11/17/2015 Simply Soups Inc.: A Teaching Case Designed to Integrate the Electronic Confirmation Process into the Auditing Curriculum Instructional Guide for Students Version 2.8 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. https://edu.Confirmation.com 1 11/17/2015 Table of Contents © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 2 11/17/2015 Student Instructions The purpose of this case study is to allow you to gain experience with the audit of cash, in particular the confirmation of cash balances using electronic confirmations. This exercise will challenge you to think critically about the confirmation process, applicable auditing standards, and risk. As you go through the case you will become familiar with Confirmation.com and the electronic confirmation process. For the purpose of this case study you will be using edu.Confirmation.com. The auditor obtains comfort over Longtop PFGBest management’s assertions of existence, Kmart Parmalat completeness, and accuracy by confirming the reported balances directly with external Ahold Olympus parties (i.e., banks). Because management Refco Satyam may have incentives to misstate the cash China Biotics HealthSouth balance in order to achieve a stronger China MediaExpress Sino-Forest balance sheet, hide overstated revenues or increase financial ratios, confirming cash is Shepherd Major Play Fund ZZZZ Best an important audit step. Unfortunately, in recent years, there has been an increase in the use of the cash account as a mechanism to help perpetrate fraudulent actions by management. As a result, many cash confirmation frauds have been perpetrated over the last decade (e.g., PFGBest, Satyam, Parmalat, China Media Express) on public company audits worldwide. Confirmation.com, creator of the edu.Confirmation.com application, is the world’s leading provider of online audit confirmation services. Their multi-patented solution processes more than $1 trillion in confirmation information annually, helping reduce financial fraud and bringing efficiency to the 90-year-old paper based audit confirmation process. Confirmation.com is utilized by over 13,000 accounting firms in more than 100 countries to process cash, debt, AR and more than 40 other audit confirmation types. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 3 11/17/2015 Assume the following: You are an Audit Staff with the CPA firm Putnam and Jacobs LLP (P&J) in January 2016. The firm has assigned you to the audit of Simply Soups Inc., an international manufacturer of soups, for the year ending on December 31, 2015. The Audit Manager on the engagement asks you to complete the audit step “Confirm Cash Balances”. The primary contacts for this audit setup are: Lou Jennings (lou.jennings@ssoups.com) and Chuck Rogers (chuck.rogers@ssoups.com) who are both managers in the treasury department. Putnam & Jacobs relies on edu.Confirmation.com to process confirmations. NOTE: You MUST start the confirmation process at least FOUR days prior to the due date. You may need to send multiple confirmation requests to successfully complete the case and confirmation responses can take 1-24 hours to be returned. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 4 11/17/2015 o to https://edu.Confirmation.com and click on the “New User Registration:” Sign up button. Ex. 1 User login / Sign up page 1. Enter your school email address (e.g., yourname@university.edu), and click “next”. 2. Select the “Student” option from the “Type of User” page, click “next”. Ex. 2 User type selection page 3. Complete all of the required fields on the online form, including selecting your Instructors name from the “Class Name” dropdown. If working in teams it is recommend that all members work together to complete the input and evaluation of confirmations throughout the case. However, due to the parameters of the edu.Confirmation.com system only one member’s account will be used to input, send, and reconfirm account © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 5 11/17/2015 details and balances. This member should select “Staff I” from the “Job Title” dropdown when setting up his or her account. All other members should select the “Staff II” Job Title. Click “next” to continue. a. Importantly, the Staff I and Staff II designations have no bearing on your case responsibilities. These designations merely create a way for the Audit Team to individually access the team’s work from their own accounts, which mirrors how teams collaborate in this system in practice. Ex. 3 User registration page 4. Accept the User Agreement and select “finish”. 5. The edu.Confirmation.com system will generate an automated email from systems.administrator@confirmation.com to the email address you supplied. This email provides a link to activate your account and set up your password. Login to EDU.Confirmation.com using your new login credentials. 1. Watch the 3 minute welcome video to familiarize yourself with the application. 2. Click on the orange “Help” tab on the right portion of the screen. From the “Guides”, watch each of the 1-2 minute tutorial videos for creating Clients, Adding Accounts, Initiate Confirmations and Reconfirmations. Videos are also viewable on the Capital Confirmation YouTube channel. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 6 11/17/2015 Ex. 4 Video tutorials from the Help tab 1. Trial Balance (Exhibit 1) – The financial statements are developed from the trial balance, which lists all of the accounts in the company’s general ledger. 2. Cash Lead Sheet (Exhibit 2) – The cash lead sheet is designed to provide an overview of the account, the balances that make it up, and the account activity since the previous period. 3. Bank Reconciliation Summary (Exhibit 3) – The bank reconciliation summary testing documents shows the balance reported on the bank statement at 12/31/2015 (i.e., bank balance) as well as the balance reported by the client on the trial balance at 12/31/2015 (i.e., book balance). 4. Key Information for the audit step “Confirm Cash Balances” (Exhibit 4) – The bank account listing sheet provides the bank address, bank manager, account type, account number as well as the individual who can authorize the confirmation for the students at Simply Soups Inc. 1. Obtain an understanding of the controls in place over third-party intermediary edu.Confirmation.com.1 Please refer to the proposed PCAOB Standard on Confirmations, paragraphs 34 and 35, which can be found in the Addendum: Technical Guide or online. 1 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 7 11/17/2015 a. Understanding the controls used by the intermediary is part of an auditor’s assessment about where the confirmations received can in fact be relied upon as persuasive audit evidence (See Technical Guide). b. The most efficient way to acquire comfort over the controls used by the intermediary is to rely on a SOC report.2 On a SOC engagement, an independent CPA examines and reports on a service organizations controls to give the user comfort. From the edu.Confirmation.com home page, students are able to click on the Security heading to download the SOC3 report. You must carefully review this report and determine if it adequately addresses the risks associated with relying on edu.Confirmation.com. Your conclusions as well as their implications on the audit evidence obtained during this case study must be documented in your Confirmation Testing Memo. Once you have registered with edu.Confirmation.com and have familiarized yourself with the technology platform and documents included in the case study, you will complete the data entry and process confirmations through edu.Confirmation.com following the steps outlined below: 1. Set up Simply Soups Inc. as a new client by selecting the “Add New Client” link located within the Quick Links area of the main Dashboard. 3 Ex. 5 Main Dashboard / Adding a New Client SOC (Service Organization Controls) On a SOC engagement an independent CPA examines and reports on a service organization’s controls to give the user comfort. 3 Refer to “Case Study Highlights” on page 4 for all relevant information regarding Simply Soups Inc. 2 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 8 11/17/2015 2. Enter a unique Team Name in the “Team Name” field when setting up the new Client if your professor has created an AUDIT TEAM, if working individually you may enter your NAME in this field. 3. From the Staff I account give the members of your audit team access to the client by selecting the “modify/share” link located next to the Lead Auditor label within the Client Profile. 4 NOTE: The “Client Sharing” feature gives the audit team View Only access. If you need further help, please refer to the edu.Confirmation.com shortcuts for directions on how to complete this task. Ex. 6 Client Sharing for workgroup members 1. From within the Client Information tab, you will now add the first four bank accounts for Simply Soups Inc. 5 2. Select the “Add” button from the Accounts area. 3. Select the “Financial” confirmation type. 4. Search for and select the Financial Institution. 4 5 For additional instructions on this, refer to “Client Sharing” on page 18 of this document. Refer to “Adding a New Bank Account” on page 15. Video tutorials are also available within the Guides section of Help. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 9 11/17/2015 5. Choose the appropriate confirmation form from the dropdown menu; the “Asset” form. Fill in the account information for each of the Simply Soups Inc.’s accounts. a. Note that from the “Review” screen you have the option to “Add More Accounts” for Simply Soups Inc. Ex. 7 Adding Bank Accounts for the Client 1. Setup the last accounts if directed to do so by your instructor. 2. One bank is an out-of-network bank which means that it has not been authenticated as part of the electronic confirmation service offered by edu.Confirmation.com. This out-of-network responder will require a paper confirmation, which edu.Confirmation.com will simulate mailing for you. The bank will email the completed confirmation directly back to you. For help setting up an out-of-network bank, refer to the edu.Confirmation.com shortcuts. On the Client Information tab, click the “Request” button located within the “Authorization Codes” section. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 10 11/17/2015 Ex. 8 Requesting Authorization for Confirmation 2. In the “Authorization Code Request” window, check the box for the signer “Lou Jennings” then click the “send” button. Your request should move from Pending to Received within about 1 minute. 3. Once the Client Authorization has been received, initiate your first confirmations.6 a. Use positive blank confirmations.7 Specifically, when preparing the confirmations, include the account number but do not fill in the balance amount. To reduce the risk that the confirming party fails to verify that the information contained within the confirmation is correct, your firm Putnam & Jacobs, relies on the confirming party to fill in the balance amount. b. To avoid issues with the client’s Authorization Code, initiate all confirmations at the same time and confirm balances as of 12/31/2015. c. Authorization Codes are valid for 3 uses or 30 days, whichever comes first. 4. The system sends a nightly email when confirmations are completed, but you can log into at any point to see if the bank has returned the confirmation requests. a. Login to edu.Confirmation.com and select the “view client list” link within the Client List area. Select Simply Soups Inc. from the available list. Refer to “Initiating a New Confirmation” on page 19. Video tutorials are also available within the Guides section of the Help tab and the Confirmation.com YouTube channel. 7 Defined by ISA 500 as “a request that the confirming party respond directly to the auditor indicating whether the confirming party agrees or disagrees with the information in the request, or providing the requested information”. 6 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 11 11/17/2015 b. From the Client Information tab for Simply Soups Inc., select the “view log” button located within the Confirmation Statuses area. 1. Once you have received the confirmation responses, you must assess the responses to the first confirmations and determine if second confirmations or reconfirmations should be initiated. a. Second confirmations are required for a confirmation request that has been denied. i. What are Denied Confirmations? 1. Information incorrectly entered - correct the information and then initiate a new confirmation. 2. Incorrect authorized signer - identify the correct authorized signer, add him/her to the system, then request a new Authorization Code and send a new confirmation with the proper signer.8 b. Reconfirmations are for confirmations where an account balance does not agree to the details of the cash listing or the confirmed account balance does not agree to the reported bank balance on the bank reconciliation testing summary. i. What are Reconfirmations? 1. For any confirmation response that does not agree to client work papers send a reconfirmation to the bank asking them to verify their initial response.9 2. Document any discrepancies or issues noted in the initial confirmation. 1. Once you have received the second confirmation responses or reconfirmations, you must review any additional confirmations received and evaluate the information on the second confirmation to assess its appropriateness as persuasive audit evidence. 2. Consider whether alternative audit procedures are necessary. a. If the audit team does not hear back from the bank within the expected time frame, this may be considered a non-response. 10 Further information on nonresponses can be found in the edu.Confirmation.com shortcuts. Refer to “Adding a New Authorized Signer” on Page 17 and “Initiating a New Confirmation” on page 19. Refer to “Reconfirmation” on page 21. 10 Refer to “Non Responses” on page 25. 8 9 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 12 11/17/2015 1. Document findings on Confirmation Testing Workpaper and Memo.11 2. Prepare Deliverables a. Audit Procedure Checklist. 12 b. Confirmation Testing Workpaper and Memo c. Confirmation Log (export from edu.Confirmation.com) 13 d. Confirmations Received (export from edu.Confirmation.com) 14 It is important to note that confirmation responses will take from 1-24 hours to be returned by the banks in this case study as in real practice. You must begin the case at least four days before the due date in order to complete everything on time. Documentation should meet the standards in the Technical Guide under Auditing Standard No. 3. See the Audit Procedures Checklist on Page 14. 13 Refer to “Reviewing Confirmations” on page 22. 14 Refer to “Completed Confirmations report” on page 23. 11 12 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 13 11/17/2015 Audit Procedure Checklist Date Initial Audit Procedures Go to https://edu.Confirmation.com, the educational platform created by Confirmation.com for the purpose of this case, and sign up as a new user. Watch the 3 minute narrated tutorial of the edu.Confirmation.com service which is presented right after you successfully log in and also under Help. Download: (1) Simply Soups Inc. Case Study (2) Support Materials (Annotated Instructional Guide for Students); (a) A step-by-step guide on how to complete the case using edu.Confirmation.com; (b) Shortcuts to assist in trouble shooting any questions that might arise as you complete the case; and (c) Relevant excerpts of technical guidance and professional standards to assist you. Review the video tutorials from the “Guides” section under the “Help” tab. Review the client prepared documents and audit workpapers (Exhibit 1-4). Assess the controls in place around the edu.Confirmation.com service. (1) Carefully examining the SOC3 report found on edu.Confirmation.com under the security tab. (2) Consider whether or not the details of this report address all the control objectives stipulated by the professional standards in order to rely on edu.Confirmation.com. (3) Document your considerations and understanding of the controls obtained in the Confirmation Testing Memo. Be sure to document any additional SOC reports you may need to request in order to comply with the professional standards as well as the evidence each report would provide. Add Simply Soups Inc. as a new client. Add a TEAM NAME if workgroups are used. From Exhibit 4 of the Case Study (Key Information for the audit step “Confirm Cash Balance”), add the first four cash accounts you will be confirming. ADVANCED: Also add the last two cash accounts, one of which is Out-of-Network. Send the Client Authorization Code request to client contact. Initiate first confirmations. Evaluate the information received and its appropriateness as persuasive audit evidence. As necessary, prepare and send reconfirmations or second confirmation requests. For reconfirmations or second requests, evaluate the information received and assess its appropriateness as persuasive audit evidence. Document your procedures which include: (1) Agreeing the confirmed account detail to the bank account listing on the key information summary and reconciling any differences; (2) Agreeing the confirmed balance to the reported bank balance on the bank reconciliation testing summary and reconciling any differences; and (3) Considering whether the information provided by the bank is persuasive audit evidence. Submit Case Study Deliverables to be reviewed by your manager: (1) Audit Procedure Checklist (2) Confirmation Testing Workpaper and Memo (3) Confirmation Log (export from edu.Confirmation.com) (4) Confirmations Received (export from edu.Confirmation.com) © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 14 11/17/2015 edu.Confirmation.com Shortcuts Ex. 1 Client Information tab, adding a Bank Account 1. Adding Bank Accounts for the Client can be done from the Client Information Tab. Click on the “add” button from the Accounts Area. Ex. 2 Selecting the Financial Type of confirmation 2. The “Choose Type” screen will display options for what types of Confirmations will be initiated. Select the “Financial” type of confirmations for these exercises. Ex. 3 Searching & selecting the appropriate Bank 3. The “Select Responder” screen allows you to search for the desired Bank. Search, then select the appropriate Bank, then click “next”. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 15 11/17/2015 Ex. 4 Review the Bank information screen 4. The details area shows the Banks address information as well as the types of confirmations that they support. Click “next” at the Review screen. Ex. 5 Selecting the account type for confirmations 5. On the “Add Account” screen, select the appropriate Form type from the available dropdown. For this exercise we will be using the “Asset” form. Ex. 6 Entering account information for the selected type of account 6. Complete the required account information in the fields for the selected form. Click the “save” button to complete this process. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 16 11/17/2015 Ex. 7 Adding a new signer 1. An authorized signer can be added from within the Client Profile area for the selected client. Click the “add signer” button. Complete the required fields, then click “save”. Ex. 8 Reassigning signer for an account 2. To reassign a bank account from one signer to a different signer, return to the Client Information tab for the selected client. Click the “view all” button located in the Accounts area. The list of available accounts will display. Check the box located next to the Account ID you wish to modify. Select the new signer from the dropdown, then click “re-assign”. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 17 11/17/2015 Ex. 9 Sharing Client for additional auditors Select the “modify/share” link located next to the Lead Auditor label within the Client Profile area. Use the “add” or “remove” buttons to select the appropriate auditors (Staff II) that need “View Only” access to this client. Ex. 10 Sharing Client for additional auditors Select the “view client list” link located within the Client List area of the Dashboard. On the “Select a Client” window, click “Simply Soups Inc.” to view the Client Information. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 18 11/17/2015 Your confirmation may be denied if you incorrectly entered the bank account number or bank information. Ex. 11 Editing Bank Account information To correct information entered in error, click the “view all” button located within the Accounts area. To edit an account click the Account ID for the desired account. If you are not editing the responder information, select ‘next’ to continue. Modify any necessary account information, then click “Save”. To initiate a confirmation, click the “request” button on the Client Information tab. Then, click the “Initiate Confirmations” button located on the Client Information tab for the selected client. Ex. 12 Initiating a new confirmation Choose the appropriate client signer(s). All accounts for the selected signer(s) will be checked by default. Use the de-select all check box to uncheck all accounts, then place a check beside the account(s) you want to initiate. Enter the “As of Date”, and then click the “Submit” button. Review the billing information screen, then click “Initiate”. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 19 11/17/2015 Confirmations can be sent to any financial institution or company not already listed. To add an Out-of-Network responder, follow the steps of Adding an Account. Ex. 13 Adding an Out-of-Network Bank 1. If the search for the Responder Name does not appear in the window, select the option to “Add New Responder”. Ex.14 Completing the “Add Out-of-Network Bank” process 2. Enter the Responder Name, choose the desired delivery format (paper), and complete the required fields. Click “save” and this responder will now be available within the Responder list. Address Lookup: One way to obtain evidence that the confirmation was sent to the proper source is to use the Address Lookup function when adding the Out-of-Network confirmation. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 20 11/17/2015 Ex. 15 Using the Address Lookup function to verify the Address of a Bank 3. After entering the bank address, simply click the “Address Lookup” button to produce the report. Out-of-Network responders can also be added or edited from the dashboard by selecting the “Manage Out-of-Network Responders” link located within the Quick Links area. In-Network electronic confirmations require no additional authentication and authorization procedures by the auditor. Edu.Confirmation.com maintains a contractual arrangement with the responding entity and performs these validations on behalf of the auditor. Use reconfirmation if a confirmation is received back from the bank and you want to clarify the information obtained. A reconfirmation cannot be sent when a confirmation was denied; if a confirmation is denied then a new confirmation must be sent. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 21 11/17/2015 Ex. 16 Initiating a re-confirmation To send a reconfirmation, click the “view log” button located within the Confirmation Statuses area for the selected client. From within the log, click the “[view]” link next to the confirmation you would like to reconfirm. A “reconfirm” button will be located at the base of the form. Selecting this option allows you to enter a question for the bank, which may or may not be answered depending on the legal staff at the bank. If the question is not answered you should document your open concerns in your case study deliverables. The Confirmation Statuses section of the Client Information tab contains a list of: Pending, Completed, Need More Info, Denied and Future Dated confirmations. Ex. 17 Client Information tab- View Confirmation Log To review the status of any of your confirmations, click the “view log” button. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 22 11/17/2015 Ex. 18 Confirmation Log (list) To view any responder comments for the confirmations or to see the results of a paper confirmation, click the “[view]” link on any of the confirmations. Ex. 19 Completed Confirmation Report To the view or download the Completed Confirmations Report, Select the ‘Reports’ tab. Choose ‘Completed Confirmations’ from the Reports drop down list. Fill out any of the blank fields (as shown). NOTE: Video tutorials for all of these procedures can be found within the “Guides” section of the Help tab of edu.Confirmation.com. Videos are also viewable on the Capital Confirmation YouTube channel. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 23 11/17/2015 edu.Confirmation.com Glossary Terms AICPA – American Institute of Certified Public Accountants ASB – Auditing Standards Board IAASB – International Auditing and Assurance Standards Board ISA – International Standard on Auditing PCAOB – Public Company Accounting Oversight Board SAS – Statement on Auditing Standards SOC – Service Organization Controls If you review the confirmed account balances and conclude that none reconcile to the Simply Soups Inc. materials provided; it is likely that you are unclear about the difference between the book and the bank balance. Remember, the confirmed bank balance should agree to the bank balance reported in the Bank Reconciliation Summary. You should not be attempting to reconcile the confirmed account balance from the bank to the book balance reported by the client. Please be sure to register as a new user on https://edu.Confirmation.com. Do not register as a new user on www.Confirmation.com using these case materials. For this case study, your confirmation will be denied if you incorrectly enter the wrong date for the balance request date, instead of the correct balance sheet date of 12/31/2015. Before it is denied, you can recall the confirmation from within the Confirmation Log and initiate a new one for the correct date. The account information provided to you in this case study does not include information regarding any type of liability accounts. If you receive information about a liability account during your testing, you will not be able to confirm it during this case study. If you feel it warrants further consideration you should document such concerns in your case deliverables. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 24 11/17/2015 If you reconfirm an account balance or account information with a bank and you do not hear back from the bank within the expected time frame, this may be considered a non response. A non response is when the confirming party does not answer your confirmation request. In such cases, auditors must first check to make sure the confirmation was correctly filled out and sent. Your next step should then be to make your Audit Manager aware of the issue. For the purposes of this case study you will alert your Audit Manager (Instructor) of the issue by documenting the open item and your concerns in the workpapers. An out-of-network confirmation does not include authentication and authorization of the respondent. edu.Confirmation.com has performed no procedures to validate either the entity or the individual responding to the confirmation. That responsibility falls to the auditor, who is required to determine that the confirmation was sent to the proper source and that the respondent was authorized to respond. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 25 11/17/2015 Addendum: Technical Guide I. AICPA Service Organization Controls – Select Information15 Kinds of controls addressed by the report SOC 1 Report (Type 1 or Type 2) Report on controls for financial statement audits Controls likely to be relevant to user entities financial statements SOC 2 Report (Type 1 or Type 2) Report on controls related to compliance and operations Controls over the security, availability and processing integrity of a system and the confidentiality and privacy of information processed by the system Report Use Restricted Use Report Content of report Description of service organization’s system Generally a Restricted Use Report Description of service organization’s system Purpose CPA’s opinion on fairness of presentation of the description, suitability of design and in a type 2 report, the operating effectiveness of controls. A type 2 report includes a description of the CPA’s test of controls and results Standards under which the SOC engagement is performed SSAE No. 16, Reporting on Controls at a Service Organization CPA’s opinion on the fairness of presentation of the description, suitability of design and in a type 2 report, the operating effectiveness of controls. A type 2 report includes a description of the CPA’s test of controls and results AT 101, Attestation Engagements SOC 3 Report Report on controls related to compliance and operations Controls over the security, availability and processing integrity of a system, and the confidentiality and privacy of information processed by the system General Use Report An unaudited system description used to delineate the boundaries of the system CPA’s opinion on whether the entity maintained effective controls over its system AT 101, Attestation Engagements American Institute of Certified Public Accountants (AICPA). 2010. Service Organization Controls: Managing Risks by Obtaining a Service Auditor’s Report. Available at: www.aicpa.org/interestareas/informationtechnology/resources/trustservices/downloadabledocuments/10957378%20soc%20whitepaper.pdf. 15 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 26 11/17/2015 II. Auditing Standard No. 3 – Select Paragraphs16 Paragraph 4 – The auditor must prepare audit documentation in connection with each engagement conducted pursuant to the standards of the PCAOB. Audit documentation should be prepared in sufficient detail to provide a clear understanding of its purpose, source, and the conclusions reached. Also, the documentation should be appropriately organized to provide a clear link to the significant findings or issues. Examples of audit documentation include memoranda, confirmations, correspondence, schedules, audit programs, and letters of representation. Audit documentation may be in the form of paper, electronic files, or other media. Paragraph 5 – Because audit documentation is the written record that provides the support for the representations in the auditor's report, it should: a. b. c. Demonstrate that the engagement complied with the standards of the PCAOB, Support the basis for the auditor's conclusions concerning every relevant financial statement assertion, and Demonstrate that the underlying accounting records agreed or reconciled with the financial statements. Paragraph 6 – The auditor must document the procedures performed, evidence obtained, and conclusions reached with respect to relevant financial statement assertions. Audit documentation must clearly demonstrate that the work was in fact performed. This documentation requirement applies to the work of all those who participate in the engagement as well as to the work of specialists the auditor uses as evidential matter in evaluating relevant financial statement assertions. Audit documentation must contain sufficient information to enable an experienced auditor, having no previous connection with the engagement: a. b. To understand the nature, timing, extent, and results of the procedures performed, evidence obtained, and conclusions reached, and To determine who performed the work and the date such work was completed as well as the person who reviewed the work and the date of such review. NOTE: An experienced auditor must have a reasonable understanding of audit activities and has studied the company's industry as well as the accounting and auditing issues relevant to the industry. Paragraph 7 – In determining the nature and extent of the documentation for a financial statement assertion, the auditor should consider the following factors: Nature of the auditing procedure; Risk of material misstatement associated with the assertion; Extent of judgment required in performing the work and evaluating the results, for example, accounting estimates require greater judgment and commensurately more extensive documentation; Significance of the evidence obtained to the assertion being tested; and Responsibility to document a conclusion not readily determinable from the documentation of the procedures performed or evidence obtained. Application of these factors determines whether the nature and extent of audit documentation is adequate. Paragraph 8 – In addition to the documentation necessary to support the auditor's final conclusions, audit documentation must include information the auditor has identified relating to significant findings or issues that is inconsistent with or contradicts the auditor's final conclusions. The relevant records to be retained include, but are not limited to, procedures performed in response to the information, and records Public Company Accounting Oversight Board (PCAOB). 2004. Auditing Standard No. 3, Audit Documentation. Washington, DC. 16 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 27 11/17/2015 documenting consultations on, or resolutions of, differences in professional judgment among members of the engagement team or between the engagement team and others consulted. III. PCAOB Proposed Auditing Standards Related to Confirmations – Select Paragraphs17 Paragraph 18 – The auditor should design confirmation requests to establish direct communication between the confirming party and the auditor to minimize the possibility that the audit evidence resulting from the confirmation procedures might not be reliable as a result of interception, alteration, or fraud. Paragraph 19 – The auditor should perform procedures to determine the validity of the addresses on the confirmation requests, including substantive procedures or tests of controls. The nature and extent of the procedures depend on the associated risks and materiality of the items being confirmed. For example, the auditor should perform substantive procedures to determine the validity of addresses on the confirmation requests for transactions or accounts that involve significant risks or are material to the financial statements. Other factors to consider in determining the nature and extent of procedures to perform to validate addresses on confirmation request include the following: The company has a new customer base; An address is a post office box; or An e-mail address is not consistent with the confirming party’s web site address (e.g., situations in which the e-mail address has a domain name that differs from the domain name of the Web site). Paragraph 20 – If the auditor identifies an invalid address, the auditor should perform the following procedures: Investigate the reasons for the invalid address and attempt to obtain a valid address; Evaluate the implications of the invalid address on the auditor’s planned confirmation procedures and the auditor’s assessment of the relevant risk of material misstatement, including fraud risk, and on the nature, timing, and extent of other audit procedures; and Perform other audit procedures designed to obtain relevant and reliable audit evidence with respect to the account, balance, or other item if a valid address cannot be obtained for the confirmation request. Paragraph 22 – When performing confirmation procedures, the auditor should request that the confirming parties or intended intermediaries respond directly to the auditor and not to the company or any other party. If a confirming party sends a confirmation response to anyone other than the auditor, the auditor should contact the confirming party and request that the confirming party re-send the response directly to the auditor. Paragraph 30 – The auditor should investigate all exceptions in confirmation responses to determine why each exception occurred and whether any exceptions, individually or in the aggregate, are indicative of a misstatement or of a previously unidentified risk of material misstatement. Proposed Auditing Standard Related to Confirmation and Related Amendments to PCAOB Standards. PCAOB Release No. 2010-003. Available at: http://pcaobus.org/Rules/Rulemaking/Docket% 20028/2010-07-13_Release_2010-003.pdf. 17 © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 28 11/17/2015 NOTE: The item being confirmed, the account, the assertion in question, and the risk of material misstatement affect the nature of the procedures that the auditor should perform to investigate exceptions in confirmation responses. Paragraph 31 – The auditor should assess the reliability of confirmation responses. Any confirmation response carries some risk of interception, alteration, or fraud although such risks are mitigated by properly designing confirmation requests and properly performing confirmation procedures. Such risk exists regardless of whether a response is obtained in paper form or by electronic or other medium. Factors that the auditor should take into account in assessing the reliability of confirmation responses include, but are not limited to, whether confirmation responses: Are returned to the auditor indirectly because the confirming parties forwarded the confirmation responses to the company (paragraph 22). Appear not to have come from the originally intended confirming parties. Contradict other information obtained during the audit. Come from addresses other than the address to which the auditor sent the confirmation requests. Are not the original confirmation requests that were sent to the confirming parties. Do not include the signatures of or acknowledgements by the confirming parties. Reflect local customs that may affect the confirmation responses, such as customs that create an environment in which confirmation responses are inherently unreliable. Paragraph 32 – When evaluating the reliability of the response received from a confirming party, the auditor should assess any indication that the confirming party: Is not competent, or knowledgeable. Has questionable motives. Is not objective or free from bias with respect to the company. NOTE: Circumstances might indicate the need for additional audit evidence to conclude whether the confirmation request is being sent to or received from a confirming party from who the auditor can expect the response to provide relevant and reliable audit evidence. Such circumstances could include significant, unusual period-end transactions that have a material effect on the financial statements; when management of the company has significant influence over the confirming party; when the confirming party has significant influence over management of the company; when the confirming party is the custodian and servicer of a material amount of the company’s assets; or when a confirmation response is from an affiliated party. Paragraph 33 – If conditions indicate that a confirmation response might not be reliable, the auditor should obtain additional evidence. Paragraph 34 – As indicated in paragraph 31, any confirmation response involves risks relating to the reliability because proof of origin might be difficult to establish and alterations can be difficult to detect. Confirmation responses received electronically (e.g., by facsimile, e-mail, through an intermediary, or direct access) might involve additional risks relating to reliability. The auditor should assess the reliability of the information obtained through the electronic confirmation response. In assessing the reliability of the confirmation response, the auditor should take into account risks that: The confirmation process might not be secure or might not be properly controlled; The information obtained might not be from a proper source; and The integrity of the transmission might have been compromised. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 29 11/17/2015 Paragraph 35 – The auditor should perform procedures to address the risks that electronic confirmation responses might not be reliable. Such procedures depend on the form of electronic communication and include the following: If information is provided via facsimile response, the auditor should verify the source and contents of the facsimile response by directly contacting the intended confirming party (e.g., by a telephone call to the intended confirming party). If information is provided via e-mail response, the auditor should verify the source and contents of the email response, such as verifying the e-mail address of the intended confirming party or contacting the intended confirming party by telephone. If an intermediary is used to facilitate confirmation, the auditor should obtain an understanding of the controls over the procedures used by the intermediary to process the confirmation requests and responses. The auditor should perform procedures to determine whether the auditor can use the intermediary’s process. Risk to consider in performing the procedures and making this determination include (1) the process might not be secure or might not be properly controlled, (2) the information obtained might not be from a proper source, and (3) the integrity of the transmission might have been compromised. In addition, the auditor should determine whether the intermediary is authorized to respond on behalf of the intended confirming party. If information is provided via direct access, the auditor should evaluate whether direct access is an appropriate means to confirm information about the particular item that is the subject of the confirming request. Direct access is not an appropriate confirming procedure in all cases. For example, when confirming revenue agreements, the auditor should evaluate whether the revenue agreements could include terms and oral modifications that would make direct access an inappropriate mechanism for confirmation. NOTE: Direct access to information held by a confirming party constitutes a confirmation response only if (1) the auditor’s access is provided by the confirming party rather than the company, and (2) the confirming party represents to the auditor, in writing, that (a) it is aware of the auditor’s request for and intended use of the information, and (b) the files to be accessed contain information responsive to the auditor’s request. Paragraph 36 – A response to a confirmation request might contain disclaimers or restrictive language. For example, a response might include a disclaimer as to its accuracy and appropriateness for use in the preparation of financial statements, which has a negative effect on the reliability of the response as audit evidence. Paragraph 37 – The auditor should evaluate the effect of a disclaimer or restrictive language on the reliability of a confirmation response. If a disclaimer or restrictive language causes doubts about the reliability of a confirmation response the auditor should obtain additional appropriate audit evidence. Paragraph 38 – If disclaimers or restrictive language preclude the auditor from treating the response as a confirmation response, the auditor should treat such a response as a non-response and perform appropriate alternative procedures to obtain relevant and reliable audit evidence. © 2016 Dr. Denise Hanes, Dr. Barbara Porco, Dr. Jay Thibodeau, Professor Kelly Ulto, and Professor Brian Fox. Used with Permission. All rights reserved. Screenshots of edu.Confirmation.com © 2016 Confirmation.com Used with Permission. All rights reserved. 30