COSO presents recommendations for a management report and an audit committee chairman's letter, to both be included as part of the annual report to stockholders. This appears to be done. Two specific areas for improvement from looking at the COSO guidelines and the Chairman's letter is the need for seeking a second opinion from another public accounting firm, and the role of the audit committee in quarterly reporting. I don't see either of those being reported or occurring.
From the Legislative guidelines perspective, the Audit Committee Chairman's letter covers the requirement of a review with management, the independent accountant, and the director of internal auditing concerning audit activities and plans and the adequacy of internal controls. However, it does not seem to cover anything about making any necessary changes to such activities or controls as deemed necessary. Along with this, there does not appear to be a review of the independent accountants report.
3.) As the role of audit committees will likely continue to evolve, identify other potential areas of audit committee activity not specifically addressed in the case.
One major area not covered in the case is the audit of computers and networks and the data contained on them. This area is becoming an ever increasing concern for need to audit and for good reason. But - how to audit?; when to audit? As technology advances, it becomes increasingly more difficult for auditors to detect fraud. The more types of technology available; the more ways there are for fraudsters to conceal a fraud. With this in mind, it will be important for Audit Committees to remember a few key points.
The issues around when computer audits should be performed are related to how they are to be performed, and by whom. Since there is a significant cost in doing audits which is impacted by the audit design and frequency, the guiding principal should be that audits will be performed when the cost of doing so is less than or equal to the risk which the audit helps diminish.
