Question

ABC Retailers Inc. (ABC or the “Company”) is a U.S. public company that files quarterly and annual reports with the Securities and Exchange Commission (SEC) with a fiscal year end of August 31, 20X8. ABC is a leading retail chain operating more than 100 department stores across the continental United States. ABC department stores offer customers a variety of nationally advertised products, including clothing, shoes, jewelry, and other accessories. The Company’s supply chain of products is managed through a single warehouse and distribution facility located in Kansas City, Missouri. ABC has a centralized accounting and finance structure at its corporate headquarters, where all processes and controls related to all significant account balances occur. ABC recognizes revenues from retail sales at the point of sale to its customers. Discounts provided to customers by the Company at the point of sale, including discounts provided in connection with loyalty cards, are recognized as a reduction in sales as the products are sold. Cost of goods sold for the Company primarily consist of inbound freight and costs relating to purchasing and receiving, inspection, depreciation, warehousing, internal transfer, and other costs of distribution. Case Facts Audit Issue On June 1, 20X8, the Accounts Payable (AP) Manager received an e-mail inquiry about the process required for a vendor to change its bank account information. The e-mail was sent from John Smith at a domain address listed as “Watch-Makers.” Watch Makers is a manufacturer that supplies ABC-branded watches to ABC’s west region department stores. In addition, John Smith is the primary contact at Watch Makers with whom the Company typically interacts. The AP Manager responded to the e-mail request on June 15, 20X8, with the procedures required of the vendor, which include completing a vendor bank account request form. On June 20, 20X8, the AP Manager received a reply e-mail from John Smith at “WatchMakers” with a completed vendor bank account request form, which included John Smith’s signature, new bank account information, and other related information. Upon receiving the vendor bank account request form, the AP Manager completed a separately required Vendor Change Form for internal processing. The Vendor Change Form is completed for new vendors or changes to existing vendors’ information, including bank account information. The AP Manager sent the completed Vendor Change Form to ABC’s Assistant Controller, who reviewed and approved the request on June 24, 20X8. The bank account information was updated within the Vendor Master File on June 26, 20X8. Throughout the month of July 20X8, valid Watch Makers invoices were processed through the Company’s accounts payable process, and the valid invoices were paid in accordance with the Company’s process and controls for cash disbursements and wire Case 17-10: ABC Retailers – Internal Controls Page 2 Copyright 2020 Deloitte Development LLC All Rights Reserved. transfers. On August 2, 20X8, the Company received an inquiry from Watch Makers about the expected timing of the $2 million in outstanding invoices. As a result of the direct interaction with Watch Makers’ employee John Smith, the Company determined that the previous vendor bank account change form was received from a fraudulent domain name with the intent to defraud the Company. The e-mail domain for Watch Makers is “Watch Makers,” with no hyphen, rather than “Watch-Makers,” with a hyphen. Both e-mails received from “Watch-Makers” were determined to be from a fraudulent source (that also fraudulently used John Smith’s name in the e-mail). Because the bank account information for Watch Makers was changed (as a result of the June 1, 20X8, email request) approximately $2 million in payments was wired to an incorrect bank account. As noted above, there are two employees within the Company that were involved in processing and approving the Vendor Change Form. The Company’s policy on bank account change requests was put into effect and communicated by ABC’s Assistant Controller in a September 1, 20X7 e-mail that indicated that for each Vendor Change Form requesting a vendor bank account change, the accounts payable department was required to (1) obtain a previously processed and paid invoice from the vendor requesting the bank account change, (2) call the vendor using the contact information obtained from the prior invoice, (3) verify the authenticity of the requested bank account change request by directly contacting the vendor, and (4) include all relevant information obtained in steps (1) through (3) as an attachment to the Vendor Change Form. The Company’s control description relating to the review of a Vendor Change Form by the Assistant Controller is not explicit regarding the specific attributes of the review. However, because the policy was distributed by the Assistant Controller and the Assistant Controller is also the control owner (e.g., performs the review), there is a presumption that the Assistant Controller would understand that as part of her review, she should evaluate whether the AP Manager obtained sufficient information to confirm the authenticity of the bank account change request.

Would the deficiency warrant disclosure in the Company’s Form 10-K, Item 9A? If so, what information would the Company be expected to disclose?

What implications does the deficiency have on other direct or indirect controls?

Answer 1

1. As per the standards of auditing, the auditor has to identify and report the significant deficiencies detected during the audit of financial statements. In assessing the severity of deficiencies, the auditor should consider the following aspects:

• Likelihood of deficiencies leading to misstatements occurring in the future
• The susceptibility to loss or fraud of the related asset or liability
• The subjectivity and complexity of determining estimated amounts, such as fair value accounting estimates
• The financial statement amounts exposed to the deficiencies.
• The volume of activity that has occurred or could occur in the account balance or class of transactions exposed to the deficiency or deficiencies
• The importance of the controls to the financial reporting process
• The cause and frequency of the exceptions detected as a result of the deficiencies in the controls
• The interaction of the deficiency with other deficiencies in internal control

1. In the given situation, the company has implemented a control by framing a policy which provides for obtaining a previously raised invoice, verification of authenticity of request obtained, etc.

The aspects provided in the policy were not implemented adequately in changing the vendor details. Hence, the failure to review represents a deficiency in operating effectiveness of control.

1. The failure in the control relating to vendor request change form is material, considering the amount incorrectly paid to vendors due to change in bank accounts with false / non-authentic requests received.

Given that the amount of payments made to any single vendor in a payables cycle could approximate 2 million, assuming a cycle of 30 days. If we consider the same, the payments might come to 2*12 = 24 million on an average in the year, which is much higher than the materiality levels set (i.e. 8 million).

Also, the control has been operating effectively only for 5 vendors out of total changes to 105 vendors in the master, which implies that the control was implemented only for 4% of changes. Hence, the control deficiency is material.

1. The deficiency identified has to be reported in Form 10K, due to the materiality. Form 10 K is a declaration made by the management that all the internal controls are in place and implemented effectively.

As the same was not true, it has to be disclosed in the form.

1. The deficiency identified in the situation effects other controls in the following ways:

• Doubts about the functioning of other control of maker-checker / maker-approver control (The vendor changes made were approved by the Assistant Controller without verifying whether the AP manager has complied with the policy)
• Effects on controls related to payment confirmations – The company can obtain a receipt / intimation from the vendor that the amount has been received immediately after processing the payment for first invoice. This will help in early detection of incorrect bank account details.
• Effects on control of obtaining the previous invoice and other information to test authenticity: The deficiency detected (of incorrect payments due to incorrect bank details), is the direct effect of non-compliance with this aspect in the policy