Question

John Exchanging Integrated (JEI), is a subsidiary of Elegance. JEI is a securities trading firm specializing in debt and equity securities transactions mostly traded on the NASDAQ. JEI is listed on NASDAQ. Also, at the request of their customers, JEI will charge a fee to receive or place money transfers from or to accounts all over the world.   The minimum fee is $10 for buying or selling stock and $25 for money transfers. The maximum fee is $500,000 for stock transactions and 2% for money transfers. A minimum fee of $100 is also charged for redemptions. To become a customer, simply complete an on-line application and deposit a minimum of $10,000. Customers begin trading immediately.

Yong Wei is the CEO of JEI. Yong does not serve on the audit committee of JEI. In January of 2015, Crystal Lee, Director of JEI’s internal audit department, completed an audit of various functions of the company. Part of the audit involved a review of internal controls for the sales, payable and payroll functions including the controls over the authorization of transactions, accounting for transactions, and the protection of assets. The director reported the following issues to Yong Wei:

1. To facilitate working from home, an employee installed a modem on his office workstation. An attacker successfully penetrated the company’s system by dialing into that modem. Again, due to the diligent efforts of Tommy Lew, sensitive customer information was not compromised, according to internal sources.

2. An attacker gained access to the company’s internal network by installing a wireless access point in a wiring closet located next to the elevators on the fourth floor of a high-rise office building that the company shared with seven other companies.

3. A fictitious invoice was received and a check was issued to pay for small supplies that were never ordered or delivered.

4. On the job, Yong Wei got a call from the local police asking why she was sending a caller multiple adult text messages and sexually explicit emails per day. After further inveJEIgation, Yong’s account records proved the calls were not coming from her phone or email. Neither she nor her mobile company could explain how the messages were sent. After finding no way to block the unsavory messages, she changed her mobile number and quit JEI to avoid further embarrassment by association.

5. Based on total 2015 trading commissions of $4,000,000, JEI management has forecasted the following monthly growth in trading commissions and monthly cash collection measures for 2016:

• Create a 12-month cash flow budget in Excel using the following assumptions:

• Annual 2015 commissions of $4,000,000 with forecasted monthly growth of 2%

• 45% of each month’s sales for cash; 25% collected the following month; 20% collected 2 months later; 8% collected 3 months later; and 2% never collected

• Initial cash balance of $300,000 Assuming an initial cash balance of $300,000, management has concluded that they will achieve an ending cash balance of $41,000,000.

Requirements#2: Review the issues identified by the Director of JEI’s internal audit department. For each issue listed above explain why it is a weakness and recommend a way or ways to correct the weakness. Document any assumptions to support your conclusions. For issue #5, evaluate management’s conclusion but show calculations to support your decision. Your response should be addressed to: Director of Internal Audit – John Exchanging Integrated Inc.

Answer 1

1.Leakage of customer information:

Step-1: Internal control weakness identified and recommended controls:

• The company does not have the safest network security policy when the employee works from home using companies network installed in the employees home to prevent introduce of outsiders through company network.
• The unit should implement strong internal controls in those areas to prevent introduction of outsides in the companies information system.

2.Installing of outsider’s network in company premises:

Step-1: Internal control weakness identified and recommended controls:

• The unit does not have the strong internal controls to prevent the installing of outsider’s network in the companies premises.
• The unit should take proper security check to prevent entering of ousiders inside the company premises.

3..Fictitious invoice or duplicate invoices:

Step-1:Internal control weakness identified and recommended controls

• The unit does not have the practice of attachment or confirming the receipt of goods with the stores personnel before release of payments to vendors.
• The unit should start the practice of attaching the GRN (Goods Received note and Purchase order reference no to ensure payment has been released after receipt of goods.

4.Sexual harassment:

Step-1: Process lapse and recommendation to be implemented:

• The company should provide the companies mobile networks to employees to use for official purpose and employee mobile details should not be shared with any other person other than the company officials or authorised persons.