Question

Audit Observation and Recommendation:

Corporation X associates are required to abide by the organization’s formal Code of Business Conduct & Ethics (the Code). To ensure all employees are aware of the Code and their obligations under it, Corporation X requires all associates to acknowledge receipt of the Code. A global email was sent to all associates on July 1 informing them of their obligation to read and acknowledge the Code. Associates were instructed to complete and return acknowledgments by December 1. Our audit testing indicated the following relative to the acknowledgment process:

-As of March 1, fewer than 50 percent of associates had completed and returned acknowledgments.

-Follow-up procedures have not been performed by human resources (HR) or department management to date.

-There is not a formal policy indicating actions to be taken if and when associates do not return acknowledgments.

-No disciplinary actions have been taken regarding associates who have not completed acknowledgments of the Code to date.

Improving the acknowledgment process will help Corporation X demonstrate compliance with external regulations requiring a Code of Ethics. It will also help to ensure all associates are aware of their responsibilities and obligations to the organization under the Code. We recommend management enhance the acknowledgement tracking process to ensure all associates acknowledge receipt of, compliance with, and understanding of the Code. Policy and procedures need to be developed and implemented to take appropriate action when associates do not respond. Disciplinary action should be taken if associates refuse to complete and return acknowledgments, as required by policy.

Management Response:

Associates who have not acknowledged the Code as of March 24 will be sent a reminder notification the week of April 3 informing them of the requirement to acknowledge the Code. A report of all associates who continue to be delinquent in acknowledging the Code will be provided to the applicable HR liaison for review and follow-up the week of April 17. The HR function will partner with the department business heads of delinquent associates to obtain the necessary acknowledgments. A final report will be generated the week of April 24 to determine the remaining associates who have not acknowledged the Code. A verbal warning will be issued to all associates who have not acknowledged the Code by April 24 and a written warning will be provided to associates who have not acknowledged the Code by April 30.

Accountability: Jane Doe

Responsibility: John Smith

Implementation Date: March 24

1. What attributes are adequately addressed by the observation as presented? Please list the portion of the observation that you feel adequately addresses each observation attribute.

2. Do you feel the observation, as presented, adequately addresses all the suggested observation attributes? Why or why not?

3. What might you suggest to improve the observation?

Answer 1

The specific information in the engagement observation that represents the internal auditors recommendation and their observation criteria, condition, cause, and effect are as follows:

a.Recommendation:recommend management enhance the acknowledgement tracking process to ensure all associates acknowledge receipt of, compliance with, and understanding of the Code of Business Conduct & Ethics. Policy and procedures need to be developed and implemented to take appropriate action when associates do not respond. Disciplinary action should be taken if associates refuse to complete and return acknowledgements, as required by policy.

b.Criteria: Corporation X associates are required to abide by the organization’s formal Code of Business Conduct & Ethics . To ensure all associates are aware of the Code and their obligations under it, Corporation X requires all associates to acknowledge receipt of the Code. The criterion to comply with external regulations requiring a Code of Ethics is implicitly referred to in the stated effect.

c.Condition: A global e-mail was sent to all associates on July 1st informing them of their obligation to read and acknowledge the Code. Associates were instructed to complete and return acknowledgements by December 1st. Our audit testing indicated the following relative to the acknowledgement process: (1) as of March 1st, less than 50% of associates had completed and returned acknowledgements, (2) follow up procedures have not been performed by HR or department management to date, (3) there is not a formal policy indicating actions to be taken if and when associates do not return acknowledgements, and (4) no disciplinary actions have been taken regarding associates who have not completed acknowledgement of the Code to date.

Cause: The cause is not stated in the observation.

Effect: Improving the acknowledgement process will help Corporation X demonstrate compliance with external regulations requiring a Code of Ethics. It will also help to ensure all associates are aware of their responsibilities and obligations to the organization under the Code.

The observation, as presented, does not adequately address all the suggested attributes for the following reasons:
•the stated criteria does not explicitly refer to compliance with external regulations that require Corporation X to have a Code of Ethics.
•The cause is not stated in the observation. If the internal auditors were able to determine the cause of the observed condition, it should be stated. If the internal auditors were not able to determine the cause, the fact that they were unable to do so should be stated.
•Although the effect, as stated, captures the essence of the risk or exposure encountered because the condition is not consistent with the criteria, it is not expressed in this manner. The effect would more directly state the potential consequences of the observation if it was worded as follows – Corporation X may not be in compliance with external regulations requiring a Code of Ethics. In addition, associates may not be aware of, and therefore not meet, their responsibilities and obligations to the organization under the Code.

Expand wherever you feel like