11–11
Copyright © 2017 Pearson Education, Inc.
11–25 1. a. Adequate documents and records, and independent checks
on performance.
b. Transactions are recorded on the correct dates (cutoff).
c. Carefully coordinate the physical count of inventory on the
2. a. Adequate documents and records and independent checks
on performance.
when the master file is updated.
3. a. Proper authorization of transactions and adequate
b. Recorded transactions exist (occurrence).
payable.
4. a. Adequate documents and records, physical control over
b. Recorded transactions exist (occurrence).
employees from parking inside the fencing.
2) Require the accounting department to maintain
5. a. Adequate separation of duties.
b. Recorded transactions exist (occurrence).
file.
6. a. Independent checks on performance.
(accuracy).
c. Counts by qualified personnel and independent checks on
7. a. Proper authorization of transactions and activities.
b. Transactions are stated at the correct amounts (accuracy).
11–12
11–25 (continued)
2) Require independent approval of all transactions,
8. a. Adequate documents and records.
b. Recorded transactions exist (occurrence).
c. 1) Require that payments only be made on original
11–26 The criteria for dividing duties is to keep all asset custody duties with
one person (Cooper). Document preparation and recording is done by the other
person (Smith). Singh will perform independent verification. The two most
three as follows:
11–27 A schedule showing the pertinent transaction–related management
assertions and application controls for each type of misstatement is below
and on the following page.
MISSTATEMENT
a.
TRANSACTION–
RELATED ASSERTION
b.
COMPUTER–BASED
CONTROLS
1. A customer number
on a sales invoice was
transposed and, as a
result, charged to the
wrong customer. By the
time the error was found,
the original customer was
no longer in business.
Recorded transactions
exist (occurrence)
Amounts and other
data relating to
recorded transactions
and events have been
recorded appropriately
(accuracy)
Key entry verification
Check digit
Reconciliation to
customer number on
purchase order and
bill of lading
2. A former computer
operator, who is now
a programmer, entered
information for a fictitious
sales return and ran it
through the computer
system at night. When
the money came in, he
took it and deposited it
in his own account.
Recorded transactions
exist (occurrence)
Input security
controls over cash
receipts records
Scheduling of
computer processing
Controls over
access to equipment
Controls over access
to live application
programs
3. A nonexistent part
number was included in
the description of goods
on a shipping document.
Therefore, no charge
was made for those
goods.
Existing transactions
are recorded
(completeness)
Preprocessing
review
Programmed
controls (e.g.,
compare part no. to
parts list master file)
4. A customer order was
filled and shipped to a
former customer that had
already filed bankruptcy.
Recorded transactions
exist (occurrence)
Preprocessing
authorization
Preprocessing
review
Programmed
controls (e.g.,
comparison
to customer file)
11-27 (continued)
MISSTATEMENT
a.
TRANSACTION–
RELATED ASSERTION
b.
COMPUTER–BASED
CONTROLS
5. The sales manager
approved the price of
goods ordered by a
customer, but he wrote
down the wrong price.
Amounts and other
data relating to
recorded transactions
and events have been
recorded appropriately
(accuracy)
Preprocessing review
Programmed controls
(e.g., comparison
to the online
authorized price list)
6. A computer operator
picked up a computer–
based data file for sales
of the wrong week and
processed them through
the system a second time.
Recorded transactions
exist (occurrence)
Transactions are
recorded in the correct
accounting period
(cutoff)
Correct file controls
Cutoff procedures
Programmed controls
(e.g., check for
sequence of dates)
7. For a sale, a data entry
operator erroneously
failed to enter the
information for the
salesman’s department.
As a result, the salesman
received no commission
for that sale.
Existing transactions
are recorded
(completeness)
Conversion
verification (e.g.,
key verification)
Programmed controls
(e.g., check field for
completeness)
8. Several remittance
advices were batched
together for inputting.
The cash receipts clerk
stopped for coffee, set
them on a box, and failed
to deliver them to the
data input personnel.
Existing transactions
are recorded
(completeness)
Transactions are
recorded in the correct
accounting period
(cutoff)
Control totals
reconciled to manual
totals of all batches
Computer
accounts for
numerical sequence
of batches submitted
11–15
11–28
PERSON 1
PERSON 2
PERSON 3
PERSON 4
a. Systems analyst
Programmer
Computer operator
Librarian
Data
control
b. Systems analyst
Programmer
Computer operator
Librarian
Data
control
N/A
c. Systems analyst
Programmer
Data control*
Computer operator
Librarian*
N/A
N/A
* This solution assumes the data control procedures will serve as a check on
the computer operator and will allocate work across both persons.
d. If all five functions were performed by one person, internal control
would certainly be weakened. However, the company would not
necessarily be unauditable, for two reasons: First, there may be
11–29 1. Wilcoxon Sports should strengthen several of its IT general controls.
The fact that the programmer was able to access the current live
version of the sales application program suggests that there are
breakdowns in appropriate segregation of duties among IT personnel.
Programmers should be restricted from access to actual software
transactions.
Wilcoxon should consider strengthening its processes for
authorizing and approving software changes. More extensive
procedures should be implemented regarding requests and approvals
for software changes. Only upon the presentation of adequate
change was authorized. Approvals for software changes should
11–16
11–29 (continued)
the sales function.
For larger IT functions, programmers are split into subgroups
with some programmers only authorized to address programming
2. Strengthening IT general controls over program changes, restricting
access to live software versions, and enhancing segregation of
duties will significantly reduce the programmer’s ability to make
unauthorized changes to software as was done at Wilcoxon Sports.
change in software without someone’s knowledge. If the
librarian only accepts revised programs for properly authorized
If programmer functions are separated among programmers
sales application and the operating system software.
11–30
a. The strengths of Hardwood Lumber Company’s computerized accounting
system include the following:
Separate departments for systems programming, applications
programming, operations, and data control.
CHANGE or RUN capabilities.
The computer room is locked and requires a key–card for access
program files.
application software program files.
Data control clerks have no access to software program files.
11–17
11–30 (continued)
Information Systems function:
The Vice President of Information Systems (VP of IS) should report
on a day–to–day basis to senior management (e.g., the president)
The VP of IS should have access to the board of directors and
should be responsible for periodically updating the board on
of IS.
Video monitors should be examined continually. The actual monitors
could be viewed on an ongoing basis by building security guards.
Hardwood should consider taping what the cameras are viewing
for subsequent retrieval in the event of a security breach.
Hardwood may consider purchasing a vendor–developed access
features.
Restrict programmer access to test copies of software programs
for only those programs that have been authorized for program
change. Access to copies of other programs may not be necessary
when those programs have not been authorized for change.
likelihood that a strong systems development process is followed.
Develop a weekly Job Schedule that outlines the order in which
operators should process jobs. The VP of IS should review computer
output to determine that it reconciles to the approved Job Schedule.
11–18
11–30 (continued)
program and data files.
Remove the librarian’s CHANGE rights to program and data files.
Consider purchasing a vendor–developed librarian software package
11–31 a. The COSO report notes that an organization’s technology will
continually evolve as the organization evolves. At the same time,
cyber attackers are continually finding new ways of hacking
b. At the control environment level, management and the board of
directors need to set the tone that cyber security is a priority. The
board of directors needs to be aware of cybersecurity issues.
Regular communication between management and the board
c. The COSO report identifies the following five categories of
perpetrators and motives:
Nation states and spies: foreign nations attempting to steal
national security information or other intellectual property
identity information
Terrorists: individuals or groups attempting to launch
cyberattacks to disrupt infrastructure such as financial
institutions
Hacktivists: individuals attempting to steal and disclose
sell private information
11–31 (continued)
prevent and detect cyberattacks. The report also suggests there
are IT–specific frameworks that organizations can rely on as well,
such as COBIT (Control Objectives for Information and Related
Technology).
■ Case
11–32 a. Sales
TRANSACTION–RELATED
ASSERTION
CONTROL
Occurrence
Supervisor approves all invoices.
Accounts receivable clerk has no access to
cash.
Monthly statements are sent to customers.
Supervisor approves all credit.
Completeness
Cash register is at the front of the store.
Sales clerks handle no cash.
Sales clerks summarize daily sales, which
determine their commission. This summary is
compared daily to total sales.
Sales transactions are used to update
perpetuals and monthly physical inventory is
taken.
Accuracy
Owner sets all prices.
Supervisor rechecks all calculations.
Accountant reconciles all computer totals to
sales staff summary totals and supervisor’s
sales summary.
Monthly statements are sent to customers.
Computer is used to update records.
Monthly statements are sent.
The aged trial balance is compared to the
general ledger.
Classification
None
11–20
11–32 (continued)
b. Cash Receipts
TRANSACTION–RELATED
AUDIT OBJECTIVE
Occurrence
Completeness
Accuracy
Classification
Cutoff
c. Sales and Cash Receipts
Deficiencies
invoices. (Partially offset by control totals used by
comparing sales clerks’ and supervisor’s control totals.)
ledger.
There is a lack of internal verification of all of the