Risks, Controls, and Audit Tests

Your CPA firm has been contracted by the state to serve as the internal audit function for The Commission on Workforce Development. The Commission was established several years ago by the state legislature to "increase the job skills of individuals receiving public assistance and help them to obtain employment so as to be able to support themselves and their dependents." To accomplish this objective, the Commission enters into contracts with private sector contractors to train individuals in computer data entry, local area network administration, cable and telecommunications installation, auto mechanics, and other fields where there is an acknowledged need for employees.

The program works as follows:

The Commission staff identifies individuals eligible for enrollment in the program through referrals from case workers in local county and city welfare departments. The Commission staff then determines whether the individuals need both general skills and specific skills and assigns them to entities with which the state has contracted for training services. The Commission also determines the specific fields in which training will be provided through periodic assessments of employer needs across the state. For purposes of this assessment, the state is divided into five regions. Training offerings are set for each region based on surveys of employers' current and expected needs.

Contractors are responsible for (a) providing individuals with the general work skills, if needed (literacy, basic math, etc.) and (b) providing all individuals with specific work skills (training in auto mechanics, typing, network administration, etc.). Contractors are also responsible for helping all trained individuals to obtain employment.

Your firm uses a business process approach to internal auditing.

A. Identify four key activities/processes involved in the operations of the Commission (there are more than four). Prioritize them in terms of significance to the board's operations (1 = most significant, 4 = least significant).

B. For the activity/process you ranked the most significant, identify and evaluate three risks. For each risk, identify a control that would help mitigate the risk.