CASE 3.8
THE BOEING COMPANY
Synopsis
In January 2007, Matthew Neumann and Nicholas Tides, two Boeing employees, transferred to
the large aerospace company’s internal audit department. The two men expected that their new jobs
would put them on a “fast track” for career advancement within the company. Unfortunately, just
the reverse was true. A few months later, both Neumann and Tides were “former” Boeing
employees after being fired for communicating with a Seattle newspaper reporter and providing her
with company documents.
This case revolves around the internal control and whistleblowing provisions of the Sarbanes-
Oxley Act. Among other topics, the case questions require students to review the five components
of the COSO internal control framework, to explain the difference between a “significant
216
Case 3.8 The Boeing Company
217
The Boeing Company—Key Facts
1. Matthew Neumann and Nicholas Tides transferred to Boeing’s internal audit department in
January 2007 to advance their careers with the large aerospace company.
2. The primary responsibility of Neumann and Tides’ internal audit team (IT SOX) was to assist
3. Shortly after joining the IT SOX audit team, Neumann and Tides identified several serious
5. Despite the internal control problems identified by Neumann and Tides, Boeing’s management
6. Neumann and Tides discussed Boeing’s IT internal control weaknesses with a Seattle newspaper
7. Following an investigation that included monitoring Neumann and Tides’ e-mails and
computers, the two internal auditors were fired.
8. Neumann and Tides filed whistleblower lawsuits against Boeing under Section 806 of the
9. Neumann and Tides’ lawsuit was unsuccessful because Section 806 of the Sarbanes-Oxley Act
10. Several parties criticized the legal rulings handed down in the Neumann-Tides case and
suggested that those rulings would have a chilling effect on corporate whistleblowing in the future.
218 Case 3.8 The Boeing Company
Instructional Objectives
1. To introduce students to the key internal control initiatives for public companies mandated by the
Sarbanes-Oxley Act.
Suggestions for Use
This case is ideally suited to be used as an introduction to coverage of internal controls within an
auditing course. The case will help students understand the nature and importance of the key
internal control initiatives mandated for public companies by the Sarbanes-Oxley Act of 2002.
Alternatively, if you have a self-contained module within your course that focuses on Sarbanes-
Suggested Solutions to Case Questions
1. The five components of internal control, according to the COSO framework, are control
environment, risk assessment, control activities, information and communication, and monitoring.
Different arguments can be made as to which of these five components is most relevant to the SOX-
mandated whistleblowing procedures. Having said that, the most directly relevant component in this
2. Although not mentioned in the case question or discussed in the case, there are three levels of
internal control “problems”: internal control deficiency, significant deficiency in internal control,
and material weakness in internal control. Following are definitions of those terms that were taken
Case 3.8 The Boeing Company
219
Material weakness in internal control: “A material weakness is a deficiency, or a combination of
deficiencies, in internal control over financial reporting, such that there is a reasonable possibility
that a material misstatement of the company’s annual or interim financial statements will not be
prevented or detected on a timely basis.”
Example of an internal control deficiency: an organization does not have a proper petty cash
voucher system, that is, the petty cash vouchers do not identify the explicit nature of the given
disbursements being paid with petty cash. [In most cases, the resulting financial misstatements due
to this deficiency would be immaterial, if not nominal.]
3. The most obvious “problem” that this would have posed for Boeing would have been violating
the SEC rule mandating that a public company’s internal auditors be controlled by the entity’s audit
committee. But, more to the point, what operational problem is posed by having parties other than
an organization’s audit committee control the entity’s internal auditors? Under SOX, audit
4. Boeing’s corporate policies make it clear that the proper channels of communication should be
220 Case 3.8 The Boeing Company
used by company employees who want to report a significant problem they have uncovered. For
5. In the legal opinion handed down by the appellate court for the Neumann-Tides case, the court
observed that if Congress had intended to “protect reports to the media” under SOX Section 806, it
would have provided legal remedies to whistleblowers under that section for “any disclosure” as it
did under the Whistleblowers Protection Act. The opinion went on to observe that it was obvious
6. It is no doubt “legal” for Boeing to monitor the computers and e-mail systems that its employees
use in carrying out their work-related responsibilities. Those items are the property of Boeing and
the company has a legal right to ensure that they are being properly utilized by employees. In fact,