CIA Final

Revised: November 12, 2012

THE TYRONCO FOUNDATION

COSO

LSU Center for Internal Auditing

Published

By The Institute of Internal Auditors, Inc.

Developed by:

Glenn E. Sumners Sumners Audit Services

“Not everything that can be counted counts, and not everything that counts can be counted.” Albert Einstein Case #22

Ryan Sandel

Ryan SandelTurner GilreathCory Chapman

2

The Tyronco Foundation The Tyronco Foundation operates worldwide to provide food and medicine to needy individuals in third world countries. Thirteen countries currently receive assistance through the program. The number of individuals that have benefited has increased from 407,000 in 1990 to over 721,000 in 2010. Data for current years is still being tabulated for annual reporting. Contributions are received from foundations, agencies, governments and individuals. Tyronco outsources the marketing and collection processes. The marketing agency publicizes the benefits and collects the donations. The bylaws require that 75% of the funds collected be distributed to directly benefit the needy (benefit expenses). The administration expenses cannot exceed 25% of contributions. The CEO has recently determined that distribution costs should be reclassified from administrative expense to benefit costs since distribution is a benefit to the needy. Tyronco’s marketing efforts highlight the guaranteed high percent payoff to the needy. The governing agencies of several countries require that the attest auditors include the 75% goal in the financial audit. Background Information The results of your preliminary work are outlined below:

‣ Board-Audit Committee: The 13 board members are prominent celebrities, politicians, and business people. Bernie Lay serves as both the Chairman of the Board and CEO. Bernie was the CFO for five years before being appointed as the CEO. The board members are selected by the Chairman of the Board and approved by a majority of the Board. The five-member audit committee includes the Chairman of the Board and four members appointed by the Chairman for a three year term. The Board also includes a nominating committee, a risk committee and a compensation committee. The Board and the subcommittees meet for one day each quarter. The CFO is responsible for the agenda and financial reports. THE Chief Audit Executive (CAE) and the external audit partner share a one-hour slot on the agenda at each meeting.

‣ Chief Executive Officer: The CEO, Bernie Lay, has a military background and has established an autocratic management style. He feels that this approach will develop a more efficient and effective structure for a decentralized organization.

‣ Chief Financial Officer: Scott Z. Best, the CFO, previously served as the supervisor of accounts payable and was promoted by the CEO. He was the manager in charge of the Tyronco account when he worked for the attest auditors. He maintains a good working relationship with Temple and Duncan, a small regional firm in Geneva.

3

‣ Operating Management: Each participating country has an operating manager selected by the CEO. The managers report directly to the CFO.

‣ Internal Audit: Martha N. Cider, the Chief Audit Executive, served as the lead auditor on the Tyronco engagement when she worked for Temple & Duncan. She was hired because of her knowledge of the financial aspects of Tyronco. As part of a cost-cutting move she reduced the audit staff from 21 to 13 and cosources the collections, payables, and purchasing audits to Temple & Duncan. The reduction in staff was explained by increased usage of the data-mining technology. Martha was in the MBA program with Bernie and Scott and is considered a rising star in the organization. Management requests from the CEO and CFO consume about 90% of available audit time. The CEO feels that the auditors should be able to complete their audits from the headquarters location by utilizing technology. He has reduced the travel budget but significantly increased the budget for systems training and audit software. The hiring focus is now on systems knowledge.

‣ External Auditors: Temple and Duncan (T&D) have been the low bidder the last three times the organization has requested attest proposals. The external auditor proposals are reviewed by the CFO who recommends a firm to the Audit Committee for approval. Tyronco represents 60% of T&D’s audit revenues and 80% of their consulting revenues.

‣ Purchasing: The purchasing function is decentralized with a purchasing agent located in each of the 13 countries that qualify for food and non-prescription medicine. The Vice-President of Purchasing at headquarters has requested that the 13 purchasing agents purchase 50% of all items from vendors located in the same country as the recipients. The agents operate somewhat autonomously and can sole-source or utilize competitive bids. Local purchases are typically 20-30% higher than obtained through a competitive bid process. The CEO supports this approach since he feels that it establishes good relations with local government officials and business people.

‣ Warehouse: The receiving clerks and distribution managers report to the Purchasing Agent. Inventory status reports are issued quarterly to the V.P. of Purchasing who prepares a summary report for the CEO & CFO. The quarterly purchasing reports from the purchasing agents to Headquarters are provided on the following spreadsheet.

4

Total Vendor Description

The primary headquarters control and review is a comparison of budget to actual.

Purchasing Agents are provided with a quarterly budget generally based on

demographics of the recipients. Adjustments are made to the budget based on

actual contributions received from countries, organizations, foundations, and

personal sponsors. The overall increase in purchases has been approximately 13%

per year but varied from a low of +7% to a high of +21% between countries.

The summary quarterly reports are approved by the country manager and forwarded

to the CFO with the quarterly financial statements for review and approval.

Requirements: The audit programs that you will develop should have two sections to facilitate a top-down audit approach:

1. Organization COSO Evaluation

2. Purchasing COSO Evaluation

This approach is suggested since the organization’s evaluation of risk, controls, and corporate governance is the foundation for the audit of the purchasing function. Requirement #1: Based on the above background, develop a COSO-based audit program. The audit program should address the following COSO objectives as applicable:

‣ Operational: Effectiveness and efficiency of operations.

‣ Financial: Reliability of information.

‣ Compliance: Compliance with applicable laws and regulations.

5

The organization audit program should be classified to align with the five COSO components:

‣ Control Environment

‣ Risk Assessment

‣ Control Activities

‣ Monitoring

‣ Information and Communication To provide a consistent framework for comparing solutions; please use the following component subsections:

1. Control Environment

‣ Integrity and ethical values

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Commitment to competence

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Board and Audit Committee

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Management philosophy and operating style

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Ryan Sandel

How do the employees and volunteers feel about working with

Ryan Sandel

Tyronco? Do they feel they "do good work" in the world?

Ryan Sandel

How do employees feel about the management of Tyronco? Do they feel that

Ryan Sandel

Bernie Lay, and others have the best interests of the charity in mind?

Ryan Sandel

Do the employees feel that the reduced travel time has impacted their ability to

Ryan Sandel

perform meaningful audits?

Ryan Sandel

Do the employees feel that the emphasis on systems knowledge as opposed to

Ryan Sandel

technical skills and field work has impacted their ability to perform complete audits??

Ryan Sandel

Bernie Lay is COTB and CEO. Does this affect the audit department's ability to

Ryan Sandel

perform complete audits??

Ryan Sandel

Has the CAE confirmed independence to the BOD??

Ryan Sandel

Does Bernie's authoritarianism get in the way of an independent audit group?

Ryan Sandel

Has Martha's relationship with Bernie and Scott impacted her independence and objectivity?

6

‣ Organization Structure

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Assignment of authority and responsibility

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Human resource policies and practices

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

2. Risk Assessment

‣ Company-wide objectives

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Process-level objectives

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Risk identification

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Ryan Sandel

Why are attest auditors the same as the cosourced auditors? Lack of

Ryan Sandel

independence!!

Ryan Sandel

Does Bernie's status as Chairman and CEO lead to disincentivizing internal discussion

Ryan Sandel

and instead lead to a subordinate culture internally

Ryan Sandel

Internal auditor and attest auditor functions are performed by the same group. This is a

Ryan Sandel

violation of independence and objectivity!

Ryan Sandel

Martha Cider has cut 8 souls from the audit staff.. a 38 percent reduction in the audit staff!

Ryan Sandel

The majority of Board members are selected and approved by Bernie Lay. This gives incentive the

Ryan Sandel

to the board members to follow Lay no matter what.

Ryan Sandel

Power has been given to local purchasing agents generating a culuture ripe for

Ryan Sandel

corrupt practices

Ryan Sandel

How do we know that our marketing oursource is performing at expectations?

Ryan Sandel

Why does managment feel the need to reclassify expenses, effectivily leaving

Ryan Sandel

them with extra money and poor people with less?

Ryan Sandel

Purchasing function ripe for corruption.. especially when there is a focus on "buying locally

Ryan Sandel

to establish relationships"

Ryan Sandel

Why is an establisment of relationships worth a 20%+ markup on food/medicine?The

Ryan Sandel

The primary objective is to help as many in need persons as possible..

Ryan Sandel

Purchasing in country with local suppliers is ripe for corruption, especially consider that

Ryan Sandel

corruption index identifies poor countries as more likely to engage in such practices

Ryan Sandel

Why do we have people living in the countries?? Thats a HUGE liability given the variable

Ryan Sandel

nature

7

‣ Managing change

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

3. Control Activities

‣ Policies and procedures

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Segregation of duties

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Periodic reconciliation

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Proper authorization

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Transactions recorded

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Ryan Sandel

Purchaes have been increasing annually. Are the purchasing agents adequately equipped

Ryan Sandel

to handle the increased workload.

Ryan Sandel

Have the purchasing agents developed a continuity plan? If we lose one of the purchasing

Ryan Sandel

agents, can we ensure continuity of operations??

Ryan Sandel

Vendor auditing? How do we ensure our vendors are not ripping us off?

Ryan Sandel

How do we ensure that aid delivered is going towards humanitarian causes rather than

Ryan Sandel

support local governments or terrorists?

Ryan Sandel

Why is Bernie chairman and CEO along with nominator of the BOD?

Ryan Sandel

Do we reconcile goods purchased to aid delivered?

Ryan Sandel

Do we reconcile dollars spend on goods to goods received?

Ryan Sandel

How are purchases recorded?

Ryan Sandel

How is aid deliverance recorded?

Ryan Sandel

Scott Best was hired from Temple, and continues "good relationships". This constitutes a

Ryan Sandel

conflict of interest

Ryan Sandel

Is the person nominated for the Board by the CEO approved by the majority of the Board?

Ryan Sandel

Are the quarterly reports for each country approved by each country manager?

8

‣ Safeguarding assets

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

4. Information and Communication

‣ Quality of information

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Effectiveness of communication

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

5. Monitoring

‣ On-going monitoring

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Evaluation process

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

‣ Reporting control and process deficiencies

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Ryan Sandel

Who is authorized to disburse funds and who is responsible for independent review and

Ryan Sandel

verification?

Ryan Sandel

Where are goods purchased stored before distribution? Who has access to those facilities?

Ryan Sandel

When are contributions reported to administration to ensure accuracy of financial statements?

Ryan Sandel

Do the internal auditors feel that they are able to accurately assess the control environment

Ryan Sandel

when they are

Ryan Sandel

not traveling to the sites?

Ryan Sandel

How are relationships with the local governments maintained?

Ryan Sandel

How can we ensure that the reports given to the V.P. of purchasing accurately reflect the

Ryan Sandel

inventory status?

Ryan Sandel

Do the purchasing agents continually monitor the inventory status of the warehouses

Ryan Sandel

to ensure accuracy with regards to purchases

Ryan Sandel

Who ensures that 75% of benefits go to aid?

Ryan Sandel

How does the Board oversee the actions of the CEO?

Ryan Sandel

How does the Board oversee the actions of the purchasing agents?

Ryan Sandel

Do reports from countries go through the same process

Ryan Sandel

Do reports from other countries go through the same people

9

‣ Change management process

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Requirement #2: Identify the five major risks in the Purchasing Department. List the controls you would

expect to find to mitigate the risks and the audit steps that would be utilized to ascertain

that the control mitigates the risk.

Purchasing

Risk

At Risk Control COSO

Classification Audit Step 1.

2.

3.

4.

5.

Ryan Sandel

Overpayment for number of goods

Ryan Sandel

Is there a business continuity plan in place?

Ryan Sandel

Do we have a plan in place to deal with a revolution/rebellion in country?

Ryan Sandel

Security in warehouse

Ryan Sandel

Misrepresentaton of budget

Ryan Sandel

Increases in purchases do not match increases in aid needed

Ryan Sandel

Overpayment for quality of goods

Ryan Sandel

reconcile goods in inventory to market price of goods

Ryan Sandel

Control Activites

Ryan Sandel

Monitoring

Ryan Sandel

Operational

Ryan Sandel

Financial

Ryan Sandel

ensure dollars spent in country reconciles with financial statements

Ryan Sandel

Operational

Ryan Sandel

Control Activities

Ryan Sandel

Is there biometric identification?

Ryan Sandel

Operational

Ryan Sandel

Operational

Ryan Sandel

Control Environment

Ryan Sandel

Control Environment

Ryan Sandel

Go to the warehouse and make sure the food is of high quality

Ryan Sandel

Look at GDP of countries economy. There should be an inverse relationship b/t spending and GDP

10

Requirement #3: List one or two audit steps that you would perform in each of the six listed sections:

Procurement Audit

1. General:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

2. Requisitioning:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

3. Purchasing:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

4. Receiving:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

5. Invoice Processing:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

6. Accounts Payable, Encumbrances, or Obligations:

1. _____________________________________________________

_____________________________________________________

2. _____________________________________________________

_____________________________________________________

Ryan Sandel

Match deliveries with Invoice

Ryan Sandel

Check to make sure buyer has authorization for spending limit

Ryan Sandel

Ensure invoice rates equal to rates in Master Service Agreements

Ryan Sandel

Ensure Invoice has authorization

Ryan Sandel

Make sure seller is authorized.

Ryan Sandel

Segregation of duties: Approver of PO cannot be recipient of goods

Ryan Sandel

Three way match PO, Invoice, and MSA

Ryan Sandel

Ensure supplier has MSA in place

Ryan Sandel

Ensure requisitions have appropriate approval

Ryan Sandel

Ensure AP is cleared in a timely manner.

11

Requirement #4: List five major risks specifically related to Tyronco. What would be your five major areas of

concern as an internal auditor?

1. ___________________________________________________________________

___________________________________________________________________

2. ___________________________________________________________________

___________________________________________________________________

3. ___________________________________________________________________

___________________________________________________________________

4. ___________________________________________________________________

___________________________________________________________________

5. ___________________________________________________________________

___________________________________________________________________

Ryan Sandel

Corrupt Practices

Ryan Sandel

Independence of audit group

Ryan Sandel

Tone at the top

Ryan Sandel

Segregation of duties

Ryan Sandel

Safety of purchasing agents in foreign countries.

Documents

CIA Final