Recommended
Recommended
More Related Content
Similar to Access Control, Authentication, and Public Key Infrastructure .docx
Similar to Access Control, Authentication, and Public Key Infrastructure .docx (20)
More from daniahendric
More from daniahendric (20)
Recently uploaded
Recently uploaded (20)
Access Control, Authentication, and Public Key Infrastructure .docx
- 1. Access Control, Authentication, and Public Key Infrastructure Lesson 14 Testing Access Control Systems © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 1 Learning Objective and Key Concepts Learning Objective Mitigate risk from unauthorized access to IT systems through proper testing and reporting. Key Concepts System penetration testing and reporting System vulnerability assessment scanning and reporting Network and operating system (OS) discovery scan Scope for penetration test plan Page ‹#› Access Control, Authentication, and PKI
- 2. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 2 Penetration Testing Preferably called security assessment Process of actively evaluating your information security measures Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Purpose of Testing Access Control Systems Testing ensures that weaknesses are found and can be dealt with before they are exploited Tests should incorporate testing methodologies at different stages of development: Software design Hardware development Penetration testing Penetration testing: The act of simulating an attack on an organization’s resources Page ‹#› Access Control, Authentication, and PKI
- 3. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 4 The Software Development Life Cycle Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. What Needs to Be Tested? Let’s discuss!! Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved.
- 4. All parts of the way that your organization captures, stores, and processes information can be assessed; the systems that the information is stored in, the transmission channels that transport it, and the processes and personnel that manage it. Off-the-shelf products: operating systems, applications, databases, networking equipments etc. Bespoke development products: dynamic Web sites, in-house applications etc. Telephony products: war-dialing, remote access etc. Wireless products: Wireless fidelity (Wi-Fi), Bluetooth etc. Personnel: screening process, social engineering etc. Physical: access controls, dumpster diving etc. 3/30/2015 6 The Security System Life Cycle Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Security Monitoring, Incident Handling, and Testing Monitoring and incident handling are the day-to-day activities Testing and upgrading system usually occurs annually Page ‹#› Access Control, Authentication, and PKI
- 5. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 8 Security Monitoring, Incident Handling, and Testing (Cont.) Testing functionality of original design Before purchase of new system, perform risk assessment on old system Determine existing major weaknesses Development of test plan and scope Impact/vulnerabilities Breach planning Gap analysis Intrusive versus nonintrusive testing Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 9 Vulnerability Scanners Attempts to identify vulnerabilities in the hosts scanned
- 6. Helps identify out-of-date software versions, applicable patches, or system upgrades Validates compliance with or deviations from the organization's security policy Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Vulnerability scanners take the concept of a port scanner to the next level. Like a port scanner, a vulnerability scanner identifies hosts and open ports, but it also provides information on the associated vulnerabilities (as opposed to relying on human interpretation of the results). Most vulnerability scanners also attempt to provide information on mitigating discovered vulnerabilities. Vulnerability scanners provide system and network administrators with proactive tools that can be used to identify vulnerabilities before an adversary can find them. A vulnerability scanner is a relatively fast and easy way to quantify an organization's exposure to surface vulnerabilities. 3/30/2015 10 Common Vulnerability Scanners Page ‹#› Access Control, Authentication, and PKI
- 7. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Network-based scanners are used primarily for mapping an organization's network and identifying open ports and related vulnerabilities. In most cases, these scanners are not limited by the operating system of targeted systems. The scanners can be installed on a single system on the network and can quickly locate and test numerous hosts. Host-based scanners have to be installed on each host to be tested and are used primarily to identify specific host operating system and application misconfigurations and vulnerabilities. As host-based scanners are able to detect vulnerabilities at a higher degree of detail than network-based scanners, they usually require not only host (local) access but also a “root” or administrative account. 3/30/2015 11 Network-based scanners Host-based scanners Benefits of Vulnerability Scanning
- 8. Identifies: Active hosts on network Active and vulnerable services (ports) on hosts Applications and banner grabbing Operating systems Vulnerabilities associated with discovered operating systems and applications Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 12 Benefits of Vulnerability Scanning (Continued) Misconfigured settings Testing compliance with host application usage or security policies Establishing a foundation for penetration testing Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved.
- 9. 3/30/2015 13 Zenmap Configuration Screen Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Sample Nmap Report in Zenmap GUI Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Nessus® Configuration Screen Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved.
- 10. Sample Nessus® Report Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Retina Configuration Screen Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Sample Retina Report Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Gap Analysis Within the Seven Domains of a Typical IT Infrastructure
- 11. Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 20 Penetration Testing and Teams Penetration testing: Is most accurate way to assess an infrastructure’s true vulnerability Simulates actual attack Is an intrusive testing method Is risky for the attacking team Pen test team members should carry authorization memo from upper management Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015
- 12. 21 Seven Domains of a Typical IT Infrastructure Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. From a business perspective, penetration testing helps safeguard your organization against failure, through: Preventing financial loss through fraud (hackers, extortionists and disgruntled employees) or through lost revenue due to unreliable business systems and processes Proving due diligence and compliance to your industry regulators, customers and shareholders. Non-compliance can result in your organization losing business, receiving heavy fines, gathering bad public relations, or ultimately failing. At a personal level it can also mean the loss of your job, prosecution, and sometimes even imprisonment. Protecting your brand by avoiding loss of consumer confidence and business reputation 3/30/2015 22 Rules of Engagement Specific Internet Protocol (IP) addresses or ranges to be tested Any restricted hosts, systems, and subnets not to be tested A list of acceptable testing techniques, such as social engineering and denial of service (DoS), and tools, such as
- 13. password crackers and network sniffers Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Formal permissions are often called the rules of engagement. 3/30/2015 23 Rules of Engagement (Continued) Times when testing is to be conducted (for example, during business hours, after business hours) Identification of a finite period for testing IP addresses of the machines from which penetration testing will be conducted Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Formal permissions are often called the rules of engagement. IP addresses help administrators to differentiate the legitimate penetration testing attacks from actual malicious attacks.
- 14. 3/30/2015 24 Penetration Testing Teams Red Team The attacker Blue Team The defending team Attacker and defender know test is taking place Tiger Team External testers who operate in a double-blind penetration test Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 25 Performing the Penetration Test: Methodology Technological, or focus on uncovering weaknesses to social engineering Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
- 15. www.jblearning.com All rights reserved. 3/30/2015 26 Planning and preparation Information gathering Vulnerability detection Penetration attempt Analysis and reporting Clean-up
- 16. Preparing the Final Test Report Identify gaps and risk exposures and assess impact Develop remediation plans for closing identified security gaps prioritized by risk exposure Prepare cost magnitude estimate Prioritize security solutions based on risk exposure Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3/30/2015 27 Summary System penetration testing and reporting System vulnerability assessment scanning and reporting Network and operating system (OS) discovery scan Scope for penetration test plan
- 17. Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Virtual Lab Authenticating Security Communications with Digital Signatures Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. If your educational institution included the Jones & Bartlett labs as part of the course curriculum, use this script to introduce the lab: "In this lesson, you learned that testing is a crucial activity for any IT department because it provides assurance that access controls and other security systems are working as designed. In the lab for this lesson, you will use the encryption utility GnuPG (GPG) to test the security of the message transmission. To do that, you will create a digitally signed message for another user. Then, you will retrieve that message (as the other user) and use GPG to verify the digital signature."
- 18. 3/30/2015 29 OPTIONAL SLIDES Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Security Auditing Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Define the physical scope of audit Document audit results Specify and implement new/updated controls Perform security risk assessment
- 19. Develop the audit plan Define the process scope of the audit Conduct historical due diligence Purpose of Security Audit How difficult are passwords to crack? Do network assets have access control lists? Do access logs exist that record who accesses what data? Are personal computers regularly scanned for adware or
- 20. malware? Who has access to back-up media in the organization? Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Security audits are best understood by focusing on the specific questions they are designed to answer. 3/30/2015 32 Why Conduct a Penetration Test or Vulnerability Scan? Let’s discuss!!!! Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. From a business perspective, penetration testing helps safeguard your organization against failure, through: Preventing financial loss through fraud (hackers, extortionists
- 21. and disgruntled employees) or through lost revenue due to unreliable business systems and processes Proving due diligence and compliance to your industry regulators, customers and shareholders. Non-compliance can result in your organization losing business, receiving heavy fines, gathering bad public relations, or ultimately failing. At a personal level it can also mean the loss of your job, prosecution, and sometimes even imprisonment. Protecting your brand by avoiding loss of consumer confidence and business reputation 3/30/2015 33 Penetration Testing—Formal Permissions Why are formal permissions required to conduct penetration testing??? Let’s discuss!! Page ‹#› Access Control, Authentication, and PKI © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Since penetration testing is designed to simulate an attack and use tools and techniques that may be restricted by law, federal regulations, and organizational policies, it is imperative to get formal permission for conducting penetration testing prior to starting.
- 22. 3/30/2015 34 Sheet1CustIDTerritoryIDCustNameShipAddrBillAddrCredLimit ModifiedDateModifiedTime12Desert Medical7159 Clear Sky Thicket, Robins Forest West, SC, 29039-9723, US, (864) 930- 37127159 Clear Sky Thicket, Robins Forest West, SC, 29039- 9723, US, (864) 930-37122500001/6/1315:4223Maple Limited5341 Silent Pond End, Venetie Landing, SD, 57281- 9847, US, (605) 859-64435341 Silent Pond End, Venetie Landing, SD, 57281-9847, US, (605) 859- 64432500001/27/137:4435Moonlight Medical3625 Lazy Quail Village, Silver Springs, BC, V7F-2N6, CA, (604) 371-25403625 Lazy Quail Village, Silver Springs, BC, V7F-2N6, CA, (604) 371-25402500002/27/1317:1743Lagoonavigations1659 Harvest Mountain Street, Triumph, MI, 49961-9208, US, (248) 363- 50891659 Harvest Mountain Street, Triumph, MI, 49961-9208, US, (248) 363-50892500003/18/138:0755Phantasmedia4513 Fallen Wagon Valley, Phelan, CO, 80076-0422, US, (719) 928- 32354513 Fallen Wagon Valley, Phelan, CO, 80076-0422, US, (719) 928-32351000004/29/139:2462Radiantelligence4267 Round Rise, Huntington Downs, SC, 29935-1535, US, (864) 460-55814267 Round Rise, Huntington Downs, SC, 29935- 1535, US, (864) 460- 55814000006/8/1314:4571Monarctronics8760 Jagged Highlands, Hopatcong Hills, DC, 20009-0006, US, (202) 943- 88698760 Jagged Highlands, Hopatcong Hills, DC, 20009-0006, US, (202) 943-88694000007/18/139:4182Dinowater4258 Easy Autumn Hill, Basher, MS, 39719-6291, US, (228) 469- 48834258 Easy Autumn Hill, Basher, MS, 39719-6291, US, (228) 469-488325000010/2/1310:4893Tulipwares3292 Iron Line, Luttrell, OH, 43059-3950, US, (614) 920-45823292 Iron Line, Luttrell, OH, 43059-3950, US, (614) 920- 45825000010/25/1317:52103Mazetube1949 Blue Barn Field,
- 23. Bailey Cove Estates, OH, 44366-0289, US, (513) 163-11731949 Blue Barn Field, Bailey Cove Estates, OH, 44366-0289, US, (513) 163-11735000010/26/1310:23112Gold 5216 Cinder Mountain, Beard, VA, 23543-9363, US, (804) 533-58465216 Cinder Mountain, Beard, VA, 23543-9363, US, (804) 533- 584625000010/31/1310:26121Stardust Medical2169 Pleasant Zephyr Bank, Williamson, CT, 06824-9749, US, (860) 990- 25052169 Pleasant Zephyr Bank, Williamson, CT, 06824-9749, US, (860) 990-250525000012/5/1310:53131Typhoon Enterprises4820 Dewy Willow Acres, Cleveland Mills, CT, 06485-9584, US, (203) 229-35414820 Dewy Willow Acres, Cleveland Mills, CT, 06485-9584, US, (203) 229- 35412500001/9/1412:33142Grottolutions2677 Red View Way, Arnot, GA, 39919-9664, US, (470) 777-40782677 Red View Way, Arnot, GA, 39919-9664, US, (470) 777- 40784000001/25/1415:40152Deserprises7765 Merry Apple Parade, Belt, GA, 39918-5660, US, (678) 771-84947765 Merry Apple Parade, Belt, GA, 39918-5660, US, (678) 771- 84945000002/17/1410:49165Shadearts8749 Emerald Quay, Bosse, HI, 96859-2768, US, (808) 350-65218749 Emerald Quay, Bosse, HI, 96859-2768, US, (808) 350- 65212500004/18/1416:53173Witchystems9369 Wishing Branch Estates, Pine Grove Estates, KS, 66333-3165, US, (785) 061- 28859369 Wishing Branch Estates, Pine Grove Estates, KS, 66333-3165, US, (785) 061- 28855000005/13/148:09182Hogpoint2167 Rustic Sky Field, Edenville, AK, 99954-7494, US, (907) 267-41912167 Rustic Sky Field, Edenville, AK, 99954-7494, US, (907) 267- 41911000008/11/1415:29192Ravenbar8682 Amber Wagon Ramp, Wilmot, TN, 37570-0935, US, (901) 231-65298682 Amber Wagon Ramp, Wilmot, TN, 37570-0935, US, (901) 231- 65292500001/12/1515:10203Stormpoly8253 Amber Anchor Falls, Georgetown, MI, 48872-9449, US, (906) 809-17538253 Amber Anchor Falls, Georgetown, MI, 48872-9449, US, (906) 809-17531000003/6/1512:16211Sprite Devices7482 Foggy Chase, Bell City, NY, 14494-3874, US, (315) 403-32847482
- 24. Foggy Chase, Bell City, NY, 14494-3874, US, (315) 403- 328410000012/5/157:44223Topiary Sales5585 Velvet Fox Close, North Belgrade Station, NE, 68723-1544, US, (531) 810- 94525585 Velvet Fox Close, North Belgrade Station, NE, 68723-1544, US, (531) 810- 945210000012/26/1515:40231Lioness Medical5656 Golden Hickory Townline, Indian Creek Estates, QC, G9V-7P0, CA, (450) 229-25735656 Golden Hickory Townline, Indian Creek Estates, QC, G9V-7P0, CA, (450) 229- 25731000001/18/1615:29243Midnightelligence7726 Old Edge, Southburg, ND, 58046-7150, US, (701) 469-41807726 Old Edge, Southburg, ND, 58046-7150, US, (701) 469- 41805000002/1/168:10251Honeysuckle Inc8747 Heather Elk Terrace, Rockwood, FL, 34256-3991, US, (239) 673-87818747 Heather Elk Terrace, Rockwood, FL, 34256-3991, US, (239) 673-87812500003/14/1613:02264Grasshop Products7212 Cotton Square, South Findlay, AZ, 86529-8733, US, (520) 150- 04817212 Cotton Square, South Findlay, AZ, 86529-8733, US, (520) 150-04812500003/23/1611:05272Hurricane Hospital Supply8492 Hazy Autumn Subdivision, Quaker Hill, VA, 23583-3752, US, (434) 551-61038492 Hazy Autumn Subdivision, Quaker Hill, VA, 23583-3752, US, (434) 551- 61034000004/2/1610:30285Wizardfruit7007 Umber Landing, Bancker, MT, 59603-7909, US, (406) 969-61877007 Umber Landing, Bancker, MT, 59603-7909, US, (406) 969- 61871000005/4/1610:12291Driftworks6207 Gentle Panda Freeway, Strawntown, PA, 15081-8581, US, (814) 180- 12516207 Gentle Panda Freeway, Strawntown, PA, 15081-8581, US, (814) 180-12511000007/3/1613:49303Acewell5787 Colonial Campus, Hunt Crossing, IN, 46696-5345, US, (260) 187-74705787 Colonial Campus, Hunt Crossing, IN, 46696- 5345, US, (260) 187-74702500007/16/1610:38313Enigma Medical4853 Merry Pine Inlet, Cedar Creek Crossing, IA, 50499-9862, US, (641) 534-04624853 Merry Pine Inlet, Cedar Creek Crossing, IA, 50499-9862, US, (641) 534- 04622500007/19/1613:29325Monarch Intelligent Devices8897
- 25. Hazy Gardens, Property Consultants Condominium, MT, 59904- 3852, US, (406) 528-94938897 Hazy Gardens, Property Consultants Condominium, MT, 59904-3852, US, (406) 528- 94935000007/29/1611:29331Titanium Supply7610 Green Deer Run, Epworth Forest, NY, 13399-1593, US, (347) 463- 14427610 Green Deer Run, Epworth Forest, NY, 13399-1593, US, (347) 463-14421000008/2/1611:46345Icecaproductions8946 High Gate, Shade, BC, V1P-8N4, CA, (604) 968-64218946 High Gate, Shade, BC, V1P-8N4, CA, (604) 968- 64211000008/17/1617:40352Alpine Medical198 Honey Private, Livingston, GA, 39881-2053, US, (762) 677-4904198 Honey Private, Livingston, GA, 39881-2053, US, (762) 677- 49045000008/19/1611:04361Junglectics4658 Green Glen, Pettyview, DE, 19735-5523, US, (302) 235-48774658 Green Glen, Pettyview, DE, 19735-5523, US, (302) 235- 48772000009/2/168:40372Electrorks9719 Rustic Deer Isle, Fremont, FL, 34239-2370, US, (941) 029-80999719 Rustic Deer Isle, Fremont, FL, 34239-2370, US, (941) 029- 809940000011/9/167:50381Flowernite2445 Noble Chase, Nekoosa Junction, CT, 06463-8700, US, (475) 559-81622445 Noble Chase, Nekoosa Junction, CT, 06463-8700, US, (475) 559-816215000012/2/1617:43395Griffintube87 Dewy Park, Harford Estates, UT, 84469-2845, US, (801) 523-975687 Dewy Park, Harford Estates, UT, 84469-2845, US, (801) 523- 97562500001/8/1710:51401Flipbook Devices7610 Green Deer Run, Epworth Forest, NY, 13399-1593, US, (347) 463- 14427610 Green Deer Run, Epworth Forest, NY, 13399-1593, US, (347) 463-14424000001/13/1717:47415Cyclops Supplies1194 Hidden Woods, Apple Valley, CA, 94739-6226, US, (530) 151-19151194 Hidden Woods, Apple Valley, CA, 94739-6226, US, (530) 151-19151000001/31/1717:19425Quad Tech2798 Rocky Treasure Wharf, Belfast, CA, 93270-2109, US, (408) 534-69532798 Rocky Treasure Wharf, Belfast, CA, 93270-2109, US, (408) 534- 69535000002/9/179:31432Timberlake Medical916 Cozy Lake Mall , Alexandria, DC, 20068-4808, US, (202) 629-8790916
- 26. Cozy Lake Mall , Alexandria, DC, 20068-4808, US, (202) 629- 87902500002/22/1717:53443Champrod Devices108 Noble Front, Beasley Road, KS, 67297-6901, US, (316) 630-6852108 Noble Front, Beasley Road, KS, 67297-6901, US, (316) 630- 68522500003/8/1715:03454White Wolf Supplies9488 Stony Pony Villas, Mumurva, AZ, 86560-1324, US, (480) 454- 20659488 Stony Pony Villas, Mumurva, AZ, 86560-1324, US, (480) 454- 20651000003/16/1714:29465Tempestechnologies7437 Old Horse Estates, Hudson, CA, 95853-4288, US, (562) 595- 09467437 Old Horse Estates, Hudson, CA, 95853-4288, US, (562) 595-09462500003/16/1710:50473TitaniuMedical431 Tawny Farms, North Waterford, SD, 57666-2528, US, (605) 982-3469431 Tawny Farms, North Waterford, SD, 57666-2528, US, (605) 982-34691000003/22/1715:33482Bluestar2024 Sunny Cloud Manor, Vacaville, VA, 23395-6366, US, (276) 942- 16182024 Sunny Cloud Manor, Vacaville, VA, 23395-6366, US, (276) 942-16181000003/26/1712:06494Pixelwater1943 Emerald Ridge, Cherryland, NM, 87280-4951, US, (505) 477-26451943 Emerald Ridge, Cherryland, NM, 87280-4951, US, (505) 477- 26451000004/5/1716:19505Woodbite8441 Broad Private, Rinckel, MT, 59469-0085, US, (406) 532-35088441 Broad Private, Rinckel, MT, 59469-0085, US, (406) 532- 35082500004/5/1711:05511Whiz Systems6767 Burning Landing, Kellys Ford, RI, 02972-0366, US, (401) 772-86166767 Burning Landing, Kellys Ford, RI, 02972-0366, US, (401) 772- 86162500004/6/1712:15522Sharkfin Industries6596 Velvet Hickory Place, Sebastian, FL, 32413-2068, US, (305) 269- 99126596 Velvet Hickory Place, Sebastian, FL, 32413-2068, US, (305) 269-99121000004/22/1715:21535Beta Sports Medicine9455 Indian Woods, Minquadale Trailer Village, OR, 97402-5800, US, (503) 883-64739455 Indian Woods, Minquadale Trailer Village, OR, 97402-5800, US, (503) 883- 64734000004/23/1712:08542Signetworks9611 Middle Lagoon Highway, Blakeslee, MS, 39445-4887, US, (662) 005-58459611 Middle Lagoon Highway, Blakeslee, MS, 39445-4887, US,
- 27. (662) 005-58452500005/5/1715:09553Starlightning9256 Easy Apple Corner, Sunny Hill, ND, 58861-1563, US, (701) 318- 82379256 Easy Apple Corner, Sunny Hill, ND, 58861-1563, US, (701) 318-82371000005/30/1712:42562Melonetworks4948 Broad Manor, Roseau, LA, 71536-7597, US, (337) 312- 32124948 Broad Manor, Roseau, LA, 71536-7597, US, (337) 312-32122000006/9/1710:01571WaterMalone Devices9298 Rustic Port, South Point, NS, B1G-2J0, CA, (902) 731- 92499298 Rustic Port, South Point, NS, B1G-2J0, CA, (902) 731-92494000006/11/1712:45582Worldgold3818 Sleepy Carrefour, Gwinner, MS, 38842-1373, US, (769) 831-31263818 Sleepy Carrefour, Gwinner, MS, 38842-1373, US, (769) 831- 31265000006/11/177:55592Soulwell8720 Green Deer Bend, Whitney Station, WV, 25199-7080, US, (304) 239-25578720 Green Deer Bend, Whitney Station, WV, 25199-7080, US, (304) 239-25572500007/29/1712:11604Blossommedia3371 Heather Edge, Ritchie, NM, 87634-1549, US, (575) 888-18793371 Heather Edge, Ritchie, NM, 87634-1549, US, (575) 888- 18791000008/12/1711:34615Sharkfin Industries1442 Silver Impasse, Myrtle Point, WY, 82678-4812, US, (307) 893- 65291442 Silver Impasse, Myrtle Point, WY, 82678-4812, US, (307) 893-65292500008/15/1717:32624Mountain Medical454 Crystal Cider Stead, Boudreaux, AZ, 85963-0091, US, (928) 582-8877454 Crystal Cider Stead, Boudreaux, AZ, 85963-0091, US, (928) 582-88772500008/26/178:50631Buzzy Bee Medical3917 Grand Common, Broad Creek, CT, 06864-0242, US, (475) 240-87503917 Grand Common, Broad Creek, CT, 06864-0242, US, (475) 240- 87505000009/1/1715:21645Prophecycurity6292 Blue Townline, Ceres, WY, 83011-5218, US, (307) 787-14846292 Blue Townline, Ceres, WY, 83011-5218, US, (307) 787- 14842500009/10/1711:25651Squidustries6077 Silent Beacon Freeway, Athol, DE, 19901-1976, US, (302) 726-26796077 Silent Beacon Freeway, Athol, DE, 19901-1976, US, (302) 726- 26792500009/16/1716:03662Diamontronics1132 Colonial Elk Chase, Java, MS, 39172-4537, US, (662) 798-84101132
- 28. Colonial Elk Chase, Java, MS, 39172-4537, US, (662) 798- 84102500009/19/1716:07672Southern Devices4734 Amber Row, Plainview, FL, 34444-9097, US, (954) 857-13004734 Amber Row, Plainview, FL, 34444-9097, US, (954) 857- 13002500009/25/1716:20681Vortexgate8989 Foggy Quay, Olmstedville, NH, 03519-8492, US, (603) 729-21568989 Foggy Quay, Olmstedville, NH, 03519-8492, US, (603) 729- 215625000010/6/178:55694Luckytechs6511 Dewy Wagon Extension, Inniswold, TX, 75429-5739, US, (469) 272- 78756511 Dewy Wagon Extension, Inniswold, TX, 75429-5739, US, (469) 272-787510000010/14/178:14705Heartbit Digital6866 Wishing Pathway, Pumpkin Center, HI, 96721- 2610, US, (808) 436-12596866 Wishing Pathway, Pumpkin Center, HI, 96721-2610, US, (808) 436- 125910000011/7/1713:41711Omegatube5711 Quiet Shadow Close, Beth Eden, DE, 19758-1981, US, (302) 463-50405711 Quiet Shadow Close, Beth Eden, DE, 19758-1981, US, (302) 463-504010000011/10/1715:28723Karmaman Bionics6767 Bright Point, Hutchinson, ND, 58682-0342, US, (701) 997- 47376767 Bright Point, Hutchinson, ND, 58682-0342, US, (701) 997-473725000011/16/178:20731Goldwater2243 Golden Trace, Curry, NY, 13977-5298, US, (716) 899-94742243 Golden Trace, Curry, NY, 13977-5298, US, (716) 899- 947410000011/17/178:27 Field Statistics Requirement # 2 a) Since the sales order file is open, click on analysis/ join. The primary file is the sale order file and the secondary file is the customer invoice file, match using the sales order ID for both files, name this file Sales and Customers, select all records in both files to join
- 29. 5) Keeping only the Sales and Customer file open, join in the shipments file as the secondary file, again match on sales order ID for both files, name this file All Three, select all records in both files to join 6) Only keep the All Three file open and close all other files. Click on analysis/direct (this is a direct extract). Name this file Sales 2017 and in the equations box (click on the little calculator) you want the invoices that are dated between Jan 1 and Dec 31, 2017. So the formula needs to say greater than equal to Jan 1 AND less than equal to Dec 31 using the proper IDEA format when writing formulas.
- 30. 7) Click on field statistics to verify the net value. History File Requirement 2 b) Again use direct (direct extraction) and call the file AR 2017. The equation for this part is to look for a paid date greater than Dec 31 2017. Use the appropriate IDEA formula 3) Run field statistics to verify the total due. History file
- 31. Requirement 4 1) Open sales 2017 from requirement 2. You want to create a file called three-way match using direct extraction. In the calculation box look for sales order ID =0 or ship ID=0 or ship date before invoice data using the appropriate IDEA formula. b) 1) Make sure all other files are closed. Open sales 2017 join this file with the customer master file and matching on the customer ID. Call the file sales wo credit limits and select records with no secondary match C) 1) Make sure all other files are closed. Open AR 2017 file from requirement 2. Click analysis/summarization. Call this file ar by cust id. Summarize by customer ID and the numeric field to total is total due. 2) Be sure only the ar by cust id file is open and join this file with customer master file. Call this new file cr limit except 2017. Match based on customer ID but narrow down the report to only territory ID, customer name, credit limit and
- 32. modification date by selecting fields and only highlighting these titles (you may have to clear first then highlight the ones you want). Select all records in primary 3) Only leave open the credit limit except 2017 file and extract cases where the total due sum is greater than the credit limit. Call this file AR credit limit except 2017
- 33. 1) Make sure all other files are closed. Open the AR 2017 file from requirement 2. Click analysis/summarization. Call this file ar by cust id. Summarize by customer ID and the numeric field to total is total due. d) ) Make sure all other files are closed. Open the AR 2017 file. Click on analysis/aging. This aging is as of Dec 31 2017 (again watch the format for dates in IDEA). The aging field is invoice date and field to total is total due. Select only 30, 60, 90 days. Call this file aging sched. Copy and paste the aging report AND copy and paste the detail on the 5 items over 90 days from this section. Include both reports here along with your answer 120 days
- 34. 180 days History Files Running head: THE CASE ON URGENT MEDICAL DEVICE, INC 1 THE CASE ON URGENT MEDICAL DEVICE, INC 2 The Case on Urgent Medical Device, Inc Part #1 The Case on Urgent Medical Device, Inc Requirement 1- Fraud Risk Auditors have a responsibility in identifying fraud risk in revenue recognition because they are guided by bodies such as the Public Company Accounting Oversight Board-PCOB, and auditing standards. For instance, PCOB mandates auditors to plan and perform audits with the aim of obtaining reasonable assurance that the financial statements are free of error or fraud
- 35. (Public Company Accounting Oversight Board-PCOB, 2019). a. Fraud Risk Factor Accounts Affected Audit Assertions (AU Section 326) Possible issue based on the risk factor identified 1. Pressure Customer Invoices There is pressure for distributors to increase sales The need to increase sales triggers distributors to persuade customers to make orders. As such, the distributors are paid for sales orders that have not been delivered 2. Nature of control environment Sales orders There are many related transactions The information on sales orders is for 3-way match control. That means sales orders that have not been shipped but have been invoiced are difficult to track 3. Nature of items Product There are products with similar weights The products with similar weights have different unit prices; as such, accountants might swap the prices leading to financial loss to the organization. b. The solutions to the identified risk factors include reducing the level of pressure exerted to the distributors to make orders even before the customers place the orders The organization should establish a controlled environment in which sales orders are counter checked with the shipment data to prove that the orders have been delivered before the distributors are paid. In the case of the nature of the items, the organization should vary the weight of the products so that there is no swapping of prices between cheap and expensive products.
- 36. Requirement 2: Requirement 3: Areas of risk A Memorandum To : The Chief Executive Officer, From : Data Analyst, Date : November 25th, 2019. Subject: ANALYSISOF DATA FROM URGENT MEDICAL DEVICE INC. The data on shipment ID, invoice ID, and sales order ID was entered in tableau software and the resulting graph showed that the organization used the information to cross check for consistency. As such, it was a control measure. However, it is difficult to identify when sales order ID and the invoice ID are not matching because there is no comparison of the two data. In cognizant of the challenge, it is necessary that the sales order data is compared directly with the shipment data and with the invoice data because there are scenarios where the sales orders have been received, customer invoice has been delivered but the products have not been shipped. In relation to territory and sales goal quarter, the analysis revealed some territories that were allocated relatively lower sales goal quarters. It creates difficulties in comparing the performance of different territories. For instance,Northeast and West territories have higher sales goal quarter allocations while Southwest has the lowest. The analysis also revealed that a product called hinged titanium axle has the highest unit price while the standard cost is relatively low.Comparatively, it has the biggest profit margin. B
- 37. Summarily, the three charts show that some products made by the organization have a higher profit margin compared to others. It also showed that some territories had higher sales quarters compared to others. References Public Company Accounting Oversight Board-PCOB (2019). AS 2401: Consideration of Fraud in a Financial Statement Audit. Web. Accessed on 26/11/2019 © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 1
- 38. Urgent Medical Device, Inc. A Teaching Case Designed to Integrate Data and Analytics in the Financial Statement Auditing Classroom By Allen D. Blay – Florida State University Jay C. Thibodeau – Bentley University Background Urgent Medical Device, Inc. (the Company) is a medical device company founded in 2013 in Provo, Utah that specializes in the development and manufacturing of cutting-edge medical devices designed for all types of joint replacement surgeries. In January 2015, the FDA approved Urgent’s premier product, a hinged titanium axle designed to provide physicians with more precise placement of joints during joint replacement surgery. In early 2016, approximately one year after the new product’s approval, the Company hired a new senior vice president (SVP) of sales to oversee sales, physician training, product delivery, and customer service. The broad set of responsibilities allowed the charismatic SVP to significantly influence the
- 39. Company’s revenue generation. The hiring of the new SVP was also done in large part to help guide the company’s development of an important new sales channel: third-party distributors that are each strategically located in close proximity to key hospitals in regions around the country. The move to hire the SVP was in direct response to overwhelming disappointment about the first year’s sales volume for the new surgical implant, which was lagging significantly behind expectations. Reports from the field led management to recommend the new sales channel to the board of directors that overwhelmingly approved the new strategy, the execution of which was being led by the new SVP. Execution of strategy To help execute the new strategy, the SVP hired five regional sales managers who would become his trusted cohorts. Together, they set aggressive sales targets for the Company’s surgical implants. The sales targets focused on achieving a growth pattern that was characterized by a record high sales volume for each successive quarter in each region. In fact, it is
- 40. fair to say that the sales targets were intentionally created at almost unreachable levels to remove any question about possible weakness in demand for the Company’s new product. The strategy focused on the development of a new sales channel with third-party distributors. Each of the distributors had already established close relationships with the physicians that were actually using the product during surgical procedures. To help pay for the launch of their new product, along with the execution of the new strategy, the Company was also working hard to raise a significant amount of new investment capital to fund the resulting increased operating costs. In order to be successful in attracting the new investment capital, top management made it clear to the SVP how important it was to report strong sales for its premier product, the surgical implant for titanium joints. The SVP, in turn, passed along the same message to the regional sales managers. © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG
- 41. International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 2 Management control philosophy The upper management team of Urgent can be described as being aggressive in business practices and often emphasizes speed and efficiency when implementing their decisions. Management rarely hires external consultants because they are of the opinion that consultants are too expensive and often follow a conservative approach. The upper management team meets regularly with its key managers. In general, the upper management team has cooperated with the audit team in order to provide fair and adequate financial reporting, but there have been disagreements in the past. The Company has a strict policy for following all established internal control procedures. Incentive compensation Top management focuses significant attention on achieving short-term performance measures based on the audited financial statements when determining compensation and making promotion decisions.
- 42. Revenue earned is the most important criterion in performance assessment throughout the organization. As part of the launch of its new surgical implant, a new bonus plan was established to provide additional incentives for the entire organization to focus on this new opportunity, with revenue earned as the key criterion used to determine incentive compensation. Preliminary results Despite the SVP’s optimism about sales in 2017, internal reports have indicated that the actual sales volume of the surgical implant was well below budget each quarter. The SVP responded to these reports by repeatedly communicating his disappointment to the regional sales managers. Furthermore, he consistently warned that if the team could not boost sales, the Company would likely not be able to raise additional investment capital and would then be forced to significantly downsize its headcount. Unfortunately, boosting revenue of the new surgical implants was not as simple as merely shipping the product to distributors. The distributors were hesitant to purchase product until the sale to the final customer was finalized as the distributors did not want to be
- 43. stuck with the inventory on their own balance sheets. Further, the terms of the sales do not include any refund or rebate conditions. In addition, the Company has no intention of changing those terms and accepting any return. Therefore, any sale to distributors are final. By the end of 2017, the Company had signed on a total of 73 distributors to sell its surgical implants in more than 20 different states throughout the United States. Each distributor was independently owned and operated but the company routinely shared best practices among its network. The SVP monitored sales closely from the distributor network through his regional sales managers. In fact, he even maintained a monthly sales report from each of the 73 distributors. The Company invoices customers when the goods are shipped, and invoicing triggers the recording of revenue. The Company does not include freight costs in sales revenue but does offset shipping costs with any freight charged to customers. The following relevant financial data is taken from the Company’s unaudited trial balance, which was
- 44. used to produce the unaudited financial statements: Sales revenue, year ended 12/31/2017 $84,867,855 Gross accounts receivable, 12/31/2017 $11,988,886 © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 3 Audit approach Your audit team is currently in the midst of year-end testing in the revenue and accounts receivable cycle for the audit of the calendar year 2017 financial statements. Your testing will focus on the existence/occurrence, cutoff, and accuracy assertions for sales revenue, as well as the existence and valuation assertions for accounts receivable. As relationships with third-party distributors generally require significant contract analysis to ensure the appropriateness of when revenue is recognized, the
- 45. audit team expects more hours to be spent this year testing revenue and accounts receivable as compared to the prior year. In addition to the procedures you will perform, the audit team will also confirm accounts receivable and perform other procedures according to the audit plan. The audit team has assessed the risk of material misstatement (RMM) for each relevant assertion in order to determine the nature, timing, and extent of the procedures to be performed at Urgent. Other members of the audit team have already completed a walk-through of the revenue and accounts receivable processes, identified “what could go wrongs” within the process, and identified the controls that have been placed in operation to mitigate the risks. Based on the work performed, the team decided to test the operating effectiveness of certain key controls during interim testing. The results are found below. Tests of controls – Revenue and accounts receivable cycle – Interim There are four key application controls tested at interim. Prior to testing the application controls, the
- 46. information technology (IT) auditors tested the general controls (GITCs) over program changes, access to programs, and computer operations that are relevant to the revenue and accounts receivable cycle. The GITCs were found to be effective and can be relied upon to support the effective operation of application controls. In addition, the IT auditors tested the system to make sure that proper segregation of duties occurred throughout the period and that controls over data input, data integrity, and the completion and accuracy of data used in the four application controls were operating effectively. No exceptions were noted in the testing performed by the IT auditors, and the team decided to test the four key application controls. The first control is an automated three-way sales match. The control matches the details from 1) an approved sales order; 2) relevant shipping documents; and 3) the sales invoice before revenue is recorded. The control has been designed to support the existence/occurrence assertion for revenue. A test of the control’s operating effectiveness was conducted at the interim. No exceptions were noted. The second control requires the credit department at Urgent to
- 47. conduct a detailed credit check for all new customers, including the new distributors. To do so, the credit department obtains information from the customer that allows for a comprehensive review of the financial condition of the new customer and an assessment of the customer’s capacity to pay outstanding invoices. The control culminates with an approval of the new customer and the establishment of a credit limit by the credit department manager based on the information reviewed. A test of the control’s operating effectiveness was conducted at interim. No exceptions were noted. The third control is an automated sales authorization control. When a sales order is entered into the system, the amount of the sale is added to the existing accounts receivable balance for that customer. The sum is then compared to the customer’s credit limit. If the sum is greater than the credit limit, the sale is not approved. If the sum is less than the credit limit, the sale is approved. A credit manager notes the approval and authorizes shipment by electronically entering their initials into the system, which gets posted into the sales order database. A test of the
- 48. control’s operating effectiveness was conducted at interim. No exceptions were noted. © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 4 The fourth control is a monthly review of the adequacy of the allowance for doubtful accounts, completed by the controller. On a monthly basis, the controller reviews the aging of accounts receivable report produced by the company’s information system. During the review, the controller identifies for follow-up all balances greater than 90 days past due for consideration in the allowance calculation. A test of the control’s operating effectiveness was conducted at interim. No exceptions were noted. Roll-forward period By the end of the third quarter of 2017, sales revenue for the company’s premier surgical implant was
- 49. still lagging far behind expectations. To help ensure that Urgent delivered impressive fourth quarter revenue numbers, the entire sales team, led by the SVP and the regional sales managers, began to exert pressure on a number of distributors in an attempt to improve sales in 2017. This effort seemed to be paying off as the sales team successfully persuaded more than a dozen distributors to purchase product in advance of final customer demand. These circumstances presented a problem for the Company, because the distributors began to ask for concessions from Urgent Medical. For example, in order to persuade the distributors, the Company agreed to hold the inventory in their own warehouse. The SVP’s actions led to a dramatic increase in revenue for the fourth quarter of 2017. In fact, sales increased year-over-year by 214 percent for the fourth quarter alone. The upward trajectory of sales revenue helped the Company raise the much-needed investment capital as Urgent issued more than 10 million shares of common stock for $40 million in early 2018. Most importantly, roll-forward testing procedures were
- 50. completed for each of the four key application controls. No exceptions were noted in the roll-forward procedures. Thus, the audit team concluded that the controls were operating effectively throughout the year. Substantive testing – Revenue and accounts receivable cycle – Final As a result of the tests of controls, the audit team assessed the control risk as low for the existence/occurrence, cutoff, and the accuracy assertions for revenue and the valuation assertion for accounts receivable. Since the recognition of revenue is a presumed fraud risk, along with the significant risk of sales cutoff related to the launch of the new surgical implant, the audit team concluded that fraud risk related to the timing of revenue recognition over period-end is high. Overall, based on the control risk assessment as low and the inherent risk assessment of high, the overall assessment of RMM is moderate for each of the assertions. In response to the RMM assessment, the audit team has asked that you complete a number of substantive testing procedures. In addition, since your manager is trying to improve the efficiency and
- 51. effectiveness of substantive testing, you have been asked to use two technological tools, IDEA and Tableau, to facilitate identification of potential concerns related to the substantive testing for the revenue and accounts receivable cycle. Urgent has provide you with the following databases to facilitate your testing. Database definitions for data provided 1. SalesOrders – Urgent has provided the SalesOrders database, which includes a master listing of all customer orders placed during the year. The client has informed you that the database also includes sales orders from the prior year that were not completed until the current year, as well as orders taken this year that were not delivered to customers as of 12/31. This database is also the client’s primary database for the three-way match control. When an order is shipped or invoiced, the system automatically posts the ShipID or InvoiceID to the SalesOrders database. © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG
- 52. International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 5 Column name Column description Field type SalesOrderID Customer order number – Primary Key Numeric (int) OrderDate Date the customer order was created Date MM/DD/YYYY ProdID Product Number. Foreign Key to Products.ProdID Character CustID Distributor Number. Foreign Key to CustomerMaster.CustID Numeric (int) TerritoryID Territory in which the sale was made. Foreign key to SalesTerritory.TerritoryID Numeric (int) Quantity Quantity Ordered Numeric (int) UnitPrice Price per unit Numeric (dollars)
- 53. SubTotal Sales subtotal, amount included in Sales Revenue Numeric (dollars) TaxAmt Tax amount Numeric (dollars) Freight Shipping Cost Numeric (dollars) TotalDue Total due from customer, amount posted to Accounts Receivable Numeric (dollars) CredApr Credit Approval – Initials of CM Character ShipID Shipping ID number – Foreign key to Shipments.ShipID Numeric InvoiceID Invoice ID number – Foreign key to Invoice.InvoiceID Numeric ModifiedDate Date the row was last updated Date MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour)
- 54. 2. Shipments – Urgent has provided you with the Shipments database, which includes a listing of all shipments made during fiscal 2017, as well as shipments of products ordered during 2017 and not shipped until 2018. Column name Column description Field type ShipID Shipping ID Number – Primary Key Numeric (sequential int) SalesOrderID Sales order number – Foreign key to SalesOrders.SalesOrderID Numeric (int) ShipDate Date of shipment Date MM/DD/YYYY ShipWeight Total Weight of Shipment Numeric (int) Carrier Shipping Carrier Character ModifiedDate Date the row was last updated Date MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour)
- 55. © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 6 3. CustomerInvoices – Urgent has provided you with the CustomerInvoices database, which includes a listing of all invoices issued during 2017, as well as invoices for sales orders taken during 2017 but not delivered to customers until 2018. Column name Column description Field type InvoiceID Invoice number – Primary Key Numeric (sequential int) CustID Distributor ID number - Foreign key to CustomerMaster.CustID Numeric (int) InvoiceDate Date of sales invoice Date MM/DD/YYYY SalesOrderID Sales Order ID – Foreign key to
- 56. SalesOrders Character PaidDate Date invoice paid, 9/9/9999 is unpaid Date MM/DD/YYYY ModifiedDate Date the row was last updated Date MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour) 4. SalesTerritory – Urgent has provided you with this database listing the sales territories, as well as the sales goals for the fourth quarter of 2017 for all territories. Column name Column description Field type TerritoryID Territory Identification Number – Primary Key Numeric (int) TerritoryName Name of Sales Territory Character SalesVP Name of Sales VP for Territory Character SalesGoalQTR Quarterly Territory Sales Goal Numeric (dollars) ModifiedDate Date the row was last updated Date
- 57. MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour) 5. CustomerMaster – Urgent has provided you with the CustomerMaster database, which is a listing of all distributors. It classifies distributors by territory and also includes the most current credit limit for the customer. This credit limit is used for the automated credit limit check control. Column name Column description Field type CustID Distributor ID number – Primary Key Numeric (int) TerritoryID Territory in which the customer is located. Foreign key to SalesTerritory.TerritoryID Numeric (int) CustName Distributor Name Character ShipAddr Distributor Shipping Address Character © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG
- 58. International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 7 Column name Column description Field type BillAddr Distributor Billing Address Character CredLimit Credit Approval Limit Numeric (dollars) ModifiedDate Date the row was last updated Date MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour) 6. Products – Urgent provided the Products database, which includes a listing of all products currently manufactured and sold by the company. The UnitPrice is the current verified selling price and is automatically populated in SalesOrders when a customer places an order. Similarly, the weight determines the freight charged to customers. Column name Column description Field type ProdID Product ID number – Primary Key Numeric (int) ProdName Product Name Character SafetyStockLevel Minimum inventory quantity Numeric (int)
- 59. ReManPoint Inventory level that triggers manufacturing additional product Numeric (int) StandardCost Standard manufacturing cost of product Numeric (dollars) UnitPrice Selling price Numeric (dollars) Weight Shipping Weight of Product Decimal (8,2) DaysToMan Number of days required to manufacture the product Numeric (int) SellStartDate Date the product was available for sale Date MM/DD/YYYY ModifiedDate Date the row was last updated Date MM/DD/YYYY ModifiedTime Time the row was last updated Time (24-hour) Your firm’s Data and Analytics center has already converted the files, as provided by the client, into Excel format. As such, the contents and format of the databases you have been provided are exactly
- 60. the same as they were provided by the client. Requirements 1. According to the professional auditing standards, an audit team should ordinarily presume that revenue recognition is a fraud risk. Complete the following steps. a. Based on your understanding of fraud risk assessment and the case information, identify at least three specific fraud risk factors related to Urgent. Classify these risks in terms of What Can Go Wrong (WCGW) with each of the significant accounts and relevant assertions identified for Urgent’s revenue and accounts receivable cycle. b. What do you believe is the most significant risk related to the revenue account for Urgent? © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 8
- 61. c. What special audit considerations would you propose in response to the significant risk you identified above? In your response, consider how you would change your approach to the nature, timing, and extent of evidence in response to the identified risk. 2. Based on the tests of controls and other Information Technology General Controls (ITGC) testing, your firm has concluded that the data files supplied to you for your procedures are complete and accurate. The conclusion was based on tests of controls over data input risks, including all relevant data elements (e.g., invoice date), data integrity risks, and the relevant automated application controls. However, it is also important to confirm that the data, once imported into IDEA or Tableau, was transferred into the technology tool in a complete and accurate manner prior to working with the data within the technology tool. Import all supplied data into IDEA and then reconcile the data with the supplied trial balance and check figures from the case. Simply stated, you must check that the data has been transferred in a complete and accurate manner at each step
- 62. in the process. Thus, to ensure that you are working with the set of transactions and balances that the client used to calculate Sales Revenue and Accounts Receivable, answer the following questions: a. What are the total number of valid sales that comprise the $84,867,855 sales revenue shown on the trial balance as of 12/31/2017? b. What are the total number of unpaid invoices that comprise the $11,988,886 gross accounts receivable balance shown on the trial balance as of 12/31/2017? Assume that Urgent has no outstanding accounts receivable from 2016. 3. Data visualization tools such as Tableau can be used to help audit teams identify items or specific areas of higher risk within an entire population. Your data and analytics center has provided you with a set of Tableau visualizations to consider during your substantive testing procedures: i. Three-way match of SalesOrderID, InvoiceID, and ShipID based solely on SalesOrders database ii. Sales by territory
- 63. iii. Sales by distributor iv. Sales by quarter v. Sales by territory by quarter vi. Product sales by territory vii. Fourth quarter sales by territory viii. Sales vs. sales goals for fourth quarter by territory ix. Sales by quarter by territory vs fourth quarter sales goals a. Using the data visualizations provided in Tableau, compose a memo to be included in the audit documentation file that identifies any pattern in the data that you believe may be indicative of specific audit risks. In your memo, be sure to link the identified risks to the appropriate significant account and relevant assertions. b. Based on the analysis completed above, what further testing, if any, needs to be performed over the identified risks and the remaining population? Stated differently, do any further tests need to be performed or does the three-way match visualization, combined with your tests of
- 64. © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 9 controls and additional visualizations, provide you with sufficient appropriate evidence to conclude about the occurrence of revenue at Urgent? 4. Technology tools like IDEA can also be used to help audit teams identify items with potentially higher risks within an entire population of items in an efficient and effective manner. With this in mind, complete the following steps. a. The SalesOrder database was used to produce a Tableau visualization of three-way match in the revenue cycle as described in the previous requirement. Using IDEA, verify the accuracy of the SalesOrder database by creating a three-way match on your own using the SalesOrder, Shipments, and CustomerInvoices databases. Are your conclusions the same? If so, how does this increase your assurance about the accuracy of the
- 65. SalesOrder database? If not, why not? Did you identify any specific transaction that you believe should be considered higher risk for the audit? b. Analyze the sales revenue file using IDEA to determine whether any sales were made to distributors without an established credit limit. Are there any exceptions? If there are exceptions, what further testing would you perform on these exceptions? c. Analyze the accounts receivable and related credit authorization limits using IDEA to determine whether any customers have account balances as of 12/31/17 that exceed their existing credit limit. Are there any exceptions to the credit limit control as of 12/31/17? Do you notice any pattern in the exceptions? What further testing would you perform on these exceptions? d. For some time, Urgent has based its allowance for doubtful accounts on an aging analysis and the results have been historically accurate. Below, you have been provided with the client’s list of customer balances in excess of 90 days. These are the accounts that the client will consider
- 66. when calculating the allowance for doubtful accounts as of 12/31/2017. Perform an aging analysis using IDEA to assess the completeness and accuracy of Urgent’s list of customer balances in excess of 90 days. Urgent Medical Devices Analysis of >90-Day Delinquent Accounts Receivable As of December 31, 2017 SalesOrderID InvoiceDate TotalDue 3236 7/4/2017 56,251.34 3241 7/9/2017 73,450.67 3422 9/5/2017 73,450.67 3466 9/21/2017 59,932.09 3490 9/27/2017 54,851.15 317,935.92 i. Based on your analysis, does the client’s listing agree to your analysis completed in IDEA? ii. Do you have any concern with the client’s process for
- 67. identifying the total amount of significantly delinquent accounts? You may think broadly, beyond mechanical accuracy, in considering the sufficiency of their process for identification of delinquent accounts. kpmg.com/socialmedia iii. According to Urgent’s unaudited trial balance, the balance for Allowance for Doubtful Accounts is $310,000. Does the test performed above provide sufficient appropriate evidence to support a conclusion on the valuation of accounts receivable? If not, what additional testing would you recommend to reach an audit conclusion for this relevant assertion? 5. Based on your risk analysis and findings in requirements 1) through 4), perform additional analyses using IDEA to identify specific transactions, territories, or distributors that may require additional substantive testing. Be creative when doing so. For example, consider patterns in the data
- 68. provided that might indicate management override of a control activity. Focus your additional analytics on those areas. Prepare a listing of specific findings from your additional analytics that you believe warrant additional testing. 6. In order to conclude on whether the risk of material misstatement has been reduced to an acceptably low level for the relevant assertions identified, you need to consider, on an overall basis, whether the results of your procedures provide sufficient appropriate evidence. Based on the evidence that you have considered, can you reach a conclusion for the relevant assertions identified? Why or why not? Learning objectives of case 1. To understand the fraud risks associated with revenue recognition and its impact on the testing of the revenue and accounts receivable cycle (demonstrated when students complete requirement 1 of the case). 2. To understand the importance of determining that a population of data is complete and accurate
- 69. prior to its use in audit testing, including understanding how to reconcile the population to the underlying books and records of the audit client (demonstrated when students complete requirement 2 of the case). 3. To learn how to interpret commonly used data visualizations and reach audit conclusions based on the issues, objectives and alternatives that surface given the observed facts and circumstances (demonstrated when students complete requirement 3 of the case). 4. To understand how to utilize commonly used data and analytics software tools (i.e., IDEA and Tableau) within a realistic audit context (demonstrated when students complete requirements 3, 4, and 5 of the case). 5. To develop critical thinking skills around the identification of exceptions and risk factors in client provided data (demonstrated when students complete requirements 3, 4, and 5 of the case). 6. To recognize the importance of reaching an overall conclusion for each relevant assertion in accordance with applicable professional standards based on the evidential matter considered
- 70. (demonstrated when students complete requirement 6 of the case). © 2018 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 741662 The KPMG name and logo are registered trademarks or trademarks of KPMG International. The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation. This simulation is a work of fiction. Any names of persons, companies, events or incidents, are fictitious. Any resemblance to actual persons, living or dead, companies or actual events is purely coincidental.
- 71. The views and opinions expressed herein are those of the authors and do not necessarily represent the views and opinions of KPMG LLP. 04/12/2019 11:59 PM 1 For Educational Purposes Only Database History for C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1AR 2017.IMD Database Date User Data Set_Sales Orders-Sheet1.IMD Import from Excel 12/4/2019 12:38:12 AM anacr Imported from: C:UsersanacrGoogle DriveMACCDATA ANALYTICSW6Data Set_Sales Orders.xlsx Data Source: Excel Sheet Name: Sheet1 Number of records: 1168 First record as title: TRUE IDEAScript code: Set task =
- 72. Client.GetImportTask("ImportExcel") dbName = "C:UsersanacrGoogle DriveMACCDATA ANALYTICSW6Data Set_Sales Orders.xlsx" task.FileToImport = dbName task.SheetToImport = "Sheet1" task.OutputFilePrefix = "Data Set_Sales Orders" task.FirstRowIsFieldName = "TRUE" task.EmptyNumericFieldAsZero = "TRUE" task.PerformTask dbName = task.OutputFilePath("Sheet1") Set task = Nothing Client.OpenDatabase(dbName) Index Database 12/4/2019 12:44:18 AM anacr Indexed by: SALESORDERID/A IDEAScript code: Set db = Client.OpenDatabase("Data Set_Sales Orders-Sheet1.IMD") Set task = db.Index task.AddKey "SALESORDERID", "A" task.Index FALSE
- 73. Set task = Nothing Set db = Nothing Sales and Customers .IMD Join Databases 12/4/2019 1:22:32 AM anacr File name: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Sales and Customers .IMD Number of records: 1167 Control field: No Control Total 04/12/2019 11:59 PM 2 For Educational Purposes Only Database History for C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1AR 2017.IMD Database Date User Control total: No Control Total Primary recs rejected: 1 Join primary file: C:UsersanacrDocumentsMy IDEA
- 74. DocumentsIDEA ProjectsProject 1Data Set_Sales Orders-Sheet1.IMD Number of records: 1168 Join secondary file: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Data Set_Customer Invoices (1)-Sheet1.IMD Number of records: 1167 Type of join: Matches only Key used: SALESORDERID/A - SALESORDERID/A Creating a virtual data... No IDEAScript code: Set db = Client.OpenDatabase("Data Set_Sales Orders-Sheet1.IMD") Set task = db.JoinDatabase task.FileToJoin "Data Set_Customer Invoices (1)-Sheet1.IMD" task.IncludeAllPFields task.IncludeAllSFields task.AddMatchKey "SALESORDERID", "SALESORDERID", "A" task.CreateVirtualDatabase = False dbName = "Sales and Customers .IMD"
- 75. task.PerformTask dbName, "", WI_JOIN_MATCH_ONLY Set task = Nothing Set db = Nothing Client.OpenDatabase (dbName) All Three.IMD Join Databases 12/4/2019 1:23:50 AM anacr File name: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1All Three.IMD Number of records: 1165 Control field: No Control Total Control total: No Control Total Primary recs rejected: 2 04/12/2019 11:59 PM 3 For Educational Purposes Only Database History for C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1AR 2017.IMD
- 76. Database Date User Join primary file: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Sales and Customers .IMD Number of records: 1167 Join secondary file: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Data Set_Shipments (1)-Sheet1.IMD Number of records: 1165 Type of join: Matches only Key used: SALESORDERID/A - SALESORDERID/A Creating a virtual data... No IDEAScript code: Set db = Client.OpenDatabase("Sales and Customers .IMD") Set task = db.JoinDatabase task.FileToJoin "Data Set_Shipments (1)-Sheet1.IMD" task.IncludeAllPFields task.IncludeAllSFields task.AddMatchKey "SALESORDERID", "SALESORDERID", "A"
- 77. task.CreateVirtualDatabase = False dbName = "All Three.IMD" task.PerformTask dbName, "", WI_JOIN_MATCH_ONLY Set task = Nothing Set db = Nothing Client.OpenDatabase (dbName) Sales 2017.IMD Record Extraction 12/4/2019 11:40:27 PM anacr File name: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Sales 2017.IMD Number of records: 1156 Control field: No Control Total Control total: No Control Total Extraction from: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1All Three.IMD Number of records: 1165 Indexed by: No index
- 78. Extraction Range: 1 - 1165 04/12/2019 11:59 PM 4 For Educational Purposes Only Database History for C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1AR 2017.IMD Database Date User Extraction Criteria: INVOICEDATE >= "20170101" .AND. INVOICEDATE <= "20171231" Creating a virtual data... No IDEAScript code: Set db = Client.OpenDatabase("All Three.IMD") Set task = db.Extraction task.IncludeAllFields dbName = "Sales 2017.IMD" task.AddExtraction dbName, "", " INVOICEDATE >= ""20170101"" .AND. INVOICEDATE <= ""20171231""" task.CreateVirtualDatabase = False
- 79. task.PerformTask 1, db.Count Set task = Nothing Set db = Nothing Client.OpenDatabase (dbName) AR 2017.IMD Record Extraction 12/4/2019 11:53:34 PM anacr File name: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1AR 2017.IMD Number of records: 148 Control field: No Control Total Control total: No Control Total Extraction from: C:UsersanacrDocumentsMy IDEA DocumentsIDEA ProjectsProject 1Sales 2017.IMD Number of records: 1156 Indexed by: No index Extraction Range: 1 - 1156 Extraction Criteria: PAIDDATE >= "20171231"
- 80. Creating a virtual data... No IDEAScript code: Set db = Client.OpenDatabase("Sales 2017.IMD") Set task = db.Extraction task.IncludeAllFields dbName = "AR 2017.IMD" task.AddExtraction dbName, "", " PAIDDATE >= ""20171231""" task.CreateVirtualDatabase = False task.PerformTask 1, db.Count Set task = Nothing Set db = Nothing Client.OpenDatabase (dbName) Sheet1InvoiceIDCustIDInvoiceDateSalesOrderIDPaidDateModif iedDateModifiedTime100635541/2/1726792/2/172/2/1717:2910 0636621/3/1726812/1/172/1/1710:05100634231/2/1726821/31/1 71/31/1716:30100637191/3/1726832/1/172/1/1711:3210063831/ 3/1726842/1/172/1/1710:18100640651/4/1726852/2/172/2/1711: 33100639271/3/1726862/1/172/1/1714:03100641431/4/1726872/ 2/172/2/179:21100642311/4/1726882/2/172/2/1711:4310064373 1/5/1726892/4/172/4/178:01100644681/5/1726922/1/172/1/1717