,Solution manual for Contemporary Auditing 12th
Edition by Michael C. Knapp
Notes
1- All Chapters are step by step.
2- We have shown you 10 pages.
3- The file contains all Appendix and Excel
sheet if it exists.
4- We have all what you need, we make
update at every time. There are many
new editions waiting you.
5- If you think you purchased the wrong file
You can contact us at every time, we can
replace it with true one.
Our email:
, Case 1.1 Wells Fargo & Company 1
CASE 1.1
WELLS FARGO & COMPANY
Synopsis
Wells Fargo & Company got its start in 1852 in the midst of the California Gold Rush. The
company’s two founders raised the capital to finance a new company to be based in the Wild West
boomtown of San Francisco after realizing that the Bay Area provided a wealth of business
opportunities for investors willing to accept a high risk of failure. The company’s founders decided
that transportation and banking services were desperately needed in San Francisco so they decided
that Wells Fargo would pursue those two unrelated lines of business. The company initially made
a “name” for itself by providing rapid and reliable freight, courier, and mail delivery services. But,
when the federal government nationalized major freight and transportation lines during World
War I, Wells Fargo’s management shifted its focus almost exclusively to the banking industry.
Throughout much, if not most, of Wells Fargo’s history successive generations of senior
executives have embraced the high-risk, “Wild West” mindset around which the company was
created. That mindset or company culture triggered a massive, high-profile scandal that surfaced
in September 2016 when a federal agency announced that Wells Fargo had been fined nearly $200
million for engaging in improper sales practices on an enormous scale.
Critics of Wells Fargo eventually turned their attention to the company’s longtime audit
firm, KPMG. Several U.S. senators, in particular, harshly criticized the prominent audit firm. The
senators demanded that KPMG explain how it could issue a “clean” opinion each year on Wells
Fargo’s internal control over financial reporting (ICFR) while the company was involved in the
massive fraud involving improper sales practices.
Central to this case are three lengthy letters that are included as exhibits. Exhibit 1 presents
a letter sent by four U.S. senators to KPMG in which the senators demand that the audit firm
respond to a series of questions including whether the Wells Fargo auditors were aware of the
improper sales practices being applied by their client. The senators also demanded to know
whether KPMG continued to stand by its opinions that Wells Fargo had maintained “effective
internal control over financial reporting” during the timeframe that the sales fraud was ongoing.
KPMG’s letter in response to the senators is contained in Exhibit 2—in the letter KPMG indicated
that it did, in fact, still stand by its earlier opinions that Wells Fargo had maintained effective ICFR.
Finally, Exhibit 3 presents a letter that the senators sent to the PCAOB—the senators had been
troubled by much of the information conveyed to them by the KPMG letter shown in Exhibit 2.
In this final letter, the senators suggested that the PCAOB review KPMG’s audits of Wells Fargo’s
ICFR and that the agency review its “rules and guidance” relevant to public company auditors’
consideration of ICFR weaknesses and illegal acts perpetrated by their clients.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 2
Wells Fargo & Company--Key Facts
1. In 1852, Henry Wells and William Fargo organized Wells Fargo & Company because they
were convinced that the California Gold Rush provided a wealth of business opportunities in the
San Francisco Bay Area.
2. Banking and transportation services were the two lines of business Wells Fargo’s founders
decided their new company would pursue.
3. After the federal government nationalized major freight and transportation lines during
World War I, Wells Fargo’s executives focused the company’s operations almost exclusively on
the banking industry.
4. Beginning in the early twentieth century, successive generations of Wells Fargo senior
executives relied on a relentless acquisition strategy and aggressive marketing initiatives to expand
the company’s banking operations.
5. By 2015, Wells Fargo was the largest global bank in terms of collective market value; at
the time, the company operated nearly 9,000 retail branches in 35 countries and had over 70 million
customers.
6. In addition to its impressive size, Wells Fargo consistently ranked among the most
respected multinational companies in annual surveys by Barron’s.
7. In September 2016, the Consumer Financial Protection Bureau (CFPB) announced that
Wells Fargo had been fined $185 million for improper sales practices between 2011 and 2016;
those illegal activities had resulted in the creation of millions of unauthorized customer accounts.
8. In response to the widely-publicized scandal, Wells Fargo’s executives typically attributed
the illegal practices to self-interested lower-level employees.
9. KPMG, Wells Fargo’s longtime audit firm, issued “clean” opinions on the company’s
internal control over financial reporting (ICFR) throughout the time frame in which the illegal
sales practices were being applied.
10. In a letter sent to KPMG in late 2016, four U.S. senators posed a series of questions to the
firm, including whether the Wells Fargo auditors had been aware of the illegal sales practices and
whether the firm continued to stand by its prior opinions that the company had maintained effective
ICFR.
11. KPMG responded to the senators by indicating that the Wells Fargo auditors had been
aware of the illegal sales activities but had concluded that they did not involve the company’s
ICFR and did not have a significant impact on the company’s financial statements.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 3
12. After receiving the letter from KPMG, two of the senators wrote the PCAOB and asked
the agency to review KPMG’s audits of Wells Fargo’s ICFR and its “rules and guidance” relevant
to auditors’ consideration of ICFR weaknesses and illegal acts perpetrated by their clients.
Instructional Objectives
1. To identify the different types or classes of internal controls.
2. To identify the nature and scope of internal controls over financial reporting (ICFR).
3. To define a “material weakness in internal control” and to identify the factors auditors should
consider when determining whether a deficiency in internal control qualifies as a material
weakness.
4. To define a “material weakness in ICFR” and to identify the factors auditors should consider
when determining whether a deficiency in ICFR qualifies as a material weakness in ICFR.
5. To examine the responsibility of public company auditors to search for illegal acts committed
by their clients.
6. To identify public company auditors’ responsibilities after determining that a client has engaged
in an illegal act.
7. To consider how the length of an audit firm’s tenure with a public company client may impact
its ICFR assessment for that client.
Suggestions for Use
Consider launching this case by requiring your students to either individually or in groups
research and report on a recent ICFR material weakness reported by a public company. If you
want to ensure that each individual or group reports on a unique material weakness, then use a
Google search to identify a sample of material weaknesses to be used for this exercise. After the
students have made these presentations, ask them to compare and contrast the material weaknesses
they researched with the internal control deficiencies that were evident within Wells Fargo. After
completing this exercise, students will be better equipped to provide an informed opinion on
whether KPMG should have reported an ICFR material weakness for Wells Fargo.
Suggested Solutions to Case Questions
1. Internal controls can be categorized several different ways. For example, we could classify
internal controls by transactions cycles, by cost, or by complexity. The key scheme that the
accounting profession has historically used to categorize internal controls is by their overarching
objective. According to the COSO’s internal control framework, an entity’s internal control
process is designed to achieve three broad classes of objectives. Those classes of objectives
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 4
include “reliability of financial reporting,” “effectiveness and efficiency of operations,” and
“compliance with applicable laws and regulations.”
Obviously, the key distinction between internal controls over financial reporting (ICFR)
and the other two types or classes of internal controls is the underlying intent or purpose of ICFR.
The PCAOB notes that ICFR are intended to “provide reasonable assurance regarding the
reliability of financial reporting and the preparation of financial statements for external purposes
in accordance
with GAAP” [AS 2201.A5]. In this same context, the PCAOB auditing standards note that ICFR
include those “policies and procedures that—
(1) Pertain to the maintenance of records that, in reasonable detail, accurately and
fairly
reflect the transactions and dispositions of the assets of the company;
(2) Provide reasonable assurance that transactions are recorded as necessary to permit
preparation of financial statements in accordance with generally accepted
accounting principles, and that receipts and expenditures of the company are being
made only in accordance with authorizations of management and directors of the
company; and
(3) Provide reasonable assurance regarding prevention or timely detection of
unauthorized acquisition, use, or disposition of the company’s assets that could
have a material effect on the financial statements.” [AS 2201.A5]
The other two classes of internal controls address differing control objectives. For
example, the intent or objective of internal controls relating to “effectiveness and efficiency of
operations” involve operational issues such minimizing waste on a production line. An example
of the final category of internal controls would be ensuring compliance with the Americans with
Disabilities Act (ADA).
2. This is a question that has diametrically opposed answers, each of which could be supported
with at least somewhat reasonable arguments. In its November 28, 2016, letter to the four U.S.
senators, KPMG defended its position that the improper sales practices “did not involve key
controls over financial reporting” by arguing that (1) those activities had no significant impact on
the company’s financial statements and (2) none of the individuals involved in the improper sales
practices “worked in financial reporting or had the ability to influence the financial reporting
process.”
There is certainly a basis for countering KPMG’s argument. AS 2201.21 requires auditors
to use a “top-down approach” in auditing a client’s ICFR: “A top-down approach begins at the
financial statement level and with the auditor’s understanding of the overall risks to internal control
over financial reporting. The auditor then focuses on entity-wide controls and works down to
significant accounts and disclosures . . .” (Note the reference to “disclosures.” One could certainly
argue that Wells Fargo’s internal sales “fraud” was a significant disclosure item for users of the
company’s financial statements.)
AS 2201.23 and 24 identify a variety of entity-wide controls “that are important to the
auditor’s conclusion about whether the company has effective internal control over financial
reporting” [paragraph 23]. One group of such controls are “controls related to the control
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 5
environment” [paragraph 24]. Following is the complete text of AS 2201.25:
“Control environment. Because of its importance to effective internal control over
financial reporting, the auditor must evaluate the control environment at the company. As
part of evaluating the control environment, the auditor should assess—
Whether management’s philosophy and operating style promote effective internal
control over financial reporting;
Whether sound integrity and ethical values, particularly of top management, are
developed and understood; and
Whether the Board or audit committee understands and exercises oversight
responsibility over financial reporting and internal control.
Given paragraph 25, a client’s overall control environment is linked directly to the entity’s
ICFR. Now, recognize that the results of the study by Wells Fargo’s independent board members
indicted or criticized the company’s control environment. That is, the overly “decentralized”
nature of the company’s organizational structure was a direct consequence of a control
environment that one could argue was inadequate, at a minimum. So, in summary, the improper
sales practices were a consequence of the decentralized organizational structure which, in turn,
was a consequence of the company’s poor control environment. Bottom line, one could certainly
make an argument that Wells Fargo’s weak control environment was an issue that should have
been considered in KPMG’s audit
of the company’s ICFR because a company’s control environment has a major impact on the
reliability or effectiveness of its ICFR.
3. Here is the definition of “material weakness” in internal control that is included in the AICPA’s
professional auditing standards: “Material weakness. A deficiency, or a combination of
deficiencies, in internal control such that there is a reasonable possibility that a material
misstatement of the entity’s financial statements will not be prevented, or detected and corrected,
on a timely basis.” AU-C 265.07
AS 2201.98.A7 provides the following definition or description of a material weakness in
ICFR. “A material weakness is a deficiency, or a combination of deficiencies, in internal control
over financial reporting, such that there is a reasonable possibility that a material misstatement
of the company’s annual or interim financial statements will not be prevented or detected on a
timely basis.” AS 2201, paragraph 62 notes that “The auditor must evaluate the severity of each
control deficiency that comes to his or her attention to determine whether the deficiencies,
individually or in combination, are material weaknesses as of the date of management’s
assessment.” The next several paragraphs then discuss factors that auditors should consider in
making that determination. Those factors include, among many others, “the nature of the financial
statement accounts, disclosures, and assertions involved;” “the susceptibility of the related asset
or liability to loss or fraud;” and the “possible future consequences of the deficiency.” [Note: the
last item was particularly relevant to the Wells Fargo situation.]
Auditors of public companies have struggled to apply the materiality concept in a new
context, namely, in determining whether or not ICFR deficiencies rise to the level of “material.”
This point was addressed several years ago in a speech made by a PCAOB board member.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 6
“For ICFR purposes, the meanings of ‘reasonably possible’ and ‘material’ rely upon
established definitions of these same terms that exist with respect to accounting. However,
experience gathered during the first year of implementing Section 404 and AS No. 2
demonstrate that auditors and companies both had a difficult time applying these terms in
this new context. Like the generally accepted accounting principles (GAAP) that govern
the preparation of financial statements, there are no clear bright-line tests based solely on
quantitative measures; qualitative measures must also be considered, and professional
judgment is required.” – emphasis added [K. Gillan, “A Layperson’s Guide to Internal
Control Over Financial Reporting (ICFR),” pcaobus.org/News/Speech/Pages/03312006_
GillanCouncilInstitutionalInvestors.aspx, 31 March 2006.
Notice the emphasized text in this quote. In my view, given the nature of ICFR evaluations,
one could reasonably argue that, in fact, qualitative considerations may be more important in this
context than quantitative considerations. No doubt, applying qualitative benchmarks or criteria
are more challenging than applying quantitative guidelines . . . meaning that assessing ICFR
deficiencies can be particularly “messy.”
4. Notes: This question is closely linked to the two preceding ones. In addition, recognize
that there is not a definitive answer to this question. So, instead of assessing the accuracy of a
student’s answer, I instead evaluate the rigor of the supporting argument for it.
At some point in addressing this question, consider taking a poll of your students to
determine whether they believe the decentralized corporate structure of Wells Fargo qualified as
a material weakness in ICFR—my students typically vote overwhelmingly that it did. A common
justification for a “yes” vote is the fact that the quality of a company’s overarching control
environment—including how authority is delegated within the organization—has an enormous
impact on all dimensions of an organization, particularly its accounting and financial reporting
functions. Many of my students point to the metrics identified in Exhibit 3 by the senators to
demonstrate how pervasive an impact Wells Fargo’s overall poor control environment—including
its decentralized management structure—ultimately had on the company.
5. AS 2405, “Illegal Acts by Clients” defines the responsibilities of auditors vis-à-vis illegal
acts committed by a public company client. As a sidebar, AS 2405.03 notes that “Whether an act
is, in fact, illegal is a determination that is normally beyond the auditor’s professional
competence.” Because of this reality, the paragraph goes on to note that auditors may ultimately
have to rely on the “advice of an informed expert” before deciding whether a particular act is
illegal.
The degree of responsibility that an audit firm assumes for detecting illegal acts by a public
company client depends upon the nature of those acts as discussed by AS 2405. That section of
the PCAOB’s auditing standards distinguishes between an audit firm’s responsibility to detect
illegal acts that have a "direct and material" effect on a client's financial statements and illegal acts
that have a "material indirect" effect on a client's financial statements.
AS 2405.05 notes that an auditor’s responsibility to detect and report “misstatements
resulting from illegal acts having a direct and material effect on the determination of financial
statement amounts is the same as that for misstatements caused by error or fraud as described in
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 7
AS 1001, Responsibilities and Functions of the Independent Auditor.” In turn, AS Section 1001.02
notes that an auditor “has a responsibility to plan and perform the audit to obtain reasonable
assurance about whether the financial statements are free of material misstatement, whether caused
by error or fraud.”
Auditors generally have much less responsibility to detect illegal acts that have a material
indirect effect on a client’s financial statements. AS 2405.06 observes that an auditor “ordinarily
does not have sufficient basis for recognizing” such violations by clients. AS 2405.07 adds: “If
specific information comes to the auditor’s attention that provides evidence concerning the
existence of possible illegal acts that could have a material indirect effect on the financial
statements, the auditor should apply audit procedures specifically directed to ascertaining whether
an illegal act has occurred.”
When a public company auditor discovers an apparent illegal act that may have a material
indirect impact on the client’s financial statements, one of his or her first responsibilities is to
evaluate the materiality of that item. “In evaluating the materiality of an illegal act [having a
potential material indirect effect on a client’s financial statements] that has come to his attention,
the auditor should consider both the quantitative and qualitative materiality of the act. For
example, an illegal payment of an otherwise immaterial amount could be material if there is a
reasonable possibility that it could lead to a material contingent liability or a material loss of
revenue” [AS 2405.13]. Auditors also have a responsibility to assess the “adequacy of disclosure”
of illegal acts that apparently have a material indirect impact on a public company’s financial
statements. “The auditor should evaluate the adequacy of disclosure in the financial statements of
the potential effects of an illegal act on the entity’s operations. If material revenue or earnings are
derived from transactions involving illegal acts, or if illegal acts create unusual risks associated
with material revenue or earnings, such as the loss of a significant business relationship, that
information should be considered for disclosure” [AS 2405.15]. AS 2405.16 also notes that
auditors “should consider the implication of an illegal act [having a potential material indirect
effect on the client’s financial statements] in relation to other aspects of the audit . . .”
In terms of communication, AS 2405.17 notes that “the auditor should assure himself that
the audit committee is adequately informed as soon as practicable” about an illegal act having a
material indirect impact on the financial statements. Paragraphs 18-21 of AS 2405 discuss the
impact of a “material indirect” illegal act on an auditor’s report. Paragraph 18 notes that such an
act that “has not been properly accounted for or disclosed” may require the auditor to issue a
qualified or an adverse opinion.
6. The key issue in this context is the trade-off between the level of knowledge that an auditor
accrues as its tenure with a public company client lengthens versus the corresponding increase in
the risk that an auditor may become too “cozy” with the client as the relationship “ages.” The
existence of a learning curve effect in auditing a client and its ICFR is widely accepted, which
means that the periodic rotation of public company auditors would have some clear-cut negative
impact on the quality of those services. However, periodically rotating public company auditors
would have a countervailing positive impact (at least theoretically) because the de facto
independence of auditors under a rotation policy regime should be enhanced, that is, auditors who
are aware that a client relationship is finite should be less inclined to curry favor with their clients
by downplaying “problem” circumstances that they discover.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 8
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
Edition by Michael C. Knapp
Notes
1- All Chapters are step by step.
2- We have shown you 10 pages.
3- The file contains all Appendix and Excel
sheet if it exists.
4- We have all what you need, we make
update at every time. There are many
new editions waiting you.
5- If you think you purchased the wrong file
You can contact us at every time, we can
replace it with true one.
Our email:
, Case 1.1 Wells Fargo & Company 1
CASE 1.1
WELLS FARGO & COMPANY
Synopsis
Wells Fargo & Company got its start in 1852 in the midst of the California Gold Rush. The
company’s two founders raised the capital to finance a new company to be based in the Wild West
boomtown of San Francisco after realizing that the Bay Area provided a wealth of business
opportunities for investors willing to accept a high risk of failure. The company’s founders decided
that transportation and banking services were desperately needed in San Francisco so they decided
that Wells Fargo would pursue those two unrelated lines of business. The company initially made
a “name” for itself by providing rapid and reliable freight, courier, and mail delivery services. But,
when the federal government nationalized major freight and transportation lines during World
War I, Wells Fargo’s management shifted its focus almost exclusively to the banking industry.
Throughout much, if not most, of Wells Fargo’s history successive generations of senior
executives have embraced the high-risk, “Wild West” mindset around which the company was
created. That mindset or company culture triggered a massive, high-profile scandal that surfaced
in September 2016 when a federal agency announced that Wells Fargo had been fined nearly $200
million for engaging in improper sales practices on an enormous scale.
Critics of Wells Fargo eventually turned their attention to the company’s longtime audit
firm, KPMG. Several U.S. senators, in particular, harshly criticized the prominent audit firm. The
senators demanded that KPMG explain how it could issue a “clean” opinion each year on Wells
Fargo’s internal control over financial reporting (ICFR) while the company was involved in the
massive fraud involving improper sales practices.
Central to this case are three lengthy letters that are included as exhibits. Exhibit 1 presents
a letter sent by four U.S. senators to KPMG in which the senators demand that the audit firm
respond to a series of questions including whether the Wells Fargo auditors were aware of the
improper sales practices being applied by their client. The senators also demanded to know
whether KPMG continued to stand by its opinions that Wells Fargo had maintained “effective
internal control over financial reporting” during the timeframe that the sales fraud was ongoing.
KPMG’s letter in response to the senators is contained in Exhibit 2—in the letter KPMG indicated
that it did, in fact, still stand by its earlier opinions that Wells Fargo had maintained effective ICFR.
Finally, Exhibit 3 presents a letter that the senators sent to the PCAOB—the senators had been
troubled by much of the information conveyed to them by the KPMG letter shown in Exhibit 2.
In this final letter, the senators suggested that the PCAOB review KPMG’s audits of Wells Fargo’s
ICFR and that the agency review its “rules and guidance” relevant to public company auditors’
consideration of ICFR weaknesses and illegal acts perpetrated by their clients.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 2
Wells Fargo & Company--Key Facts
1. In 1852, Henry Wells and William Fargo organized Wells Fargo & Company because they
were convinced that the California Gold Rush provided a wealth of business opportunities in the
San Francisco Bay Area.
2. Banking and transportation services were the two lines of business Wells Fargo’s founders
decided their new company would pursue.
3. After the federal government nationalized major freight and transportation lines during
World War I, Wells Fargo’s executives focused the company’s operations almost exclusively on
the banking industry.
4. Beginning in the early twentieth century, successive generations of Wells Fargo senior
executives relied on a relentless acquisition strategy and aggressive marketing initiatives to expand
the company’s banking operations.
5. By 2015, Wells Fargo was the largest global bank in terms of collective market value; at
the time, the company operated nearly 9,000 retail branches in 35 countries and had over 70 million
customers.
6. In addition to its impressive size, Wells Fargo consistently ranked among the most
respected multinational companies in annual surveys by Barron’s.
7. In September 2016, the Consumer Financial Protection Bureau (CFPB) announced that
Wells Fargo had been fined $185 million for improper sales practices between 2011 and 2016;
those illegal activities had resulted in the creation of millions of unauthorized customer accounts.
8. In response to the widely-publicized scandal, Wells Fargo’s executives typically attributed
the illegal practices to self-interested lower-level employees.
9. KPMG, Wells Fargo’s longtime audit firm, issued “clean” opinions on the company’s
internal control over financial reporting (ICFR) throughout the time frame in which the illegal
sales practices were being applied.
10. In a letter sent to KPMG in late 2016, four U.S. senators posed a series of questions to the
firm, including whether the Wells Fargo auditors had been aware of the illegal sales practices and
whether the firm continued to stand by its prior opinions that the company had maintained effective
ICFR.
11. KPMG responded to the senators by indicating that the Wells Fargo auditors had been
aware of the illegal sales activities but had concluded that they did not involve the company’s
ICFR and did not have a significant impact on the company’s financial statements.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 3
12. After receiving the letter from KPMG, two of the senators wrote the PCAOB and asked
the agency to review KPMG’s audits of Wells Fargo’s ICFR and its “rules and guidance” relevant
to auditors’ consideration of ICFR weaknesses and illegal acts perpetrated by their clients.
Instructional Objectives
1. To identify the different types or classes of internal controls.
2. To identify the nature and scope of internal controls over financial reporting (ICFR).
3. To define a “material weakness in internal control” and to identify the factors auditors should
consider when determining whether a deficiency in internal control qualifies as a material
weakness.
4. To define a “material weakness in ICFR” and to identify the factors auditors should consider
when determining whether a deficiency in ICFR qualifies as a material weakness in ICFR.
5. To examine the responsibility of public company auditors to search for illegal acts committed
by their clients.
6. To identify public company auditors’ responsibilities after determining that a client has engaged
in an illegal act.
7. To consider how the length of an audit firm’s tenure with a public company client may impact
its ICFR assessment for that client.
Suggestions for Use
Consider launching this case by requiring your students to either individually or in groups
research and report on a recent ICFR material weakness reported by a public company. If you
want to ensure that each individual or group reports on a unique material weakness, then use a
Google search to identify a sample of material weaknesses to be used for this exercise. After the
students have made these presentations, ask them to compare and contrast the material weaknesses
they researched with the internal control deficiencies that were evident within Wells Fargo. After
completing this exercise, students will be better equipped to provide an informed opinion on
whether KPMG should have reported an ICFR material weakness for Wells Fargo.
Suggested Solutions to Case Questions
1. Internal controls can be categorized several different ways. For example, we could classify
internal controls by transactions cycles, by cost, or by complexity. The key scheme that the
accounting profession has historically used to categorize internal controls is by their overarching
objective. According to the COSO’s internal control framework, an entity’s internal control
process is designed to achieve three broad classes of objectives. Those classes of objectives
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 4
include “reliability of financial reporting,” “effectiveness and efficiency of operations,” and
“compliance with applicable laws and regulations.”
Obviously, the key distinction between internal controls over financial reporting (ICFR)
and the other two types or classes of internal controls is the underlying intent or purpose of ICFR.
The PCAOB notes that ICFR are intended to “provide reasonable assurance regarding the
reliability of financial reporting and the preparation of financial statements for external purposes
in accordance
with GAAP” [AS 2201.A5]. In this same context, the PCAOB auditing standards note that ICFR
include those “policies and procedures that—
(1) Pertain to the maintenance of records that, in reasonable detail, accurately and
fairly
reflect the transactions and dispositions of the assets of the company;
(2) Provide reasonable assurance that transactions are recorded as necessary to permit
preparation of financial statements in accordance with generally accepted
accounting principles, and that receipts and expenditures of the company are being
made only in accordance with authorizations of management and directors of the
company; and
(3) Provide reasonable assurance regarding prevention or timely detection of
unauthorized acquisition, use, or disposition of the company’s assets that could
have a material effect on the financial statements.” [AS 2201.A5]
The other two classes of internal controls address differing control objectives. For
example, the intent or objective of internal controls relating to “effectiveness and efficiency of
operations” involve operational issues such minimizing waste on a production line. An example
of the final category of internal controls would be ensuring compliance with the Americans with
Disabilities Act (ADA).
2. This is a question that has diametrically opposed answers, each of which could be supported
with at least somewhat reasonable arguments. In its November 28, 2016, letter to the four U.S.
senators, KPMG defended its position that the improper sales practices “did not involve key
controls over financial reporting” by arguing that (1) those activities had no significant impact on
the company’s financial statements and (2) none of the individuals involved in the improper sales
practices “worked in financial reporting or had the ability to influence the financial reporting
process.”
There is certainly a basis for countering KPMG’s argument. AS 2201.21 requires auditors
to use a “top-down approach” in auditing a client’s ICFR: “A top-down approach begins at the
financial statement level and with the auditor’s understanding of the overall risks to internal control
over financial reporting. The auditor then focuses on entity-wide controls and works down to
significant accounts and disclosures . . .” (Note the reference to “disclosures.” One could certainly
argue that Wells Fargo’s internal sales “fraud” was a significant disclosure item for users of the
company’s financial statements.)
AS 2201.23 and 24 identify a variety of entity-wide controls “that are important to the
auditor’s conclusion about whether the company has effective internal control over financial
reporting” [paragraph 23]. One group of such controls are “controls related to the control
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 5
environment” [paragraph 24]. Following is the complete text of AS 2201.25:
“Control environment. Because of its importance to effective internal control over
financial reporting, the auditor must evaluate the control environment at the company. As
part of evaluating the control environment, the auditor should assess—
Whether management’s philosophy and operating style promote effective internal
control over financial reporting;
Whether sound integrity and ethical values, particularly of top management, are
developed and understood; and
Whether the Board or audit committee understands and exercises oversight
responsibility over financial reporting and internal control.
Given paragraph 25, a client’s overall control environment is linked directly to the entity’s
ICFR. Now, recognize that the results of the study by Wells Fargo’s independent board members
indicted or criticized the company’s control environment. That is, the overly “decentralized”
nature of the company’s organizational structure was a direct consequence of a control
environment that one could argue was inadequate, at a minimum. So, in summary, the improper
sales practices were a consequence of the decentralized organizational structure which, in turn,
was a consequence of the company’s poor control environment. Bottom line, one could certainly
make an argument that Wells Fargo’s weak control environment was an issue that should have
been considered in KPMG’s audit
of the company’s ICFR because a company’s control environment has a major impact on the
reliability or effectiveness of its ICFR.
3. Here is the definition of “material weakness” in internal control that is included in the AICPA’s
professional auditing standards: “Material weakness. A deficiency, or a combination of
deficiencies, in internal control such that there is a reasonable possibility that a material
misstatement of the entity’s financial statements will not be prevented, or detected and corrected,
on a timely basis.” AU-C 265.07
AS 2201.98.A7 provides the following definition or description of a material weakness in
ICFR. “A material weakness is a deficiency, or a combination of deficiencies, in internal control
over financial reporting, such that there is a reasonable possibility that a material misstatement
of the company’s annual or interim financial statements will not be prevented or detected on a
timely basis.” AS 2201, paragraph 62 notes that “The auditor must evaluate the severity of each
control deficiency that comes to his or her attention to determine whether the deficiencies,
individually or in combination, are material weaknesses as of the date of management’s
assessment.” The next several paragraphs then discuss factors that auditors should consider in
making that determination. Those factors include, among many others, “the nature of the financial
statement accounts, disclosures, and assertions involved;” “the susceptibility of the related asset
or liability to loss or fraud;” and the “possible future consequences of the deficiency.” [Note: the
last item was particularly relevant to the Wells Fargo situation.]
Auditors of public companies have struggled to apply the materiality concept in a new
context, namely, in determining whether or not ICFR deficiencies rise to the level of “material.”
This point was addressed several years ago in a speech made by a PCAOB board member.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 6
“For ICFR purposes, the meanings of ‘reasonably possible’ and ‘material’ rely upon
established definitions of these same terms that exist with respect to accounting. However,
experience gathered during the first year of implementing Section 404 and AS No. 2
demonstrate that auditors and companies both had a difficult time applying these terms in
this new context. Like the generally accepted accounting principles (GAAP) that govern
the preparation of financial statements, there are no clear bright-line tests based solely on
quantitative measures; qualitative measures must also be considered, and professional
judgment is required.” – emphasis added [K. Gillan, “A Layperson’s Guide to Internal
Control Over Financial Reporting (ICFR),” pcaobus.org/News/Speech/Pages/03312006_
GillanCouncilInstitutionalInvestors.aspx, 31 March 2006.
Notice the emphasized text in this quote. In my view, given the nature of ICFR evaluations,
one could reasonably argue that, in fact, qualitative considerations may be more important in this
context than quantitative considerations. No doubt, applying qualitative benchmarks or criteria
are more challenging than applying quantitative guidelines . . . meaning that assessing ICFR
deficiencies can be particularly “messy.”
4. Notes: This question is closely linked to the two preceding ones. In addition, recognize
that there is not a definitive answer to this question. So, instead of assessing the accuracy of a
student’s answer, I instead evaluate the rigor of the supporting argument for it.
At some point in addressing this question, consider taking a poll of your students to
determine whether they believe the decentralized corporate structure of Wells Fargo qualified as
a material weakness in ICFR—my students typically vote overwhelmingly that it did. A common
justification for a “yes” vote is the fact that the quality of a company’s overarching control
environment—including how authority is delegated within the organization—has an enormous
impact on all dimensions of an organization, particularly its accounting and financial reporting
functions. Many of my students point to the metrics identified in Exhibit 3 by the senators to
demonstrate how pervasive an impact Wells Fargo’s overall poor control environment—including
its decentralized management structure—ultimately had on the company.
5. AS 2405, “Illegal Acts by Clients” defines the responsibilities of auditors vis-à-vis illegal
acts committed by a public company client. As a sidebar, AS 2405.03 notes that “Whether an act
is, in fact, illegal is a determination that is normally beyond the auditor’s professional
competence.” Because of this reality, the paragraph goes on to note that auditors may ultimately
have to rely on the “advice of an informed expert” before deciding whether a particular act is
illegal.
The degree of responsibility that an audit firm assumes for detecting illegal acts by a public
company client depends upon the nature of those acts as discussed by AS 2405. That section of
the PCAOB’s auditing standards distinguishes between an audit firm’s responsibility to detect
illegal acts that have a "direct and material" effect on a client's financial statements and illegal acts
that have a "material indirect" effect on a client's financial statements.
AS 2405.05 notes that an auditor’s responsibility to detect and report “misstatements
resulting from illegal acts having a direct and material effect on the determination of financial
statement amounts is the same as that for misstatements caused by error or fraud as described in
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 7
AS 1001, Responsibilities and Functions of the Independent Auditor.” In turn, AS Section 1001.02
notes that an auditor “has a responsibility to plan and perform the audit to obtain reasonable
assurance about whether the financial statements are free of material misstatement, whether caused
by error or fraud.”
Auditors generally have much less responsibility to detect illegal acts that have a material
indirect effect on a client’s financial statements. AS 2405.06 observes that an auditor “ordinarily
does not have sufficient basis for recognizing” such violations by clients. AS 2405.07 adds: “If
specific information comes to the auditor’s attention that provides evidence concerning the
existence of possible illegal acts that could have a material indirect effect on the financial
statements, the auditor should apply audit procedures specifically directed to ascertaining whether
an illegal act has occurred.”
When a public company auditor discovers an apparent illegal act that may have a material
indirect impact on the client’s financial statements, one of his or her first responsibilities is to
evaluate the materiality of that item. “In evaluating the materiality of an illegal act [having a
potential material indirect effect on a client’s financial statements] that has come to his attention,
the auditor should consider both the quantitative and qualitative materiality of the act. For
example, an illegal payment of an otherwise immaterial amount could be material if there is a
reasonable possibility that it could lead to a material contingent liability or a material loss of
revenue” [AS 2405.13]. Auditors also have a responsibility to assess the “adequacy of disclosure”
of illegal acts that apparently have a material indirect impact on a public company’s financial
statements. “The auditor should evaluate the adequacy of disclosure in the financial statements of
the potential effects of an illegal act on the entity’s operations. If material revenue or earnings are
derived from transactions involving illegal acts, or if illegal acts create unusual risks associated
with material revenue or earnings, such as the loss of a significant business relationship, that
information should be considered for disclosure” [AS 2405.15]. AS 2405.16 also notes that
auditors “should consider the implication of an illegal act [having a potential material indirect
effect on the client’s financial statements] in relation to other aspects of the audit . . .”
In terms of communication, AS 2405.17 notes that “the auditor should assure himself that
the audit committee is adequately informed as soon as practicable” about an illegal act having a
material indirect impact on the financial statements. Paragraphs 18-21 of AS 2405 discuss the
impact of a “material indirect” illegal act on an auditor’s report. Paragraph 18 notes that such an
act that “has not been properly accounted for or disclosed” may require the auditor to issue a
qualified or an adverse opinion.
6. The key issue in this context is the trade-off between the level of knowledge that an auditor
accrues as its tenure with a public company client lengthens versus the corresponding increase in
the risk that an auditor may become too “cozy” with the client as the relationship “ages.” The
existence of a learning curve effect in auditing a client and its ICFR is widely accepted, which
means that the periodic rotation of public company auditors would have some clear-cut negative
impact on the quality of those services. However, periodically rotating public company auditors
would have a countervailing positive impact (at least theoretically) because the de facto
independence of auditors under a rotation policy regime should be enhanced, that is, auditors who
are aware that a client relationship is finite should be less inclined to curry favor with their clients
by downplaying “problem” circumstances that they discover.
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
, Case 1.1 Wells Fargo & Company 8
© 2022 Cengage Learning. All Rights Reserved. May not be scanned, copied or duplicated, or
posted to a publicly accessible website, in whole or in part.
