Question

Codger Corp. — Internal Controls

Codger Corp. (CC or the “Company”) is a U.S. public company that files quarterly andannual reports with the Securities and Exchange Commission (SEC). CC is a leading retail chain operating more than 100 department stores across the continental United States. CC department stores offer customers a variety of nationally advertised products, including clothing, shoes, jewelry, and other accessories. The Company’s supply chain ofproducts is managed through a single warehouse and distribution facility located in Kansas City, Missouri.

CC has a centralized accounting and finance structure at its corporate headquarters, whereall processes and controls related to all substantive account balances occur, includingcontrols related to accounts payable and the Vendor Master File. CC recognizes revenues from retail sales at the point of sale to its customers. Discounts provided to customers bythe Company at the point of sale, including discounts provided in connection with loyaltycards, are recognized as a reduction in sales as the products are sold. Cost of goods sold for the Company primarily consist of inbound freight and costs relating to purchasing and receiving, inspection, depreciation, warehousing, internal transfer, and other costs ofdistribution.

Case Facts

Audit Issue

On June 1, 20X2, the Accounts Payable (AP) Manager received an e-mail inquiry about the process required for a vendor to change its bank account information. The e-mail was sent from John Smith at a domain address listed as “Time-Peace.” Time Peace is a manufacturer that supplies CC-branded watches to CC’s west region department stores.In addition, John Smith is the primary contact at Time Peace with whom the Companytypically interacts.

The AP Manager responded to the e-mail request on June 15, 20X2, with the procedures required of the vendor, which include completing a vendor bank account request form. On June 20, 20X2, the AP Manager received a reply e-mail from John Smith at “Time-Peace” with a completed vendor bank account request form, which included John Smith’s signature, new bank account information, and other related information.

Upon receiving the vendor bank account request form, the AP Manager completed a separately required Vendor Change Form for internal processing. The Vendor Change Form is completed for new vendors or changes to existing vendors’ information,

including bank account information. The AP Manager sent the completed Vendor Change

Form to CC’s Assistant Controller, who reviewed and approved the request on June 24,

20X2. The bank account information was updated within the Vendor Master File on June

26, 20X2.

Throughout the month of July, valid Time Peace invoices were processed through the

Company’s accounts payable process, and the valid invoices were paid in accordance

5

with the Company’s processes for cash disbursements and wire transfers. However, because the bank account information for Time Peace was changed (as a result of the June 1, 20X2, e-mail request) approximately $2 million in payments was wired to an incorrect bank account. On August 2, 20X2, the Company received an inquiry from Time Peace about the expected timing of the $2 million in outstanding invoices. As a result of the direct interaction with Time Peace’s employee John Smith, the Company determined that the previous vendor bank account change form was received from a fraudulent domain name with the intent to defraud the Company. The e-mail domain for Time Peace is “Time Peace,” with no hyphen, rather than “Time-Peace,” with a hyphen.Both e-mails received from “Time-Peace” were determined to be from a fraudulent source (that also fraudulently used John Smith’s name in the e-mail).

As noted above, there are two employees within the Company that were involved in processing and approving the Vendor Change Form. The Company’s policy on bank account change requests was communicated by CC’s Assistant Controller in an August

20X1 e-mail that indicated that for each Vendor Change Form requesting a vendor bank account change, the accounts payable department was required to (1) obtain a previously processed and paid invoice from the vendor requesting the bank account change, (2) call the vendor using the contact information obtained from the prior invoice, (3) verify the authenticity of the requested bank account change request by directly contacting the vendor, and (4) include all relevant information obtained in steps (1) through (3) as an attachment to the Vendor Change Form. The Company’s control description relating to the review of a Vendor Change Form by the Assistant Controller is not explicit regarding the specific attributes of the review. However, because the policy was distributed by the Assistant Controller and the Assistant Controller is also the control owner (e.g., performs the review), there is a presumption that the Assistant Controller would understand that as part of her review, she should evaluate whether the AP Manager obtained sufficient information to confirm the authenticity of the bank account change request.

Other Relevant Facts

•?Materiality — $8 million.

•?The Company processed approximately 105 vendor requested bank accountchanges during FYX2 before the realization that the request from “Time-Peace” was fraudulent (from September 25, 20X1, to August 2, 20X2). After the identification of the misappropriation of assets, the Company’s internal audit department obtained and reviewed all 105 Vendor Change Forms reviewed by the Assistant Controller, noting that only five Vendor Change Forms contained the information required by the

policy. In addition, internal audit determined that the primary review procedure performed by the Assistant Controller related to the verification that the bank account number was appropriately included on the Vendor Change Form. This procedure was performed in all cases before the bank account information was input into the accounts payable system.

•?The total wire transfer payments made to the 105 vendors that requested bank account changes in FYX2 totaled approximately $56.2 million (based on an analysis prepared by Internal Audit of the invoices processed and paid by the Company afterthe processing of a Vendor Change Form for the 105 vendors).

•?There are more than 30 vendors with annual purchase activity of over $20 million (12 of which have purchase activity of over $40 million); thus, the amount ofpayments made to any single vendor in a payables cycle could approximate $2 million, assuming a cycle of 30 days.

•?The Company’s Chief Security Officer completed an internal investigation and concluded that there was no indication that the AP Manager and Assistant Controller were involved in the scheme that resulted in the $2 million misappropriation.

•?After the determination on August 2, 20X2, that the Vendor Change Form was from a fraudulent source, the Company ceased processing additional Vendor ChangeForms until it could understand the root cause of the deficiency. On September 10, 20X2, the Assistant Controller sent a reminder regarding the importance of following the vendor bank account request change policy. The e-mail also highlighted an enhancement to the process, which primarily included an enhancement to the VendorChange Form. The form was revised to include the following three new, explicit sections that are required to be completed: (1) contact phone number pulled from previously processed and paid vendor invoice, (2) name of individual at the vendor(from a previous invoice) that was contacted, and (3) date discussed/contacted. Thepolicy e-mail reiterated the requirement to include a copy of the previously processed vendor

invoice with the Vendor Change Form.

•?Internal Audit performed a thorough evaluation of the competency of theAssistant Controller and concluded that notwithstanding the Assistant Controller’s lack of historical performance, the Assistant Controller was suitably competent to perform the control.

Engagement Team Note

In planning the 20X2 audit, the engagement team obtained an understanding of the internal controls related to cash disbursements. This understanding was developed through the engagement team’s walkthrough of the cash disbursements process. As part of its walkthrough procedures, the engagement team made inquiries of appropriate personnel, inspected relevant documentation, and in certain cases, observed the control performers carrying out required control procedures. As a result, the engagement team concluded that there were no significant changes to the cash disbursements process in the current year.

The engagement team identified four risks of material misstatement relating to the cash disbursements process. For each risk identified, the team documented the control activity that addresses the risk of material misstatement in the excerpted worksheet (see

Handout 1). As a result of the Audit Issue described above, the engagement team identified a control deficiency in the following control:

CD5C — The accounts payable department is required to complete the following for each Vendor Change Form requesting a bank account change:

1. Obtain a previously processed and paid invoice from the vendor requesting the bank account change.

2.   Call the vendor using the contact information from the obtained invoice.

3. Verify the authenticity of the requested bank account change request.

4. Attach all relevant information obtained in steps (1) through (3) to the Vendor

Change Form for review and approval.

The Company’s control description regarding the Assistant Controller’s review of the Vendor Change Form is not prescriptive regarding the specific attributes of the review. However, there is a presumption that the Assistant Controller would understand the primary objective of the control, which is to evaluate whether sufficient information was obtained by the AP Manager to confirm that the bank account change request was authentic.

Internal Controls -> Control DeficiencyEvaluation

Identified Risks of Material Misstatement
Cash Disbursement 1	Incorrect vendor set up in the system submits invoice without providing goods for services.
Cash Disbursement 2	Invoice is received for goods or services never received; therefore, a liability and expense are recorded when ABC has noobligation.
Cash Disbursement 3	Payments are not appropriately authorized and accurate.

Controls in Cash Disbursement Process
CD1C	Bank statements are reconciled to the general ledger regularly and differences are investigated and resolved on a timely basis.
CD2C	Cash disbursements are generated through the ERP system. The ERP system automatically records the journal entry for cashdisbursements to the accounts payable and cash sub-ledgers.
CD3C	All manually generated checks, including supporting documentation and the related journal entry, are reviewed and approved bymanagement before the journal entry is recorded.
CD4C	Finance personnel record bank account activity to the general ledger on a daily basis; management reviews recorded entries andcash position regularly for unusual activity and investigates and resolves issues on a timely basis.
CD5C	Each Vendor Change Form requesting a bank account change, the accounts payable department is required to complete thefollowing for each Vendor Change Form requesting a bank account change: 1. Obtain a previously processed and paid invoice from the vendor requesting the bank account change 2. Call the vendor using the contact information from the obtained invoice 3. Verify the authenticity of the requested bank account change request Attach all relevant information obtained in steps (1) – (3) to the Vendor Change Form for review and approval.
FR1C	At month-end, corporate accounting performs variance analysis for all financial statement line items as compared to prior monthand prior year to identify variances in excess of $5 million or 10 percent period to period. All variances in excess of this thresholdare to be explained.

Question: As CC's auditor, what implications does this control deficiency have for other controls related to the cash disbursement process, and for the controls related to the cash disbursement process, and for the control environment in general?

Answer 1

As CC's auditor, the following internal controls may fail as implication of control deficiency related to cash disbursement process in common parlance of control environment :

1. Segregate duties. The foundation of a good internal control system is segregation of duties. The duties of authorization (signing a check or releasing a wire transfer), custody (having access to the blank check stock or the ability to establish a wire transfer), and recordkeeping (ability to record the transaction in the accounting system) should be separated so that one individual cannot complete a transaction from start to finish. The concept behind segregation of duties is that in order to misappropriate cash, individuals would have to collude, rather than one individual acting alone.

For many businesses, proper segregation of duties can be difficult to achieve. In these instances, company owners may want to consider the bank statements delivered to them unopened. The owners should then review the bank statements and the check images for any transactions that appear unusual, and follow up on these transactions to obtain an understanding of them. This process alone has uncovered many situations like the one described above.

2. Review authorized signors. Carefully consider who your authorized signors are (authorization of the transaction). Those individuals should not have access to the blank check stock (custody of the asset) nor the ability to enter the transaction into the accounting system (recording of the transaction). The use of a signature stamp, although efficient, may be problematic in that you must have separate controls to ensure that the stamp is not readily available for inappropriate use.

3. Consider requiring dual signatures. Your company may also want to consider the use of dual signatures. A dual signature policy includes the establishment of a dollar threshold over which checks require two signatures. The utilization of dual signatures establishes an element of segregation of duties for disbursements over a specified threshold in that these disbursements require more than one individual to authorize the transaction.

4. Remember the wire transfers. The use of wire transfers has increased significantly over the years, and segregation of duties around wire transfers is paramount. The responsibilities for establishing a wire transfer should be segregated from the responsibility of releasing the wire transfer. If this segregation is not possible, consideration should be given to using a call-back procedure, in which the financial institution will call a specified individual when a wire transfer is initiated. Most important, the call back cannot go to any individual who is able to initiate a wire transfer.

5. Reconcile bank accounts in a timely manner. The bank reconciliation should be completed in a timely manner by someone who is independent of the cash disbursement process. The bank reconciliation should also include a review of the bank statement and the check images that are returned with the bank statement for unusual transactions. Any unusual items should be investigated and evaluated when necessary.

It is never too late to review your internal controls. While processes often vary among companies, implementing the items in this checklist should significantly reduce the likelihood of your business becoming the subject of another one of those stories.

Remedies

Following are some basic control procedures for cash disbursements:

• Make all disbursements by check or from petty cash. Obtain proper approval for all disbursements and create a permanent record of each disbursement. Many retail stores make refunds for returned merchandise from the cash register. When this practice is followed, clerks should have refund tickets approved by a supervisor before refunding cash.
• Require all checks to be serially numbered and limit access to checks to employees authorized to write checks.
• Require two signatures on each check over a material amount so that one person cannot withdraw funds from the bank account.
• Arrange duties so that the employee who authorizes payment of a bill does not sign checks. Otherwise, the checks could be written to friends in payment of fictitious invoices.
• •equire approved documents to support all checks issued.

Click Image to Enlarge

• Instruct the employee authorizing cash disbursements to make certain that payment is for a legitimate purpose is made out for the exact amount and to the proper party.
• Stamp the supporting documents paid when liabilities are paid and indicate the date and number of the check issued. These procedures lessen the chance of paying the same debt more than once.
• Arrange duties so that those employees who sign checks neither have access to canceled checks nor prepare the bank reconciliation. This policy makes it more difficult for an employee to conceal a theft.
• Have an employee who has no other cash duties prepare the bank reconciliation each month, so that errors and shortages can be discovered quickly.
• Void all checks incorrectly prepared. Mark these checks void and retain them to prevent unauthorized use.