Introduction
Internal controls entail accounting and auditing procedures used in a business’s finance division to guarantee the accuracy of financial reporting and regulatory compliance. Internal controls support businesses in adhering to rules and laws and preventing fraud. By ensuring that policies are followed, budgets are followed, capital shortages are discovered, and accurate reports are produced for leadership, they can also enhance operational efficiency. However, there are two reasons which result in deficiencies in internal controls. Firstly, the deficiency might occur due to a missing control, and secondly, the internal controls might be present, but they may serve the purpose they intend to serve. In either of the two circumstances, internal control deficiencies may occur, and this is where auditors come in: in the determination of internal control deficiencies.
The essay will use a case study: Mason Inc.-internal controls, to address various related aspects. Section one of the essay will explain the effects of ‘accepting a fraudulent vendor change request and making payments to an incorrect bank account’ on the company’s financial statement as a control deficiency. Section two will explain if the failure in the vendor request change form control indicates a material weakness in internal control over financial reporting based on the PCAOB Auditing Standard (AS 2201). This section will focus on factors to consider when evaluating the severity of a deficiency in a control that addresses a risk of material misstatement and materiality level and discovered or possible misstatements. Further, the next section will entail how to control deficiencies that can be a deficiency in design and operation. Here, a statement of what auditors should consider when making the distinction and determining whether the Assistant Controller’s failure to review the Vendor Change Form adequately represents a deficiency in the design or operating effectiveness of the control will be made. The next section will discuss auditors’ obligations when communicating their results, entailing to whom they report and how they do it. The essay will also discuss what auditors should do if they believe the deficiency is a material weakness. The consequence is that the auditor decides to give a favorable report to retain the client. Based on the SOX of 2002, the essay will discuss the potential benefits to investors of having an external auditor audit and obtain reasonable assurance on the effectiveness of internal control over financial reporting.
Discussion
Effects of various internal control deficiencies on the Company’s financial statements
Notably, accepting vendor change requests fraudulently and making payments to the wrong bank accounts can have various effects on a company’s financial statements. The two deficiencies affected Mason Inc. Company, where, following the email dated June 1, 2022, the AP manager approved the change of vendor details, which was a fraud. As a result, the bank details were changed, resulting in payments of $4 million to an incorrect bank account. Payment of money to the wrong bank account results in an understatement or overstatement of the account payable balance. Mason Inc. received an inquiry from Watch Makers regarding the outstanding invoices, which the company had already settled into the wrong account. In this case, it resulted in the overstatement of the amount payable, because the company would later clear the invoices after the due process of determining the authenticity of the two emails. The control deficiency can also result in a misstatement of the company’s expenses, which will further result in a misstatement of the cash balance in the balanced sheet—all these result in a misstatement of the company’s financial performance. Therefore, the effect of fraudulent changes of vendors and making payments into the wrong bank accounts results in various misstatements in the company’s financial statements.
Factors to consider when evaluating the severity of a deficiency in a control
According to the PCAOB Auditing Standard (AS) 2201, when determining the severity of a deficiency in control, various factors need to be considered. Some of these factors include the types of accounts, disclosures, and claims involved in the control deficiency, the magnitude of the misrepresentation resulting from the deficiency, the extent to which other controls can come in and make up for the control deficiency, and the potential impact from which might result from the interaction of control deficiencies and other aspects (Auditing Standard No. 2201. 2013). Considering the payments to the incorrect bank account and fraudulent vendor request change, some of these factors can be significant while determining the severity of the deficiency. For instance, the misstatement’s magnitude can be estimated using the amount of money that was wired to the wrong bank account. Considering the case study, there might also be an interaction between the control deficiency and other aspects of the company’s control environment. The AP manager, for instance, was responsible for determining the authenticity of the email from Watch Makers. The person making the payments was also responsible for tracking the difference between the bank accounts before making the payments. In determining the severity of the deficiency of the controls, all these factors can come into place.
The auditing standard also stipulates that auditors should consider whether the deficiency represents a significant or material weakness when determining its severity. A material weakness entails a deficiency or deficiencies in a company’s internal financial reporting, resulting in misstatements that cannot be prevented or detected easily on a timely basis (Auditing Standard No. 2201. 2013). On the other hand, relative to a material weakness, a significant deficiency is less severe, but those responsible for a company’s financial statements should be aware of it. In the case study, failure in the vendor request change form control resulted in various issues for the company, including fraudulent vendor requests and also payment of approximately $4 million to an incorrect bank account, which resulted in misstatements in the financial reporting and, therefore, the failure is an indication of material weakness.
The distinction between deficiency in design and in operation
While evaluating control deficiencies, auditors must distinguish between design deficiencies and deficiencies in operation. A deficiency in design entails a failure to implement or design the control. In contrast, a deficiency in operation means that the design and implementation of the control were perfect, but then the operation of the control is not perfect. For auditors, making the distinction requires considering various factors related to deficiencies (Bentley-Goode et al., 2017). The first that auditors need to consider is how the control has been designed and whether the design fits the intended purpose. If the design and the purpose of the control are not complimentary, then the auditor should term that a design deficiency. Auditors should also evaluate the duration of the existence of the deficiency. If the deficiency has existed since the implementation of the control, then it is a design deficiency. Still, if it occurred after an operation breakdown, then it is likely to be a deficiency in operation. The frequency and significance of the deficiency should also be considered by auditors when distinguishing between an operation and design deficiency. The higher the frequency of occurrence and significance of the deficiency, the more the likelihood that it is an operation deficiency and vice versa. When making the distinction, auditors must be keen on the various facts and circumstances concerning the deficiencies.
In determining whether the Assistant controller’s failure to review the Vendor Change Form sufficiently represents an operation or design deficiency, the interplay of various factors surrounding the control must be considered. The factors to be considered include the competence of the Assistant controller in terms of training, how he handled the review process, and whether the control design was sufficient to prevent errors from happening. Notably, all these aspects have been addressed in the auditor’s report in the case study. According to the auditor, the Vendor Change Forms contained only some of the information required by the policy. In addition to this and regarding the role of the Assistant controller, the primary review procedure performed by the Assistant Controller related to verifying that the bank account number was appropriately included on the Vendor Change Form. Although there was a presumption that the Assistant controller would understand the primary objective of the control, from the evaluation that the auditor did, he was competent to run the control. Therefore, it was a design rather than an operation deficiency because the control was insufficient in its design rather than how it was operated and who operated it.
The kinds of obligations that auditors have in terms of communication of results
Notably, assuming that the auditor concluded that the internal control was not severe enough to be a material weakness, but it implies internal control, the next step would be for the auditor would be reporting the stakeholders in the company who are responsible for governance, that is, the audit committee. The report should include details of the significant deficiency and recommendations for improving the control. In addition, the auditors must determine and establish whether this significant deficiency affects other aspects of the financial reporting. If it does, the auditor must advise the company on the potential misstatements. Lastly, the auditors must determine whether the various opinions and recommendations have been followed up to the letter and whether they are working towards solving the intended problem.
However, for the Mason Inc. case study, from the auditor’s report, the deficiency in the internal control was severe enough to be a material weakness rather than just a significant deficiency, which can be derived from the fact that the auditor reported a materiality of $8 million. According to the PCAOB standard, one of the indicators of material weakness is “Identification by the auditor of a material misstatement of financial statements” (Auditing Standard No. 2201. 2013). In contrast to when the control has a significant deficiency when a material weakness is involved, the auditor should report this to the company’s management and the audits committee (Auditing Standard No. 2201. 2013). The report should typically have the details of the material weakness involved, the potential impact on the financial reporting, and their opinion on what should be done by the company to combat the effects of the material weakness. In the report by the auditor in the Mason Inc. Case study, the auditor includes detailed information on the circumstances around the material weakness, including the number of vendors involved and the role of the assistant controller in the entire process of verifying the authenticity of the vendor forms, the total payments made to the vendors, the cause of the misappropriation of assets and the recommendations. Therefore, auditors should report all their findings to the company’s management and offer recommendations.
Ethical issues in auditing
Since accountants are the key personnel with access to people’s and organizations’ financial information, accounting ethics is a crucial subject. Such power also includes the potential and opportunities for information abuse or number manipulation to improve corporate perceptions or impose earnings management. In the process of an audit, ethics are also a must. An audit must immediately stop if it does not adhere to auditing and accounting ethics. If the company notifies the auditor about changing their conclusions in favor of the company’s reputation, failure to which they will change the auditor is an ethical issue. It presents the auditor with an ethical dilemma. However, according to professional ethics and auditing standards, auditors are required to give unbiased and true findings about the client’s internal controls. Therefore, in this case, the auditor should not heed the company’s demands; rather, he is supposed to give a true statement of the company’s internal controls (Duska et al., 2018). However, if the auditor heeds the company’s demands to report in their favor, various consequences severe to the auditor may follow. First, the auditor can suffer a legal liability if investors suffer losses due to his decision. The auditor might also suffer disciplinary actions from professional bodies, including the SEC and PCAOB, which might result in the loss of their license and damage their reputation.
Potential Benefits to Investors of Having an External Auditor
According to Section 404(b) of the Sarbanes-Oxley Act (SOX) of 2002, external auditors must attest to how effective internal control over financial reporting is. The stipulation was added to the act to ensure that external auditors give accurate and reliable financial reports and also help boost investor confidence (Rice & Weber, 2012). One of the potential benefits is that the auditor’s report on internal control over financial reporting assures investors of the effectiveness of the internal controls of the company, which results in accurate and reliable financial reports. In this case, the external auditor reveals a deficiency in the internal control system which would have resulted in errors in the financial reporting. Relying on the information from the external auditor, the investors can now make informed decisions on matters of investment (Rice & Weber, 2012). The requirement also gives the investors additional details regarding financial statements. With the information, investors are able to evaluate the progress of the company financially, and with this, the investor can make better, evidence-based decisions. Therefore, although the requirements for this section can be costly, the benefits the investors derive outweigh the incurred costs.
Conclusion
Markedly, auditors play a crucial role in assessing and reporting the effectiveness of the internal controls in a company. The case study of Mason Inc. presents how important effective controls are, and the roles that auditors play in ensuring that the deficiencies in internal controls have been identified and corrected to boost investor confidence and also present fraudulent financial reporting. The case has also highlighted some accounting ethics, where an auditor might be required to change their opinions in favor of the client for reasons including retaining the client. However, the SOX Act and various auditing standards have laid out various guidelines on how the auditors should handle such dilemmas, failure to which they might face the consequences.
References
Auditing Standard No. 2201. (2013). An Audit of Internal Control Over Financial Reporting That Is Integrated With An Audit of Financial Statements. Public Company Accounting Oversight Board. Retrieved from https://pcaobus.org/Standards/Auditing/Pages/Auditing_Standard_2201.aspx
Bentley-Goode, K. A., Newton, N. J., & Thompson, A. M. (2017). A business strategy, internal control over financial reporting, and audit reporting quality. Auditing: A Journal of Practice & Theory, 36(4), 49-69. https://publications.aaahq.org/ajpt/article-abstract/36/4/49/6020
Duska, R. F., Duska, B. S., & Kury, K. W. (2018). Accounting ethics. John Wiley & Sons. https://books.google.com/books?hl=en&lr=&id=kJJuDwAAQBAJ&oi=fnd&pg=PR7&dq=the+wall+street+journal+professional+ethics+and+legal+liabilities+of+auditors,+list+all+possible+consequences+you+can+think+of++for+the+auditor+who+agrees+to+issue+a+more+favorable+report+in+order+to+retain+the+client.&ots=ilkebjQmt1&sig=gU8ekIGmbrDwWIcObamfns2x4z8
Rice, S. C., & Weber, D. P. (2012). How effective is internal control reporting under SOX 404? Determinants of the (non‐) disclosure of existing material weaknesses. Journal of Accounting Research, 50(3), 811-843. https://onlinelibrary.wiley.com/doi/abs/10.1111/j.1475-679X.2011.00434.x
write