Question

(CASE STUDY )Company Information: ABCCompany is a large automotive dealer company operating in the fieldof automobile retailing that is owned by a big Holding GroupCompany XYZ. ABC Company buys cars from distributors of well knownbrands and sells them to customers as the authorised dealer. ABCCompany also provides after-sales service, spare parts andsecond-hand services for many automobile brands. The company has 7branches throughout the Country. The company prioritizes customersatisfaction, and relies on its years of expertise.

ABC Company employs around 380 people and has an annual turnoverof about NZ$100million.

The Company doesn’t have an Internal Audit department. But theGroup Holding Company XYZ (total employee of 2000 people withconsolidated annual turnover of NZ$ 4 billion) has an internalaudit department (4 qualified internal auditors working for thedepartment) that audits 17 group companies based on theirrisk-based audit planning for their audit assignments.

ABC Company has an Audit Committee.

Incident / Case: Auto PartsDepartment’s Stock Planner (will be referred to as Stock Plannerthroughout this document) whose main duty is to plan theprocurement of auto parts and to place purchase orders based onapproved plan) was accused of stealing expensive parts and sellingthem personally in the street market. This came to management’sattention through informal internal whistleblowing (one employeesaid that a friend of his saw the Stock Planner doing something notright).

The Management informed the Audit Committee. The Audit Committeeasked the Group Internal Audit (will be referred to as InternalAudit throughout this document) to evaluate the whistleblowinginformation.

At the start of their investigation, Internal Audit deactivatedall system access rights of the Stock Planner and asked Companymanagement to send him on annual leave. Internal Audit interrogatedthe Stock Planner several times outside the company premises andinvestigated all his previous years’ dealings looking for allpossible ways for him to cheat.

Internal Audit findings noted that this person was involved inseveral different fraudulent activities at the same time.

It also became quite apparent that there were serious weaknessesin the Company’s Internal Control System, grouped under thefollowing three headings:(1)unapplied operational process controls;(2) ineffective financial controls;and(3) deactivated systemcontrols.

As soon as the internal auditwork was finalized the results were reported to the ABC Management,ABC Audit Committee and Group Holding Company XYZ (who is ashareholder of the ABC Company appointing some boarddirectors).

The main findings related to theStock Planner’s fraudulent activities are as follows:

– He made several product codemodifications over 4 years (changing the product codes of expensiveauto parts stolen from the warehouse to car paint product codes, anuncountable –liquid- product category so that inventory differencesare not detected at stock counts).

– He invoiced auto parts withoutapproved customer’s order (customer is not aware – fictitousaction); waiting as open account (showing as receivable infinancial accounts) to be collected for some time.

– He invoiced customers withunauthorized signature and fake stamps to collect cash money fromthe customer and not reflecting any of these in the accountingsystem.

– He took expensive auto partsout of the warehouse assigning them to open job orders that werecreated for cars waiting to be serviced at scheduled times (so thatwarehouse responsible would allow the stock to be taken out of thewarehouse).

– He took expensive auto partsout of the warehouse assigning them to ‘reserved for customer’status in the system (as if customer had ordered) so that warehouseresponsible would allow the stock to be taken out of thewarehouse.

– He took some auto parts out ofthe warehouse assigning them to unauthorized/unapproved job ordersbypassing any procedural controls.

– He took an employee loan andhas not paid back, claiming that he has financialdifficulty.

In response to the Internal Auditfindings, the ABC management terminated the employment contract ofthe Stock Planner (and some other employee who did not do theirjobs properly in relation with what happened) and started legalaction to recover their losses and to get him prosecuted for hisfraudulent activities.

The Management also immediatelyundertook the following actions recommended by the Internal Auditand closely monitored by the Audit committee:

– Made the necessary adjustmentsin the company accounts (financial entries)

– Made organizational changesincluding job rotations.

– Established a voice of ethicshotline and implemented a formal whistleblowing system in thecompany.

– Revised company proceduresgoverning the review, authorisation and approvals of job orders andthe policy & procedures for monitoring open accounts(receivables from service customers).

– Reviewed the reconciliations ofcustomer accounts which were performed by Internal Audit duringtheir investigations for any additional potential problems andinstructed Finance to perform such reconciliations on a monthlybasis going forward (which was not being made on a regularbasis).

– Reviewed stock count performedby Internal Audit and asked Finance to carry out monthly stockcounts going forward.

– Reviewed and updated systemaccess rights.

– Asked Information SystemsDepartment to generate built-in locks and warnings for criticalsystem transactions.

– Produced exception reports andlog reports (which need to be reviewed by appropriate management ona periodic basis)

– Asked related line managementto do a timely and effective implementation of operational controlsand financial controls.

A copy of the internal audit report circulated isattached (see attachment 1) for further details. Financials of theABC Company is also attached at the end of this document (seeattachment 2).

REQUIREMENTS Please discuss andevaluate and discuss the case study and answer the followingquestions:

1. Could the external auditor have detected thefraudulent activities? Defend your answer.

2. What should the external auditor do when this issueis reported to him? Discuss how the external auditor should usethis information derived from internal audit investigation todetermine the external audit responsibility for the detected fraudand its implications for audit planning. Your answer should referto ISA (NZ) 240 and ISA (NZ) 315.

3. How should the Audit Committee act on the informationabout the fraudulent activities when Internal Audit reported theincident? Discuss the Audit Committee’s responsibilities for thiscase.

ATTACHMENT 1: INTERNAL AUDITREPORT

Summary Report on Auto Parts Fraud Company ABC

Internal Audit Distribution: MA AN TA GS –Printed Copies: 4

PART I: FINANCIAL IMPACT OF THE FRAUD (I) AMOUNT THAT COULD BECALCULATED UNTIL NOW:

1. Parts taken out of the inventory and the related amount wereinvoiced without the knowledge of the customers, receivable sittingas open item in the system: $50,801

2. Amount that was invoiced, signed with a fake stamp andcollected from the customer in cash that was not posted in companyaccounts: $14,146

3. Parts taken out of the inventory on the basis of open joborders but not physically present anywhere in the warehouse:$36,396 (at cost)

4. Parts that were reserved in the system in the name of acustomer but physically not present anywhere in the warehouse:$30,814 (at cost)

5. Amount that was borrowed from the company but not paid back:$6,500

6. Product code modifications made over 4 years (changingproduct codes of expensive auto parts stolen from the warehouse topaint product codes, an uncountable (liquid) product category)$408,537*

7. Some auto parts taken out of the warehouse withunauthorized/unapproved job orders $55,934

TOTAL CALCULATED AMOUNT: $603,128

* Examples for parts whose product codes were changed to paintare as follows: expensive accessories sold at the Boutique($22,200), steel tire rim ($24,050), tyres ($11,100), injector($6,660), Screen & Mirrors ($18,500), headlamps ($6,013),hydraulic suspension & compressor ($8,048), arm-rest tool($4,625), indicator panel ($4,255), refrigerator ($2,775),cabrio-type car ceiling ($5,365)

PART II: DEFICIENCIES NOTED (I) UNAPPLIED OPERATIONAL PROCESSCONTROLS:

• Other Service managers confirmed that physical access to theParts Warehouse is not restricted and that even the workshopemployee could enter to the warehouse without any control.

• Periodic stock counts are not performed on a regularbasis.

• Open job orders are not reviewed by appropriate manager on aperiodic basis.

• Discounts given on parts are not reviewed by appropriatemanager on a periodic basis.

• Material movement vouchers are not reviewed by appropriatemanager on a periodic basis.

• Exception reports such as overrides/changes to master datalike product code changes are not reviewed by appropriate manageron a periodic basis.

• Aftersales department has worked with unapproved customers onan open account basis instead of cash basis.

• Aftersales insurance receivables are not followed up forcollection on a timely basis by the respective operationsmanager.

(II) INEFFECTIVE FINANCIAL CONTROLS:

• Periodic customer reconciliations are not performed.

• Nobody from Finance participates in the stock-counts

• Open account follow-up is not performed effectively and ontime. Problematic situations are not escalated to themanagement.

(III) DEACTIVATION OF SOME SYSTEM CONTROLS:

• Service employee who is authorized to issue invoices hasaccess to make changes in customer master data (including creatinga new customer). The system allows changes to master data even ifthere has been a transaction posted over this customer.

• During invoicing, changes/overrides can be made to defaultcustomer group discounts field and customer information flowingfrom the master data and log reports are not created to review suchoverrides.

PART III: RECOMMENDED URGENT ACTION PLAN

Termination ofemployee + legal actions?Actions with effects at organizational level:

?1) In order to communicate the appropriate message to theorganization, fair penalty mechanism should be utilized. In thisline, in order to give highest penalty the ones with the highestresponsibility, After Sales Manager, Parts Chief, Parts StockPlanner, Warehouse Responsible, Operations Open Account Followerand the cashier should be penalized with one of the following:termination of job employment, giving notice, monetary penalty, jobrotation.

?2)Organizational changes including rotations Rotating employeeworking in the same position for too long should be part of aregular activity as a company principle. This is especiallycritical for those who are directly involved with money andvaluable company assets.

3)Voice of ethics hotline (whistleblowing) implementation

Actions that require procedural changes:?

?1) Job order review, authorizations and approvals Personnel whoare authorized to issue material movement vouchers should berestricted to issue them only to their assigned cost centre(predefined in the system). Issuance, receipt and approvalauthorities should be segregated in terms of access rights in thesystem.

2)Policy & ?procedures for open accounts As the companypolicy is to work cash-basis for aftersales customers, allcustomers that will be worked with on an open account basis have tobe approved by the Management.

?3)Customer reconciliations on a monthly basis Aftersales(Service) should make effective follow up of open accounts(receivables from service customers) including insurance. Financeshould make periodic customer reconciliations. Finance should checkaftersales team on a monthly basis for progress.

4)Participation of Finance in periodic stock counts Financeshould participate in periodic counts as well. Surprize spot countsin addition to cycle counting should be organized and the relatedprocedure should be issued by Finance.

Actions that require changes in the system:?

?1) System access rights Unneeded access to customer master datamust be revoked immediately. Employee who has access to salesinvoice generation should not have access to customer master datamaintenance.

?2) Built-in locks and warnings for critical system transactionsSystem should be configured in a way that users are not allowed tomake any over-rides.

3) Production of exception reports and log reports (which needto be reviewed by appropriate management on a periodic basis) Logreports and exception reports needed to control that the righttransactions are made for the right purpose must be produced andthese must be reviewed on a periodic basis to detect wrong-doingsfor further assessment.

Management actions:? 1) Timely and effectiveimplementation of operational controls ?

2) Timely and effective implementation of financial controls

PART IV: URGENT ACTIONS ALREADY TAKEN BY THEMANAGEMENT

• Executive Committee issued a letter to all department managersabout the issue stressing internal controls

• The following employees’ job employments were terminated: -SM, XY, ZX

• Written notices were given to the following employee: – CK,SE, HK, LS

• Following job rotations were made:

– Open aftersales customer accounts follow-up will be performedby the Car Guarantee Department (by controller DZ)

– Cashier A and Cashier B

• Action plans are being discussed for other issues noted inthis report

?• Indemnification for company loss based on our currentliability insurance policy is being discussed with our insuranceaccount manager and lawyers

ATTACHMENT 2: FINANCIALS (All figures are inNZ'000)

1. ABC Company 31/12/XX Balance Sheet

Assets

 

liability

 

banks

3500

loans

25000

trades receivable

12000

trade payables

30000

other receivable

2500

other payables

5000

investments

6000

accrued liability

9000

inventories

35000

provisions

10000

property plant equipment- net

37950

paid capital

10000

 

 

reserves

6350

 

 

current year P/L

1600

Total assets

96950

Total liabilities

96950

2. Profit & Loss Statement

Revenues 100,000

Cost of Sales 85,000

Gross Profit 15,000

Operating Expenses 10,500

Operating Profit 4,500

Non-operating Expenses 2,500

Profit Before Tax 2,000

Tax 400

Profit After Tax 1,600