ABC Retailers — Internal Controls- ACCT 461
Introduction
This case gives students an opportunity to (1) understand the process of evaluating identified
control deficiencies; (2) understand the annual disclosure requirements for management’s report
on internal control over financial reporting (ICFR); and (3) determine the effect of identified
control deficiencies on other controls. Students are required to read the case and address the
seven questions are listed on the last page.
Background
ABC Retailers Inc. (ABC or the “Company”) is a U.S. public company that files quarterly and
annual reports with the Securities and Exchange Commission (SEC). ABC is a leading retail
chain operating more than 100 department stores across the continental United States. ABC
department stores offer customers a variety of nationally advertised products, including clothing,
shoes, jewelry, and other accessories. The Company’s supply chain of products is managed
through a single warehouse and distribution facility located in Kansas City, Missouri.
ABC has a centralized accounting and finance structure at its corporate headquarters, where all
processes and controls related to all substantive account balances occur, including controls
related to accounts payable and the Vendor Master File.
ABC recognizes revenues from retail sales at the point of sale to its customers. Discounts provided to customers by the Company at the point of sale, including discounts provided in connection with loyalty cards, are recognized
as a reduction in sales as the products are sold. Cost of goods sold for the Company primarily
consist of inbound freight and costs relating to purchasing and receiving, inspection,
depreciation, warehousing, internal transfer, and other costs of distribution.
Facts
Audit Issue
On June 1, 2020, the Accounts Payable (AP) Manager received an e-mail inquiry about the
process required for a vendor to change its bank account information. The e-mail was sent from
John Smith at a domain address listed as “Watch-Makers.” Watch Makers is a manufacturer that
supplies ABC-branded watches to ABC’s west region department stores. In addition, John Smith
is the primary contact at Watch Makers with whom the Company typically interacts.
The AP Manager responded to the e-mail request on June 15, 2020, with the procedures required
of the vendor, which include completing a vendor bank account request form. On June 20, 2020,
the AP Manager received a reply e-mail from John Smith at “Watch-Makers” with a completed
vendor bank account request form, which included John Smith’s signature, new bank account
information, and other related information.
Upon receiving the vendor bank account request form, the AP Manager completed a separately
required Vendor Change Form for internal processing. The Vendor Change Form is completed
for new vendors or changes to existing vendors’ information, including bank account
information. The AP Manager sent the completed Vendor Change Form to ABC’s Assistant
Controller, who reviewed and approved the request on June 24, 2020. The bank account
information was updated within the Vendor Master File on June 26, 2020.
ACCT 461-Deep dive
2
Throughout the month of July, valid Watch Makers invoices were processed through the
Company’s accounts payable process, and the valid invoices were paid in accordance with the
Company’s processes for cash disbursements and wire transfers. However, because the bank
account information for Watch Makers was changed (as a result of the June 1, 2020, e-mail
request) approximately $2 million in payments was wired to an incorrect bank account. On
August 2, 2020, the Company received an inquiry from Watch Makers about the expected timing
of the $2 million in outstanding invoices. As a result of the direct interaction with Watch
Makers’ employee John Smith, the Company determined that the previous vendor bank account
change form was received from a fraudulent domain name with the intent to defraud the
Company. The e-mail domain for Watch Makers is “Watch Makers,” with no hyphen, rather than
“Watch-Makers,” with a hyphen. Both e-mails received from “Watch-Makers” were determined
to be from a fraudulent source (that also fraudulently used John Smith’s name in the e-mail).
As noted above, there are two employees within the Company that were involved in processing
and approving the Vendor Change Form.
The Company’s policy on bank account change
requests were communicated by ABC’s Assistant Controller in an August 2019 e-mail that
indicated that for each Vendor Change Form requesting a vendor bank account change, the
accounts payable department was required to (1) obtain a previously processed and paid invoice
from the vendor requesting the bank account change, (2) call the vendor using the contact
information obtained from the prior invoice, (3) verify the authenticity of the requested bank
account change request by directly contacting the vendor, and (4) include all relevant
information obtained in steps (1) through (3) as an attachment to the Vendor Change Form.
The Company’s control description relating to the review of a Vendor Change Form by the Assistant
The controller is not explicit regarding the specific attributes of the review. However, because the
the policy was distributed by the Assistant Controller and the Assistant Controller is also the control
the owner (e.g., performs the review), there is a presumption that the Assistant Controller would
understand that as part of her review, she should evaluate whether the AP Manager obtained
sufficient information to confirm the authenticity of the bank account change request.
Other Relevant Facts- ACCT 461-Deep dive
• Materiality — $8 million.
• The Company processed approximately 105 vendors requested bank account changes during
2018 before the realization that the request from “Watch-Makers” was fraudulent (from
September 25, 2019, to August 2, 2020). After the identification of the misappropriation of
assets, the Company’s internal audit department obtained and reviewed all 105 Vendor Change
Forms reviewed by the Assistant Controller, noting that only five Vendor Change Forms
contained the information required by the policy. In addition, an internal audit determined that the
primary review procedure performed by the Assistant Controller related to the verification that
the bank account number was appropriately included on the Vendor Change Form. This
procedure was performed in all cases before the bank account information was input into the
accounts payable system.
• The total wire transfer payments made to the 105 vendors that requested bank account changes
in FY16 totaled approximately $56.2 million (based on an analysis prepared by the Internal Audit of
the invoices processed and paid by the Company after the processing of a Vendor Change Form
for the 105 vendors).
ACCT 461-Deep dive
3
There are more than 30 vendors with annual purchase activity of over $20 million (12 of which
have purchase activity of over $40 million); thus, the number of payments made to any single
vendor in a payables cycle could approximate $2 million, assuming a cycle of 30 days.
• The Company’s Chief Security Officer completed an internal investigation and concluded that
there was no indication that the AP Manager and Assistant Controller were involved in the
a scheme that resulted in the $2 million misappropriations.
• Internal Audit performed a thorough evaluation of the competency of the Assistant Controller
and concluded that notwithstanding the Assistant Controller’s lack of historical performance, the
Assistant Controller was suitably competent to perform the control.
Engagement Team Note
In planning the 2020 audit, the engagement team obtained an understanding of the internal
controls related to cash disbursements. This understanding was developed through the
engagement team’s walkthrough of the cash disbursements process. As part of its walkthrough
procedures, the engagement team made inquiries of appropriate personnel, inspected relevant
documentation, and in certain cases, observed the control performers carrying out required
control procedures. As a result, the engagement team concluded that there were no significant
changes to the cash disbursements process in the current year.
The engagement team identified three risks of material misstatement relating to the cash
disbursements process. For each risk identified, the team documented the control activity that
addresses the risk of material misstatement in the excerpted worksheet (see Appendix 1). As a
result of the ‘Audit Issue’ described above, the engagement team identified a control deficiency
in the following control:
CD5C — The accounts payable department is required to complete the following for each
Vendor Change Form requesting a bank account change:
1. Obtain a previously processed and paid invoice from the vendor requesting the bank account
change.
2. Call the vendor using the contact information from the obtained invoice.
3. Verify the authenticity of the requested bank account change request.
4. Attach all relevant information obtained in steps (1) through (3) to the Vendor Change Form
for review and approval.
The Company’s control description regarding the Assistant Controller’s review of the Vendor
Change Form is not prescriptive regarding the specific attributes of the review. However, there is
a presumption that the Assistant Controller would understand the primary objective of the
control, which is to evaluate whether sufficient information was obtained by the AP Manager to
confirm that the bank account change request was authentic.
Required:
ACCT 461-Deep dive
4
1. Briefly explain the misstatements made in the company financial statement. How did
‘accepting a vendor change request and making payments to an incorrect bank account’ affect
the Accounts Payable balance?
2. According to PCAOB Auditing Standard (AS 2201)
(https://pcaobus.org/Standards/Auditing/Pages/AS2201.aspx), what factors should auditors
consider when evaluating the severity of a deficiency in control that directly addresses a risk of
material misstatement?
3. PCAOB AS 2201 distinguishes the difference between a deficiency in design and a deficiency
in operation. First, explain what auditors should consider when making the distinction. Second,
determine whether the Assistant Controller’s failure to adequately review the Vendor Change
The form represents a deficiency in the design or operating effectiveness of the control.
4. Based on the guidance in AS 2201, determine if the failure in the vendor request change form
control is indicative of a material weakness in internal control over financial reporting. Consider
both quantitative and qualitative factors.
5. SEC Regulation S-K requires that management provide a report on a registrant’s ICFR in the
company’s Form 10-K. Assuming the company and the auditor concluded that this internal
control failure indicates a material weakness in internal control, what information would the
company management be expected to disclose?
6. Assuming the company and the auditor concluded that this internal control failure is not severe
enough to be a material weakness but indicates a significant deficiency in internal control,
explain the next steps for auditors. What kinds of obligations do auditors have in terms of
communicating the results (e.g. To who do they report? And How?) Compare and contrast with
the case of material weakness.
7. Assume the auditor believes the deficiency is a material weakness, but the company pleads that
a material weakness in internal controls will greatly damage the company’s reputation. The
company notifies the auditor that the company will consider changing the auditor in the
subsequent year if the auditor concludes the deficiency is a material weakness. ABC Retailers
Inc. is an important client for the auditor, and losing the client will have a nontrivial impact on
the auditor’s revenue. What should the auditor do? Based on what we learned in Module B and C
of the textbook, explain possible consequences for the auditor who agrees to issue a more
favorable report in order to retain the client.
(The situations described in 5, 6, and 7 are independent of one another.)
The list above does not present a complete list of issues related to the topic. You may
additionally discuss other issues relevant to the audit process of internal control in your paper
