Question

In May 2018, a local chemical plant had an unfortunate accident. Chemicals leaked from a plant holding tank and seeped onto the parking lot. A number of employee vehicles were damaged and required repainting. The company agreed to reimburse employees for the cost of these repairs. Employees were instructed to submit their bills for the repairs to the Controller, Jim Bemond. Jim would then issue a check to the employee for the amount of the bill. While the Internal Auditor Director questioned the Audit Committee about the monitoring of the reimbursements during a meeting a month after the accident, the Committee determined that procedures in place were adequate. Nine months later, at a full board meeting, someone made a remark about the fact that bills were still being turned in for reimbursement. By this time, the total of the damages reimbursed to employees had reached nearly $150,000. After making inquiries, it was discovered that some of the “repairs” were for expensive paint jobs, upgrades, buffing, body repairs, and waxing. Further investigation revealed that thousands of dollars were reimbursed for paint jobs on cars that were damaged prior to the industrial accident. Moreover, some employees had turned in bills for similar jobs just a few months apart—in other words, some cars were reimbursed for the same repair twice. Although this appeared suspicious, no one caught it until the internal auditors came in one year after the accident in response to the board’s inquiry and reviewed the invoices and compared them with the employee list and cars repainted. Answer questions 1-3 below with reference to COSO’s Control Activities, Information and Communication and Monitoring Principles and corresponding Focus Points. 2. How should have the policy concerning the reimbursements been communicated to the employees?

Answer 1

Information is necessary for an organisation to follow through its internal control responsibilities.Management obtains or generates and uses relevant and quality information from both internal and external sources to support the functioning of internal control.Communication is the continual, iterative process of providing, sharing, and obtaining necessary information. Internal communication is the means by which information is disseminated throughout the organization, flowing up, down, and across the entity. It enables personnel to receive a clear message from senior management that control responsibilities must be taken seriously

Following Principle 14, "The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control"

The management should have created an appropriate chain of command, and set up guidelines for communication to the board of directors including the senior management for the reimbursement policy. Furthermore they should have defined the criterion for reimbursement so there was no scope for error so the right parts could be reimbursed.

Following Principle 16, "The organization selects, develops, and performs ongoing and or separate evaluations to ascertain whether the components of internal control are present and functioning:"

The management should have had controls in place for the review of the reimbursment policy. This could have be done by Periodically Reviewing the Mix of Monitoring Activities, Establishing a Baseline, Identifying and Using Metrics, Designing and Implementing a Dashboard, Using Technology to Support Monitoring Activities, Conducting Separate Evaluations,