1
Boeing Audit Case
At the beginning of 2007 Neumann and Tides were transferred to Boeing’s internal audit
department. Their job was to monitor the IT controls of the company; however, this required a lot
of manpower, so Boeing also contracted with PwC for additional help for their team. They
weren’t in these new positions long before they began to realize how stressful their positions
were. They were constantly worried that their auditors, Deloitte, would find some material
weaknesses that they missed causing major adverse consequences. As they progressed in their
new positions, they each found internal control weaknesses that they brought to their superior’s
attention. Though they brought it up many times, their superiors did not do anything about the
internal control weaknesses.
As the concerns grew, a reporter was looking into some internal control problems at
Boeing. Neumann and Tides did end up talking to the reporters, which goes against Boeing’s
policy. When the reporter publishes the story Boeing has their suspicions that Neumann and
Tides are behind the leak, so they monitor their computers and IT for proof of what they suspect.
Since they broke policy, the two employees are fired. Neumann and Tides go to court to try and
defend their actions, but they have no success even after their attorney appeals to the U.S.
Supreme Court.
Unfortunately for Neumann and Tides, they had difficulty finding a job that compares to
their previous jobs at Boeing after this incident. The Economist would go on to suggest that SOX
should strengthen its statutes to protect whistleblowers more effectively.
Questions
2
1. The COSO internal control framework identifies five internal control components. Which
of those components is most relevant to the procedures that SOX mandates public
companies establish to enable, if not encourage, whistleblowing by corporate employees?
a.The five COSO internal control components are Control Environment, Risk
Assessment, Control Activities, Information and Communication, and Monitoring
Activities (Lawson et al., 2017).
i.“The control environment is the set of standards, processes, and structures
that provide the basis for carrying out internal controls across the
organization” (Committee of Sponsoring Organizations of the Treadway
Commission Internal Control-Integrated Framework Executive Summary,
2013).
ii.“Risk assessment involves a dynamic and iterative process for identifying
and assessing risks to the achievement of objectives” (Committee of
Sponsoring Organizations of the Treadway Commission Internal Control-
Integrated Framework Executive Summary, 2013).
iii.“Control activities are the actions established through policies and
procedures that help ensure that management’s directives to mitigate risk to
the achievement of objectives are carried out” (Committee of Sponsoring
Organizations of the Treadway Commission Internal Control-Integrated
Framework Executive Summary, 2013).
iv.“Information is necessary for the entity to carry out internal control
responsivities to support the achievement of its objectives…
Communication is the continual iterative process of providing, sharing, and
3
2.
obtaining necessary information” (Committee of Sponsoring
Organizations of the Treadway Commission Internal Control-Integrated
Framework Executive Summary, 2013)
v.Monitoring activities include “ongoing evaluations, separate evaluations, or
some combination of the two are used to ascertain whether each of the five
components of internal control, including controls to effect the principles
within each component, is present and functioning” (Committee of
Sponsoring Organizations of the Treadway Commission Internal Control-
Integrated Framework Executive Summary, 2013)
b.Out of the 5 internal control framework identities outlined above, I believe that
information and communication is most relevant to the procedures that SOX
mandates public companies have a procedure in place that facilitates the
whistleblowing process for corporate employees. This is due to the fact that the
SOX is trying to make sure that the employees can communicate information that
they feel is important to the higher-ups of the company.
Explain the difference between a “significant deficiency” and “material weakness” in
internal control. Provide an example of each.
a.“The difference between a material weakness and a significant deficiency is highly
subjective” (Whitehouse, 2016).
b.A significant control deficiency is defined as “A significant deficiency is a control
deficiency, or combination of control deficiencies, that adversely affects the
company's ability to initiate, authorize, record, process, or report external financial
4
3.Assume that the PwC contract auditors did, in fact, exert “managerial authority” over
Boeing employees? What internal control problems or issues would that have posed for
Boeing?
data reliably in accordance with generally accepted accounting principles such that
there is more than a remote likelihood that a misstatement of the company's
annual or interim financial statements that is more than inconsequential will not
be prevented or detected” (AU 325 communications about control deficiencies in
an audit of financial statements previous version, n.d.)
c.On the other hand, a material weakness is defined as “a significant deficiency, or
combination of significant deficiencies, that results in more than a remote
likelihood that a material misstatement of the annual or interim financial
statements will not be prevented or detected” (AU 325 communications about
control deficiencies in an audit of financial statements previous version, n.d.)
d.An example of a significant deficiency would be if a company’s computer system
was not able to protect itself from someone trying to hack into the computer or the
network. The computer system should have measures in place to protect itself
from potentially threatening situations.
e.An example of a material weakness would be if the computer system did not have
measures in place to prevent someone from making a simple error when entering
the accounting information. This lack of preventative measures would allow
someone from accidentally recording incorrect information.
5
a.“Audit committees play a vital role in the financial reporting system through their
oversight of financial reporting, including the internal control over financial
reporting (ICFR) and the external, independent audit process” (Clayton et al.,
2019). If the PwC contract auditors did exert managerial authority of Boeings
employees, then this could inhibit the internal employee’s ability to do their job.
An internal employee is likely going to know more about the company; if the 3rd
party employees are in charge it is possible that they would make some
uninformed decisions.
b.Additionally, this could lessen the validity of the internal audit. If a 3rd party
employee is receiving compensation for their work to find weaknesses in the
company’s internal controls, they could be incentivized to not find any weaknesses
in order to keep their employer happy. (Bishop, 2003)
4.Would it have been unethical or otherwise inappropriate for Neumann and Tides to have
directly communicated their concerns regarding Boeing’s IT controls to the company’s
Deloitte auditors? Explain. Assuming that Neumann and Tides had done just that, how
should the Deloitte auditors have responded?
a.Neumann and Tides’ job at Boeing was to communicate these concerns about
Boeing’s IT controls to the company. As part of the internal audit process, and the
employees who have appropriate knowledge of the company, the culture, and the
relevant processes their job was to spot these concerns and communicate them.
Since they had tried to communicate these concerns to their supervisors multiple
times to no avail, I believe that communicating these concerns to Deloitte was
6
b.
their next best option (About Internal Auditing, 2019) (Michael Chris Knapp,
2016).
If Neumann and Tides had communicated these concerns to Deloitte then as the
auditors of Boeing, Deloitte should have taken the time and looked into the
concerns with careful consideration (About Internal Auditing, 2019).
5.Why do you believe that SOX does not provide legal remedies for corporate
whistleblowers who are punished by their employers after communicating with members
of the news media?
a.In my opinion, one possible reason that SOX does not provide legal remedies for
corporate whistleblowers who are punished for going to the media is that they do
not want to encourage employees to take this type of information to the media. In
theory, it would be easier for a company to handle such an issue itself without
dealing with the press. It would also prevent any monetary losses that may come
from the bad press. Unfortunately, this would likely get in the way of the truth
coming out in some situations
6.Was it ethical for Boeing to monitor the computers and email of Neumann and Tides
during the investigation to determine whether one or more employees were
communicating with members of the news media? Defend your answer.
a.It is my opinion that it was ethical for Boeing to monitor the computers and emails
of Neumann and Tides. This is assuming that the company was only monitoring
the employees' work emails and their company computers Assuming that they
7
Christian World View
In the Boeing case, there was a severe lack of trust on all sides. The Bible says, “When I
am afraid, I put my trust in you” (English Standard Version Bible, 2001, Psalm 56:3). If the
employees had been able to trust Boeing to correct the problems that they found then they would
not have felt the need to go to the media. If Boeing had felt that they could trust the employees,
then they would not have felt the need to spy on their activity.
The Bible also says “Let every person be subject to the governing authorities. For there is
no authority except from God, and those that exist have been instituted by God” (English
Standard Version Bible, 2001, Romans 13:1). Even though the employees felt they had no other
option, they should not have broken the rules that governed them.
signed the standard policies that most companies have employees sign regarding
the company being able to monitor the employee’s computer activities. In this
case, Boeing had every right to investigate their suspicions about which employees
broke their policies about speaking to the media.
8
References
About Internal Auditing. (2019). Theiia.org. https://global.theiia.org/about/about-internal-
auditing/pages/about-internal-auditing.aspx
AU 325 communications about control deficiencies in an audit of financial statements previous
version. (n.d.). PCAOB. Retrieved January 27, 2022, from
https://pcaobus.org/oversight/standards/archived-standards/pre-reorganized-auditing-
standards-interpretations/details/AU325b#:~:text=A%20significant%20deficiency%20is
%20a
Bishop, W. (2003, January 13). Comments of Institute of Internal Auditors on S7-49-02.
Www.sec.gov. https://www.sec.gov/rules/proposed/s74902/wgbishop1.htm
Clayton, J., Teotia, S., & Hinman, W. (2019, December 30). SEC.gov | Statement on Role of
Audit Committees in Financial Reporting and Key Reminders Regarding Oversight
Responsibilities. Www.sec.gov. https://www.sec.gov/news/public-statement/statement-
role-audit-committees-financial-reporting
Committee of Sponsoring Organizations of the Treadway Commission Internal Control
-Integrated Framework Executive Summary. (2013).
https://www.coso.org/Documents/990025P-Executive-Summary-final-may20.pdf
English Standard Version Bible. (2001). Crossway Bibles.
Lawson, B., Muriel, L., & Sanders, P. (2017). Shibboleth Authentication Request. Research in
Accounting Regulation, 29(1), 30–43. login.ezproxy.liberty.edu. https://www-
sciencedirect-com.ezproxy.liberty.edu/science/article/pii/S1052045717300048?via
%3Dihub
9
Michael Chris Knapp. (2016). Contemporary auditing : real issues and cases (11th ed.). Cengage
Learning.
Section 404(b) of Sarbanes-Oxley Act of 2002. (n.d.). AICPA.
https://us.aicpa.org/advocacy/issues/section404bofsox
Whitehouse, T. (2016). Spotting the difference between “significant deficiency” and “material
weakness”: Material misstatements involve mistakes large enough, surely, to involve
some kind of internal control shortcoming that allowed the misstatement to occur in the
first place. so why aren’t more internal control reporting and auditing processes helping
to identify control lapses in advance of material misstatements?. Business Insight:
Global, 29+. Web.
