ASSISSING CONTROL RISK Case 4 The CPA firm of Abernethy and Chapman was hired during the summer

of 2006 to audit the financial statements of the Lakeside Company for the year ending December 31, 2006. Even though the year-end was nearly six months away, the firm began its preperation almost immediately. Wallace Andrews, a manager, and Art Heyman, a staff accountant, both with Abernethy and Chapman, spent a number of days doing preliminary analysis at Lakesides headquarters. During this time, they also visited King and Company to review the audit documentation created during previous audits. Andrews and Heyman were looking for information that would assist in the assessments of both inherent risk and control risk. In looking at the predecessor auditors documentation, Heyman was assigned to study the permanent file to learn more about the various accounting systems and internal control features that were in place at the Lakeside Company. While examining these documentations. Heyman discovered an organization chart that King and Company had drawn to represent the clients internal control (see Exhibit 4-1). He also found the symbols used by the previous auditors in flowcharting the companys various systems (see Exhibit 4-2). Heyman next came to a section of the permanent file entitled Revenue and Cash Receipts Cycle-Distributorship. Apparently, two people performed this portion of the audit work originally. The Revenue Recognition function had been described in a memo (see Exhibit 4-3), whereas the Cash Receipts section of the company was captured in flowchart form (see Exhibit 4-4). Heyman analyzed both of these systems in detail to familiarize himself with the organization and operations of the Lakeside Company. After finishing the initial investigation of Lakeside, Andrews and Heyman held a discussion with Dan Cline, the audit partner who had been placed in charge of the actual engagement. This group met to discuss their uderstanding of the clients internal control, a procedure necessary for audit planning purposes. They wanted to make a preliminary assessment of control risk, which is the the auditors expectation that a material misstatement would not be prevented or detected on a timely basis by Lakesides internal control. The auditors evaluation of control risk has a significant impact on the nature, timing, and extent of subtantive procedures. Thus, this assessment is made early in the examination. For example, if the auditors assume the maximum control risk, then the auditors will likely perform more extensive subtantive tests using more experienced personnel. Conversely, if control risk is judged to be below the maximum level, the auditor may reduce the overall audit time and effort. However, to justify a lower assessment of control risk, additional tests of the controls are necessary. After identifying specific client policies and procedures that could prevent material misstatements, the auditors have to verify both the design of these controls and their effectiveness. As part of the preliminary assessment of control risk, the auditor must come to an understanding of the five components of internal control. To focus attention on the five areas, Cline posed several questions to Andrews and Heyman:

Has Lakeside established the proper environment for strong internal control? Is the management aware of the importance of internal control? Does management work to ensure that internal control is constantly functioning in an appropriate fashion? Does the company have a risk assesment policy that identifies and analyzes relevant risks to achievement of its objectives? Does it have a policy for determining how these risks should be managed? Has the company established control activities, policies, and procedures such as the use of adequate documents? Do transactions have to be authorized? Are duties properly segregated to prevent irregularities? Are the companys information and communication systems appropriately designed in order to allow for the proper identification, capture, and exchange of information in a form and time frame that enable people to carry out their responsibilities? Does the company have a process that monitors the quality of internal control performance over time?