Alchemy Case Memo free essay sample

The passing of the Sarbanes-Oxley Act of 2002, as well as the numerous corporate frauds and bankruptcies over the past decade—including some from Fortune 500 companies such as Enron, WorldCom, and Tyco—reinforced the need for a strong system of internal controls, and significantly increased the awareness of management, investors, the Congress, and the public of the importance of a strong system of internal controls. Further, without effective internal controls, management, as well as investors, have little assurance that fraudulent, improper, and abusive actions are being prevented or, if occurring, are being promptly detected with appropriate corrective actions taken. Assessing the internal control environment, as well as the design of the controls themselves, continues to be an integral step in our auditing process. Without taking the time to understand and assess a company’s controls, not only would the firm not be in compliance with generally accepted auditing standards and the Sarbanes-Oxley Act of 2002, but we would also be unable to provide the comprehensive and reliable audits that the firm’s clients have come to expect. The purpose of this memo is to discuss the results of the audit team’s assessment of Alchemy Inc. ’s internal controls—including identifying missing controls, control weaknesses, and opportunities for fraud—and to recommend improvements to address any weaknesses. In order to gain an understanding of Alchemy Inc. ’s internal controls, our team obtained and reviewed corporate policies and guidance, as well as audits and reports conducted by the company’s internal audit department. We interviewed personnel across the organization regarding company policies, operations, and their specific job functions. These personnel included management, the internal audit department, and staff from the receiving, shipping, and operations departments. In addition, the team conducted a walk-through to observe the processes and controls in place across the company. During our analysis of Alchemy Inc. , our audit team identified internal control weaknesses that leave Alchemy Inc. vulnerable to fraud, errors, and abuse. While the team found numerous control problems across the company, our memo describes only those control problems which the team believes to be the most significant. We organized these weaknesses into two separate categories: (1) executive management and internal audit department weaknesses, and (2) operations (control weaknesses found in the company’s receiving, processing, and shipping departments). Within these two categories, we classified the weaknesses by severity (material weaknesses, significant deficiencies, and control deficiencies) and provided what we believe to be cost effective recommendations for overcoming each of these weaknesses. Executive Management and Internal Audit Department- Current Control Environment, Oversight, and Monitoring Are Material Weaknesses At the executive management and internal audit department levels, the team identified two internal control weaknesses, both of which represent material weaknesses. These two material weaknesses are (1) an ineffective control environment and (2) ineffective oversight and functioning of the internal audit department, including the department’s risk assessment and internal control monitoring responsibilities. Material Weakness: Ineffective Control Environment While the team found that management does have company-wide procedures and controls in-place, neither employees nor management demonstrated an understanding of the purpose or importance of the controls. We found that although a code of conduct, ethics hotline, and newsletter exist, none were consistently used, enforced, or reinforced by company employees or management. For example, upon joining the company, employees must sign a code of conduct; however, management has not made a sustained effort to implement or reinforce the code. Potential for misstatement fraud: Compliance with the established procedures and controls were found to be ineffective. The fraud reporting process, technically put in place does not serve its intended purpose. The ineffective control environment has created an attitude and tone across the company where errors and inappropriate behavior may be seen as acceptable, thus creating opportunity for concealing fraud and potential misstatements. †¢Recommenda tion—The team recommends that Alchemy Inc. ncrease awareness of the code of conduct by posting it around the facility and reinforcing it when needed, such as through periodic meetings specially designed to address this issue. In addition, the company should actively distribute the company newsletter—for example, delivering a copy to each employee personally—rather than passively leaving it out in the break room or distributing it via email. Management should also actively encourage employees to use the ethics hotline and other feedback venues, such as email or an anonymous suggestion box for employees without access to email. Further, management needs to demonstrate actions on the feedback by monitoring the effects of the tips and feedback and communicating these effects when improvements are made, while preserving the anonymity of the proponent. Material Weakness: Ineffective Functioning and Oversight of the Internal Audit Department The team found Alchemy Inc. ’s internal audit department to be largely ineffective due to the weaknesses in managing the department, the experience of the department’s personnel, and the department’s oversight and monitoring across the company. Currently, the internal audit department is under the direction and supervision of the CEO, not the audit committee as best practices dictate. Further, the internal auditor and his staff do not have the appropriate level of experience and qualifications needed to design and apply effective control procedures. For example, the team questions the validity of the CPA license one employee was able to obtain in only two days over the internet. In addition, the department does not perform any periodic oversight of processes across the company, monitoring to see if the controls are in place and functional. For example, the receiving clerk said that in his two years at the company, the receiving process has never been reviewed by the internal audit staff. †¢Potential for misstatement fraud: A serious conflict of interest can occur not only when an internal audit department is directly supervised by management, but also when its agenda and work is approved by management. By doing so, management has the opportunity to create fraud and misstatement by directing the internal audit department in a way so that the fraud will not be discovered. This problem is only exacerbated when the internal audit department does not have the necessary experience to regularly test the design and operational effectiveness of controls across the company. Furthermore, if the internal audit department is not regularly conducting oversight and monitoring of the effectiveness of controls across the company, management will not know how effective the controls are. In addition, the lack of consistent oversight creates a favorable ground for the proliferation of misstatements or frauds by the employees, starting with low quality work and moving up to theft. Recommendation: The internal audit department should be placed under the supervision of the Audit Committee, thus eliminating the potential conflict of interest by answering directly to management. Secondly, the team recommends Alchemy Inc. to review the credentials of all internal auditors. If insufficient, Alchemy Inc. should hire at least one legitimate CPA to run the department, as well as provide and require training for auditors that lack the required experience. While training may be costly for the company, some low cost alternatives may be available, such as self-paced on-line courses from legitimate providers. The team believes the benefits of such training will greatly outweigh the costs in the long run. Finally, the internal audit department should consistently monitor controls across the company. The timeliness of monitoring plays a very important role in the internal control design. In other words, the more frequent the monitoring, the more timely the discovery of the weakness. Discovered in time, the roblems can be fixed, and the risks involved with misstatement or fraud can be minimized. Combined, the Number of Significant and Control Deficiencies within Alchemy Inc. Operations Represent a Material Weakness The team found a number of significant and control deficiencies across Alchemy Inc. ’s operations, which includes receiving, processing, and shipping. While each of the internal control problems identified are only classifi ed as a significant or control deficiency, we believe the internal control problems altogether across Alchemy Inc. ’s operations represent a material weakness. Significant Deficiency: Receiving Department’s Procedures to Process and Document Receivables Are Ineffective While the receiving clerk counts the number of bags received and records it in a log provided to management, the clerk does not retain documentation from the shipper to verify the number of items sent. Even though a shipping slip is attached to each bag, the receiving clerk does not compare this slip with the invoice or purchase order to verify the accuracy of the delivery. As a result, the number of spheres received is not reconciled with the final billing amount. In addition, the access to materials received, but not yet delivered to operations, is not restricted. †¢Potential for misstatement fraud: By not systematically confirming and documenting receipt of goods and not limiting access to raw materials, Alchemy Inc. has left itself susceptible to potential over billing by vendors and theft by employees, not just in the shipping department, but company-wide. †¢Recommendation: Upon receipt of the spheres, the receiving clerk should perform a 3-way match by reconciling his/her count with the shipping invoice and the purchase order. Upon reconciliation and completion, this documentation should be sent to the accounting department in order to verify billing amounts. Any discrepancy should be reported to the manager of the receiving department. Further, the company can safeguard access to raw materials in the shipping department by improving the monitoring system in the receiving department, such as installing a surveillance camera or restricting access to the materials- for example, placing the materials in a secure and locked storage area, such as an adjacent room, until the materials are needed. Significant Deficiency: Controls to Provide Increased Accountability Needed in Receiving Department’s Delivery and Assignment of Materials After receipt, the receiving clerk distributes the raw materials to the operators as needed. In a part of this process, the receiving clerk counts the number of spheres per bag upon delivery, but the clerk’s count is neither verified by the operator nor recorded or differentiated between sphere colors. Further, while the total count per bag is noted on a log provided to management, the assignment of each bag to any specific operator is not recorded. Potential for misstatement fraud: The following three problems create the opportunity for theft or manipulation by both the receiving clerk and operator: 1) not having the operators verify the receiving clerk’s count, 2) not recording the assignment of specific bags to specific operators, and 3) not differentiating among colors during the count. For example, since the receiving cl erk has access to the raw materials and responsibility for recording the quantity, he/she has opportunity to steal materials and adjust the records. Further, similar opportunity is provided to operators since information regarding the specific bag of raw materials, the quantities of each color within the bag, and the specific operator to which the bag is assigned are not recorded. †¢Recommendation: The team recommends Alchemy Inc. to institute controls that would help increase the accountability of both receiving clerks and operators. Upon receipt, each bag should be given a unique identification number, and the operator assigned to each bag should be recorded. During the count, the receiving clerk should differentiate between the number of gold, green, and orange spheres, providing a total for each color in each bag. The machine operator assigned to a bag should confirm the receiving clerk’s count and sign the receiving log indicating as such. Upon final processing, the total number of each sphere color processed by each operator should be reconciled with the total number of each sphere color provided to the operator. Control Deficiency: Operator Color Sorting of Spheres Lacks the Needed Controls In some instances, spheres that are neither gold nor green will be delivered and processed by operations—employees indicated these spheres are generally orange. These orange spheres are discarded as waste, without making any notation regarding the quantity of orange spheres delivered or processed. In addition, the spheres in the color sorting bins are not counted or inspected. Therefore, a gold sphere could easily be misplaced in the green bin or thrown away. Potential for misstatement fraud: While the gold and green spheres have revenue value to the company, orange spheres do not. By not quantifying the number of orange spheres delivered, Alchemy Inc. is not holding its suppliers accountable for delivery of unwanted raw materials that have no value. By not holding suppliers accountable, the company is being consistently over-billed for these raw materials by its suppliers. In addition, by throwin g these orange spheres in the waste and not keeping a record of them, the company is not holding operating employees accountable and providing them with the opportunity for fraud. Recommendation: We recommend that Alchemy Inc. input an internal control to help hold both employees and vendors accountable. Alchemy Inc. should create a separate bin for the orange spheres to be placed during sorting and include the total number of these spheres in the reconciliation process. In order to keep accurate records and inspection of the spheres, the operator should count the spheres in the color sorting bins and inspect that no spheres were accidentally placed in the wrong color bin. In addition, Alchemy Inc. hould explore opportunities for resale of orange spheres, which may have value to other customers, as well as pursuing the possibility that these spheres could be returned to the supplier for credit. Significant Deficiency: Improvements Needed in Controls for Counting Helixinated Spheres In processing spheres, we found that green or orange spheres are sometimes placed in the helixinator by accident. When this occurs, the operator places the green (which are sold much cheaper) and orange spheres (which have no residual value) in the correct bin (either the green storage bin or trash bin if the sphere is orange) at the end of the process. Notation of these errors is not made, and the count provided by the laser counter at the end of helixination process is not adjusted. †¢Potential for misstatement fraud: Since this final helixination count is used for both recognizing revenues and determining employee wages, the most important result of operators not correcting or noting mistakes in the final helixination count is that the company consistently and inaccurately recording revenues and employee wages. Since operators currently get compensated based on the number of spheres processed through the helixinator, employees have incentives to inflate the final helixination count. For example, this can be accomplished either through re-processing the same spheres, or through processing incorrectly colored spheres. †¢Recommendation: The team recommends Alchemy Inc. to institute a procedure where operators document, either on an existing log or a new log, the number of non-gold spheres placed in the helixinator accidentally. Also on this log, the operator should record the number on the laser counter at the beginning of the bag of raw materials and the number on the counter once the entire bag has been processed, thus allowing for precise and accurate reconciliation. To provide an additional level of accountability and certainty in recognizing revenue, the company should record revenue based on the number of items actually shipped, not based on the number of spheres on the helixinator counter. In addition, to improve the accuracy of employee wages, the company should either: (1) use reconciled helixinator counter numbers to determine wages, such that employees are not paid for non-gold spheres, (2) adjust the employees’ pay scale to be based on total spheres processed, which would include all of the gold, green, and orange spheres, and not just those spheres that have been helixinated, thus eliminating the incentive for errors, or (3) a combination of both 1 and 2. Control Deficiency: Additional Controls Needed for Incomplete Processing Remaining at the End of a Shift At the end of a shift, any spheres remaining in the size separating, color sorting, or helixinating processes are left as is and are completed when the shift begins the next day. †¢Potential for misstatement fraud: By leaving valuable raw materials in areas with minimal access controls, the company is providing all employees and staff, including cleaning and maintenance personnel, with the opportunity for theft. †¢Recommendation: We recommend Alchemy Inc. o either: (1) have an operator record on their log, at the end of the shift, the number of each color sphere at each phase of the process, to be certified by a supervisor and spot checked as needed (but on a regular basis); (2) provide an analysis of the amount of time an operator takes to process one bag of spheres and create a policy or standard procedure, such that an operator does not start a new bag if it can not be completed within a reasonable amount of time of the shift ending to minimize overtime (for example, within 15 minutes). Since operators are paid per processed sphere, and not hourly, they should have extra incentive to work to complete as much inventory as possible within a given day; or (3) put controls in place to significantly reduce all open access to spheres during non-shift times. For example, placing a lid and lock on the holding tank; locking the trap doors; removing all inventory from conveyors, labeling them and placing them in a secure location; and locking all completed spheres, green and gold, in secure locations. Control Deficiency: Additional Controls Needed for Transfer of Processed Spheres from Operations to Shipping After the spheres have been processed by an operator, a shipping clerk makes note of the number on the laser counter, but does not confirm the count, sorting, or packaging of the final product. †¢Potential for misstatement fraud: By not confirming the count, sorting, or packaging of the final product, Alchemy Inc. posses the risk of incorrectly billing, either over-billing or under-billing, the client. Further, not having a final count of spheres performed by both operators and shipping clerks, leaves Alchemy Inc. ulnerable to employee theft. †¢Recommendation: The team recommends that upon arrival to pick up processed spheres from operations, beyond recording the number of the laser counter, the shipping clerk should verify the operator’s final processing logs by counting the number of green and gold spheres he/she is picking up. Since the clerk is counting t he spheres, he/she will simultaneously be conducting a quality check, ensuring that no spheres were packaged incorrectly (that is, putting a gold sphere in a bag of green spheres, or vice versa). Upon reconciliation and completion of the quality check, the shipping clerk should sign the operator’s processing logs providing confirmation of the number of spheres he/she is accepting. Alchemy Inc. Engagement Team Next Steps The team anticipates having the final report on Alchemy Inc. internal controls within a week of receiving your final comments. Further, in reviewing materials provided by the company, and in interviews with personnel across the company, the team came across a number of instances in which items were identified as key internal controls, but are in fact not internal controls by steps in company operations. For example, Alchemy Inc. ’s management control matrix incorrectly identifies the following steps as controls: †¢Operator turns crank which turns on the â€Å"volume-limiter† which shrinks the large spheres and turns them to small ones—By turning the crank, the operators are running or operating the machine. These actions do not provide a reasonable assurance for achieving any of the company’s objectives. †¢Color sorting operator represents a control in place to sort colors and place only the gold spheres on the conveyor to the helixination and counting process—This represents a step in processing the spheres. An example of a sorting control would be having an individual spot-check or verify the accuracy of the sorting. †¢Completeness is ensured since the tank is fully encased; and access to the size sorting process is restricted in the enclosed tubes—Both of these items are factors or dimensions of the processes in place, and are not controls to reinforce compliance or reliability. Upon completion of the final report, the team will present the findings to Alchemy Inc. ’s audit committee, after which the team also anticipates reviewing these additional findings with management and the internal audit department.