11 The COSO framework: monitoring activities

You have been delegated by the board of directors of Ramero Ltd, a family-owned business, to assess and evaluate the effectiveness of the company’s internal control system, as well as any fraud risks. The company manufactures and sells food and beverages, and has been in the industry for about four years. You have held several meetings with key personnel to get an idea about the company’s internal control system. You also had a tour of the company’s premises to observe the working environment.

Your first meeting was with Mr Jones, the company manager. Mr Jones gave you a very brief idea about the company’s internal control system and organisational structure. Mr Jones explained that he reports directly to the CEO, Mrs Ramy, who strives to meet family owners’ expectations and is under continuous pressure to achieve high returns. Mr Jones is overburdened with many responsibilities as he rarely delegates authority to lower-level managers and prefers to approve and authorise almost every business-related transaction. Mr Jones even sets the required criteria for the company’s employees at all levels and is keen to interview and assess them himself. This is why he thinks there is no need for a human resources department. You were told by Mr Jones that there are two accounts officers in the company, who usually do all the recording as well as the preparation of financial statements. However, there is no finance manager to review and approve the financial records and Mr Jones does that himself.

Your second meeting was with Ms Anderson, the IT manager, who is responsible not only for designing the computerised accounting systems but also for updating customers’ information and maintaining the system. After talking to Ms Anderson, you realised she is a qualified and intelligent employee. She is very loyal to the company and does her best to save money for the company. For example, she does all the updates and data backups herself to save the cost of setting staff passwords, creating backups and purchasing security software. Employees in other departments share computers to save the money needed to purchase a PC for each individual employee. There are only two printers for the whole company, easily accessible to everyone and with no login detail for ease of use.

Your third meeting was with Mr Wenzhao, who has been the external auditor for Ramero Ltd since it was first established. Mr Wenzhao assured you of the integrity and qualification of Ramero’s senior management. He mentioned that he always issues a clean audit report for Ramero Ltd because of the management’s integrity, history, and cooperation. However, he mentioned that some internal control weaknesses have not yet been resolved, despite Mr Wenzhao raising them with management. You noticed that there is no internal audit department or audit committee, which Mr Jones justified by cost constraints and the small size of the company.

During your tour of the company’s premises, you found that there were no security guards for the stockroom and poor-quality locks on the stockroom doors. When you entered the room, you found some of the stock boxes were opened, with some of the stock scattered on the floor. You also found the stockroom inappropriate for keeping food and beverages for a long time. The administrative offices housed ten employees who shared three computers. After talking to three of the employees, you realised that morale is low and they complained of unfair treatment by Mr Jones. One of them commented that ‘if Mr Jones likes you, work will be fun’. Some were also unhappy with the compensation structure and annual pay rises, which are usually not linked to performance but based on Mr Jones’s personal judgement. Employees also have no code of ethics or penalty system, as Mr Jones decides on what is acceptable behaviour in the workplace and who should be penalised for what.