1 http://www.caats.ca/acl.html Functions in ACL Function UPPER(), LOWER(), PROPER() MATCH( comparison_value , test1 , test2 <,test3 ...> ) ABS(value) SUBSTR(string, start, length) CTOD(field, date format) Date(date) DOW(Date) CDOW(date) STRING(value, length) Value(string, decimals) MOD(number, divisor) INCLUDE(string, chars_to_include) ECLUDE(string, chars_to_exclude) AGE(date1, date2) LEN(string) LTRIM(string) TRIM(string) ALLTRIM(string) Verify(field) BETWEEN(string, min, max) Logical (T or F) Description Changes the case of a character string Compare value with a list of values; T if at least one match Absolute value of number Returns substring of a string Convert text to date Convert date to text Determine Day of Week Converts Numeric Value to a string Converts string to a numeric value Remainder of Number when divided by divisor Removes all characters except include string Returns all characters except exclude string Date1 - date2 Calculate length of a string Removes leading blanks Removes trailing blanks Removes leading and trailing blanks Checks integrity of field with field type Selects only records where the value is >= min and <= max Example UPPER(dave) = "DAVE" LOWER('DAVE') = "dave" PROPER("DAVE code")= "Dave Code" MACTH("DAVE", NAME, INIT, LNAME) - T if NAME="DAVE" or INIT="DAVE" or LNAME="DAVE" ABS(-12.3) = 12.3 SUBSTR("GARY",2,2) = "AR" SUBSTR("DAVE",4,1) = "E" CTOD("20010301") = 2001/03/01 DATE(2001/03/01) = "2001/03/01" DOW(`20010301`) = 5 CDOW(`20010301`) = "THU" STR(123.5,5) = " 123.5" STR(645,1) = "5" VALUE("123",2) = 123.00 VLUE("12.3",2) = 12.30 MOD(25,5) = 0 MOD(14,3) = 2 INCLUDE("9A6","0987654321")="96" INCLUDE("A55A2","A") = "AA" EXCLUDE("N/A","/") = "NA" EXCLUDE("99-OCT","-") = "99OCT" Age(`20010331`,`20010415`) = 15 LEN("David") = 5 LEN("Gary") = 4 LTRIM(" ABC") = "ABC" TRIM("DAVE ") = "DAVE" TRIM("G IVINGS ") = "G IVINGS" ALLTRIM(" Johnny ") = "Johnny" VERIFY(DATE) - T if record contain valid date BETWEEN(Name,"D","F") = all names starting with D, E or F) BETWEEN(Amount,2,6) = amounts >=2 and <=6 2 3 FIND(string, field) MAX(num1,num2) MIN(num1, num2) AT(pos,#,,search_for,string) OCCURS(string, search_for) SPLIT(string, separator, segment) RECNO() LAST(string, length) INSERT(string, insert_text, location) REPLACE(string, old_text, new_text) MAP(string, format) Logical (T or F) Find a string FIND("Dave", NAME) - T is NAME contains "Dave" (not case sensitive) Returns Maximum of two MAX(2,5) = 5 values MAX(8,2) = 8 Returns Minimum of two MIN(2.3,7) = 2.3 values MIN(8,3) = 3 Returns position of AT(2,"B","ABBA") = 3 search_for_string in field AT(1,"0","1234") = 0 Counts the number of OCCURS('ALLAN','A') = 2 times the search_for string OCCURS("YNNYYN","Y") = 3 occurs in the field Creates a field based on SPLIT("Johnny,Shilo,1233 Main separator and specified St,Ottawa,",",3) = "1233 Main St" segment Record Number The last 'x' characters of the field Inserts new text into field at specified location Replaces specified character with new characters Test string to see if it is in format specified: x-alph; 9-numeric; ? - any char; \ - a literal Repeats given string 'x' times Creates a character string of 'x' blanks Identify records where field is blank T if specified position contains string Reverse the character string Right justifies field RECNO() LAST("Johnny Shilo",5) = "Shilo" INSERT(Phone,'-',4) 9960784 = 996-0784 REPLACE("2000-0-01","-","/") = "2001/03/01" MAP(Date,'99/99/99") checks date field to see if data is in format 99/99/99. MAP('99-03-26','99/99/99') = False MAP('99/03/26','99/99/99') = True MAP('K1A0K2','x9x9x9') = True REPEAT("A",3) = "AAA" REPEAT("AB",2) = "ABAB" BLANKS(3)=" " ISBLANK(Phone) = records with no phone number TEST(72,".") - T is position 72 contains a decimal point (dot) REVERSE("Music") = "cisuM" RJUSTIFY("ABC ") = " ABC" REPEAT(string, count) BLANKS(count) ISBLANK(string) Logical (T or F) TEST(position, string) REVERSE(string) RJUSTIFY(string) Copyright Dave Coderre 2007 4 ACL Command - Explanation FILTER - Show me only records where ….. a condition is true COUNT - How many ? - counts number of records TOTAL - How much ? - totals one or more numeric fields STATISTICS - Minimum, Maximum, Average, Standard Deviation, etc. SEQUENCE - Is file sorted (sequenced) on … DUPLICATE - Duplicate Records - one or more criteria (key fields) GAPS - Are there any missing records? CLASSIFY - Total of one or more numeric fields by any Character field STRATIFY - Ranges of a Numeric field (0-100, 101-200, 201-300 …) AGE - Number of Days past a Cutoff Date CROSS TAB - Creates rows and columns for specified fields, totaling a numeric field SUMMARIZE - Totals by one or more Character fields - can list other fields SORT - Re-order the data - creates a new data file (faster processing) INDEX - Re-orders the data - using an index (less space required) EXTRACT - Create a new file containing only some of the records and/or fields EXTRACT - APPEND - Add records to the bottom of another file - must have same table layout MERGE - Combine two sorted files into one sorted file – same table layout EXPORT - Send the data to another software package (Excel, Word, etc.) JOIN - Combine two files to create a third file - Matched, Unmatched, Primary, Secondary, Primary Secondary. The Secondary file must be sorted RELATE - Logically combine up to 18 files - Children must be indexed BENFORD - compare actual frequency of first ‘x’ digits distribution to Benford frequency VERIFY - Checks the integrity of the data - identifies invalid numeric, date or character fields SIZE - Determines sample size - based on confidence level etc. SAMPLE - Select sample records - creates new file EVALUATE - Projects the sample results to the entire population SCRIPTS - To save commands in a file so you can re-execute them later; to ensure consistency; to speed up analysis 5 LOG - Automatically records all ACL Commands and the results Generic Approach to the Application of Data Analysis to Auditing ©CAATS 2007 The first step is to ensure that you understand the goals and objectives of the audit. Then: Meet with the client and the programmer for the client applications. Identify all available databases both: Internal to the client organization – main application systems; and External to the client organization – including benchmarking and standards List fields in all available databases and the standard reports that are available. Based upon the audit objectives, identify the data sources, the key fields or data elements required by the audit team. Request the required data – trying to ensure that unnecessary fields are excluded for the request. Prepare a formal request for the required data, specifying: the data source(s) and key fields, the timing of the data (for example: as of Sept 31 2002), the data transfer format (floppy, LAN, Internet, CD ROM, tape, etc.), the data format (DBF, Delimited, flat file, ODBC, ASCII print file, etc.), control totals (number of records, key numeric field totals), record layout (field name, start position, length, type, description), a print of the first 100 records Create or Build the ACL Input File Definition - automatically created by ACL for DBF, ODBC, and Delimited files. Verify the data integrity: - Use Verify Command - to check data integrity, - Check ACL totals against control totals, - check the timing of the data to ensure proper file has been sent, - compare ACL view with Print Out of first 100 records - authorization – obtain client agreement on data (source, timing, integrity, etc.). Understand the Data - use ACL commands COUNT, STATISTICSC, STRATIFY, CLASSIFY, etc to develop an overview of the data For each objective - formulate hypotheses about field and record relationships - Use ACL to perform analytical tests for each hypothesis - Run tests - the output is your “hit list” - possible problem records - Evaluate initial results and refine the tests - Re-run and refine test to produce shorter, more meaningful results (repeat steps 5-7 as needed) - Evaluate the results - using record analysis, interview, or other techniques - to examine every item on the refined results. - Form an audit opinion on every item in your results. For each you should be say that Count. Cross tabulation. The materials are provided only as a supplement to the ACL materials (electronic reference documentation and help). dBASE and Printed report files. Quick Sort. Statistics. Stratify. Index. The purpose of the hands-on course is to expose you to the basics of ACL and give you an opportunity to use ACL in a classroom setting. Extract. Sequence. Gaps. The second part of the course will concentrate on the ACL commands: Verify.there is a valid explanation. and identify reasons for the exceptions. Duplicates. Introductory ACL CAATS offers a 3-day Introductory ACL course. Excel (ODBC). • Audit specific training (minimum 4 days) All courses can be customized to meet your specific requirements using your data files and tailored exercises. Age. data file types. Export. while learning ACL. Sort. TRAINING FOR CATTS CAATS offer four courses: Introduction to ACL (3 days) Advanced ACL (3 days) Fraud Detection and Data Analysis Continuous Auditing Workshop (1 day) CAATS also offers a unique opportunity to combine training and consulting activities – to address the objectives of an ongoing audit. including table layouts (creating and using). Delimited. Classify. Total. By the end of the course you should understand the: • • ACL project concept. expressions and filters ACL commands allowing you to o assess data integrity and completeness . The course uses a combination of instructor-led presentation and hands-on exercise. Summarize. The first part of the course stresses the ACL user interface and the ACL Project concepts. confirm analysis and nature of exceptions. or that it is a probable improper transaction and more review is needed Quality Assurance and Documentation .exceptions to source. It also covers the definition of different file types: flat file.6 the record is OK . Benford Analysis. Join and Relate. data file types. and Groups: Simple. the course covers the following topics: • Define what constitutes fraud and look at the cost of fraud . including IF Command. The course concludes on Day 3 with instruction on Interactive Dialog. Next the advanced course covers some of the most commonly used Functions and then moves on to discuss methods of creating script. expressions – logical. Conditional. By the end of the course you should fully understand the: • • • ACL project concept. flat file. workspaces. and Nested. maximizing efficiency through the use of the LOG. expressions and filters ACL functions Developing ACL applications (scripts). ODBC. Accept Command and Dialog boxes. and Report files. It then discusses Interactive Scripts. The first part of the course should be a refresher .starting with a review of importing the five types of data dBASE. Fraud Detection and Data Analysis: Over the 3 days. The prerequisite is a good working knowledge of ACL – usually obtaining through frequent use of ACL over a period of 6 months or more. and a review of Join and Relate. The second part of the course covers: reusing table layouts. including table layouts (creating and using). Delimited. unconditional and conditional.7 o o o o • get an overview of the data drill-down into the details export/extract data join and relate data files How to use the ACL Log file Advanced ACL The Advanced ACL course is 3 days of intensive instruction aimed at experienced ACL users. and to develop a continuous risk assessment tool Continuous auditing approaches will be employed by the participants. At the end of the workshop you will: • • Understand the concept of continuous auditing Have practice in applying continuous auditing techniques . Monitoring and Risk Assessment. During the course. A/R. The afternoon session will allow participants to identify indicators of risk in specific areas (finance.payroll. Fraud schemes in several areas . and the Fraud Toolkit.used to identify control deficiencies . Most of the materials are contained in the two books that you received with your registration – Fraud detection – a revealing look at fraud. informatics). During the exercises you should refer to these books often. GTAG #3 discusses continuous auditing tools and techniques for assessing controls and risks.used to develop enterprise-wide audit planning. etc Exercises to obtain practice using an approach to detect fraud and abuse The building a series of ACL scripts in the payroll and purchase card areas There are only a few additional handouts for this course. The prerequisite is a good knowledge of ACL . – the audit/monitoring of corporate credit cards.usually obtaining through frequent use of ACL over a period of 6 months or more.8 • • • • How to use the fraud toolkit – examining the uses of each of the scripts in the toolkit. operations. The goal of this course is to leave with working series of ACL scripts. Continuous Auditing One day presentation/workshop David Coderre will discuss the main concepts presented in the IIA’s third Global Technology Audit Guide (GTAG #3) – Continuous Auditing: Implications for Assurance. A/P. and look at how they can be used to create your own fraud templates. – the follow-up for an audit of accounts payable. Examples of an automated continuous auditing application for these three areas will be also demonstrated. who will work in groups to identify/assess indicators of risk supporting three audit activities: – the development of an annual enterprise risk-based audit plan.and continuous risk assessment . you will be working in groups to address a series of cases. The morning session will introduce participants to the theory and tools supporting continuous control assessment. Coderre for more information Dave_Coderre@Hotmail. and ‘The Fraud Toolkit’ The notion of continuous monitoring was first introduced to auditors in the 1980s. These include both on-site and remote (via the Internet) consulting services. and the objectives of an ongoing audit.com The Case for Continuous Auditing By David Coderre. Note: only available for in-house courses. Please contact Mr. Author of ‘CAATTs and Other BEASTs for Auditors’. Its basic premise was using ongoing automated data analysis to draw conclusions concerning risk in a subject area. they lacked the tools and necessary data access or were unwilling to embrace this idea at the time. Consulting Services A wide range of consulting services are available. ‘Fraud Detection: A Revealing Look at Fraud’. . Perform a payroll audit while learning how to develop specific payroll test. The results would help to determine where an audit was required and to focus the audit on the areas of greatest risk. auditors were not ready. Using your own data. CAATS will tailor the ACL training to help you work through your audit program. Unfortunately.9 • • • Benefit from the contribution of others (group work) See the utility of continuous auditing Have the beginning of a continuous auditing application Audit Specific ACL training Maximize your benefits by combining training with an actual audit that requires data analysis. Prerequisites: must have an on going audit with defined objectives and pertinent data files. • • Perform a p-card audit while learning how to build ACL scripts to detect p-card fraud. If a company can’t adjust to changing market.000. so its acceptance and implementation is far from widespread.a similar. proponents of continuous monitoring now define it as the identification of systems or processes that are experiencing higher-than-normal levels of risk. Therefore. .10 Now. and response to issues. They may range from sending an email to the manager to a rapid response audit of the area. plus changes in auditing standards and the evolution of audit software. In this context. However. the financial system may notify the auditors of any journal vouchers over $250. Sarbanes-Oxley Section 409 requires timely disclosure to the public of material changes to financial conditions. Continuous auditing versus continuous monitoring To help overcome some of the problems and confusion associated with the term “continuous monitoring. but more powerful approach to identifying and assessing risk. but not limited to. Real-time analysis is still beyond the capabilities of many audit organizations. Another point of confusion is the application of the term “continuous monitoring” to both instantaneous auditing (a review of transactions in real time) and to the notion of ongoing or frequent. technology and audit standards are driving auditors to make more effective use of information and data analysis and encouraging auditors to adopt continuous monitoring. For example. The auditor’s response will depend on whether or not this is seen as a single item of concern or as a systemic problem. there is a proliferation of information systems in the business environment. will trigger auditor-initiated actions. audits. continuous monitoring measures specific attributes that. however.” auditors ought to consider the notion of “continuous auditing. such as where the values of the performance attributes fall outside the acceptable range. technological and financial conditions.’ which is seen as a management function. Often the need for high quality information for decision-making in the highly volatile business environment is greater than the need for reliable historical cost-based financial statements.” -. This regulation. Increasingly. Further. The environment. the rapid pace of business requires prompt identification of. I define continuous auditing as: The identification and assessment of risk through the application of analysis and other audit techniques including. One of the main reasons for the reluctance is the term ‘monitoring. has combined to persuade auditors to adopt new approaches to assessing information. This has produced a shift in the focus of internal audit activities. it won’t be in business for long. many auditors are still resistant to or confused about continuous monitoring. giving auditors and managers easier access to more relevant information. the marketplace demands independent assurance that control procedures are effective and that the information produced for decision-making is both relevant and reliable. but not real time. if certain parameters are met. The nature of these actions will vary depending on the risk identified. The main difference between the macro. The analysis of patterns within the digits of numeric fields (digital analysis). Continuous auditing is a unifying structure or framework that brings risk assessment. The annual audit plan requires high-level information to establish the risk factors. continuous auditing also supports risk identification and assessment for the entire audit universe – supporting the development of the annual audit plan – in addition to contributing to the objectives of a specific audit. such as developing the objectives and criteria for an individual audit. trend analysis. Typically. But continuous auditing goes beyond simple data analysis and includes techniques from statistical analysis. Individual audits start with the risks identified in the annual audit plan but use digital analysis and other techniques (interviews. There also are a number of differences between continuous auditing and continuous monitoring. to further define the main areas of risk and focus the risk assessment and subsequent audit activities. prioritize risks and set the initial timing and objectives for the planned set of audits. digital analysis and neural networks.and micro-audit levels is the amount of detail that is considered. It supports the macro-audit issues. and Comparisons of one audit entity to another. and micro-audit issues. walk-throughs. Comparisons across years.11 • • • • • The identification of anomalies. to a large extent continuous monitoring. data analysis and. audit planning. while data analysis contributes to an individual audit by identifying or supporting specific audit objectives. Both continuous monitoring and continuous auditing have their genesis in data analysis. The frequency of continuous auditing is based on the assessed level of risk and is not “continuous” unless the level of risk justifies a real-time analysis of transactions. questionnaires. etc. The main differences are: • • Continuous auditing recognizes and acknowledges that monitoring is a management function – not an internal audit function. control self-assessment. is only used to identify transactions that fail a specified cut-off or threshold value. as well as establish dynamic thresholds that respond to changes in the organization. Comparisons against cut-off or threshold values. whereas continuous auditing helps auditors to identify and assess risk. digital analysis and the other audit tools and techniques together. . Further. such as using risk to prepare the annual audit plan.). rather than simply identifying a transaction that failed to meet a static cut-off value. Supporting audit follow-up Finally. The concept of variability. Tracking performance over time is critical to ensuring the organization is being successful in meeting established goals and in identifying additional actions to be taken. This premise can just as easily be applied to the measurement of the integrity of a financial system by measuring the variability (e. is the key differentiating factor in continuous auditing versus continuous monitoring or embedded audit modules. auditors can track specific data-driven measures of performance to determine whether management has implemented the agreed-upon recommendations and whether they are having the desired effect. Auditors need to be considering questions like: How many journal vouchers were processed this year? What percentage was above the threshold amount? How does this compare to last year and to other audit entities? Can we tighten the criteria and lower the cut-off value? Answering these questions will allow auditors to develop a dynamic set of thresholds that provide a better idea of the direction the organization is headed. Measuring variability Continuous auditing seeks to measure not only transactions against a cut-off but the totality of the transactions. the more concerns about the proper functioning of the production line.12 • Continuous auditing uses not only the comparison of both individual and summarized transactions against cut-off or threshold values but also the comparison of an entity against other entities (e. It is an integral . The more variability in the number of defects. number and dollar value) of the adjusting entries over time and in comparison to other similar entities. it is not a form of monitoring that would determine if operations are functioning properly (which is a management issue). • Continuous auditing can be used by audit to determine if risk is at a level where audit intervention is required. one operational unit to all other operational units) and a time-wise comparison of the entity against itself (e. measuring the variability in the number of defects is a method for testing the consistency of a production line.g. and those that can only be seen as anomalies when compared to other similar entities or when viewed across time (unknown thresholds). over time and against other audit entities. continuous auditing supports automation of audit recommendation follow-up. However.g. the entity’s performance over the last five years compared to its current performance). This allows one to test the consistency of a process by measuring the variability of each dimension. Simply knowing that an audit entity processed a journal voucher that is greater than a cut-off amount will not help auditors to gauge whether the entity has improved in its use of journal vouchers. Continuous auditing also allows auditors to follow up on the implementation of audit recommendations. Continuous auditing allows auditors to quickly identify instances that are outside the allowable range (known thresholds).g. For example. With continuous auditing. What are we going to do about it? Continuous auditing applied to accounts payable – an example While continuous auditing can be used in any area of the organization. once the risks related to an activity are identified and activities to reduce such risks are undertaken. Further. such as the labor cost for . 2. Cost-based measures cover the financial side of performance. Identification of trends related to performance and efficiency. 4. the review of subsequent performance (continuous auditing) can gauge how well the mitigation efforts are working. the analysis would consider trends over time and compare the accounts payable section under review to other accounts payable sections within the organization. Audit. performing similar functions. As the actions of an organization become more observable. A wide variety of data-driven and non-data-driven risk factors should be included in the initial risk assessment. What is the impact? 3. quality and time-based performance measures. In each case. The tracking of the implementation of audit recommendations and their affect on accounts payable operations. Benchmarking against external A/P operations adds another dimension to the examination. A comprehensive evaluation of business performance looks at cost. Risk Identification and Assessment. The example will be used to discuss four main objectives: 1. of different sizes. The example assumes that there are numerous separate accounts payable (A/P) processing centers. The data-driven predictors of performance must be responsive to changes in performance. What happened? 2. 3. The identification of specific anomalies and potential frauds. through continuous auditing. continuous auditing facilitates the implementation of ongoing quality improvement and assurance.13 element of performance measurement and continued improvement in operations. can assess the quality of performance over time and ensure the prompt resolution of identified problems. Identification and assessment of risk related to the accounts payable processes. They should help an organization answer three basic questions if the indicator goes “Red:” 1. provide an early warning when performance is deteriorating. a simple example involving accounts payable illustrates the differences and strength of this approach. be easy to use and not be resource intensive. retention rates and training received – this data should be available from the HR system. Efficiency measures allow you to compare one audit area to another: Analyzing trends can help to identify not only problems but also areas where improvements have been made. (Particularly telling if early payment discounts are not taken. continuous auditing can determine: • • • • • • • • • • Number and classification/level of accounts payable staff. such as the average number of errors per invoice. percentage paid early. The graph below shows that Division D still has the . Generally speaking. It is also possible to determine. Percentage of recurring payments or Electronic Funds Transfer (EFT) payments.) Percentage of adjusting entries. For example.) Average dollar cost to process an invoice. Percentage of invoices paid late.14 accounts payable. for each A/P section. The combination of this type of information with the transaction types and volumes can help to identify areas of risk. Average number of days to process a payment. trending data will easily identify performance and efficiency concerns. For example. look at number of correcting journal entries and manually produced checks. number and classification/level of staff. for each A/P operation. (Purchase card could be used for more efficiency and less cost). You can also examine organization structure: reporting relationships. Percentage of invoices that do not reference a purchase order. there is greater complexity in operations when more transaction types are processed. These are indicators of additional workload. such as the average number of days to pay an invoice. When considering A/P. (Too many or too few can increase risk. the types of transactions and dollar amounts for each. Timebased measures focus on efficiency of the process. Number of invoices processed by each user at either end of the spectrum. Percentage of invoices that are less than $500. length of time in job. such as understaffing or lack of trained staff to handle complex transaction types Trends in performance and efficiency. The analysis also will tell you how many different types of transactions are being processed. Percentage of manual checks. Quality-based measures assess how well an organization’s products or services meet customer needs. whereas Division G’s percentage has gone up..S. Identification of all functions performed by each user to identify incompatibility or lack of segregation of duties. and more opportunities to take early payment discounts). Improvements in the days-to-pay figures (reduction in late payment charges.15 highest percentage of invoices without a purchase order reference. Identification of anomalies or potential fraud. Decrease in the number and dollar value of duplicate invoices. Mrs. Improved operations – lower cost per invoice. Mr. Invoices processed against purchase orders that were created after the invoice date (back-dated purchase orders). Identification of instances where the payee is the entry or approving user. Identification of duplicates in the vendor table or of vendors with names such as C. phone numbers or other key information. a single accounts payable clerk. and only used by. Identification of vendors that were created by. • • • • . or vendor with no contact information.H. but they have made considerable improvements over the previous year. The aim is to determine whether management has implemented the recommendations and whether the recommendations are having the desired effect. Identification of instances where the entry user is the same as the user who approves payment.. more use of EFT payments. Number of invoices going to suspense accounts. Reduction of duplicates in the supplier master table. The final objective of continuous auditing is the tracking of recommendations. Tracking of recommendations. Possible measures include: • Evidence of increased used of purchase cards for low dollar transactions (reduction in percentage of invoices less than $500 and increase in percentage of purchase card payments less than $500). possible anomalies and measures of potential fraud include: • • • • • • • • The identification of duplicate payments (should include a comparison to previous years to see if operations are improving).A. Within A/P. the design of the predictive indicators. Identification of sources of the data to support risk assessment. datadriven. an assessment of the baseline assurance. Definition of relevant variables (predictors) to be measured. Definition of the desired traits for the variables (normal range. Selection of audit projects. continues into the conduct and reporting phase and culminates with the ongoing monitoring and follow-up activities. Prioritization of risk. Assessment of the predicted level of risk. anomalies). Revision to variables that will be measured. Understanding of the data and an assessment of its reliability. Conclusion . to the maximum extent possible. More detailed steps include: Audit plan preparation and planning phase • • • • • • Identification of categories/areas of risk. All stages of the process should be risk-based and. monitoring for changing conditions and follow-up as required. Follow-up audit activity as required. Preparing for continuous auditing Continuous auditing starts with the selection of audit projects. The basic implementation strategy must include a consideration of the risk. Measurement of the variables (predictors). Assessment of the levels of risk. criteria and the traits. Audit conduct phase • • • • • • • • Integration of audit procedures and technology. Definition of the criteria for these variables to be used to predict outcomes.16 The graph below shows how continuous auditing can be used to determine whether A/P operations in each division have successfully implemented the recommendation calling for purchase cards to be used for low dollar transactions. the audit organization will have to develop and maintain the technical competencies necessary to access and manipulate the data in multiple information systems. If the auditors are not already using data analysis techniques to support audit projects. as well as built-in review mechanisms and internal review measures. Finally. Monitoring and review is the final component of an effective control framework (COSO’s five elements of a control).17 The implementation of continuous auditing will place certain demands on internal auditors. In particular. The implementation of continuous auditing will also require the adoption of the concept by all persons within the audit organization. Continuous auditing will support and strengthen the monitoring and review environment in an organization. It is a key ingredient in an organization’s continuous improvement process. the audit group will have to purchase analysis tools and develop and maintain analysis techniques. it will help focus the audit effort but will not obviate management’s responsibilities to perform a monitoring function . An effective monitoring and review environment uses both periodic reviews and those undertaken by internal and external audit. . please submit your answers to the following exercises and problems to your instructor in a word processing document. Find the “ACL Version 8” folder icon 4. in the folder where ACL data and the tutor are saved on your hard drive (e. ACL Help.18 Chapter 1 For technical assistance with ACL.acl. Alternatively. While on the website. http://www. Click on the PDF file.) Problem 1 Briefly describe Metaphor’s credit card policy. . C:\ACL 8 Data\Sample Data Files) (Note: Unless otherwise instructed. during which stages of the “financial statement audit process” might ACL be the most useful? Problem 3 Go to the ACL internet website by opening ACL Version 8 and clicking on ACL Homepage under ACL Weblinks.
[email protected].) To access the ACL Tutor: 1. After installing ACL Version 8. Tutor. 5. Single click on the “ACL Version 8” folder icon to display the folder contents (i.pdf. open the Start Menu on your computer 2. Insert the ACL disk and follow the instructions to install the software. please contact technical support: 604-669-4225. click on Audit under the Solutions tab.g. Read that page and explain how ACL can help in an audit. ACL Version 8. Click All Programs 3.com. Readme). Problem 2 Looking at Figure 1-3 in Chapter 1 of your auditing textbook. ACL Tutor. ACL Utility.com/supportcenter/ Tutorial Assignment (Estimated time to complete tutor chapter 1 is 15-20 minutes) Read Chapter 1: Introducing Metaphor Corporation of the ACL Tutor (Note: ACL software is bundled with each copy of the 4th edition of the textbook.. you can navigate directly to the file. “ACL Tutor” to open the tutor 6. e.com. Agents_Metaphor table). Alternatively. http://www. How many records result from the filter described? Include the expression you used to create the filter in your solution. Your instructor will inform you which. Problem 3 How does computing the amount paid in commissions to Metaphor agents in Problem 2 help an auditor verify the management assertion of completeness? . Readme). Tutor. ACL Tutor. “ACL Tutor” to open the tutor 6. Chapter 2 (Note: Unless otherwise instructed.com/supportcenter/ Tutorial Assignment (Estimated time to complete is tutor chapter 2 is 20-30 minutes. please contact technical support: 604-669-4225. in the folder where ACL data and the tutor are saved on your hard drive (e. Click All Programs 3. To access the ACL Tutor: 1. C:\ACL 8 Data\Sample Data Files) 7.) Chapter 2 Tutorial Exercises: 1-5 There are five questions at the end of the Chapter 2 tutorial. ACL Version 8. please submit your answers to the following exercises and problems to your instructor in a word processing document. 5.. ACL Utility.. if any. Complete the tasks in the ACL Tutor. Click on the PDF file. You may find it helpful to review the assigned problems before completing the Tutorial Assignment.g. Problem 1 Create a filter to display the employees at Metaphor Company that were hired after January 1. Open the Start Menu on your computer 2. ACL Help. you can navigate directly to the file. Single click on the “ACL Version 8” folder icon to display the folder contents (i. 2000 and who make more than $60. Find the “ACL Version 8” folder icon 4. of the exercises to complete and submit.pdf.19 Chapter 2 For technical assistance with ACL.000 per year in salary.) Read and complete the tasks in Chapter 2: Examine Employee Data of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently.acl. Problem 2 Use ACL to compute how much was paid in commissions to Metaphor Agents (Comm 2002 column. info@acl. However. Problem 2 Roger Company is a mid-size company located in the Midwest that handles the distribution of various home and garden products. Your tasks as one of the auditors on the engagement are outlined below and in other problems of the remaining chapters.000. the engagement partner has made it very clear to you that there is no room for mistakes.388. please contact technical support: 604-669-4225.com.20 Chapter 3 For technical assistance with ACL. of the exercises to complete and submit. What might cause differences between the number reported in the financial statements and the details in the file? . please submit your answers to the following exercises and problems to your instructor in a word processing document. the auditors at Roger Company calculate materiality to be 5 percent of net income before taxes.com/supportcenter/ Tutorial Assignment (Estimated time to complete the chapter 3 tutor is 20-30 minutes. predictable. You are part of the engagement team assigned to audit the financial statements of Roger Company. Now determine how many employees earned more than $85. You may find it helpful to review the assigned problems before completing the Tutorial Assignment. is materially different from the detailed files in Rogers_Company_AR table.500.acl. Net income before taxes at Roger Company for fiscal 2004 is $1. and your firm has rarely encountered any problems with them.) Chapter 3 Tutorial Exercises: 1-2 There are two questions at the end of the Chapter 3 tutorial. (Note: Unless otherwise instructed. and representative of its size. Define tolerable misstatement as 60 percent of materiality. http://www. Determine materiality for the audit of Roger Company’s 2004 financial statements. Please download the Roger Company ACL files. For instructions on accessing the ACL Tutor please see earlier assignments. Net income before taxes at Roger Company is stable.) Read and complete the tasks in Chapter 3: Set up Your Project of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently. found under Course-Wide Content on the Student Edition of your text’s Online Learning Center. Thus. Your instructor will inform you which. Roger Company has been a client of your firm for many years. info@acl. if any. Use ACL to determine if the reported AR account balance. Problem 1 Edit the layout of the Employee_List table to form a new column for total compensation (salary plus bonus). $487.000 in total compensation in 2002. 2004? When was the last review for those vendors? Chapter 4 For technical assistance with ACL. You may find it helpful to review the assigned problems before completing the Tutorial Assignment. Your instructor will inform you which. Click on the Edit View Filter button to open the Edit view filter dialogue box 3. Click on the down arrow. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. if any. Click OK 8. Click on the Date button to display the date selector 6. In the reviews. (Note: Unless otherwise instructed.. double-click on the Last_Review field 4.acl. Click on the “<” sign 5. management at Roger Company reviews each approved vendor at least once a year.
[email protected]/supportcenter/ Tutorial Assignment (Estimated time to complete the chapter 4 tutorial is 20-30 minutes. please submit your answers to the following exercises and problems to your instructor in a word processing document. For instructions on accessing the ACL Tutor please see earlier assignments. Open the Roger_Company_Vendors table 2. and click OK 7. management compares pricing across vendors. Problem 1 Roger Company has a policy that their allowance for uncollectible accounts should be 50% of the amount in the 61-90 day past due category plus 75% of the amount in the >90 .) Chapter 4 Tutorial Exercises: 1-8 There are eight questions at the end of the Chapter 4 tutorial. click on it.) Read and complete the tasks in Chapter 4: Begin Your Analysis of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently. please contact technical support: 604-669-4225. of the exercises to complete and submit. and performs testing to ensure purchasing personnel are not inappropriately favoring a vendor or potentially colluding with vendors (e. In the Available Fields list. 2004. Which vendors have not been reviewed since January 1. find January 1. Use ACL to check the Roger_Company_Vendors table to make sure each vendor has been reviewed sometime since January 1.21 Problem 3 As a quality control procedure.g. 1. receiving kickbacks from the vendors). 2004. retests products being purchased from vendors to ensure they meet quality control standards. http://www. Your instructor will inform you which. of the exercises to complete and submit.com/supportcenter/ Tutorial Assignment (Estimated time to complete is 30-40 minutes.com. info@acl. delete the numbers 10000 and 120 so that your table will compute a >90 day past due total. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. Use the Roger Company AR table in ACL and the Analyze >> Age command to re-compute the allowance for uncollectible accounts.22 day past due category as of the reporting date (in this case 12/31/04). Problem 2 Assuming no cash is collected on past due accounts. Problem 1 How many inventory items at Roger Company are valued at more than $10. click the Analyze tab. 7.acl. (Note: Unless otherwise instructed. Highlight the Amount field under the Subtotal Fields column. http://www. Click Age. please submit your answers to the following exercises and problems to your instructor in a word processing document.000? What is the total value of those items? How many inventory items at Roger Company cost more than $10. 2. 5. 3.) Chapter 5 Tutorial Exercises: 1-5 There are five questions at the end of the Chapter 5 tutorial. Change the cutoff date to December 31.000? What is the total cost of those items? . For instructions on accessing the ACL Tutor please see earlier assignments. Once in the Roger Company AR Table. make sure Due_Date is the selected field for Age On. In the Aging Periods box. You may find it helpful to review the assigned problems before completing the Tutorial Assignment. Click Okay. report the results of the aging table that you are asked to complete. In addition to re-computing the allowance for uncollectible accounts. 6. 1. 2004. please contact technical support: 604-669-4225. 4. if any. In the Age dialog box. how much will be more than 60 days past due as of January 31. 2005? Chapter 5 For technical assistance with ACL.) Read and complete the tasks in Chapter 5: Examine Expense Patterns of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently. com. Your assignment now is to use the Roger_Company_AR table to determine how much in sales were made to these related customers.23 Problem 2 Use information from Roger Company to determine how many inventory items are valued lower than original cost. Use ACL to identify all Accounts Payable invoices greater than $50. you want to identify all invoices (Invoice_Amount) are greater than $50. What is the total market value of those items? What is the total cost of those items? Chapter 6 For technical assistance with ACL. info@acl.. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. receiving records). Problem 1 After reviewing a list of parties related to Roger Company. You may find it helpful to review the assigned problems before completing the Tutorial Assignment.acl. What percent of total sales were made to the two related customers? Problem 2 As part of the audit of Accounts Payable. http://www. please contact technical support: 604-669-4225.e. Why is it important for auditors to determine if large purchases are properly authorized? Chapter 7 For technical assistance with ACL. info@acl. you notice that the customers with customer numbers 803882 and 512198 are related to the owners of the company.com/supportcenter/ Tutorial Assignment (Estimated time to complete is 40-60 minutes) Read and complete the tasks in Chapter 6: Analyze Transactions of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently. of the exercises to complete and submit.com. Your instructor will inform you which. please contact technical support: 604-669-4225.) Chapter 6 Tutorial Exercises: 1-5 There are five questions at the end of the Chapter 6 tutorial. http://www.000 and compute the total value of those transactions.000 so that you can vouch the transaction to original documentation (i.acl. For instructions on accessing the ACL Tutor please see earlier assignments. please submit your answers to the following exercises and problems to your instructor in a word processing document. (Note: Unless otherwise instructed. if any.com/supportcenter/ Tutorial Assignment (Estimated time to complete is 20-30 minutes) . approved purchase order. Using the Roger Company shipping file. you learn that it is common for a partial or “split” shipment to go out because a sufficient quantity of items a customer orders is not in stock. controls over shipping should prohibit shipping a higher quantity than was ordered.24 Read and complete the tasks in Chapter 7: Validate. (Note: Unless otherwise instructed. However. Problem 1 Roger Company’s policy is to not ship goods unless a valid purchase order has been received. Problem 2 In discussions with order the fulfillment and shipping departments. if any. of the exercises to complete and submit. When rush orders are received the sales person taking the order completes a “Rush Order” form which is then approved by the sales department supervisor. The “Rush Order” form is then attached to the purchase order when it is received and the details of the two forms (i. Your instructor will inform you which. you learned that occasionally a rush order is received via telephone and the goods are shipped before receiving the purchase order. To test the effectiveness of the controls around rush orders. please submit your answers to the following exercises and problems to your instructor in a word processing document. You may find it helpful to review the assigned problems before completing the Tutorial Assignment. you want to identify all situation where product is shipped before a purchase order is received. However. based on information obtained during your walk through to confirm your understanding of processes and controls. Correct. determine how many invoices were shipped before they were ordered. Using information from Roger Company’s shipping file. For instructions on accessing the ACL Tutor please see earlier assignments.e. Rush orders are only processed for existing customers. . product and quantity) are compared. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. and Extract Data of the ACL Tutor Hint: Staying actively involved while completing the tutorial assignment will help you to complete the ACL problems more efficiently.. determine how many records contain fields where the quantity shipped exceeds the quantity ordered.) Chapter 7 Tutorial Exercises: 1-7 There are seven questions at the end of the Chapter 7 tutorial. please submit your answers to the following problems to your instructor in a word processing document. or expected error rate—has the smallest effect on the sample size? b. Upper Error Limit (%) decreases to 7? e. please contact technical support: 604-669-4225. What is the recommended sample size? Problem 2 How would the sample size change if all sample-size inputs listed in Problem 1 stayed the same with the exceptions listed below? Please evaluate each item independently by resetting the inputs to those listed in Problem 1 and changing only the one factor listed in each item below. Which two factors appear to have the greatest effect on sample size? c. Click Calculate 5.com/supportcenter/ (Note: Unless otherwise instructed. (Hint: If you use the Calculate button rather than the OK button the sample size window will stay open). With any ACL project (e. Expected Error Rate (%) increased to 4? d.) Problem 1 Use ACL to determine the sample size an auditor should use for attributes sampling given the criteria listed below: 1. Which of the following four input factors—confidence. Roger Company) open.000? c. population.25 Chapter 8 For technical assistance with ACL.com. upper error limit. What happens as the expected error rate is nearly as large as the upper error limit or tolerable error? Why does this happen? . Choose the Record option • Confidence is 95 • Population is 1000 • Upper Error Limit (%) is 8 (this is tolerable error) • Expected Error Rate (%) is 3 4.. Population increased to 500. a. Go into ACL’s sampling size tool and input the factors listed in Problem 1 and then experiment with increasingly larger expected error rates.g. info@acl. Confidence dropped to 90 percent? b. http://www. choose Sampling on the menu toolbar 2.acl. Upper Error Limit (%) increases to 15? Problem 3 Using your results from Problem 2 above: a. Click on Calculate Sample Size 3. Number of Errors or deviation listed above) 4. For problem 8-27. receiving report.5 percent.. 1-The purchase order was approved (purchasing department stamp provides evidence) 2-The purchase order. Did the differences lead to different conclusions or auditor decisions? .26 Problem 4 For the following three control attributes. Enter the applicable parameters (e.g. Select Sampling >> Evaluate Error 2. Confidence is 90 and Sample Size is 52. Roger Company) evaluate the results of your testing by: 1. use the sample sizes computed by ACL in 8-27. Make sure Record is the selected sample type 3. Click OK What is the upper error limit frequency for each attribute? Based on the results of your controls testing. and vendor invoice are included in each voucher packet 3-The accounts payable department compared product and quantities across the three documents (initials by an accounts payable clerk and auditor reperformance provide evidence) You tested a sample of 52 voucher packages and discovered the following deviations: • 2 deviations for attribute 1 • 1 deviation for attribute 2 • 0 deviations for attribute 3. With any ACL project open (e.. which controls are considered effective? Please explain why or why not? Problem 5 Use ACL to complete problems 8-27 and 8-28 in your book. does the population amount you enter change the results? For 8-28. ACL’s sample sizes and upper error limit frequency will differ from those computed using the tables in the textbook. you want to be 90 percent confident that the population deviation rate does not exceed 7.g. 1.com/supportcenter/ (Note: Unless otherwise instructed. click on OK 8. Click on the Size button so the Size Dialogue box opens 6. please contact technical support: 604-669-4225.) 7. Click on Calculate. Click OK 10. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. evaluate the effectiveness of the control that the invoice date should always precede the due date. Draw a sample of Accounts Receivable (AR) transactions from the Roger Company AR table assuming the confidence is 95.. Sample Size 175.) Problem 1 In addition to determining sample size. Enter the appropriate parameters (i. Select Sampling from the menu toolbar and click on Evaluate Error 4. Select Sampling >> Sample Records 3. Confidence 95. Open the Roger_Company_AR table 2. info@acl. http://www. 1. How many exceptions are there to the control above? 3.27 Chapter 9 For technical assistance with ACL. please submit your answers to the following problems to your instructor in a word processing document. click on the Random option 5. How many records are in the new Roger Company AR Sample table? Problem 2 Assuming that the electronic data were difficult to obtain and that the client compiled the electronic data only for the sample you selected in Problem 1. can the control be considered effective? Why or why not? Problem 3 Determine an appropriate sample size to test the Roger_Company_AR table using monetary unit sampling by following the directions below. Under Sample Parameters. Create a filter in the Roger AR Sample table for the control described above 2. In the To field. Enter the parameters as specified above (Note: The Population field should automatically have a value in it. and the number of exceptions you observed) 6. Open the Roger_Company_AR table 2. ACL can also select a random sample for you. and the expected error rate is 5 percent. the upper error limit is 9 percent. Select Sampling >> Calculate Sample Size .com. Click OK 7. What is the upper error limit frequency? Based on the results from the operations you completed above.acl.e. type “Roger AR Sample” 9. Make sure Record is the selected sample type 5. In the Sample Dialogue box make sure Record is the chosen sample type 4. Sum the Amount field 3. 1. Input the following: • Confidence is 92 percent • Population is the sum of the Amount field • Materiality is 10. Click on Calculate 7. Save the table as “Roger Company MUS Sample”. What is the appropriate sample size? Problem 4 Create a Roger Company MUS Sample table (or file) by selecting Sample >> Sample Records. Enter the appropriate Interval value from the results in Problem 3. Ignore the Cutoff. . and chose 350 as the Start. In the Size dialogue box make sure Monetary is the chosen sample type 5. Make sure MUS is the chosen sample type and Fixed Interval is the chosen option under Sample Parameters.28 4.000 • Expected Total Errors is 1500 6. How many records are in the sample table? Why is the sample size different from what was calculated in Problem 3? Problem 5 Use ACL to complete questions b and c of problem 9-21 in your textbook. Rogers included a liability in the current year.com. and determine how many purchases were made from unauthorized vendors. Problem 2 In prior year’s audits.acl. by vendor number. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. the auditor has discovered cutoff errors in the purchasing area.29 Chapter 11 For technical assistance with ACL. Use the Relate Tables command in ACL to relate. The fiscal year for Roger Company is from March 1. info@acl. 2004 to February 28. even though the purchase transaction related to the next year. In some cases. please submit your answers to the following problems to your instructor in a word processing document.) Problem 1 A risk in the purchasing process is that a purchase is made from an unauthorized vendor.com/supportcenter/ (Note: Unless otherwise instructed. http://www. 2005. What is the total invoice value of the purchases that were inappropriately included in the fiscal 2005 AP balance that belong in the fiscal year 2006 balance? . Rogers included a liability in the subsequent year when it should have been included in the current year. This can be accomplished by creating a new column of vendor numbers from the Roger_Company_Vendors table and adding it to Roger_Company_AP_Transactions table. please contact technical support: 604-669-4225. the Roger_Company_Vendors table to the Roger_Company_AP_Transactions table (see Tutorial Chapter 6). In other cases. This histogram will help you to visualize the market value of inventory items at Roger Company. http://www. sometimes certain inventory items become obsolete and must be priced lower than the original cost. please submit your answers to the following problems to your instructor in a word processing document. Choose 100 as a minimum and 10. there has been significant turnover in the HR department and you want to test that payroll checks are going only to current. Document your results. determine which items Roger Company is selling at a price below the original cost. Comment on the results of your histogram. Leave the interval at 10. Problem 2 Create a histogram of the market value of the inventory items at Roger Company. However. Chapter 13 For technical assistance with ACL. Using the Roger Company file.
[email protected]/supportcenter/ (Note: Unless otherwise instructed. Problem 2 Using ACL.acl.) Problem 1 Inventory is typically sold at a price higher than cost. please contact technical support: 604-669-4225. Alternatively. test the Roger_Company_Employee_Master_List table for duplicate records. please submit your answers to the following problems to your instructor in a word processing document. http://www.com.acl. Use the Data >> Relate Tables command in ACL (see Tutorial Chapter 6) to make sure that all employees who are receiving checks are actual employees of the company.com. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. info@acl. Although Roger Company hasn’t had any problems of this nature in the past.com/supportcenter/ (Note: Unless otherwise instructed.) Problem 1 A relatively common fraud involves a fraudster writing checks to a “ghost” employee. How many duplicate records exist? Also.000 as a maximum. you can print the graph and submit it to your instructor with your solutions.30 Chapter 12 For technical assistance with ACL. Copy the graph to your clipboard and paste it to the word processing document you are using to submit your answers. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. . How many duplicate records exist? Comment on the results. test the Roger_Company_Payroll table for duplicate records. valid employees. please contact technical support: 604-669-4225. com. on the other hand. ACL can help with such a procedure by expediting the scanning process. info@acl. footing can easily be done by simply selecting a column and pressing the Σ button. please contact technical support: 604-669-4225. please contact technical support: 604-669-4225. Comment on the results.acl. please submit your answers to the following problems to your instructor in a word processing document. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center.com/supportcenter/ (Note: Unless otherwise instructed. is not as easy. Footing is the process of adding a column of numbers. and cross-footing is the process of adding a row of numbers. Include the expression you used in your answer. Cross-footing. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. In the Roger_Company_Shipping table use the expression filter to determine if the Subtotal field and the Tax field add up to equal the Invoice_total field. Problem 2 Another way auditors can quickly scan a large database of transactions is to use the Analyze >> Classify command in ACL. Use the Analyze >> Stratify command in ACL to stratify the Invoice_Amount field in the Roger_Company_AP_Transactions table.com. especially when the database of transactions is large. Use the Analyze >> Classify command in ACL to classify the Vendor_Number field in the Roger_Company_AP_Transactions table. Are there any transactions that seem unusual? Include a copy of the classification table in your answer. info@acl. Chapter 15 For technical assistance with ACL.) Problem 1 Common procedures that auditors perform are footing and cross-footing. As was demonstrated in earlier ACL problems. Are there any transactions that seem unusual? Include a copy of the stratification table in your answer. http://www.) Problem 1 An audit procedure that is useful for identifying potential risks is to scan transactions for unusual items. Choose Invoice_Amount as the subtotal field.acl.31 Chapter 14 For technical assistance with ACL. please submit your answers to the following problems to your instructor in a word processing document. Comment on the results.com/supportcenter/ (Note: Unless otherwise instructed. What seems to be the reason why there are a few cases where the Subtotal field added to the Tax field doesn’t equal the Invoice_total field? . http://www. How much has been paid for legal services? Were payments for legal services made to law offices other than Happy Homes? Problem 2 . please contact technical support: 604-669-4225. Data for non-routine cash disbursements is saved in a different database. Are there any gaps and/or duplicates? Imagine what it would be like to manually look for duplicates or gaps in a large database and compare that to how ACL was able to accomplish the same task. Chapter 17 For technical assistance with ACL.com/supportcenter/ (Note: Unless otherwise instructed. and everything else should be in the other database. you want to make sure no other legal fees have been paid to other law offices. Use ACL and the Roger_Company_Cash_Disbursements table to determine if all cash disbursements are under $1.500.500 as routine. http://www.) Problem 1 Use ACL and the Roger_Company_Cash_Disbursements table to determine how much has been paid for legal services over the last year. Specifically. Using ACL conduct a search for payments to other lawyers. Problem 2 Roger Company has a policy of making routine cash disbursements on a bi-monthly basis and saving the cash disbursements information in a database that is available to you as the Roger_Company_Cash_Disbursements table.” However. please submit your answers to the following problems to your instructor in a word processing document.acl. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center.com/supportcenter/ (Note: Unless otherwise instructed. info@acl. please submit your answers to the following problems to your instructor in a word processing document.com. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center.com. Roger Company considers cash disbursements under $1. From experience on past audits.) Problem 1 Use ACL to test the integrity of the data in the Roger_Company_AR table. http://www. info@acl. you know that the law office that handles all of Roger Company’s legal issues is Happy Homes Law Offices and that Roger Company records legal payments as “Legal Services. use the Analyze >> Look for Gaps and Analyze >> Look for Duplicates commands to determine the consistency of the data in the Invoice_Number field.32 Chapter 16 For technical assistance with ACL.acl. please contact technical support: 604-669-4225. Comment on the results. Chapter 20 For technical assistance with ACL. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. please submit your answers to the following problems to your instructor in a word processing document. please contact technical support: 604-669-4225.com/supportcenter/ (Note: Unless otherwise instructed. go back to the ACL problems you have completed throughout the term to refresh your memory regarding the capabilities within ACL. info@acl. http://www. please contact technical support: 604-669-4225.500 limit to Hartford Brothers for cleanings services.acl. Use ACL and the Roger_Company_Cash_Disbursements table to determine if all balances are under $500. The Roger_Company_Cash_Disbursements table is organized to display the running accounts payable balance over time.33 Roger Company has a policy that routine payments should be made frequent enough so that a vendor’s accounts payable balance never exceeds $500. Comment on the results considering both the typical running balance and payments that exceed the routine transaction limit (see description in Problem 2. If necessary. . info@acl. Roger Company files can be downloaded from the Course-Wide Content on the Student Edition of your text’s Online Learning Center. please submit your answers to the following problems to your instructor in a word processing document. http://www.com/supportcenter/ (Note: Unless otherwise instructed. Chapter 16).) Problem 1 Write a brief paragraph explaining how you believe ACL is most useful to auditors.com.com. Chapter 21 For technical assistance with ACL. Use ACL and the Roger_Company_Cash_Disbursements table to ascertain what the typical running balance is for the Hartford Brothers vendor. Comment on the results.acl.) Problem 1 In Problem 2 from Chapter 16 it was discovered that there were some routine cash disbursements that exceeded the $1. identified risks or accept the risk because of cost considerations. or actions to address significant. programs.34 Questionnaire for Problem 6-34 Risk Assessment Questionnaire Client: EarthWear Clothiers Completed by: ___ Date: ______ Balance Sheet Date: 12/31/2005 Reviewed by: ___ Date: ______ A risk assessment process should consider external and internal events and circumstances that may occur and adversely affect its ability to initiate. Yes. Management should initiate plans. and report financial data consistent with management’s assertions. and are they supported by strategic plans? Does the entity have a risk analysis process that includes estimating the significance of the risks. No. and determining the actions needed to respond to the risks? Does the entity have mechanisms to identify and react to changes that may dramatically and pervasively affect the entity? Comments . process. record. N/A Does the entity set entity-wide objectives that state of what the entity desires to achieve. assessing the likelihood of their occurring. Control activities ensure that the entity’s financial reporting objective is carried out. assets. programs and data files? Comments .35 Control Procedures Questionnaire Client: EarthWear Clothiers Completed by: ___ Date: ______ Balance Sheet Date: 12/31/2005 Reviewed by: ___ Date: ______ Control procedures include the policies and procedures that insure that management’s directives are effective in processing and preparing financial statements. N/A Does management have clear objectives in terms of budget. documents. profit. and other financial and operating goals? Are such objectives: • Clearly written? • Actively communicated throughout the entity? • Actively monitored? Does the appropriate level of management: • Adequately investigate variances? • Take appropriate and timely corrective actions? Has management established procedures to prevent unauthorized access to. No. or destruction of. Yes. records. and regulatory information obtained from external sources. including relevant external and internal information? Is the information provided to the right people in sufficient detail and in time to enable them to carry out their responsibilities effectively? Is the development or revision of information systems over financial reporting based on a strategic plan? COMMUNICATION Communication includes the extent to which personnel understand how their activities in the financial reporting information system relate to the work of others and the means of reporting exceptions to an appropriate level within the entity. as well as internally generated information. No. N/A Does the information system give management the necessary reports on the entity’s performance relative to established objectives. No. economic.36 Information and Communication Questionnaire Client: EarthWear Clothiers Completed by: ___ INFORMATION SYSTEMS Information systems initiate. Relevant information includes industry. process. Yes. N/A Does management communicate employees’ duties and control responsibilities in an effective manner? Are communication channels established for people to report suspected improprieties? Does communication flow across the organization adequately to enable people to discharge their responsibilities effectively? Comments Comments Date: ______ Balance Sheet Date: 12/31/2005 Reviewed by: ___ Date: ______ . record. and report information. Yes. No. Yes.37 Monitoring Questionnaire Client: EarthWear Clothiers Completed by: ___ Date: ______ Balance Sheet Date: 12/31/2005 Reviewed by: ___ Date: ______ Management should monitored internal control in the ordinary course of operations. N/A How many customer complaints are received about billings? Are complaints investigated for underlying causes and any internal control deficiencies corrected? Does the entity have an internal audit function? Are internal control recommendations made by internal and external auditors implemented? Does the entity conduct separate evaluations of internal control? Comments . This monitoring includes regular management and supervisory activities and other actions personnel take in performing their duties that assess the quality of internal control. Attributes include the board or audit committee’s independence from management. Yes. the extent of its involvement and scrutiny of activities.38 Control Environment Questionnaire Client: EarthWear Clothiers Completed by: _____ Date: ______ BOARD OF DIRECTORS AND AUDIT COMMITTEE An entity’s control consciousness is influenced significantly by the entity’s board of directors or audit committee. the experience and stature of its members. N/A Comments Are there regular meetings of the board of directors (or comparable bodies) to set policies and objectives. and take appropriate action. and are minutes of such meetings prepared and signed on a timely basis? Does an audit committee exist? Does the audit committee adequately assist the board in maintaining a direct line of communication with the entity’s external and internal auditors? Does the audit committee have adequate resources and authority to discharge its responsibilities? Is this evidenced by • Regular meetings? • The appointment of qualified members? • Minutes of meetings? Balance Sheet Date: 12/31/2005 Reviewed by: _____ Date: _______ . review the entity’s performance. No. the degree to which difficult questions are raised and pursued with management. the appropriateness of its actions. and its interaction with internal and external auditors. Establishing a relevant organizational structure includes considering key areas of authority and responsibility and appropriate lines of reporting. No. No. Yes.39 MANAGEMENT PHILOSOPHY AND OPERATING STYLE Management’s philosophy and operating style significantly influence the control environment — particularly when management is dominated by one or a few individuals. N/A Comments Is the organization of the entity clearly defined in terms of lines of authority and responsibility? Are controls for authorization of transactions established at an adequately high level? Are such controls adequately adhered to? Is the organizational structure appropriate for the size and complexity of the entity? Has management established policies for developing and modifying accounting systems and control activities? Are accounting and data processing centralized or decentralized? . Management’s philosophy and operating style should create a positive atmosphere that reduces the risk of misstatement and that is conducive to the effective operation of internal control. controlled. executed. and monitored. N/A Comments Are management and operating decisions dominated by one or a few individuals? Are business risks adequately monitored? Is management willing to adjust the financial statements for misstatements that approach a material amount? Does management adequately consult with its auditors on accounting issues? Has management been responsive to prior recommendations from its auditors? Is a high priority given to internal control? ORGANIZATIONAL STRUCTURE An entity’s organizational structure provides the framework within which its activities for achieving entity-wide objectives are planned. Yes. promoting. N/A Comments Is there a clear assignment of responsibility and delegation of authority to deal with such matters as organizational goals and objectives. evaluating. compensating. clearly established and communicated to employees? Has management clearly communicated the scope of authority and responsibility to data processing management? Does adequate computer systems documentation indicate the controls for authorizing transactions and approving systems changes? Is there adequate documentation of data processing controls? HUMAN RESOURCE POLICIES AND PROCEDURES Human resource policies and practices relate to hiring. counseling. orientation. No. and remedial actions. N/A Comments Do client accounting personnel appear to have the background and experience for their duties? Do client accounting personnel understand the duties and procedures applicable to their jobs? Is the turnover of accounting personnel relatively low? Does the entity adequately train of new accounting personnel? Does the workload of accounting personnel appear to permit them to control the quality of their work? Does previous experience with the client indicate sufficient integrity on the part of personnel? .40 ASSIGNMENT OF AUTHORITY AND RESPONSIBILITY The methods of assigning authority and responsibility should result in clear understanding of reporting relationships and responsibilities established within the entity. Yes. reporting relationships. and constraints. training. Yes. and regulatory requirements? Are employee job responsibilities. including specific duties. No. The entity’s human resource policies and practices should positively influence the entity’s ability to employ sufficiently competent personnel to accomplish its goals and objectives. operating functions. Actual performance is reported on a weekly and monthly basis.41 EarthWear Clothiers Memo on Internal Control Components 12/31/05 Prepared by: MKT Date: 10/15/05 The following information was gathered through inquiry with EarthWear’s Risk Management Officer. and growth plans. The company uses a business plan and budgeting process to monitor decisions. Information System and Communication: The strategic plan and the budgeting process identify information that is needed to analyze and monitor the entity’s objectives. Monitoring: . and to recommend appropriate actions. Chief Information Officer. Employees are provided with information regarding their duties during their initial training. See B10 for a description of the IT Department’s controls over access to (1) the computer operations area and (2) data programs and files. See A20 for extracts of significant items from the controller’s report. and Chief Internal Auditor. There is a strategic plan for updating the information systems over financial reporting that is revising on an annual basis. Control Procedures: EarthWear has a very sophisticated budgeting process that includes monitoring activities. Monthly meetings are held by senior management to discuss recent events and how they may affect the company. EarthWear’s employee manual states that suspected violations of company policies should be reported to a vice president. Management has prepared a five-year business plan that includes goals about that company’s products. All significant budget variances are summarized and explained in a monthly controller’s report. The Entity’s Risk Assessment Process: EarthWear has established broad objectives. responsibilities. Performance is monitored by the controller’s office. There are good communications channels across departments. There are procedures that allow such suspected violations to be reported anonymously. All department groups within EarthWear are required to provide timely and adequate financial reporting. Management relies heavily on its Risk Management Department to identify risks that may affect the company. Chief Financial Officer. 004 0. .525 Months July August September October November December Gross Margin % Auditor expectation Legend: λ = Traced to monthly sales journal. Since this amount is less than the tolerable difference of $885.000 1653.006 0. Recommendations that management and the board feel are cost beneficial are implemented.000 invoices).01 0.025 0.425 5.890.000 6480.870.000.525 is approximately $20.000 13813.000 x 0.800 935. the analytical procedure supports the fair presentation of the reserve for returns account.000 less the book value of $5. Most complaints relate to delays in receiving goods that are on order by the company.000.032 Estimated Returns 293.200 496. The board of directors focuses on the control environment and monitoring activities.015 0. ‡ = Historical rate tested for reasonableness Conclusion: The expectation of $5. E20 SAA 1/10/06 EarthWear Clothiers Reserve for Returns Account 12/31/05 Monthly Sales (in 000s) λ $ 73300 82800 93500 110200 158200 202500 Historical Return Rate ‡ 0.870.000 3955. The audit committee meets regularly with the internal and external auditors about control related activities.42 Customer complaints are generally very low (1 out of every 5. 43 . 44 . 45 . 46 . 500 18. † = Recaluated the average interest rate for the client’s debt.000 Legend: £ = Traced to monthly general ledger balance.200 20.100 17.000 $ 230.000 x .900 16.0525† = $1.200 34.000 from the auditor’s calculation is not material based on tolerable difference of $49.100 15.010. The difference of $27.47 E20 SAA 1/7/06 EarthWear Clothiers Reasonableness Test of Interest Expense 12/31/03 Month January February March April May June July August September October November December Total Average $19.500 28. No further investigation.240 .500 14.150.200 11. Balance (in thousands) $ 21.600 18.100 15.900 19.000 of interest expense.240. Conclusion: EarthWare’s income statement shows $983. 48 . 49 . 50 .