· For each weakness, provide a description of the activity or feature that you believe is a control environment weakness, an explanation of how it weakens the control environment, and a recommended improvement. Limit your answer to three major strengths and three major weaknesses. I have provided one example of each in the template file and you need to add three more strengths and three more weaknesses to the table in the template file.
· Review their specific controls over sales and collections (i.e., based on the Sales and Collection Processing section of the case) and purchases and payments (i.e., based on the Purchasing and Payments Processing section of the case) to evaluate transaction control weakness.
a) Describe the control weakness (just a short statement of weakness);
b) Describe how the weakness could create a material error in the financial statements including which general ledger accounts and audit objective might be affected (be clear on which category is involved, balance, transaction, or presentation and disclosure) and provide an explanation of how the weakness might lead to a violation of the audit objective;
c) Make a recommendation on how their controls could be improved to mitigate this weakness; and
d) Discuss some potential weaknesses in the control you suggest (e.g., how it might be overridden).
e) Limit your answers to the four most serious weaknesses you find in the sales and collection processes and the four most serious weaknesses you find in the purchases and payments processes. The template file has separate sections for each step in these processes to help you structure your answer. The four weaknesses in each of the processes can be spread in any way across the steps and you are not required to have any minimum number in any step.
· Your control weaknesses and recommendations need to be specific to the case and sensitive to the size of the organization. The following are some examples of recommendations that would not be appropriate for ABC:
· They are too small and cannot afford to establish and internal audit department nor contract out those services to an outside auditor.
· They cannot afford to make significant changes to their current computer systems and so recommendations to computerize their current manual operations are not practical. However, all their information is currently stored electronically and so you may suggest simple ways they could more effectively share or control that data.
· The operations of their EDP environment are not completely described in the case. Thus your critique of their controls should be limited to those portions of their EDP environment that are included in the case description.
