Scribd
Upload
12 views5 pages

CE 3- Revision question (Sthabile)

This document is a revision pack for the CE 3 Test scheduled for May 17, 2025, emphasizing the importance of independent study and utilization of various resources. It provides background information on BetaChem Limited, an audit client, detailing its management structure, operations, and recent cybersecurity issues. The document outlines the scope of the audit and includes specific questions related to risks of material misstatement, application controls, and general controls for virus protection.

Uploaded by

Sumeshan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
12 views5 pages

CE 3- Revision question (Sthabile)

This document is a revision pack for the CE 3 Test scheduled for May 17, 2025, emphasizing the importance of independent study and utilization of various resources. It provides background information on BetaChem Limited, an audit client, detailing its management structure, operations, and recent cybersecurity issues. The document outlines the scope of the audit and includes specific questions related to risks of material misstatement, application controls, and general controls for virus protection.

Uploaded by

Sumeshan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

Dear Student.

In preparation for the CE 3 Test being written on 17 May 2025, please read through the
questions in this document and attempt them under exam conditions. The purpose of
this revision pack is to supplement your knowledge; make sure you use other resources
like your textbooks, your slides, your concept videos, independent study tasks, and the
ability to ask should you be confused.

While we are here to support you through your postgraduate journey, please ensure that
you complete the required independent study tasks and work through all material after
class. As the lecture content is uploaded before class, please ensure that you go through
the additional information and resources before class.

We have also provided you with CE 3 for 2024 and 2025. Please make sure you also go
through this.

Do consult if there are any issues with your understanding of the content.

CE 3 Scope: Learning Units 5 to 7.1.

This will include:

• Risks of material misstatement at the financial statement and assertion levels.


• General controls
• Application controls
• Cycles (covered to date)

To remove ANY ambiguity, Tests of Controls and Computer-Assisted Auditing Techniques


(CAATs) will NOT be in the scope of CE 3.

Study hard �.

Kindest regards,

Sthabile Mbonambi CA(SA)

Head of Programme: AUDI8419


QUESTION 1 60 MARKS

1. BACKGROUND
You are an audit manager at Able Auditors Incorporated (AA), a medium sized audit firm,
based in KZN with offices in Durban and Pietermaritzburg. AA has recently been
appointed as auditors of BetaChem Limited (BetaChem) with you being assigned on the
31 March 2022 (FY2022) audit. The audit deadline has been set for 29 April 2022 as the
CEO will be leaving for Massachusetts, USA on 1 May to complete his MBA at the
prestigious Harvard School of Business.

1.1 Company background


BetaChem was listed on the JSE Limited in the Food and Drug Retail sector in February
2018. The primary purpose of the listing was to raise the public profile of BetaChem and
to provide easy access to capital. The company was founded in 2008 by Sam Davidson,
an entrepreneurial pharmacist who remains actively involved in the business as
executive chairman. The group expanded from a single pharmacy located in Durban to a
nationwide chain of 66 stores.

The head office in Umhlanga, Durban was expanded to include a massive distribution
centre (DC) responsible for distributing stock to all stores around the country. All stores
are linked to BetaChem’s central server in the head office in Durban via a wide area
network (WAN) using dedicated lines. The company’s operations are divided into various
departments, viz., personal care, cosmetics and fragrances, baby products, drugs and
supplements and pharmacy. Each of these departments is supervised by a Department
Manager who reports directly to the Financial Manager, Ms Grace Moloi.

BetaChem differentiates itself in the market by selling products at lower prices than
competitors at its large-format store layouts. The average size of BetaChem stores is
currently 1,500 m², which is three times larger than the average size of major competitors’
stores. The number of stores has doubled in the past year to 66.

1.2 Management and Governance

The company has a strong visionary management team led by Andy Ncube, who has been
CEO since 2015. Andy’s daughter (Akona) is an industrial psychologist and was recently
appointed as the group's Chief Financial Officer (CFO). In addition to Andy and Akona,
the board of directors has an executive chairman and two independent directors. The
company also has an audit and risk committee and a remuneration committee.

Andy Ncube has a very hands-on approach to management, and managers take their
instructions directly from him. The Chief Audit Executive, Steve Pillay, is Andy’s wife’s ex-
husband, and due to their tensions, they interact only at the quarterly audit and risk
committee meetings.
Management is dedicated to the company's growth and development and has a positive
attitude toward a sound control environment. Bonuses for executive directors and senior
management are based on performance and profitability.

2. CURRENT YEAR AUDIT (FY2022)


You are provided with the following documents relevant to the FY2022 audit:

Description Reference

Systems Description - Wages at distribution centre SW002

Client: BetaChem Ltd Year-end: 31/03/2022


Prepared by: J Edwards Date: 12/04/2022
SW002
Reviewed by: Date:
Subject: Systems Description - Wages at distribution centre
The company makes use of an automatic payroll application program, Sage-Pay, to
account for all their salaries and wages. The company employs 7 000 full time
employees consisting of wage and salaried workers and has one centralised human
resources department (HR department) at the head office in Durban. Employees at the
distribution centre (DC) in Durban are paid an hourly wage rate whilst all other
employees earn a fixed monthly salary. Only the HR department can employ, transfer,
or dismiss employees and update these activities on the Sage-Pay system. If the
distribution centre needs to have an amendment made to details relating to wage
employees, the relevant supporting documentation needs to be e-mailed to Ms
Annette Vermeulen, the HR Manager, who will only affect the amendment if all
supporting documentation (for example, payroll amendment form, increase letter or
promotion letter) is correct and complete.

When workers are employed for the first time they register all 10 fingerprints on the
Sage-Pay system. This will enable them to gain entrance to the DC by placing any one
of their fingers on the biometric scanners at the entrance. The gate will only open if the
employee’s fingerprints are registered on the Sage-Pay system. Visitors (service
providers, suppliers etc) can only enter the DC after going through strict security
procedures by providing their ID or driver’s license, stating who they are visiting and
the purpose of their visit. When a visitor exits, the vehicle is searched to ensure that no
unauthorised objects are taken from the premises.

The entrance point of the DC is situated next to the vehicle access point, which is under
24-hour security supervision. The DC has one entrance and exit point available.

The Sage-Pay system keeps record of every time an employee registers his\her
fingerprint on the biometric scanner and uses this information together with the
Masterfile to calculate the number of hours worked and the amount payable to every
employee. If changes to the “hours worked” need to be made, the department
manager will make these changes on an “hours amendment form” and send it through
to Ms Vermeulen at the HR department.
The employees are paid bi-weekly (end of every second week) via electronic fund
transfers.

APPENDIX A:

EXTRACT FROM THE MINUTES OF A SPECIAL MEETING OF THE DIRECTORS OF


BETACHEM LTD, HELD AT UMHLANGA, DURBAN ON 25 JANUARY 2022

Special matters discussed:

Feedback of a virus attack from the Chief Audit Executive:

On Friday afternoon, 21 January 2022, at 16:45, our computer systems were attacked
(like many other companies) by the well-known “CyberArk” ransomware virus. One of
our accounting clerks opened a zip file received via email that indicated an invoice was
attached, requiring immediate payment. When he opened it, it was unreadable. The
clerk was then prompted to click on a button, which activated the virus.

Once the virus had been launched onto the computer system, it logged into the
memory of the accounting clerk’s computer and encrypted all data as hash.cyberark
files, installed .bmp and .txt files, and encrypted network files that the accounting clerk
had access to. All data was subsequently lost as it was not accessible without the
decryption key for the hash.cyberark files. The decryption key is only available if a
ransom of a few thousand dollars is paid through the internet to the hackers.

Luckily, our computer systems were backed up at 16:00 on the said Friday afternoon
and we were able to wipe all computers linked to the network and restore all data and
“went live” again on Monday morning at 06:00 as if the attack never happened. Some
personal computers (which were switched on at the time of the invasion of the virus)
had to be destroyed as part of this process.
QUESTION 1 – PART I – PLEASE ANSWER IN GREEN BOOK Mark
Sub- Total
total
(a) Based on the information provided under the heading 14
“Background”, identify and explain the risks of material
misstatement at the overall financial statement level for the 15
2022 financial year.
Communication skills: structure and layout 1

(b) With reference to working paper SW002:

Describe the application controls that should be present in the 16


system to ensure the validity, accuracy, and completeness of 16
hours worked.
(c) With reference to feedback received from the Chief Audit
Executive on the CyberArk virus attack as documented in
Appendix A: 8

Discuss the general controls that should be put in place with


regard to virus protection to ensure that such a virus attack
does not occur again. 9
1
Communication skills - clarity of expression
TOTAL FOR QUESTION 1 - PART I 40

You might also like