Website created

Hello team, i created a website as a presentation tool for Thursday. I wanted to add some risks calculator in it but the website builder currently do not have that feature on it yet. I tried to download some free trial Adobe CS DW to get some javascript calculator running, but that feature is not available on trial version. So, i think a website and a prezi is good enough for the automation part...

CLICK ME!

Compliance with Auditing Standard No. 3

Auditing Standard 3 outlines the requirements for audit documentation that an auditor should prepare and retain.

In general, we have made progress in meeting As No. 3 standards. We've accomplished the objectives of audit documentation, generally met the audit documentation requirements, and have provided documentation of specific matters if it was necessary. The retention of and subsequent changes to audit documentation part of the standard may not have yet been met.

Objectives of Audit Documentation
The objectives of audit documentation are to (1) have a written record of the basis for auditor conclusions and (2) have information that might be reviewed. Having a written record or evidence supporting auditors conclusions is important because it facilitates planning of the audit, audit performance, supervision of the engagement, and is the basis for the review of the quality of work done. Audit documentation should be documented in such a way that it can be easily reviewed by by others including but not limited to members of the engagement team.
Our audit has been documented via this blog and the information can be easily reviewed.

Audit Documentation Requirement

The main ideas of audit documentation requirements are:

Have we complied?	Audit Documentation Requirements
Yes	Document in compliance with PCAOB Standards.
Yes	Document in a clear and organized enough manner so that the reviewer may understand.
Yes	Documentation should support auditor conclusions with respect to every relevant financial statement assertion.
Yes	Documentation should show that accounting records agree with financial statements. Procedures performed, evidence obtained, and conclusions reached need to be documented.
Yes	Documentation must have enough information for an experienced auditor with no previous connection to the engagement to be able to understand what went on during the engagement, who performed and reviewed the work and when.
Yes	Documentation must include information the related to significant findings or issues that is inconsistent with final conclusions.
N/A, but should we encounter this issue we will comply	If after the documentation completion date (explained in the next section), the auditor discovers “that audit procedures may not have been performed, evidence may not have been obtained, or appropriate conclusions may not have been reached, the auditor must demonstrate that all those things were done with respect to relevant financial statement assertions via persuasive evidence. o    If the problem is lack of documentation, then documentation must be provided.
N/A, but should we encounter this issue we will comply	In terms of documentation of risk assessment procedures and responses to risks of misstatement, the following must be included o    summary of identified risks of misstatement and the auditor's assessment of risks of material misstatement o    and the auditor's responses to the risks of material misstatement

Documentation of Specific Matters
The main ideas of documentation of specific matters are:

Have we complied?	Documentation of Specific Matters
Yes	Documentation of auditing procedures that involve the inspection of documents or confirmation, including tests of details, tests of operating effectiveness of controls, and walkthroughs, should include identification of the items inspected. Documentation of auditing procedures related to the inspection of significant contracts or agreements should include abstracts or copies of the documents.
N/A, we are not auditing such matters but should we encounter this issue we will comply	Certain matters, such as auditor independence, staff training and proficiency and client acceptance and retention, may be documented in a central repository for the public accounting firm ("firm") or in the particular office participating in the engagement.
N/A, but should we encounter this issue we will comply	The auditor must document significant findings or issues* actions taken to address them (including additional evidence obtained), and the basis for the conclusions reached in connection with each engagement. *More information on what significant findings or issues are available on PCAOB website.
N/A, but should we encounter this issue we will comply	The auditor must identify all significant findings or issues in an engagement completion document which must be as specific as possible for the reviewer to be able to understand the significant findings or issues.

Retention of and Subsequent Changes to Audit Documentation

This section of AS No. 3 is irrelevant to us at this time as it pertains to retention of documentation and procedures for any changes made. We have not yet finished our audit but we do intend to keep copies of our documentation and follow the correct procedures in making any changes if necessary.


The following is a summarized outline of the "Retention of and Subsequent Changes to Audit Documentation" section of AS No. 3 found on the PCAOB site.

1. The auditor must retain audit documentation for seven years from the date

• the auditor grants permission to use the auditor's report in connection with the issuance of the company's financial statements
• that fieldwork was substantially completed is a report is not issued.
• the engagement ceased id the engagement was not completed

2. A final set of audit documentation should be assembled for retention as of a date not more than 45 days after the report release date.

• not 45 days from the date fieldwork was substantially completed if a report is not issued
• not be more than 45 days from the date the engagement ceased if the engagement was not completed

3. Audit documentation must not be deleted or discarded after the documentation completion date. Instead, information may be added and such information must have the date added, the name of the person who added it, and why the information was added.

References:http://pcaobus.org/Standards/Auditing/Pages/Auditing_Standard_3.aspx

Internal Control Checklist

4       Quality Management System
4.1       General requirements
4.1 820.5	Is the quality management system documented, implemented and maintained?	Are processes needed for the quality management system identified and established (process map)? Is the sequence and interaction between these processes determined (process map)? Are criteria and methods for the operation and control of quality system processes established (operational procedures)? Are required resources available? Are quality system processes monitored and measured (internal audit, customer feedback, manufacturing process performance, etc.)?	Y
4.1	Are outsourced processes adequately controlled?	How are outsourced processes controlled? Are outputs of outsourced processes verified? Are subcontractors and suppliers required to operate and maintain quality management systems (ISO 9001, for example)?
4.2       Documentation requirements
4.2.1    General
4.2.1 820.20(e)	Are the following types of documents established, maintained and controlled: § quality policy and quality objectives; § quality manual; § operational procedures; § device specifications including drawings, composition, formulation, components, software etc. (Device Master Record); § production process specifications including equipment, production methods and procedures, operator (work) instructions, production environment specifications, etc. (Device Master Record); § quality assurance procedures and specifications including control plans, inspection equipment and procedures, acceptance criteria, etc. (Device Master Record); § packaging and labeling specifications, including methods and processes used (Device Master Record); § installation, maintenance and servicing procedures and methods (Device Master Record); § other documents needed to ensure the effective planning and operation of the quality system; and § records (ref to ISO 13485 4.2.4)?	Are quality policy and quality objectives documented? Where? Is there a quality manual? Operational procedures? Are drawings, specifications, work instructions, work orders, control plans, etc., issued and maintained as controlled documents (as required in 4.2.3)? Are electronic documents (computer files) backed up?	Y
4.2.2    Sales Process Orders
4.2.2 820.20(e)	Does the Sales Orders   include: § the scope of the quality management system and exclusions, § operational procedures or references to them, § description of the interaction between the processes of the quality system, and § outline of the structure of the quality system documentation?	Is the sales order addressing all relevant requirements? Are exclusions from Section 7, Product Realization, documented in the quality manual (if any)? Are operational procedures included or referenced in the quality manual? How is the interaction between the processes of the quality system documented (process map, flowcharts, etc.)?  How is the structure of the quality system documentation outlined in the manual?	Y
4.2.3    Control of documents
4.2.3 820.40(a)	Is there a written procedure defining the controls needed to § review and approve documents prior to issue, § review, update and re-approved documents, § identify changes and current revisions of documents, § make relevant and current documents available at points of use, § ensure that documents are legible and identifiable, § identify and control the distribution of documents of external origin, and § identify retained obsolete documents and prevent their unintended use? Is the procedure fully implemented?	Is there a written procedure for control of documents? Are controlled documents reviewed and approved? How is the approval evidenced (signature)? Is there a process for reviewing, updating and re-approving documents? Are documents identified with their revision level? How are changes identified (change brief, highlighted, etc.?) What measures are implemented to ensure that relevant and current documents are available at points of use (distribution lists, current master lists, etc.)? Are documents uniquely identified (unique title and /or code-number) and are they legible? Is there a process for receiving, reviewing, approving (for use) and distributing documents of external origin (form customers, regulators, suppliers, etc.)  When obsolete documents are retained, is it for a specific, stated reason? Are obsolete documents clearly marked to distinguish them from current revisions? What other measures are implemented to prevent unintended use of obsolete documents?	Y
4.2.3	Is the period for retention of obsolete controlled documents defined?	Is a retention period defined for each type of controlled documents? How is this period determined? Is the retention period at least equal to the lifetime of the device? Is it coordinated with the retention period for corresponding records? Are regulatory requirements considered?
4.2.3 820.40(b)	Are document changes reviewed and approved by the same function that performed the original review and approval (unless specifically designated otherwise)? Are change records maintained, including description of the change, identification of the affected documents, approval signatures and date, and when the change becomes effective?	Is there a clearly stated requirement that changes to documents must be reviewed and approved by the same function that issued the original document, or by another, explicitly designated function? Is it implemented? Are changes in documents (mostly product and process specifications) backed by design change and/or process change records, such as engineering change notices? How is it defined/documented when document changes become effective?
4.2.4    Control of Records
4.2.4	Is there a documented procedure for the identification, storage, protection, retrieval, retention, and disposition of records?	Are there documented instructions how to identify, organize, store, protect, and retrieve records?  Are storage locations for records defined?	Y
4.2.4 820.180(b)	Are retention periods for records defined? Are records retained for at least the period of time equivalent to the expected life of the device, and no less than 2 years?	Is a retention period defined for each type of record? How is this period determined? Is the retention period at least two years or equivalent to the lifetime of the device, whichever is greater? Are regulatory requirements considered?	Y
4.2.4 820.180	Are records organized and maintained to ensure that they remain legible, readily identifiable and retrievable, and to prevent deterioration and loss? Are records accessible to the regulatory inspections? Are electronic records backed up?	Are records stored in dry, clean locations to minimize deterioration? Is there a system for organizing the records? Are boxes, drawers, binders holding records properly identified? Are records easily retrievable (test by asking for retrieval of specific records)? Are records kept in a location that is accessible to regulatory inspections? Are electronic records backed up? Are there specific schedules, instructions, etc. for backing up data? Where are the back-up media (tapes, disks, etc.) kept?	Y
4.2.4 820.181	For each type of device, is there a Device Master Record (DMR) including, or referring to appropriate device specifications, production process specifications, quality assurance procedures, packaging and labeling specifications, and installation, maintenance and servicing procedures and methods?	How is the DMR organized? Is it a file containing the actual specifications documents, or is it a list referring to these documents and their locations? Is the DMR complete, e.g., includes all required categories of documents? Who decides, and how, which documents are included in the DMR? Are all documents included in the DMR correctly identified, reviewed, approved and otherwise controlled? Are the DMR documents the same (and the same revisions) as those used in production?	Y
4.2.4 820.184	Are Device History Records (DHR) maintained for each manufactured batch, lot or unit? (Refer also to ISO 13485 Clause 7.5.1 and 820.184)	Are DHR records properly identified to specific batches, lots or units; and are the records easily retrievable? (For other questions refer to 7.5.1)	Y
4.2.4 820.186	Are Quality System Records (QSR) maintained, including current and obsolete quality system manuals and procedures, and records of quality system activities such as management reviews, corrective and preventive actions, internal audits, etc.?	How is it determined and documented what quality system records are maintained (in QMS Manual and lists of procedures and quality forms, and in operational procedures and work instructions)? Are retention periods specified for obsolete quality system documentation and for quality system records?	Y
4.2.4	Are sufficient records maintained to provide evidence of conformity and effectiveness of the quality management system?	Is there a list (or other documented specification) of quality system records that are maintained by the company? Are the records sufficient to demonstrate product and process conformity, and the conformity and effectiveness of the quality management system and its implementation?	Y
5       Management Responsibility
5.1       Management Commitment
5.1	Is the top management § communicating to the organization the importance of meeting customer and other applicable requirements, § establishing the quality policy, § establishing quality objectives, § conducting management reviews, and § ensuring availability of resources?	How is importance of meeting customer and other requirements communicated? Do employees understand the consequences of failing to meet requirements? Is there a quality policy? Are quality objectives defined? Are management reviews being conducted regularly? Are adequate resources necessary for the quality system provided?	Y
5.2       Customer Focus
5.2	Is the top management ensuring that customer requirements are determined and are met?	What measures are implemented to ensure that customer requirements are determined and met (processes, procedures, training, monitoring, auditing, etc.)?	Y
5.3       Quality Policy
5.3 820.20(a)	Is there a documented quality policy; and § Is it appropriate to the purpose of the organization? § Does it include a commitment to comply with requirements and maintain the effectiveness of the quality management system? § Does it provide a framework for establishing the quality objectives? § Is it communicated and understood throughout the organization? § Is it periodically reviewed for continuing suitability?	Is the quality policy appropriate (relevant to the types of products, type of market, customer expectations, etc.)? Does it include explicit commitment to comply with requirements and maintain (or improve) the effectiveness of the quality system? Is it related to quality objectives? Would achievement of the quality objectives bring the company closer to achieving its overall quality policy? Do employees know the meaning of the quality policy and understand how they can contribute to achieving the policy? Is the quality policy periodically reviewed by management reviews? Has the policy ever been modified since it was initially formulated?	Y
Taken from ISO demo

Risk Map of Sales Recording System

PR1: Errors in customer orders due to electronic glitches

This process poses a risk in that 100% of all sales orders are taken electronically via an EDI interface.  This becomes a risk because small problems in the system can have big impacts on customer orders and a system failure would put a halt on the ability of taking customer orders.  Electronic malfunctions are not uncommon and therefore the likelihood that this would happen is moderate but its impacts could be quite high.

PR2: Excessive default on bills by customers

According to the inquiries presented, it is more and more difficult to collect payment on shipped products.  This poses a risk of excessive default by customers.  There seems to be no way to ensure payment prior to sending products to consumers.  This causes a big impact especially on the financial statements where accounts will be inaccurate due to this failure to collect.

PR3: Miscommunication between warehouse and shipping

There seems to be some miscommunication between the warehouse and the shipping dock.  There are times when not all items that need to be shipped to the customer are given to shipping.  Therefore when shipping has to update its files, there is some confusion.  This confusion is further irritated when the items not originally shipped are shipped to customer, as the invoice has already been filed.

PR4: Maintenance of large amounts of accounting records

It was indicated that a large number of accounting records are maintained, even though a number of them contain duplicate information.  This could cause disorganization among the accounting books and records could be ignored or recorded multiple times, causing inaccuracies in the financial statements.

PR5: Lack of supervision over credit verification

It seems that authority over credit verification has been given to sale representatives.  This poses a conflict of interest as sales representatives have the incentive of commissions driving their actions.  This could lead to the approval of customers with bad credit.  However, since sales representatives do not have a sole authority over verification and the accounting department double checks these verifications, this risk has been somewhat mitigated.

PR6: Incomplete shipping orders

As the warehouse employee stated, some orders are sent to shipping incomplete.  This means customer orders are not completely fulfilled.  When partial orders are sent to shipping, this creates confusion for shipping, as well as accounting, because they cannot match the order to what is on the invoice.  However, this risk is decreased due to the fact that the warehouse updates inventory before it is sent to shipping.  That way orders will not be taken if the product is not in stock and partial shipping orders will not be sent.

PR7: Inadequate credit authorization process

This risk seems to be the one creating the most impact.  SDE does not have a clear cut credit authorization process.  Different employees have different ideas of the process.  For example, on employee stated that almost everyone who applies is approved, while another stated that the process is very rigorous.  In addition, there is no set authority over this area.  It is unclear whether this is the task of the sales representatives or the task of the accounting department.  Furthermore, while the company feels that this should be the job of the accounting department, sales representatives have the stake of commission in the task.  This creates a lot of confusion and could result in inconsistent approval methods.  It could also lead to approval of customers with bad credit, especially since the default on bills has increased recently.  It also seems that there is no set control to help mitigate this problem as of yet.