Internal Control Deficiencies and Their Effect on the Audit Approach
During the audit of 'Armenia Manufacturing' CJSC, you identify the following internal control deficiencies: (1) The same employee has custody of inventory and maintains the inventory records. (2) There is no segregation of duties between purchasing and accounts payable. (3) The company's IT system has no password controls; all employees have access to all modules. (4) The month-end close process is not documented and reconciliations are not reviewed. The company has a small accounting department of 4 people. The auditor plans to rely on internal controls to reduce substantive testing. The company's revenue is 2 billion AMD, and materiality is set at 40 million AMD. The auditor has not yet performed tests of controls.
1. Assess the significance of each deficiency and determine whether the auditor can rely on internal controls. What is the impact on the audit strategy?
Read the worked answer
Deficiency assessment: (1) Custody and record-keeping by same employee: a significant deficiency because it allows theft and manipulation of inventory records; no segregation of duties. (2) No segregation between purchasing and accounts payable: significant deficiency, increases risk of unauthorized purchases and fraudulent payments. (3) No IT password controls: significant deficiency, as all employees can access all modules, leading to unauthorized changes and data integrity issues. (4) Undocumented close process and no review of reconciliations: significant deficiency, increases risk of errors in financial reporting. Given the small department, some segregation may be impractical, but compensating controls (e.g., management review) are not evident. The auditor cannot rely on internal controls because the deficiencies are pervasive and no tests of controls have been performed. The audit strategy should be substantive: increase the extent of substantive testing, especially for inventory, purchases, and IT-dependent data. The auditor should communicate the deficiencies in writing to those charged with governance (as required by ISA 265) and consider the impact on the audit opinion if uncorrected. The auditor may also need to involve an IT specialist.
2. Describe the substantive procedures you would perform to address the risks arising from these deficiencies, focusing on inventory and purchases.
Read the worked answer
For inventory: (1) Observe the physical inventory count and perform test counts, especially for high-value items. (2) Obtain confirmations from third parties for inventory held by others. (3) Test the valuation of inventory by comparing cost to net realizable value. (4) Review inventory movements and investigate unusual fluctuations. (5) Perform analytical procedures on inventory turnover and gross margin. For purchases: (1) Test a sample of purchase transactions from initiation to payment, verifying authorization, receiving reports, and matching to invoices. (2) Perform cut-off tests to ensure purchases are recorded in the correct period. (3) Confirm balances with major suppliers. (4) Review accounts payable for unrecorded liabilities by examining subsequent payments and receiving reports. (5) Test IT general controls over the purchasing system, such as access controls, even if not relying on them, to assess the risk of fraud. Given the lack of segregation, the auditor should increase the sample size and consider using data analytics to identify anomalies. The auditor should also assess the risk of management override and fraud.