Planning, Evidence, and Risk

ACC-491-RS-CLCTyroncoFoundationCOSOCaseStudy.pdf

Home >Business & Finance homework help >Accounting homework help >Planning, Evidence, and Risk

THE TYRONCO FOUNDATION COSO Glenn E. Sumners, DBA, CIA Sumners Audit Services Not everything that can be counted counts, and not everything that counts can be counted. – Albert Einstein

This project was

funded through a

grant from the

Internal Auditing

Academic

Advancement

Fund Inc.

supporting The

IIA’s Internal

Audit Education

Partnership

(IAEP) program

LSU CENTER FOR INTERNAL AUDITING

The Tyronco Foundation operates worldwide to provide food and medicine to needy individuals in third world countries. Thirteen countries currently receive assistance through the program. The number of individuals that have benefited has increased from 407,000 in 1990 to over 721,000 in 2010. Data for current years is still being tabulated for annual reporting. Contributions are received from foundations, agencies, governments and individuals. Tyronco outsources the marketing and collection processes. The marketing agency publicizes the benefits and collects the donations.

The bylaws require that 75% of the funds collected be distributed to directly benefit the needy (benefit expenses). The administration expenses cannot exceed 25% of contributions. The CEO has recently determined that distribution costs should be reclassified from administrative expense to benefit costs since distribution is a benefit to the needy. Tyronco’s marketing efforts highlight the guaranteed high percent payoff to the needy. The governing agencies of several countries require that the attest auditors include the 75% goal in the financial audit. Background Information The results of your preliminary work are outlined below:

‣ Board-Audit Committee: The 13 board members are prominent celebrities, politicians, and business people. Bernie Lay serves as both the Chairman of the Board and CEO. Bernie was the CFO for five years before being appointed as the CEO. The board members are selected by the Chairman of the Board and approved by a majority of the Board. The five-member audit committee includes the Chairman of the Board and four members appointed by the Chairman for a three year term. The Board also includes a nominating committee, a risk committee and a compensation committee. The Board and the subcommittees meet for one day each quarter. The CFO is responsible for the agenda and financial reports. THE Chief Audit Executive (CAE) and the external audit partner share a one-hour slot on the agenda at each meeting.

‣ Chief Executive Officer: The CEO, Bernie Lay, has a military background and has established an autocratic management style. He feels that this approach will develop a more efficient and effective structure for a decentralized organization.

‣ Chief Financial Officer: Scott Z. Best, the CFO, previously served as the supervisor of accounts payable and was promoted by the CEO. He was the manager in charge of the Tyronco account when he worked for the attest auditors. He maintains a good working relationship with Temple and Duncan, a small regional firm in Geneva.

‣ Operating Management: Each participating country has an operating manager selected by the CEO. The managers report directly to the CFO.

‣ Internal Audit: Martha N. Cider, the Chief Audit Executive, served as the lead auditor on the Tyronco engagement when she worked for Temple & Duncan. She was hired because of her knowledge of the financial aspects of Tyronco. As part of a cost-cutting move she reduced the audit staff from 21 to 13 and cosources the collections, payables, and purchasing audits to Temple & Duncan. The reduction in staff was explained by increased usage of the data-mining technology. Martha was in the MBA program with Bernie and Scott and is considered a rising star in the organization. Management requests from the CEO and CFO consume about 90% of available audit time. The CEO feels that the auditors should be able to complete their audits from the headquarters location by utilizing technology. He has reduced the travel budget but significantly increased the budget for systems training and audit software. The hiring focus is now on systems knowledge.

‣ External Auditors: Temple and Duncan (T&D) have been the low bidder the last three times the organization has requested attest proposals. The external auditor proposals are reviewed by the CFO who recommends a firm to the Audit Committee for approval. Tyronco represents 60% of T&D’s audit revenues and 80% of their consulting revenues.

‣ Purchasing: The purchasing function is decentralized with a purchasing agent located in each of the 13 countries that qualify for food and non-prescription medicine. The Vice-President of Purchasing at headquarters has requested that the 13 purchasing agents purchase 50% of all items from vendors located in the same country as the recipients. The agents operate somewhat autonomously and can sole-source or utilize competitive bids.

Local purchases are typically 20-30% higher than obtained through a competitive bid process. The CEO supports this approach since he feels that it establishes good relations with local government officials and business people.

‣ Warehouse: The receiving clerks and distribution managers report to the Purchasing Agent. Inventory status reports are issued quarterly to the V.P. of Purchasing who prepares a summary report for the CEO & CFO.

The quarterly purchasing reports from the purchasing agents to Headquarters are provided on the following spreadsheet.

Total Vendor Description

The primary headquarters control and review is a comparison of budget to actual. Purchasing Agents are provided with a quarterly budget generally based on demographics of the recipients. Adjustments are made to the budget based on actual contributions received from countries, organizations, foundations, and personal sponsors. The overall increase in purchases has been approximately 13% per year but varied from a low of +7% to a high of +21% between countries. The summary quarterly reports are approved by the country manager and forwarded to the CFO with the quarterly financial statements for review and approval.

Requirements The audit programs that you will develop should have two sections to facilitate a top-down audit approach:

1. Organization  COSO Evaluation

2. Purchasing  COSO Evaluation

This approach is suggested since the organization’s evaluation of risk, controls, and corporate governance is the foundation for the audit of the purchasing function. Requirement #1: Based on the above background, develop a COSO-based audit program. The audit program should address the following COSO objectives as applicable:

‣ Operational:  Effectiveness and efficiency of operations.

‣ Financial:  Reliability of information.

‣ Compliance:  Compliance with applicable laws and regulations.

The organization audit program should be classified to align with the five COSO components:

‣ Control Environment ‣ Risk Assessment ‣ Control Activities ‣ Monitoring ‣ Information and Communication

To provide a consistent framework for comparing solutions; please use the following component

subsections:

1. Control Environment

‣ Integrity and ethical values 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Commitment to competence 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Board and Audit Committee 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Management philosophy and operating style 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Organization Structure 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Assignment of authority and responsibility 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Human resource policies and practices 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

2. Risk Assessment

‣ Company-wide objectives 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Process-level objectives 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Risk identification 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Managing change 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

3. Control Activities

‣ Policies and procedures 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Segregation of duties 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Periodic reconciliation 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Proper authorization 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Transactions recorded 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Safeguarding assets 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

4. Information and Communication

‣ Quality of information 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Effectiveness of communication 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

5. Monitoring

‣ On-going monitoring 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Evaluation process 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Reporting control and process deficiencies 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Change management process 1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Requirement #2:

Identify the five major risks in the Purchasing Department. List the controls you would expect to find to mitigate the risks and the audit steps that would be utilized to ascertain that the control mitigates the risk.

Purchasing

Risk

At Risk Control COSO

Classification Audit Step

Requirement #3:

List one or two audit steps that you would perform in each of the six listed sections:

Procurement Audit

1. General:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

2. Requisitioning:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

3. Purchasing:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

4. Receiving:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

5. Invoice Processing:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

6. Accounts Payable, Encumbrances, or Obligations:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Requirement #4:

List five major risks specifically related to Tyronco. What would be your five major areas of concern

as an internal auditor?

1. ___________________________________________________________________________

___________________________________________________________________________

2. ___________________________________________________________________________

___________________________________________________________________________

3. ___________________________________________________________________________

___________________________________________________________________________

4. ___________________________________________________________________________

___________________________________________________________________________

5. ___________________________________________________________________________

___________________________________________________________________________