Question

The following questions and cases deal with the subject of cost-benefit analysis of internal control. Some important concepts in cost-benefit analysis are as follows:

1. Measurable benefit. Benefits or cost savings may be measured directly or may be based on estimates of expected value. An expected loss is an estimate of the amount of a probable loss multiplied by the frequency or probability of the loss-causing event.

A measurable benefit can arise from the reduction of an expected loss.

2. Qualitative benefit. Some gains or cost savings may not be measurable, such as company public image, reputation for regulatory compliance, customer satisfaction, and employee morale.

3. Measurable costs. Controls may have direct costs such as wages and equipment expenses.

4. Qualitative cost factors. Some costs may be indirect, such as lower employee morale created by over-controlled work restrictions.

5. Marginal analysis. Each successive control feature may have marginal cost and benefit effects on the control problem.

 

Case A

Porterhouse Company has numerous bank accounts. Why might management hesitate to spend $20,000 (half of a clerical salary) to assign someone the responsibility of reconciling each account every month for the purpose of catching the banks’ accounting errors? Do other good reasons exist to justify spending $20,000 each year to reconcile bank accounts monthly?

 

Case B

Harper Hoe Company keeps a large inventory of hardware products in a warehouse. Last year, $500,000 was lost to thieves who broke in through windows and doors. Josh Harper figures that installing steel doors with special locks and burglar bars on the windows at a cost of $25,000 would eliminate 90% of the loss. Hiring armed guards to patrol the building 16 hours a day at a current annual cost of $75,000 would eliminate all the loss, according to officials of the Holmes Security Agency. Should Josh arrange for one, both, or neither of the control measures?

 

Case C

The Merry Mound Cafeteria formerly collected from each customer as he or she reached the end of the food line. A cashier, seated at a cash register, rang up the amount (displayed on a digital screen) and collected money. Management changed the system, and now a clerk at the end of the line operates a calculator/printer machine and gives each customer a paper tape. The machine accumulates a running total internally. The customer presents the tape at the cash register on the way out and pays.

The cafeteria manager justified the direct cost of $30,000 annually for the additional salary and $500 for the new machine by pointing out that he could serve four more people each weekday (Monday through Friday) and 10 more people on Saturday and Sunday. The food line now moves faster and customers are more satisfied. (The average meal tab is $12, and total costs of food and service are considered fixed.) “Besides,” he said, “my internal control is better.” Evaluate the manager’s assertions.

 

Case D

Assume, in the Merry Mound situation cited above, that the better control of separating cash custody from the end-of-food-line recording function was not cost beneficial, even after taking all measurable benefits into consideration. As an auditor, you believe the cash collection system deficiency is a significant deficiency in internal control, and you have written it as such in your letter concerning reportable conditions, which you delivered to Merry Mound’s central administration. The local manager insists on inserting his own opinion on the cost-benefit analysis in the preface to the document that contains your report. Should you, in your report, express any opinion or evaluation on the manager’s statement?

Answer 1

a.

Porterhouse management may hesitate because its expected loss from bank accounting errors may be less than $10,000, or the expected benefit (reduction of the expected loss) by $10,000 or more might be in doubt. Bank accounting is generally very accurate and further analysis might confirm management's hesitation.

 

b.

Josh Harper should install the steel doors and burglar bars but not hire the armed guards.

 

Cost-Benefit of Doors and Bars

Benefit $500,000 loss x 90% elimination                                             $450,000

Qualitative benefit--The company is no longer a

                  "push-over target" for thieves                                             Unknown

Direct cost                                                                                                 ($25,000)

Direct cost-subsequent maintenance                                                          small

Qualitative costs                                                                                   none (?)

Net benefit estimated                                                                             $425,000

Cost-Benefit of Armed Guards

Benefit                                                                                                       $500,000

Qualitative benefit--no longer a "push-over

 Target" for thieves                                                                                   Unknown

Direct cost                                                                                                     (75,000)

Direct cost--subsequent inflation                                          some expected

Qualitative cost--possibility of someone

                 Being killed or wounded in robbery attempt;

Social and insurance costs                                                        remote, but high

Net benefit estimated                                                                              $425,000

 

Marginal Analysis (Measurable Information)

1.

If armed guards are hired, no more loss reductions (benefit) is available to justify the additional $75,000 direct cost.

 

2.

                                                Doors and      Guards

                                                 Bars Only       Only                Both                Neither

Loss expected without

Control                            500,000           500,000           500,000          500,000

Remaining expected loss

With control                             50,000              -0-             -0-500,000

Benefit (expected loss

Reduction)                              450,000           500,000           500,000               -0-

Cost of control                          25,000             75,000           100,000              -0-

Net benefit                              425,000           425,000           400,000               -0-

 

The armed guards control has two adverse factors not expected with the doors/bars control:

(1) Inflation in guard costs will probably outpace the doors/bars maintenance costs and

(2) The possibility of a shooting incident on company property is not very appealing.

 

 

c.

Both of the manager's assertions are justifiable.

1.

Cost-Benefit of the New Arrangement

Benefits

4 meals @ $6 x 260 days                                                                6,240

10 meals @ $6 x 104 days                                                              6,240

Customer satisfaction                                                                         some

Possible reduction of exposure to theft loss to

Collecting cashier at end of food line (former arrangement)   *12,480

 

• The control is cost-beneficial without considering whether theft of cash had occurred.

Costs

New salary, annual                                                                                  10,000

New adding machine, 5-year life                                                                500

Employee dissatisfaction                                                       none expected

 

TOTAL COST                                                                                              10,500

Net benefit, first year                                                                             1,980

Net benefit, succeeding years                                                                   2,480**

**        Assuming inflation in food prices tends to offset future salary increases.

 

2.         The control is better because

(i)         The recording duty and cash custody are separate. Running the cash register amounts to authorizing and recording transactions for all practical purposes, and under the former arrangement this person also handled the cash. The cashier could have failed to ring up a sale and just pocketed the money.

(ii)        The manager can compare the internal adding machine cumulative total to the cash register total for correspondence of amounts. A theft would require collusion of both persons.

 

d.

CAS 256, paragraph 10 is relevant to this situation. It states:

“10. The auditor shall also communicate to management at an appropriate level of responsibility on a timely basis:

(a)     In writing, significant deficiencies in internal control that the auditor has communicated or intends to communicate to those charged with governance, unless it would be inappropriate to communicate directly to management in the circumstances; and

(b)      Other deficiencies in internal control identified during the audit that have not been communicated to management by other parties and that, in the auditor's professional judgment, are of sufficient importance to merit management's attention.

 

            Paragraph A2 is also useful in this case:

A2.  In discussing the facts and circumstances of the auditor's findings with management, the auditor may obtain other relevant information for further consideration, such as:

• Management understands of the actual or suspected causes of the deficiencies.

• Exceptions arising from the deficiencies that management may have noted, for example, misstatements that were not prevented by the relevant information technology (IT) controls.

• A preliminary indication from management of its response to the findings. “

 

Assuming that you communicated this control deficiency to the local manager prior to including it in your report to the ‘central administration’ (i.e., a level of management above the local manager in this case), his views on it might have been incorporated in your communication. However, since you have concluded that the control deficiency is significant despite the manager’s views on it, clearly you do not agree with the manager’s position. You could give advice to the manager about your analysis and conclusion. Still, the manager is the one responsible for risk analysis and cost-benefit decisions. You are responsible for conducting an audit that meets the requirements of the CAS that are relevant to the audit.

 

It is not appropriate for the manager to include any statement in your communication. If the manager wishes to add a statement to a report that the central administration will prepare, for example a control report to be forwarded to a higher level of governance in which they copy your communication, you would not express any opinion on management's statement. This is an internal matter that is beyond the scope of your engagement. If asked to provide response to the manager’s statement, you would disclaim any opinion about the statement because it is beyond the scope of your work to opine on such matters. This response assumes you have been engaged just to audit the financial statements, not to report on the effectiveness of internal control.

 There may be other considerations in an engagement to specifically provide an audit opinion on control effectiveness.