Review the Keystone case study and the client suitability interview to validate Keystone as a viable client. Apply GAAS to the audit planning process.

1. Determine potentialinternal risk factorsfor conducting the external audit. Include the following:
   1. Risk related to structure of the company based on the client interview
   2. Risk discovered during due diligence process
   3. Client risk profile

ACC 640 Keystone Case Study

Engagement Overview

Keystone Inc., a listed company on a U.S. stock exchange (publicly traded) in the United States, is looking to expand. XBroker was seen as a potential target.

In 2015, Ron Smith started XBroker in Columbia, Maryland, for trading equities, options, and derivatives on the financial markets. He borrowed from the bank to start a company, using his house as security. Over the years, he worked very hard to establish a profitable niche in the highly competitive trading market.

In February 2023, Ron received a call from Linda Alvarez, the senior vice president of Keystone. Linda expressed an interest in buying XBroker. Linda has asked XBroker for its audited financial statements. XBroker came to an arrangement with Keystone to sell the company to Keystone in 2024.

Your accounting firm, Penmen Associates, will be conducting the audit of Keystone. The partner responsible for the audit is Jo Wadley with team members Alice Cooper (audit manager) and Sally Brown (audit senior) to assist.

Penmen Associates discussed its own independence to confirm that there are no independence problems associated with either its investments or relationship with Keystone or the investments or relationships associated with immediate family members or close relatives.

At the first planning meeting, Jo, Alice, and Sally focused on the risk assessment phase for the new audit, the audit team needs to gain an understanding of Keystone's structure and its business environment, determine materiality, and assess the risk of material misstatement.

Once the initial high level risk assessment is complete, Penmen Associates needs to have an audit program it can use for the Keystone audit to address how risks are mitigated and to ensure quality evidence is gathered for the accounts that are most at risk of being misstated.

Keystone Inc. Company Background

Keystone Inc. is a financial services company based in Sacramento, California. In 2024, Keystone purchased XBroker from Ron Smith. As part of the sale agreement, Ron was appointed to the Keystone board of directors.

Keystone businesses also operate in various international markets. Keystone has wholly owned subsidiaries in Canada and Japan and has built a reputation for reliable trading technology.

Keystone receives about 25% of its total revenue from Canada, 10% total revenue from Japan, with the remainder coming from the United States.

Keystone launched a new data product line that included selling options and equities data to other financial markets and broker dealers.

The Keystone corporate office has 358 full-time employees but only five in the accounting department. The company employs two full-time managers and some part-time staff.

Key positions in the Keystone accounting and IT area are as follows.

CFO: Henry Carpenter

Financial controller: Bob Carpenter

IT manager: Kyle Johnson

The company does have an internal audit department.

Keystone set a goal to increase revenue by 3% each year. One of the critical success factors for the company to achieve this 3% increase is to grow its share of the U.S. equities trading business.

However, with the new data products business there is an increase in costs, as well as the costs related to marketing and product branding. As a result, the management team is projecting a decline in earnings for the year.

The company recently took out an additional loan of $7 million with Windsor Bank to help fund expansion efforts and to purchase additional real estate and hire personnel. This loan is repayable over five years. The company's other debt relates to loans issued more than five years ago from various lending institutions.

The most recent financial statements for Keystone are provided in separate files.

CPA Firm Penmen Associates

Penmen Associates is a U.S.-based accounting firm with offices located in most major cities. Penmen Associates will be conducting the January 31 audit for Keystone, Inc., a publicly traded company. The firm has begun the planning phase of the external audit for Keystone and has assigned you the task of preparing for the audit.

As part of the audit's detailed risk assessment phase, you will evaluate Keystone's internal control structure, financial accounts, business environment, materiality, and any inherent risks that may impact the company. You will review external and other factors and interview data that could impact the audit. This understanding will help you develop an audit program and design its nature, extent, and timing.

ACC 640 Client Suitability Interview

Transcript of Meeting With Keystone CFO Henry Carpenter

Present:

Keystone CFO Henry Carpenter

Penmen Associates Audit Senior Sally Brown

Sally: As part of our due diligence in deciding to take on a new client, I need to ask you some questions about your company's key risks, major business operations, financial strength, and internal controls over financial reporting. Let's start with some risks related to your business and industry.

Henry: We are in the financial services industry, which is highly competitive. We face intense price competition in all areas of our business. In particular, the trading industry is characterized by price competition. We have in the past lowered prices, and, in the United States, increased rebates for trade executions to attempt to gain or maintain market share. These strategies have not always been successful and have at times hurt operating performance. Additionally, we have also been, and may once again be, required to adjust pricing to respond to actions by competitors and new entrants, or due to new SEC (Securities and Exchange Commission) regulations, which could adversely impact operating results.

Sally: How about your risk for cyberattacks?

Henry: Our role in the global marketplace may place us at greater risk for a cyberattack. Our systems and operations are vulnerable to damage or interruption from security breaches. Due to COVID-19, most of our workforce has worked, and may continue to work, from home, creating a broader and more distributed network footprint and increased reliance on the home networks of employees. While we continue to employ resources to monitor our systems and protect our infrastructure, these measures may prove insufficient depending upon the attack or threat posed. Any system issue, whether because of an intentional breach, collateral damage from a new virus or a non-malicious act, could damage our reputation and cause us to lose customers. There can be no assurance we will be able to identify and mitigate every incident involving cybersecurity attacks, breaches, or incidents.

Sally: How about your ability to attract and retain key personnel?

Henry: Our future success depends, in large part, upon our ability to attract and retain highly qualified and skilled professional personnel that can learn and embrace new technologies. In the current tight labor market, we have intensified our efforts to recruit and retain talent. There is no guarantee that we will have the continued service of key employees who we rely upon to execute our business strategy and identify and pursue strategic opportunities and initiatives.

Sally: I see you outsource services and rely on third parties to perform certain functions. How could this affect your business if the parties fail to perform as expected or experience service interruptions?

Henry: We rely on third parties for regulatory, data center, cloud, and data storage. Interruptions or delays in services from our third-party data center hosting facilities or cloud computing platform providers could impair the delivery of our services and harm our business. To the extent that any of our vendors or other third-party service providers experience difficulties or a significant disruption, breach, or outage, that may impact us. Also, changes to their business relationship with us or if they are unable to fulfil their obligations, our business or reputation may be adversely affected.

Sally: I've read that your businesses operate in various international markets, including certain emerging markets that are subject to greater political, economic, and social uncertainties than developed countries.

Henry: Our businesses operate in various international markets, including Canada and Japan, and our non-U.S. operations are subject to the risk inherent in the international environment. Political, economic, or social events or developments in one or more of our non-U.S. locations could adversely affect our operations and financial results.

Sally: Let us turn to your internal operations. What are your risk management procedures?

Henry: We utilize widely accepted methods to identify, assess, monitor, and manage our risks, including oversight of risk management by our Global Risk Management Committee, which is comprised of senior executives.

Sally: I have some questions about your internal control environment. I see your current auditor gave you an unqualified opinion on internal controls over financial reporting. However, a critical item on revenue recognition was reported. Can you elaborate how you oversee revenue recognition transactions?

Henry: We have strong controls in place over the allocation of contract transaction price to performance obligations, including management's review of the estimated margin. We also have several controls that ensure the accuracy of the revenue recognized in the current period by inspecting reports relating to the hours recorded on a project. This includes reviewing all contracts and contract modifications.

Sally: One of the things we look at in taking on a new client is the organization's culture, especially the tone at the top. Can you point out some things your company does in this area?

Henry: We require that all employees read and attest to the company's code of ethics and the company's commitment to ethics policy. We have a robust whistleblower program where employees have several options to report any aberrant behavior and remain anonymous. Both ethics certification and the whistleblower hotline process are SOX (Sarbanes-Oxley Act) controls assessed every year. Our company also has an ongoing commitment to diversity, equity, and inclusion. We have continued our series, Amplifying All Voices, which we initiated in 2020. This year, the program is a multimedia retrospective featuring works of art and photography documenting diverse cultures and life.

Sally: How strong is the company's financial position and its ability to secure credit?

Henry: Our latest investor call highlighted:

Third quarter 2022 net revenues increased 6% year over year.

Our trading segment's revenues increased 8%, including 10% organic growth, partially

offset by a negative 2% FX impact. Annualized recurring revenue increased 8% compared to the third quarter of last year.

Last quarter's GAAP (Generally Accepted Accounting Principles) diluted earnings per

share increased 5% year over year. Last quarter's non-GAAP diluted earnings per share

increased 15% year over year.

Also of note, our credit rating according to Moody's is Bbaa2 for senior unsecured debt.

Sally: We have already met with your previous auditors. They stated no issues that we should be aware of. Thanks again for your time.

Henry: No problem, feel free to reach out with any follow-up questions or document requests