To: Pat Johnson From: PWC Date: March 12, 2003 Subject: Assessment of Exton Industries, Inc. Dear Ms. Johnson: I have recently reviewed the Control Environment Questionnaire for Exton Industries, Inc. After evaluating the evidence collected by our staff member, I have come up with an assessment of the fraud risks. From the evidence gathered, I have concluded that Exton Industries has a weak control environment. Overall, it will not do an effective job of preventing fraudulent activities.

While evaluating Exton Industries, I had to consider how the control environment would prevent misstatements arising from misappropriation of assets and fraudulent financial reporting. The controller, CFO, and CEO review all financial reports before releasing them. Another area to consider was the assignment of authority and responsibility. Because three different people review the financial reports, it's easier to identify any mistakes that may have been made which in turn reduces the chances of misappropriation in fraudulent reporting. Through conversation with employees it was noted that proper responsibility and delegation of authority were assigned and the proper information appeared to be considered in developing responsibilities.

Written job descriptions and standards also exist. Since proper responsibility and delegation of authority and written job descriptions and standards exist the, the chances of fraudulent activities are reduced. Other issues to consider were management's commitment to competence and human resource policies and procedures. During the hiring process, management makes sure the potential employee possesses the proper knowledge and skills to carry out the job adequately. Upon hiring, the new employee is made aware of his or her responsibilities and management's expectations of them. In addition supervisors conduct annual reviews.

The company's previous success also shows that employees have the required skills and knowledge. Discussions with employees indicated that they are made aware of the consequences if they perform ineffectively and / or do not fulfill their responsibilities. Exton Industries has effective controls in their commitment to competence and human resource department's hiring and review process. Overall, the control environment of the board of directors and audit committee will prevent misstatements arising from misappropriation of assets and fraudulent financial reporting. The boards consists of both outside and inside members, who are sufficient in subject matter, have the knowledge, industry experience and time to serve on the board and they receive monthly financial statements.

The audit committee privately discusses relevant issues with external auditors and conducts annual reviews of audit functions and activities. However, there were three issues that could lead to misstatements arising from fraudulent financial reporting or misappropriation of assets. The first issue is the fact that the board is supposed to address management's adherence to the code of conduct and it was noted that a code exists but the board does not take specific actions related to adherence. The second and third issues are that the board is supposed to issue directives to management detailing specific actions to be taken and oversee and follow up as needed.

It was noted that neither one of these practices were observed. From the evidence gathered, it seems as though Exton Industries' control environments for their organizational structure, integrity and ethical values and management's philosophy and operating style are weak and may not prevent fraudulent activities. The new management team encourages managers to cut through red tape whenever possible, employees stated that in prior years communications channels were observed whereas now, they are more formal and less candid and the new management team has not completed their planned assessment of the organizational structure. A manager being allowed to cut through red tape seems to encourage fraudulent behavior. If open communications channels were in place and management completed their assessment of the organizational structure, this would help the company to have maximum output.

The new management team is putting a greater emphasis on short-term performance and basing employees' bonuses on that. While it may be nice for employees to receive bonuses more often, many have said that management's short-term expectations increased significantly and are difficult to meet. Management override is not prohibited. It can occur without approval and no interventions by management were observed which could mean they took place and were not documented. Management believes temptations to engage in fraudulent activity are minimal and do not have controls in place to reduce temptations. Both of these could present major problems.

First of all, different members of management could be conspiring and overriding things, committing intentional fraud in order to make the company look better. Secondly, since management believes temptations to commit fraud are minimal, misstatements arising from fraudulent financial reporting for misappropriation of assets could be taking place and no controls are in place to stop them. The new management team has taken on an aggressive approach to accounting and assumed more risks. There has been excessive turnover at all levels of the management structure and over the past year several employees have left on short notice and there has been difficulty in retaining key personnel. The new management team is probably worried about getting profits up and by using an aggressive approach there may be more errors because financial statements may not checked as thoroughly. The cause of the high turnover rate should be investigated, employees may be leaving because others are committing fraudulent behavior and they do not want to get involved.

Management may be encouraging this or may not see it because they are too worried about making the company look profitable. Lastly, there were failures to protect valuable assets, which could lead to misappropriation of assets. In conclusion, I found that Exton Industries has some internal controls that will prevent fraudulent financial reporting and misappropriation of assets however, they are lacking effective internal controls as well. As a result of Exton Industries having weak internal controls, control risk is increased and the audit team will need to choose higher control risk strategies.

If controls in the areas lacking are not improved the control environment will fail to protect future fraudulent acts.