Question

Stan is an auditor for Cartman & Kenny, CPA. He has recently been assigned to a new private client called Southpark Services, a provider of Web management services. Southpark has clients throughout the United States. The company manages the clients’ Web sites, keeping them up to date, resolving problems, and doing any other programming or troubleshooting that their clients need.

The two Southpark owners are hands-on managers. They, along with three other employees, provide the Web site management services for their clients. Although they don’t have access to their clients’ books or bank accounts, they have the ability to alter the Web site, and any data that flows through the Web site before it goes to the company or the customer. Southpark has one office manager with an undergraduate accounting degree and one full-time bookkeeper.

In discussions with management, Stan learns that Southpark Services “doesn’t bother” to maintain any processes specifically directed toward good internal controls. When Stan asked why, management replied, “internal control is too expensive for us, and since we are not a public company and Section 404 does not apply to us, we don’t see any value internal control can offer our management.”

Required:

(a) Develop a list of concerns that Southpark’s clients might have based on management’s attitude. Classify those concerns into two lists—concerns that affect the business and concerns that might affect their productive output, and thus the client’s business operations. Some of the concerns you identify might end up on both lists.

(b) Suggest processes and controls that Southpark can implement to limit the risk of the items you listed in (a).

(c) How would Stan examine or test each of the processes and controls you list in (b)?

Answer 1

A) Since the Southpark Services does not have an internal control system and also the management is not ready for implementing internal control because it is too expensive for management,hence the following issues can arise on part of southpark clients.

Concerns that affect the southpark client's business are as follows:-

1. It results in clients dissatisfaction with regard to services provided by the southpark.

2. Results in end of partnership agreement with clients because the company is suffering from lack of internal control leads to lack of direction and focus in providing their services.

3. Results in poor management decisions and high rates of errors in providing services that can significantly affect the client's business.

4. Results in loss of records of clients business and also carelessness in providing the services.

5. Chances of manipulation of clients data flow through the websites may increase because the southpark personnel have the ability to alter the website and data flow through the website.

6. Privacy Concern can also arise such as unauthorised access to financial data and customer records including sensitive information.

Concerns that affect the southpark client's productive output and business operations :-

1. In case timely services is not provided to the clients that it can adversly affect the business operations of clients

2.Unauthorized access to client's data and also modification in such data can also affect the business operations of clients

3. In case of temporary shut down of website services may also results in adverse affect on clients business operations because in such a situation the client is not able to provide timely information to its own customers.

4. In case the orders are received by the clients on the webiste and if there is any manipulation on such orders such as increasing or decreasing the no. of orders then it can adversly affect the productivity of client business.

5. Any manipulation in the orders can also affect the profits of client business and also leads to termination of agreements with its customers.

6. It can also results in breach of contract and thus leads to filing of court cases against the clients.These cases may also result in heavy penalties to be imposed on the clients.

(B) Processes and Controls to implement to limit the risks specified above :-

1. Implementation of internal control in the business.

2. Segregation of duties so that one individual does not perform all the operation.

3. Periodic checks must be performed by authorised personnel.

4. Power to access confidential data and sensitive information must be in hands of senior managemet.

5. There should be a proper backup system and servers for providing timely services to its clients in case of failure of other servers.

6. High level of firewalls and secutity software must be installed by the southpark to avoids any kind of hacking activities to get unauthorised access to clients data and confidential information.

C) Stag(Auditor) can examine the above process and controls in the following ways:-

1. Checking of documentation related to implementation of internal control by the southpark.

2. Documentation related to installation of security softwares.

3. Examine that there is a proper backup system for providing timely services to its clients.

4. Checking of organisational structure with regard to segregation of duties of employees.

5. Check that how frequently periodic check is performed by the authorised officials of southpark and also check the time gap between the two checks.

6. Check that access to sensitive and confidential information and data is given only to senior managers of southpark.