Controls, Payables, and Materiality: A Case of Unknown Collusion Open Access

I need you to start at Herringbone tomorrow was all you could remember from the phone call. When you began working for the audit firm Brown and Company a year ago, you knew there would be opportunities to work on big clients, but you never imagined being assigned to the firm's most important client so early in your career. Not only would you get phenomenal experience, but also everyone knew the firm only puts its “A” team on Herringbone.

After getting past the initial shock, you remember the second part of the message: Review the client file and be ready to start on payables when you get there. You begin your review by reading a planning memorandum that describes the audit client, its industry, and its reporting environment.

According to the memorandum, Herringbone Affiliates is an S&P 500 energy manufacturing company based out of New Orleans, Louisiana, which has operations around the world, and has been an audit client for the past eight years. In that time, Brown and Company has developed a good working relationship with Herringbone's financial management team and staff. Herringbone has received an unqualified audit opinion each year for its financial statement audit. The audit memorandum also describes Herringbone as an industry leader that manufactures specialized tools for use in the oilfield services industry. You also note that Herringbone has revenues that exceed $1 billion annually. Over the last year, the company implemented a fully integrated enterprise resource planning (ERP) system, SAP, which required significant implementation and training costs to switch from their outdated computerized transaction processing system.

Am I really ready to be on such an important engagement for the firm? you wonder. Shaking off the initial insecurities, you return to reviewing the audit file. You make a mental note that becoming familiar with the payables process first thing in the morning will require reviewing the changes in transaction processing and internal controls required with the company's shift to the new ERP system. As you shut down your laptop for the evening, you realize that with the holidays rapidly approaching, the deadline to complete the assigned audit work was going to be tight.

“With only 56 days left until the end of the year, can we even complete our testing?” you asked the audit manager, Molly Campbell, as your first question.

“I wish we had 56 days!” Molly retorted. “We only have a few weeks before most of the employees take time off prior to the year-end crunch. I don't want you to feel rushed, but we need to get going on AP now or Thanksgiving dinner will be at the client's office. Let me know if you have any questions.”

Besides feeling a little embarrassed for not realizing what a time crunch the firm was under, you began to think about your options. Despite some nerves from being assigned a lead role on a cycle for such a significant client, you are provided some assurance from Molly that you can handle it:

“Look, our firm has been with this client for years, and nothing interesting has ever been uncovered regarding their payables.”

In fact, the company recently appointed a new Treasurer, Larry Links, who has extensive experience implementing ERP systems. You are told to “see if you can schedule a meeting with him to provide a walkthrough of the company's purchasing and payables process.”

Before meeting with Larry, you review the client file one last time to see if there is anything specific you should talk about. While it's clear that few audit issues have been raised with the accounts payable process in the past, one item does stick out to you concerning the reconciliation of the AP subsidiary ledger to the AP vendor statements. Evidently there were three vendors last quarter where the client could not completely reconcile their records to that of the vendors'. The carryforward point noted that the differences, less than $685,000 in total, were below the audit scope for both the income statement and the balance sheet. The client explanations noted in the audit file pointed to timing differences between when the vendor statements were received and when the payments were electronically transferred. The client's explanation for the differences seemed reasonable, and because the amounts were beneath financial statement materiality, an adjusting entry was not required. A $685K difference and still deemed to be immaterial? You had studied the concept and calculation of materiality in your audit class, but thus far, your previous client engagements were much smaller with materiality levels in the thousands, not millions. I really am in the big leagues now; with a materiality threshold this high, audit test work should be a breeze.

Your interview with Larry gets off to a great start.

“I remember what it was like to be a green auditor on the big client just trying to avoid mistakes. I promise you, this is going to be painless; payables are simple, and SAP, our new ERP system, automates nearly every aspect for processing purchase transactions,” Larry opens.

Aided by Larry's confidence, you decide to start with controls, recalling from the audit plan that the current-year approach calls for a high internal control reliance strategy for this part of the audit. After taking one final glance at the planning memorandum, you ask Larry, “How did controls stand up after the transition to SAP?”

“We need and have great controls in this area. In fact, after being hired, I was immediately directed by the audit committee to scrutinize the controls system to identify and remedy any potential weaknesses. I can tell you, as someone who has worked in the accounting department of energy companies for twenty years, Herringbone is in great shape. We are committed to staying ahead of the curve with our technology improvements and remaining a market leader in our industry. Sure, this new implementation has placed a lot of strain on our employees, but I'm confident that all of our processes will be more efficient in the long run.”

As Larry continues to elaborate on the benefits of SAP and its integration with various functions within Herringbone, you realize he is using a lot of terms you do not understand. Being new to the client, you are too timid to ask questions. It is one thing to appear unprepared to Molly, but it would be really disconcerting to make Larry doubt your abilities. You make a note to do some follow-up with Molly later.

Trying to regroup, you remember the most important control is segregation of duties. “Larry, were there any changes to the organization chart that I need to make note of?”

Larry explains that everything is mostly steady, with one exception—the Accounts Payable and Materials Management departments now both report to him rather than directly reporting to the CFO (see Figure 1 for an organization chart).

“Our CFO did not have the time necessary to supervise those two departments. He worked with the banks to automate the AP process, linking the check processing function with the accounts payable module in SAP. The reporting change just made too much sense.”

As a follow-up, you ask him, “So what are the key processes for payables, and how do you know the internal controls over these processes are adequate?”

Larry provides you with a business process diagram in Exhibit 1, and in Figure 2, which outlines five critical processes for the payables process that are captured in SAP:

• —

  Approve purchases (daily);

• —

  Receive ordered materials (daily);

• —

  Approve invoices for payment (daily);

• —

  Transmit payment files to the bank (semi-weekly); and

• —

  Reconcile accounts payable subsidiary ledger to vendor statements (monthly).

Larry seems very confident that these processes are routinely completed without significant problems.

He remarks, “Everything is automated. Our Controller, Jim Jenkins, was skeptical at first, but I've showed him how the system works, and he's been thrilled with the results thus far. Our internal audit staff has also remarked how seamlessly this integration has gone, and they are excited about the many benefits that SAP can provide in terms of streamlining processes and information across Herringbone.”

As you leave Larry's office, you are relieved to have the interview over and wonder if you should be more stressed. As the old saying goes, if you keep your head when all those around you are losing theirs, you don't understand the situation.

To become familiar with Herringbone and its vendor verification process, this task has you review the work papers and accompanying client-provided documents. (Appendix C contains links to the audit workpaper and accounts payable subsidiary ledger [Excel File], as well as the client statements. These items are like the documents examined by the auditor in this case.)

Your task is to review the documents that have been provided, complete the audit working paper related to the client's accounts payable balance, and determine whether any follow-up procedures should be performed. The audit procedures for 15 of the 20 vendor accounts selected for testing have already been performed and documented within the working paper. You will need to complete test work on the remaining five items, documenting the results of your tests in the provided working paper. Assume that performance materiality for accounts payable is set at $5,000,000.

1. In your own words, define the term “materiality.” What sort of qualitative factors should auditors consider when evaluating an identified misstatement that is beneath common quantitative thresholds?

2. Separation of duties is a key concept of internal controls. What duties should be separated relating to the purchases and payables process, and how has Herringbone achieved appropriate separation of duties (you may wish to consult the organization chart in Figure 1 and the business process diagram in Exhibit 1)?

3. In addition to separation of duties, using the business process diagram in Exhibit 1, identify three other internal control procedures that should be in place for Herringbone's purchasing and payables processes (Figure 2).

1. Why would a company implement a fully-integrated ERP system such as SAP? What type of efficiencies might be gained over transaction processing in the purchasing and payables cycle using an ERP system compared to a more simplified computerized accounting information system, or even a manual accounting system?

2. Does the term “materiality” only apply for auditors? Should Herringbone management be concerned over seemingly inconsequential differences between its AP records and the vendor statements?

3. Who is ultimately responsible for internal controls over financial reporting, the client or the auditors? What type of internal control evaluation is required by Herringbone's management team with regards to the Sarbanes-Oxley Act of 2002?

Several weeks have passed since your interview with Larry, but you still find yourself shaking your head at the number of times you've had to interrupt Molly's work with questions concerning internal control testing in the AP cycle. Molly was always more than willing to answer your questions, but you still feel as though you shouldn't need the help. Fortunately, the control testing over the AP processes outlined by Larry went very smoothly. No deficiencies in internal control were identified, which has you hopeful that the actual audit testing over the payable balances will go just as smoothly.

By midafternoon, you decide to tackle the following audit program step: Trace Vendors' Statements That Show a Balance Due to the Accounts Payable Subsidiary Ledger. This step calls for a target-testing approach in which the largest open vendor account balances are included for testing. Your hopes for a smooth afternoon are immediately dashed as you remember that this is the audit step that has several discrepancies due to timing differences between the vendor statement dates and Herringbone's payments. You remain hopeful, however, that transitioning from a stale, outdated system to SAP has cleared up these lingering issues. Right on cue, just as you start to get the hang of testing, you note your first discrepancy between the AP subsidiary ledger and the vendor statement for BCE Technical, a local supply company. Oddly, you notice the difference is for an even amount of exactly $300,000. As you note this exception in the workpaper and continue with the audit test, you find two other exceptions with the company's largest vendors, each for rounded amounts of less than $200,000. While the exceptions, both individually and in total, are well below the tolerable misstatement level, you can't help but wonder what could be causing these discrepancies. Wasn't the transition to SAP supposed to alleviate these kinds of issues? Rather than waste any more time spinning your wheels on this issue, you decide to once again seek Molly's help.

Molly seems unsurprised by the noted exceptions.

“It's important to realize that unlike the textbook examples from your auditing course, the notion that account balances always perfectly tie-out and reconcile just doesn't exist in the real world. That's why we have materiality thresholds. It keeps us from having to chase all of the nickels and dimes down into the rabbit's hole.” Molly continues, “When I first noticed the exceptions earlier in the year, I brought them to Larry's attention. Larry was already aware of the discrepancies based on his own review of the monthly reconciliations, and he attributed them to timing differences. Brian Pain, the AP Manager, also confirmed that the differences noted in a few of the larger AP accounts were related to timing issues.”

Her comforting tone was reassuring, and Molly also reiterated the importance of staying on budget. Great, you think. Just a few weeks on the job and I'm already gaining the label of being a budget buster. You decide it's best to drop the issue and finish documenting the results so you can move on to other audit tasks.

As the week goes by you become increasingly impressed with the automation and efficiency of Herringbone's accounts payable process. Noting the built-in controls and other checks and balances, it seems improbable that any significant errors or discrepancies would exist. Furthermore, your control testing and substantive test work has yet to uncover any other discrepancies. You are starting to agree with Larry and Molly that there appears to be nothing to see here and that the high reliance strategy on internal controls is justified. With time ticking away to complete your work, you return to a control test you had previously completed related to Herringbone's automated payment system, which processes payments for open AP balances. Molly had flagged this with a coaching note for your review.

As noted in the business process diagram you obtained from Larry (see Exhibit 1), Herringbone maintains an electronic “vendor maintenance file” (VMF, see Figure 3) for each vendor that includes all the relevant banking information needed to transfer funds. Any changes made to a VMF are captured by SAP and indicated on the VMF Change Report that Lisa Moseby, the VMF Clerk, runs each week. As part of control testing, the audit plan called for you to randomly select 20 vendors from the weekly VMF change reports and examine whether changes indicated on a VMF Change Report are supported by appropriate documentation from the vendor (e.g., company letterhead outlining the change in banking information).

Everything ran smoothly for the first two quarters of the year you sample. However, Molly's coaching note asks for some clarification in the testing performed during the third fiscal quarter. As Molly points out, the VMF Change Report is missing for two consecutive weeks in August. Just great, you think, yet another adventure down the rabbit hole, only to burn more budget hours and later find out the reason is inconsequential to both the financial statements and audit opinion. Nevertheless, you decide you better follow up with Lisa, the VMF clerk, to get some supporting information.

You approach Lisa Moseby, and while she initially responds in a friendly manner, she increasingly becomes agitated and begins to roll her eyes during the conversation.

“It's a simple explanation, actually,” Lisa retorts. “I was on vacation during the two weeks where the VMF Reports are missing, and thus, no VMF Report was created.”

Lisa further adds that no one could have made changes to the VMF file while she was out because she is the only employee with access to the electronic files, so there really isn't a reason to continue with this goose chase. Sensing your concern, however, Lisa responds by saying that she will look into the matter and get back to you later in the day.

“I know you auditors need to document every little detail, so I'll go print the missing reports so that you can complete your testing.”

You breathe a large sigh of relief. I may finish this AP testing on budget after all.

After lunch, Lisa approaches you to hand over the missing VMF change reports. She begins by apologizing for her abrupt behavior earlier that day.

“I first want to apologize for my behavior when we last spoke. Since our changeover to SAP, I've been a bit overwhelmed trying to adapt to the new technology. Anyway, you already know about our requirement to run a VMF Change Report on a weekly basis. Although I am diligent about that, I never really thought it to be necessary to run them for the days I am out of the office.” After a short pause, Lisa continues, “Anyway, I ran the reports for the missing periods and noticed a couple of changes were made to the VMF file while I was out. I was initially concerned, because I couldn't locate the company's letterhead requesting the change, so I brought the reports over to Brian, who regularly reviews the reports monthly as part of his monitoring over AP.” Lisa goes on to state that Brian wasn't at all concerned because the changes noted in the VMF report must have been a glitch related to SAP implementation. “Brian pointed out that the banking information was changed back to the original information later that same day.”

As you frantically try to write down Lisa's explanation to include in the audit file, you glance at your watch and realize it's already half past six o'clock. Looks like another dinner at the client site, you mutter under your breath, out of earshot from Lisa. As you walk back to the conference room where the audit team has set up, you glance back down at the previously missing VMF report. It isn't until now that you notice the company name listed atop the report, BCE Technical. How is it that this vendor pops up in every AP test? Suddenly, it hits you that BCE Technical was also the same vendor that had an immaterial discrepancy with its AP balance. You start to fear that these two items are somehow related but aren't sure where to turn. I've already maxed out the budget for AP, and didn't Molly say the discrepancies were inconsequential? With the missing change reports in hand, you wonder if it's best to just complete the control test and respond to Molly's coaching note that there weren't any exceptions. After all, Lisa was able to provide me with the reports, and the amounts in question seem so trivial in light of the audit scope. You remain uneasy, as you're quite certain that if you document this as a control exception, not only will the budget for AP be blown wide open as you are forced to expand your sample, but the high control reliance that the firm had planned for AP may also be in jeopardy. Because the rest of the audit team has already called it quits for the day, you decide to call it a night and head home for the evening.

1. Discuss how budget and deadline pressures could shape how auditors respond to identified misstatements or potential control exceptions. How common do you believe these pressures are in the audit environment, and how should auditors respond to them?

2. Do you think that you would face criticism (from either the client or from your audit supervisor) for digging deeper and conducting additional testing if it turned out that no misconduct by the client had occurred and no additional discrepancies were discovered?

1. What additional policies should Herringbone have had in place to ensure that Lisa Moseby's job requirements were carried out during her absence?

2. The case materials indicate that Lisa Moseby found the two missing VMF change reports. Does this still constitute an exception for this control test? Why or why not?

When you arrive at the client's office the next morning, Molly tells you that Larry wants to meet with the two of you as soon as possible. You begin to expect the worst and are even more nervous because you did not get a chance to tell Molly about your meeting with Lisa last night. As you and Molly walk into Larry's office, you immediately notice that Lisa and Herringbone's Controller, Jim Jenkins, are present as well.

Larry starts off the conversation.

“Lisa called me last night and told me you were asking a lot of questions about our automated vendor payment system. While initially irritated, I am now glad you were so diligent. Lisa informed me that while she was on vacation in August, Brian Pain, the AP Manager, called her and asked for her password to the VMF system. Brian told Lisa he needed to perform some test runs related to the SAP implementation. It is obviously against company policy to share a password with anyone outside of personnel at our IT Helpdesk, but Brian insisted that she either give him her password or come in the office right away. So, Lisa shared her password. She was embarrassed to mention this to you last night, because she was afraid of the possible repercussions for violating our IT policy.”

He continues, “We are required to change our password every December, but this incident obviously happened before then. Lisa realizes she never should have given Brian her password.” As Jim glances over at Lisa, your level of curiosity as to where this was heading grows.

You can see that Lisa is recollecting some details before speaking.

“When I ran the reports for those days I was out, I noticed that there were changes made to the VMF of several vendors, in addition to the one Brian phoned me about. In fact, there were also a couple of changes made in September after my vacation when I was out of the office for dental surgery. The odd thing is that on those days, three vendors' account numbers and routing numbers were changed for smaller transactions and then changed back to the original numbers for these vendors. I asked Brian about these, and he got irritated and chastised me for taking off so much time during busy periods. Anyway, he said the changes had to do with some type of escrow account required in our purchase agreement…or something like that.”

Larry thanked Lisa for providing her insight, and then excused her from his office. After Lisa departed, Jim again spoke up. “Brian has worked for Herringbone for nearly 15 years, and I really hope there is a logical explanation for all of this. In fact, I just called him about an hour ago to get his take on the situation. He admits that he did ask for the password in August but specifically and emphatically said Lisa was supposed to reset her password when she got back in the office. He also asked that we investigate whether other unverified payment transactions occurred since our implementation of SAP. He believes Lisa has had remote access to the system after the update.”

You learn that Brian has opted to take a personal day because he doesn't want to see Lisa. Jim concludes the meeting by confirming that based on his initial review this morning of payment files for several of Herringbone's largest suppliers, over $1 million in payment transfers remain unsubstantiated.

As the two of you leave the office, Molly states, “I am numb. I have never been in a meeting like that. I will talk to Larry and Jim about whether using the services of our forensic accounting group is warranted.”

The forensic accounting group uncovered several interesting findings. Apparently, someone at Herringbone had set up relatively small individual payments with amounts up to $200,000 with three of the company's largest vendors.¹ Sure enough, as indicated by Lisa Moseby, immediately before the payment file was transmitted to Treasury, the routing and account numbers were changed. From the records, the forensic team discovered that after the request for payment was completed, likely the same individual then changed the routing and account numbers back to the previous numbers for the vendor. It became apparent that these vendors were chosen because when reconciling the amount due per the accounting records to vendor statements, being $200,000 off was immaterial given the size of the vendor account. In the vendor file, Brian had noted that the differences were the result of timing issues. At the time, the forensic team was still investigating the source of unauthorized access, but the routing numbers indicated a bank in the Cayman Islands.

Ultimately, Herringbone's counsel confronted Brian and he admitted to using Lisa's login information to reroute the payment transfers to his personal account. In the end, a police investigation determined that Brian had stolen over $1.3 million from the company through a series of these transfers. Brian admitted to being frustrated that he had been passed over several times for a promotion, and that he was finally driven over the edge when Herringbone decided to hire someone outside of the company for the open Treasury position, rather than promote someone internal. Brian was charged with multiple crimes, including federal wire fraud (because the internet was used to transfer incorrect banking information), and received a prison sentence, along with a requirement to repay the stolen funds. Because this was a federal offense, Brian served most of the sentence.

After the discovery, Herringbone changed the reporting of AP from the Treasurer to the Controller, Jim Jenkins, who has more experience monitoring internal control policies. The VMF reports now also should be reviewed by internal audit and Jim on a weekly basis, and the reconciliation process was tightened. The password requirements were also strengthened, which included changing login passwords more frequently.

1. What is an auditor's responsibility with respect to fraud in a financial statement audit? If a fraud is identified, should the auditor's response depend on whether the amount is material to the financial statements?

2. What additional internal controls would have prevented any inappropriate cash transfers from occurring? What controls would have detected their occurrence in a timelier manner?

1. Why are company policies, such as password protections and change policies, important for maintaining the integrity of a company's internal control process? What should Lisa have done once she realized that unauthorized changes to the VMF had occurred?

2. By divulging her password, Lisa allowed the AP Manager to circumvent key controls over the vendor payment process. Identify other ways that an employee could intentionally or unintentionally circumvent a company's key separation of duties within the purchasing and payables process.

1. In the context of this case, what is SAP:

   • a.

     A short-form for substantive analytical procedures

   • b.

     A type of internal controls

   • c.

     An integrated ERP system

   • d.

     A type of computer hardware

2. Herringbone Associates is described as:

   • a.

     Small Filer

   • b.

     Fortune 500 manufacturing company

   • c.

     Accelerated Filer

   • d.

     Large Accelerated Filer

3. In the case, Molly claimed that an audit delay would result in:

   • a.

     Missing a reporting deadline

   • b.

     Having Thanksgiving at the client's

   • c.

     Working 80-hour weeks to meet the reporting deadline

   • d.

     An increased risk of losing the client

4. Larry Links explained that everything at Herringbone was steady with one exception:

   • a.

     The company shifted to a lean manufacturing system.

   • b.

     The company opened a new operating division in Oklahoma.

   • c.

     The AP and Materials Management departments now both report to him rather than directly reporting to the CFO.

   • d.

     The company recently hired a new CFO.

5. What saying best summarizes how you were feeling after meeting with Larry?

   • a.

     If you keep your head when all those around you are losing theirs, you don't understand the situation.

   • b.

     A deaf auditor makes a crazy answerer.

   • c.

     Deep doubts, deep wisdom; small doubts, little wisdom.

   • d.

     Believe those who are seeking the truth; doubt those who find it.

1. During substantive testing of Herringbone's accounts payable balance, the identified discrepancies were:

   • a.

     For round amounts that were below the tolerable misstatement level

   • b.

     For amounts that individually were greater than the tolerable misstatement level

   • c.

     Individually immaterial, but exceeded the tolerable misstatement level in the aggregate

   • d.

     For seemingly random amounts that were below planning materiality

2. Brian Pain, the AP Manager, confirmed that the discrepancies found during AP vendor testing were due to:

   • a.

     A software glitch in SAP

   • b.

     A change in Herringbone's banking institution

   • c.

     Timing differences

   • d.

     Inadequate recordkeeping by a few of their vendors

3. Lisa Moseby, VMF Clerk, is responsible for running the VMF Change Report:

   • a.

     Daily

   • b.

     Weekly

   • c.

     Monthly

   • d.

     Biweekly

4. Lisa Moseby, VMF Clerk, explained that the missing VMF reports were not created because:

   • a.

     The missing periods corresponded to the changeover to SAP

   • b.

     She was attending an SAP training session

   • c.

     She was temporarily locked out of SAP due to an expired password

   • d.

     She was on vacation

5. Which AP vendor keeps showing up during AP substantive and control testing?

   • a.

     Croft Parts Design

   • b.

     BCE Technical

   • c.

     Phillips Field Tech

   • d.

     Barton Engineering

1. According to the case, who was Lisa allowed to share her password with?

   • a.

     Anyone in IT

   • b.

     The Internal Auditor

   • c.

     Personnel at The IT Helpdesk

   • d.

     No one

2. The funds in the case were misdirected by:

   • a.

     An intentional software glitch in SAP

   • b.

     Manually changing key banking information before and after small transactions

   • c.

     Creating timing issues related to vendor payments

   • d.

     Writing off material differences between recorded and actual payments to large vendors

3. To prevent future problems, AP now reports to:

   • a.

     The treasurer

   • b.

     The controller

   • c.

     Both the controller and the treasurer

   • d.

     The Internal Auditor

4. Lisa Moseby provided the following evidence to argue her innocence:

   • a.

     The records contained in SAP about vendor account changes

   • b.

     Documentation showing she had dental surgery when the supposed fraud occurred

   • c.

     Evidence that showed she did not have remote access

   • d.

     The results of a polygraph

5. The resulting fraud investigation uncovered _____ in fradulent vendor payments:

   • a.

     $200,000

   • b.

     $1 million

   • c.

     Over $1.3 million

   • d.

     None of the above

This module includes a set of audit working papers (Excel file), along with related client-provided documents. These items are like the documents examined by the auditor in the case. Your task is to review the documents that have been provided, complete the audit working paper related to the client's accounts payable balance, and determine whether any follow-up procedures should be performed. The audit procedures for 15 out of the 20 vendor accounts selected for testing have already been performed and documented within the working paper. You will need to complete test work on the remaining five items, documenting the results of your tests in the provided working paper. Assume that performance materiality for accounts payable is set at $5,000,000.

ciia-52639_Audit Working Papers: http://dx.doi.org/10.2308/ciia-52639.s01

ciia-52639_Vendor Statements: http://dx.doi.org/10.2308/ciia-52639.s02

ciia-52639_Figures: http://dx.doi.org/10.2308/ciia-52639.s03

ciia-52639_Exhibit 1: http://dx.doi.org/10.2308/ciia-52639.s04

ciia-52639_Final Resolution: http://dx.doi.org/10.2308/ciia-52639.s05

ciia-52639_Final Resolution Discussion: http://dx.doi.org/10.2308/ciia-52639.s06

ciia-52639_Reading Quiz: http://dx.doi.org/10.2308/ciia-52639.s07

This case is based on the personal experiences of an alumnus of a nationally-ranked accounting program operating within the accounting and accounts payable departments of a large S&P 500 energy company. The case describes an elaborate fraud scheme where one of the perpetrators is an unknowing participant. While the names and location of the entity and individuals involved were changed, we retained most of the technical details. The alumnus also reviewed the case materials in their entirety to ensure we maintained accuracy and realism. Finally, the case was reviewed by several senior members of large and international public accounting firms, and their feedback helped to inform the discussion questions and the Teaching Notes.

The case focuses on the development of professional judgment from two perspectives: (1) evaluating identified misstatements that are beneath standard quantitative materiality thresholds, and (2) the auditors' consideration of fraud in a financial statement audit. In particular, students are exposed to common deadline and budgetary pressures faced by the audit profession, which may shape how auditors respond when confronted with an audit matter requiring professional judgment. Students will discover that collusion, even if involuntary or unknown, can circumvent even the most elaborate of information systems. The case adds to the growing audit education literature through a contextually rich “dirty scenario” in which students may struggle to identify the appropriate auditor response.

Throughout the case, we require students to consider the perspective of both the client's management as well as the audit team by using contextually rich narratives describing the interactions between the audit team and the client. These personal aspects emphasize the pressures faced by junior auditors when attempting to balance satisfying the client, meeting or exceeding the expectations of their audit supervisors, and ultimately performing their professional duty to the public. A series of discussion questions at the end of each case section also prompt both client and auditor reflection. Finally, an optional pre-case module provides students the opportunity to complete electronic auditing work papers by reviewing related client-provided documents that pertain to the case storyline.

1. To illustrate professional judgment that is required when evaluating identified misstatements that are lower than financial statement materiality.

2. To provide a practical example of the types of evidence that auditors should examine while facing common pressures to complete the audit work as efficiently as possible.

3. To encourage students to consider the perspective of both management and auditors in a real-world scenario.

4. To illustrate the challenges between the design and implementation of general and IT internal controls.

5. To highlight the auditors' responsibility for detecting fraud in an audit as well as the appropriate auditor response to an identified instance of financial statement fraud.

6. To demonstrate how collusion, whether intentional or unknown, can circumvent separation of duties.

Our case contributes to the accounting education literature in at least two specific areas. First, students are placed in the role of a young auditor, which is not far from recent or upcoming work experience, and then they are exposed to the types of budget and reporting pressures that can undermine the quality of their professional judgments. While a few published teaching cases examine pressures that influence accounting decisions (Kohlbeck 2005; Hughes, Beaudoin, and Boedeker 2012; Porter 2012) and the treatment of ambiguous tax issues (Stuebs, Wilkinson, and Arnold 2012), our focus, instead, is on the types of audit engagement pressures specifically documented by the PCAOB as negatively influencing professional skepticism (PCAOB 2012). We also consider an audit issue that is beneath common quantitative materiality benchmarks, which provides students the opportunity to consider the qualitative components that may elevate an audit issue to a matter of greater significance.

Many fraud instructional cases have been published in recent years, and the unique circumstances of each fraud provide great teaching opportunities. We believe that our case on unknown collusion also contributes to the existing case literature documenting accounting frauds in at least two respects. First, our case is based upon personal experiences within the company presented, but the circumstances are not readily known by students and the general public. Students clearly show a preference for learning from actual frauds, but their opinions from well-known fraud cases can be biased and lessen the learning opportunities. Recent instructional fraud cases have covered frauds at Olympus in Japan (Dutta, Caplan, and Marcinko 2014), Diamond Foods (Gujarathi 2014), and California Micro Devices (D'Aquila and Capriotti 2011). We find the anonymity of our case to be an advantage, because it allows the instructor to better control the teaching environment and remove the influence of outside coverage, which can be distracting or misleading for more publicized cases.

Second, we approach the fraud from both the auditor's and manager's perspectives. Prior cases have taken a variety of approaches, including an agnostic factual understanding of the fraud (e.g., Rufus and Hahn 2011; M. Knapp and C. Knapp 2012), the role of accountants and internal auditors, and, most commonly, the role of the auditor (or forensic accountant). Because our case primarily discusses the interplay of an audit team, we consider that perspective; however, we also challenge the students to consider the perspective of management and how their responsibilities pertain to the case. This unique dual approach should deepen the students' understanding of the challenges inherent in designing and implementing effective internal controls alongside workplace pressures for auditors and the client. Overall, our case provides instructors the flexibility to focus on the topic(s) that are most relevant for their course, including audit materiality considerations, responding to engagement pressures, evaluating internal control effectiveness, and auditors' consideration of fraud in a financial statement audit.

The case is developed for use once students are familiar with the COSO internal control framework and audit materiality concepts. Because students must assess decision-making from both the client's and auditors' perspectives in this case, they should also understand each perspective's technical responsibility for preventing or detecting fraud. For the client, we examine how management influences the control environment and responds to knowledge of control deficiencies. Often students cannot appreciate the possibility that well-meaning individuals may unknowingly circumvent internal controls. The auditor perspective focuses on determining the appropriate auditor response to exceptions identified during audit testing and is shaped by common pressures experienced in the audit environment as well as qualitative materiality considerations. The Teaching Notes provide specific guidance for facilitating in-class discussion and also contain suggested solutions to the case discussion questions.

We generally recommend the case be conducted in three stages over two class days (Parts I and II on the first day and Part III on the second day) to maximize student learning while attempting to minimize class discussion time on non-essential components.

Prior to covering the case in class, students should complete the background reading for the case, a preliminary audit task, and prepare written responses to the discussion questions contained in Parts I and II. The most efficient use of class time for this case is focusing on case discussion questions, which can lead to a variety of important learning opportunities, and our suggested approach will ensure that students are well-prepared to participate. Prior to the discussion questions for Part I, we have provided an audit testing exercise. This exercise (see Appendix C for the links to downloadable files) simulates the type of work auditors conduct and the nature of evidence examined. We recommend students complete this task alongside the reading of Parts I and II. Instructors may consider collecting the materials as part of the assignment grade or including student feedback during the in-class discussion. Like the discussion questions, audit testing could be completed in small groups.

The instructor also has the option to assign, in advance, separate reading quizzes for Parts I and II, each consisting of five multiple-choice questions (see Appendix A of the case for the quiz and Appendix C of the case for the link to download the quiz), to ensure students are prepared for the in-class discussion. Students should plan on 30–45 minutes to complete the readings and discussion questions for Parts I and II.

In terms of delivery, class time, and outside-of-class expectations, the most critical decision for the instructor is how to assign the discussion questions. While we recommend the students work on these questions before class (possibly in groups), the students' time commitment would be dramatically less if discussion questions were handled during class. The trade-off would be less-prepared students, so an alternative approach to delivery could be to discuss Parts I and II on separate class days. Students can still address the discussion questions individually but split the pre-case work up over two class days. We leave it to the instructor to determine what is best for their course in terms of the pre-class approach.

Instructors will need between 15–30 minutes per part to facilitate class discussion of the case. Before the beginning of class, the instructor should identify the perspectives (auditor, client, or both) they want to consider in the class discussion. We recommend instructors divide the students into small groups to improve class discussion after the instructor has introduced a particular part of the case.² After group discussions, the class should reconvene to share each group's collective thoughts on the discussion questions before proceeding. An interesting approach would be to assign groups to consider the issues from a particular perspective (client or auditor) to create a back-and-forth dialog during class.

The Final Resolution to the case (Part III) raises several intriguing issues with many options on how to deliver the content. For this reason, we suggest the instructor cover this part of the case in class after completing class discussion of the preceding parts. The final resolution can be distributed in class to the students to allow for a brief reading, and the concluding discussion could center on the provided questions as a separately provided handout (see Appendix C of the case for the links to download the files). Alternatively, the instructor may wish to distribute the final resolution and assign the final set of discussion questions as a homework assignment. This approach lends to less discussion regarding the final resolution, but it will allow the instructor to assess each student's effort and perspective on the case given its final twists. Under this approach, after all discussions of the first two parts, the instructor could lead a discussion about “what happens next,” and then the students discover the actual end result with the take-home reading.

While the case is straightforward enough to be used in an introductory undergraduate auditing class, it has the depth and flexibility to be modified for a graduate class. For example, we expect our graduate auditing students to provide more in-depth and technical responses to the discussion questions concerning internal control effectiveness and the auditors' responsibility with respect to fraud. Many graduate students will also have had an internship with a public accounting firm prior to enrolling in the course; such experiences should allow them to reflect on instances when they either observed or personally felt the engagement pressures presented in the case. In addition to deeper insight into each discussion question, we offer several potential case extensions below that graduate audit instructors of graduate audit classes may wish to include in their case delivery. While these extensions will depend upon the emphasis of the graduate class, we suggest four possible perspectives that student groups could analyze before the instructor reveals the resolution (Part III) to the case.

1. PCAOB Inspector: Given the PCAOB is responsible for assessing compliance with professional standards for public company audit engagements, what audit deficiencies, if any, do you think a PCAOB inspector would report from a review of this case?

2. Audit Committee: Because audit committees are often called upon to adjudicate disputes between auditors and management, they would play a critical role in resolving this dispute. What actions, if any, would you as an audit committee member take to ensure the responsible parties are identified? Should the audit committee be more concerned that an innocent party may be unfairly punished or that a guilty party may be unfairly vindicated?

3. Internal Auditors: What specific actions would you recommend to remediate any internal control deficiencies identified by the external auditor? How might internal audit assist in implementing a new ERP system such as SAP?

4. External Audit Team: As part of the audit, the audit team is required to update its fraud risk assessment. For each major actor in the case, conduct an analysis of the incentives, opportunities, and possible rationalizations for committing fraud. Do you believe the evidence from the audit of accounts payable warrant additional testing in other areas? If so, which areas?

Rather than having students complete formal written reports, these questions can be used for in-class discussion or assigned for group presentations.

We piloted the case in graduate and undergraduate auditing courses at a private and public university, respectively. Specifically, we tested the case in our own graduate audit class (33 graduate accounting students) as well as four audit classes at a public university (150 junior and senior accounting students) with no author affiliation. Ninety-one percent of the graduate accounting students (30/33 graduate students) had participated in an external auditing internship with a public accounting firm; 15 percent of the undergraduate accounting students (23/150 undergraduate students) had similar internship experience. The graduate accounting students had all previously completed an undergraduate auditing course while the undergraduate students were in the process of completing their first auditing course. The case was administered during April of the spring academic semester, which allowed students to have adequate classroom exposure to the COSO internal control framework as well as key audit concepts, such as the audit risk model, materiality, and auditors' consideration of fraud in a financial statement audit.

All students were asked to provide feedback upon completing the case via an online survey in order to assess whether each of the stated learning objectives were met. Students responded to ten statements on a Likert scale from 1 (disagree) to 5 (agree), with 3 being a neutral response. The survey results in Table 1 support the use of the case in both an undergraduate and graduate auditing curriculum and its achievement of each of the stated learning objectives. Notably, 93 percent of the students responded favorably (above the neutral midpoint of the scale) to recommending that the case be used in future semesters. Across each of the six learning objectives, the percentage of students responding favorably ranged from 93–96 percent. The mean response both within and across the graduate and undergraduate courses for each of the ten statements is also significantly greater than the scale midpoint at p < 0.001.

Students were also given the opportunity to provide qualitative feedback on the case. Many students enjoyed having a real-world scenario that incorporated multiple pressures that they are likely to encounter during their professional careers. Students also responded favorably to the narrative format of the case, which allowed them to more easily assume the role of a staff auditor newly assigned to the firm's most important audit client. A few of the related student quotes about the case are as follows:

Teaching Notes and the Student Version of the Case are available only to non-student-member subscribers to Current Issues in Auditing through the American Accounting Association's electronic publications system at http://www.aaapubs.org. Non-student-member subscribers should use their usernames and passwords for entry into the system where the Teaching Notes can be reviewed and printed. The “Student Version of the Case” is available as a supplemental file that is posted with the Teaching Notes. Please do not make the Teaching Notes available to students or post them on websites.

If you are a non-student-member of AAA with a subscription to Current Issues in Auditing and have any trouble accessing this material, then please contact the AAA headquarters office at [email protected] or (941) 921-7747.