access to the warehouse. Management has established policies and procedures for storing and handling of inventory, which have been communicated to warehouse employees.

The purchasing, goods receiving, inventory custody, sales and accounting functions of Client Ltd are segregated.

Client Ltd has outsourced its distribution services to a third party supplier, Distribution Ltd. This includes the shipping of component inventory from the warehouse to the manufacturing facilities. The requirements for service delivery are specified in a written service level agreement which covers responsibilities, price and insurance.

Planned audit approach for inventories

Consistent with prior years, the management of Client Ltd has indicated that due to the strong internal controls over inventory, a full year-end inventory count will not be conducted. Accordingly, the audit approach planned for gathering audit evidence about the existence, completeness and valuation of inventory is primarily test of control based, using the same audit programmes as in prior years.

Description of internal controls for inventories

Client Ltd makes use of a batch input batch update inventory management system and all data capturing from source documents takes place in the computer centre. You are satisfied that the staff involved in the receiving, custody and delivery of inventory are competent, adequately supervised and provide evidence that they have followed control procedures (e.g. signing of documentation as evidence of their work).

The management of Client Ltd has confirmed that the following key controls are in place over the inventory receiving, custody and delivery functions at the warehouse, and that these have not changed since the prior year.

Goods receiving area (receipt of components from suppliers into the warehouse)

1 Copies of purchase orders are filed in delivery date order, which ensures that receiving department personnel are made aware of all expected deliveries.

2 Staff in the receiving department prepare goods received notes on which they record the supplier, date received and the actual quantity and condition of each item received.

3 Goods received notes are matched (specification and quantity) to purchase orders by the staff in the receiving department. Differences identified between goods received and goods ordered are reported to the purchasing department and management.
Inventory custody area (storage of components in the warehouse)

4 Inventory is subject to periodic physical counts and resultant adjustments (quantities and amounts) are reviewed and approved by an appropriate official. These inventory counts are undertaken in a systematic manner, using prenumbered count sheets which are completed in ink and signed by the counter on completion.

Despatch area (despatch of components from the warehouse to the manufacturing facility)

5 Customer order documents are prenumbered and missing documents are investigated on a timely basis.

6 The specification and quantity of components transferred to the despatch area are compared with an authorised customer order and related delivery documents prior to loading.

7 Delivery documents (including bills of lading) are signed by the delivery personnel of Distribution Ltd to confirm acceptance of quantities shipped to production.

Maintenance of standing data

8 Changes made to inventory master files are approved, prior to input, by an appropriate official. Preprinted sequence numbers are used on standing data input forms and checks are performed to ensure that all numbers are accounted for.

Fraud

The internal audit function of Client Ltd recently conducted a surprise visit to the warehouse to perform audit testing. Their work included compliance testing of documented internal controls and the performance of cyclical physical inventory verification procedures. The performance of these procedures led to the detection of a significant discrepancy between the physical inventory of certain small high-value components and the inventory records. The value of the missing inventory represents a potential material loss to Client Ltd.

The internal audit function is currently investigating the discrepancy as an instance of fraud by warehouse staff.

Draft report on Information Technology (IT) general controls

The following is an extract from the draft report prepared by your firm's computer audit specialists following their review and testing of IT general controls of Client Ltd. The extract summarises weaknesses identified during the review.

Description of weakness
Recommendation
Management comment

Question 1:

During our inspection of signed authorisation forms supporting a sample of transfers of program changes from development into production (drawn from the log of program changes), we could not locate five such forms. These forms relate to program changes implemented during the year on the salaries and wages system.

Written authorisations should be maintained on file for all transfers of program code from development into production.

There is a documented process requiring written authorisation for the implementation of all program changes. These forms have obviously been misfiled and we will endeavour to locate these for audit inspection.

Question 2:

The log of changes to access rights on all application systems is deleted after six weeks. No back up is maintained for future reference.
A back-up copy of the log of changes to access rights should be maintained in accordance with the standard document retention policies of the company.

This log is deleted on a rolling basis once entries are six weeks old in order to free up server capacity. Hardcopy user requests for access changes are maintained on file and are available for inspection.

Question 3

Some of the personnel manning the IT support help desk do not have adequate formal qualifications or experience to be effective in their role. The purpose of the desk is to support users in resolving queries about key applications.

Personnel manning the help desk should undergo additional training in new applications.

Recruitment of appropriate support personnel is the responsibility of human resources. We will reassess the competency requirements and determine whether further training is necessary.

REQUIRED

(a) Identify and state the internal controls listed above which address the existence of inventory. For each such control, describe the control objective (i.e. how the control supports the existence assertion) and additional information (if any) you would require from Client Ltd management to enable you to assess whether the control has been appropriately designed to prevent or detect and correct misstatements relating to the existence of inventory.
• You should present your answer in the form of a table.
• Ignore the possible effect of the weaknesses in the IT general controls identified in the draft report.

(b) Discuss the impact of the findings of the internal auditors on your planned audit approach for inventories.

(c) Describe the audit risks arising from the control weaknesses identified by your computer audit specialists during the interim audit and state the appropriate audit response to each risk.

• You are not required to formulate audit procedures.

(d) Identify the business risks inherent in the outsourcing arrangement with Distribution Ltd and describe how you would expect these risks to have been addressed in the service level agreement.

• You should not address contract price and insurance in your answer.

(e) Discuss the nature of any modifications required to the standard unqualified audit report which will enable the drafting of the audit report on the 2007 annual financial statements of Client Ltd, assuming that the internal audit investigations have identified the possibility of fraudulent misstatement of inventory balances and that the audit team has been unable to satisfy itself regarding the existence of the inventory balance.

• Ignore the impact of a possible reportable irregularity in your answer.