This weeks Friday Accounting Ethics Case centers around the concept of trust as an inadequate internal control.
You are discussing internal controls with your client. You noticed that they lack any sort of review over the receipt of incoming goods that have been purchased. During your engagement you pulled an invoice for the purchase of a laptop but when you inquired to the purchasing department regarding the receipt of the laptop, nobody could seem to recall who received it or where the laptop was now.
When you bring this to the controllers attention she dismisses it and states that she is sure that it is around somewhere and being used for business purposes. You point out that you are not trying to make any accusations but that there may be a control and fraud risk if there are no controls over receiving of goods purchased by the organization. You point out that without some sort of receiving process how can she be certain that the organization ever actually received the laptop that they paid for? The controller responds that she trusts all her staff so she doesn't have to worry about one of them picking up company assets and walking off with them. You try to explain that it is not only an issue of fraud risk but this could be an instance where the organization failed to receive the goods they paid for and so should go back to the vendor to verify that the goods were actually shipped. She responds that she has had enough with this line of questioning.
Subsequently the controller contacts the engagement partner and complains that you are attempting to find problems where none exist just to have audit findings to report. Although no reprimand comes down, the audit partner pulls you from the engagement. What would you do?
For tips on improving efficiency and reducing risk, signup for the Controlzkit newsletter here.
- 657 reads
- login or register to post comments
- Add to a social bookmarking site
- Send to a friend
Proper Escalation
Oops, something happened to the client relationship in this case.
Here's what I would do. After I found the laptop control weakness, I would talk to the Controller. When she dismisses the issue, I wouldn't press it, but I would go back and do more testing to see if I could spot a pattern. This happened at a client of mine. What was really going on was that the "missing" computer equipment was being given to the purchasing manager of a major customer under the table. Everyone knew what was going on, except yours truly, the auditor.
In my case, I was unable to find any other instances. I did NOT confront the Controller. Instead, I wrote up the incident and informed the manager on the job. I don't know what happened. All I know is that when I got back the next year, a member of the sales staff had been fired and I understood from gossip that the customer's purchasing agent had also been fired. Whether my finding had anything to do with it, I don't know.
For me, the lesson of this case is to know how far your influence extends. As a junior auditor, I have a duty to do my testing and report my results. If I encounter resistance from the client, my role is to escalate the issue internally, to the audit senior, manager or partner. I don't take matters into my own hands.