J. of Acc. Ed. 30 (2012) 173–193

Contents lists available at SciVerse ScienceDirect

J. of Acc. Ed.

journal homepage: www.elsevier .com/locate/ jaccedu

Educational Case

Superior Construction Inc.: An assessment of risksand controls as part of a post-acquisition engagement

Joanne Jones a,⇑, Sandra Iacobelli b,1

a School of Administrative Studies, York University, Toronto, ON, Canada M3J 1P3b Department of Business, College of Management and Economics, University of Guelph, Guelph, ON, Canada N1G 2W1

a r t i c l e i n f o

Article history:Available online 12 October 2012

Keywords:Internal audit engagementInternal controlsDue diligencePost-acquisition reviewRisk assessment

0748-5751/$ - see front matter � 2012 Elsevier Lthttp://dx.doi.org/10.1016/j.jaccedu.2012.08.009

⇑ Corresponding author. Tel.: +1 416 736 2100x3E-mail addresses: jcjones@yorku.ca (J. Jones), si

1 Tel.: +1 519 824 4120x53592.

a b s t r a c t

Superior Construction Inc. (SCI) is a fictitious Toronto-based, pub-licly traded construction company that operates in the civil infra-structure and buildings markets. For this case, you will assumethe role of a senior internal auditor at SCI, who has been giventhe responsibility to lead a post-acquisition due diligence reviewof a recently acquired privately held construction company, Build-ing Excellence Inc. (BEI). You are provided with background on theacquisition, as well as information that your internal audit teamhas gathered during the post-acquisition review. With this back-ground information, you are asked to perform a risk assessmentof the newly acquired company and recommend controls to miti-gate identified risks. In addition, you will assess SCI’s pre-acquisi-tion review and evaluate the BEI purchase decision. This caserequires you to draw upon your knowledge of risks and controlsand to develop an understanding of the political issues that inter-nal auditors face.

� 2012 Elsevier Ltd. All rights reserved.

1. Case study

You are a senior internal auditor at Superior Construction, Inc. (SCI) and will be leading an internalaudit team in a post-acquisition due diligence review of a recent SCI acquisition, Building ExcellenceInc. (BEI). Your team’s engagement involves assessing BEI’s risks and recommending controls to mit-igate those risks. The intent is to give management at BEI a ‘‘roadmap’’ of changes that need to bemade. Further, at the request of SCI’s audit committee, your team will be assessing the pre-acquisition

d. All rights reserved.

0332; fax: +1 416 736 5963.acobel@uoguelph.ca (S. Iacobelli).

174 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

review performed by SCI personnel and evaluating the BEI purchase decision. This request is in re-sponse to the Board’s recent questioning of management as to whether the pre-acquisition due dili-gence review was as thorough as it could have been.

1.1. Background on SCI and the BEI acquisition

SCI, a Toronto-based construction company listed on the Toronto Stock Exchange, is an interna-tional company that operates in the civil infrastructure and buildings markets in Canada. It is oneof the largest construction organizations in Canada, generating over $2 billion in revenue annually.The company was founded in Toronto over 50 years ago and has grown organically as well as througha series of strategic acquisitions.

On January 15, 2012, SCI acquired 80% ownership in BEI, a building company located in Vancouverthat specializes in the construction of public infrastructure (mostly educational and health care facil-ities) in Canada. Due to the limited number of companies that are capable of developing these types ofprojects, BEI has been extremely successful and its growth has been phenomenal over the past 5 years.This growth is mainly due to the Canadian government primarily relying upon public–private partner-ships (P3s) to fund new hospitals and educational institutions.

SCI’s CEO, Bob Harding, and its CFO, Steve Smith, successfully acquired BEI despite stiff competitionfrom TBD Inc., Canada’s largest construction company. BEI accepted SCI’s offer because the owner ofBEI believed that their business cultures were very similar. BEI was a privately held, family controlledconstruction business and, as part of the purchase agreement, the principal owner will remain activein the business for 5 years and retain 20% ownership.

During negotiations, Steve assembled and led a small due-diligence team. The team consisted ofpersonnel from the finance, accounting, and legal departments. Since the acquisition occurred nearyear end, Ali McPhee, the Chief Audit Officer, could not provide any support from her Internal AuditGroup. Her audit group was busy with evaluating and testing internal controls for the CEO and CFOcertifications of internal controls and in assisting the external auditors with the annual audit.

The majority of the due-diligence team’s time was spent in determining a fair value for BEI andworking out the payment terms for the various members of the controlling family. Given the tightdeadlines involved, the team did minimal work assessing the effectiveness of internal controls. Theteam did assess the overall corporate governance and reputation of BEI, although little time was spenton governance since the owner and his family controlled all major decisions. Further, Steve’s due-dili-gence team also chose not to visit BEI’s subsidiary, Vermillion. Instead, to assess Vermillion’s opera-tions Steve’s team relied upon BEI’s audited financial statements and interviews with BEI’smanagement.

The due-diligence team primarily focused its efforts on the valuation of BEI’s net assets. The team’sbiggest challenge was in the valuation of BEI’s intangible assets, specifically, its backlog and goodwill.Backlog represents the revenue to be earned from the completion of projects-in-process and the rev-enue from contracts that have been awarded but have not yet commenced.

SCI’s Board unanimously approved the acquisition of BEI. It was consistent with SCI’s expansionstrategy to build a greater presence in Western Canada and to expand into the growing and lucrativeP3s market. Bob and Steve worked extremely long hours over several months during the negotiationprocess. Upon completion of the deal, the Board approved revisions to Bob and Steve’s 2012 compen-sation to include a special bonus in recognition of the exceptional BEI deal.

1.2. Information gathered by the internal audit team during the post-acquisition review

1.2.1. Meeting with SCI’s CFOPrior to leaving for Vancouver in June 2012, you met with Steve to learn more about BEI. Since SCI

has not been very involved in the P3 market, he gave you some background on P3 contracts. Steve ex-plained that a key difference between P3s and traditional construction contracts is their complexityand the type of risk assumed by the contractor. For instance, P3 contracts are often much longer induration and, therefore, the private entity (the contractor) could potentially be exposed to more risk.In addition, the contracts often stipulate that the government does not pay until the facility is

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 175

operational. While this clause serves as an effective incentive to ensure that the project is completedon schedule, it is very different from traditional construction contracts where payments are madeupon achievement of significant milestones during construction. Therefore, the contractor often hasto secure longer-term financing.

Steve went onto explain that BEI has two types of P3 contracts that are build-finance projects andconcession projects. In the build-finance projects, the contractor (BEI) assumes responsibility for bothfinancing and building the project. During the time of construction, the contractor assumes all therisks associated with the project. Once the construction is complete, the public sector entity (i.e.,the government) pays for and takes ownership of the contract. In the concession contract, the contrac-tor operates and maintains the facility or infrastructure for the duration of what is called a concessionperiod, which may be 30 years or more. Ownership may remain in the public sector, usually through along-term lease commitment, or the contractor is the owner until the agreement has expired. Once theagreement has expired, say in 30 years, ownership reverts back to the public sector. The contractor isnot guaranteed a fixed fee for operating the facility; rather, the fee is related to the volume of servicesprovided.

Steve continued by describing BEI’s current operations and competitive positioning. In the past, allBEI’s P3 contracts typically were build-and-finance contracts. BEI is currently in the final phases ofbuilding the new St. Mary’s Hospital located in Vancouver. This contract requires BEI to build and fi-nance the hospital and, in return, the hospital will make fixed monthly payments over 30 years. At thetime when SCI acquired BEI, the St. Mary’s project represented the most significant portion of BEI’sbacklog and, therefore, was a significant intangible asset in the valuation of BEI.

The current trend in government contracts is to move away from build-and-finance contracts and,instead, to develop projects that also involve concession arrangements. Contracts that involve conces-sion arrangements place a greater emphasis on the provision of services than on the construction ofphysical infrastructure and involve bundling the requirements to provide both infrastructure and ser-vices. In order to continue to bid competitively for these concession-arrangement contracts, BEI ac-quired Vermillion Inc. in August 2011. Vermillion is a private Canadian company that provides awide range of support services, facilities management, and private financing. In March 2012, BEIwas awarded its first concession-arrangements contract for the Sunnyside Health Care Centre (Sunny-side). The Sunnyside project involves the design, building, financing, and provision of non-clinical ser-vices for the new health centre. When SCI acquired BEI, the Sunnyside project award was not yetknown. However, BEI had informed SCI that it was one of the top two contenders, since it was the onlycompany able to provide both construction and operational services without subcontracting or form-ing some sort of joint venture.

Steve told you: ‘‘This acquisition of BEI is like manna from heaven, and we paid a premium for thiscompany because we expect to get a great return on our investment. Given that the customer is thegovernment, the P3 market is practically recession-proof. And, now that BEI has acquired Vermillion,we can bid on all these P3 contracts that involve both infrastructure development and services. Wecan present ourselves as an all-in-one service provider. This will be a key selling point as most ofour competitors have to form consortiums with a variety of companies in order to provide the service.’’

‘‘The Chair of the Audit Committee has just contacted me; apparently she has read about some de-lays in the St. Mary’s contract due to protests. She also told me that the Board is watching this acqui-sition closely and that some Board members are now questioning whether we paid too much of apremium, given these unforeseen risks. I still believe that this acquisition is one of our best decisions.Many contracts remain profitable even after experiencing significant delays.’’

‘‘You should find this post-acquisition review to be a ‘walk in the park.’ Our review of the companyfound that the company was well regarded in the industry and that the family had a tight reign onmost activities. When the Board approved the BEI acquisition, we assured them that the companywas well run and that its business processes were well controlled. I want you to keep that in mindwhen you are doing your review. Also, I don’t like surprises, so if you find anything, run it by me beforeyou finalize your report.’’

After meeting with Steve, you and your team traveled to Vancouver and spent a significant amountof time with various administrative, legal, and construction personnel in an effort to gather informa-tion about BEI’s contracts with Sunnyside and St. Mary’s. Given that BEI’s and SCI’s risk appetites are

176 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

sensitive to both of these contracts, your audit team has concluded that SCI will only tolerate a lowlevel of risk for the two projects.

1.2.2. Sunnyside Health Care CentreYou discovered that the Sunnyside project is split into two distinct stages: design and development

of the building (i.e., the construction phase), and provision of non-clinical support services once thehealth care centre is in operation (i.e., the operation phase). Key terms of the contract include:

� BEI is responsible for the design and construction of the health care centre. Construction is to becompleted within 30 months.� If the site is not complete at the agreed upon time, BEI is required to pay the British Columbia gov-

ernment $6750 per day for each day past the deadline.� Upon completion of the building, the costs for building the health care centre are paid to BEI

through a lease-to-own arrangement that commits the government to 25 years of payments tocover the construction costs and to provide a profit margin for BEI.� BEI provides, for 25 years, the following non-clinical support services: laundry, housekeeping, food

services, portering (i.e., transporting patients within the health centre), materials management, andsecurity. The quality of these services must be consistent with government standards.� The fee for housekeeping, food services, materials management and security services is based upon

certain benchmarks for service volumes. BEI must submit monthly invoices based on the bench-mark volumes. Every quarter in which actual volumes are less than 95% or greater than 105% ofthe benchmark volumes, a unit rate is applied on the difference to determine adjustments to theservice payments.� The fee for portering services is fixed at $9.3 million for the first 4 years. After the first 4 years, the

price may be renegotiated.� If BEI fails to provide any of the non-clinical services in accordance with the standards, the govern-

ment has the right to make deductions from its monthly payments.

Since BEI was awarded the Sunnyside project, it has become the poster child for the debate aboutprivatization of health care. There are several organizations that are pressing the provincial govern-ments to reconsider the P3 concession arrangements. These organizations claim that concessionarrangements are more costly than the government providing the services and that these types of con-tracts expose patients to undue risks.

When you spoke to BEI’s controller about the controversy, he stated: ‘‘The unions have done a lot ofresearch and are showing all the problems when you have a private service company providing so-called public services. What is making it particularly difficult is that the unions have dug up someinformation on Vermillion’s record as a non-clinical services provider. Apparently, in one of Vermil-lion’s first projects, there was a lot of controversy about patients being left on stretchers for inordinateamounts of time. One patient was left waiting for 60 hours and another was left for 144 hours! Ver-million has assured us that the delay problems occurred over 5 years ago and that they now have pro-cesses in place to avoid them. Although we still have complete confidence in Vermillion, the negativepublicity doesn’t do much for our image in future biddings.’’

‘‘In addition, a grassroots organization that represents a variety of community groups is pressuringthe government to reconsider the arrangement. In response to all this pressure, the British Columbia(BC) government has asked its Auditor General to look into the contract and the bidding process. Weare concerned that the government may bow to political pressure and change the terms of the agree-ment. We are aware that this has occurred with some P3 contracts in Ontario. We have even heardrumours that the health care centre may even significantly reduce its originally planned capacity byone-third and will lease additional off-site space.’’

1.2.3. St. Mary’s HospitalYour review of the St. Mary’s contract indicated that the initial contract was to design and build the

hospital in 30 months for $500 million, which was payable over a 25-year lease term that begins the

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 177

31st month. The original estimated cost to build the hospital was $480 million. BEI’s controller pro-vided the following data related to the project:

Information from the contract reporting system:

� Total actual costs incurred to date

$380.4 million � Estimated cost to complete $110.6 million

Information from the financial reporting system:

� Total contract revenue

$515.0 million � Total revenue recognized to date $399.0 million � Total costs recognized to date $380.4 million

The controller of BEI is very concerned about meeting the deadline for the project. He said: ‘‘Apartfrom normal delays and fights over unexpected costs, this project has become tangled up with thepolitical issues from the Sunnyside project and the BC Auditor General has decided to include thisbuilding in its review. The late penalty is $5000 per day and we are looking at being late by at leastone month.’’

‘‘On top of the political issues, we are in a dispute with St. Mary’s Hospital over the $15 millionclaim resulting from the $14 million in extra costs incurred during the installation of the special med-ical equipment. These costs have been included in the actual costs incurred to date. St. Mary’s claimsthat the installation of medical equipment is part of the scope of the original contract. However, weare claiming that these costs are over and above the original contract. There is considerable differencebetween the requirements for a room with special X-ray equipment compared to a waiting room. Thiswould definitely have been clearly stated in the contract and we are pretty confident we will be reim-bursed. Regardless, given the political nature of the project, we decided it was necessary to install themedical equipment and incur these costs in order to ensure that we are not accused of delaying theproject.’’

Cindy Cotter, the head of BEI’s legal department (which consists of Cindy and two support staff) isnot so sure that BEI will recover all the costs. She has reviewed the contract and, in her opinion, BEI’sresponsibility regarding the installation of medical equipment is not clear. She has recommended thatBEI request mediation so that BEI and St. Mary’s can hopefully negotiate a reasonable settlement.

1.2.4. Contract revenue controlsWhile you spent your time on the two hospital construction projects, the other team members fo-

cused on controls over BEI’s construction contract administration and document management system.Since revenue recognition is determined by the structure of the contracts, your team has been spend-ing quite a bit of time on the controls over the revenue recognition process. The team documented theconstruction contract process, which included bid development, contract review and approval, andaccounting policies.

The team found that BEI’s owner is involved in the development of all significant bids and that BEImaintained high margins on its contracts. The team also noted that all construction contracts gothrough a detailed review and approval process that involves operational and legal staff, along withthe company’s Board of Directors. Further, all BEI’s accounting staff have attended various training ses-sions regarding construction contract revenue recognition under IFRS.

The team selected a sample of contracts and noted that all contracts were approved; however,there were several instances noted where change orders were not properly documented and it ap-peared that there were several disputes and claims with clients regarding payment for changes madeto the original construction plans. It was noted that each of the disputes was ultimately settled and BEIwas able to maintain high margins on the work performed.

178 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

1.2.5. Labour costsWhen assessing contract costs, the team noted that BEI’s labour costs appeared to be lower than

what SCI typically incurs. When the team inquired about this, BEI’s controller stated that it was dueto labour costs in Western Canada being lower than in Ontario. However, the team noted that a recentseries of newspaper articles covered the huge shortage of skilled labour in the Western provinces and,as a result, wages had increased dramatically.

Examination of further documentation on the wages revealed that a large number of paymentswere made to Trades in Demand, Inc. Apparently, this company is an outsourcing service that spe-cializes in construction tradespeople. Most of the tradespeople that the service provides are fromoutside Canada. Since BEI contracts with Trades in Demand, it does not deal with any of the neces-sary immigration documentation. The VP of Human Resources said that this arrangement was idealsince Trades in Demand provides high-quality, non-unionized workers at reasonable rates. The teamdid some further research and found that the federal government is currently performing an inves-tigation of the construction trades recruiting industry. Apparently, several recruiters were contract-ing illegal immigrants. The team inquired as to whether BEI had any knowledge of Trades inDemand hiring illegal workers. The VP stated, ‘‘It is not BEI’s concern how Trades in Demand recruitsits workers.’’

Fig. 1. Research resources. Note: All websites referenced above were last accessed July 31, 2012. (See the above-mentionedreferences for further information.)

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 179

2. Case questions

2.1. Part A: Understanding internal audit’s role in due-diligence engagements

Based on the case materials, and additional research resources referenced in Fig. 1, answer the fol-lowing questions:

� A1. What is a due-diligence process? What is the role of internal auditors in the pre-acquisition andpost-acquisition due-diligence processes?� A2. Provide a brief description of SCI’s pre-acquisition due-diligence review of the BEI purchase.

What was the role of the internal audit group in the pre-acquisition review of the BEI purchase?� A3. Summarize the objectives of the post-acquisition review of the BEI purchase.� A4. Review the following globally accepted definition of internal auditing issued by the Institute of

Internal Auditors (IIA): http://www.theiia.org/theiia/about-the-profession/internal-audit-faqs/?i=1077. What, if any, concerns do you have about the informal terms of the BEI post-acquisitionengagement. Provide recommendations addressing your concerns.

2.2. Part B: Assessing risks and recommending controls

� B1. For each of the areas investigated (i.e., Sunnyside Health Care Centre, St. Mary’s Hospital andTrades in Demand) provide a detailed analysis of risk to SCI. These would include risks related tostrategy, compliance, operations, and financial reporting. Limit your analysis to include only riskexposures that have not been effectively managed. Your analysis should: (1) identify the risk,and (2) include a risk rating based on the potential impact and likelihood of occurrence. Fig. 2 pro-vides definitions of risk ratings based upon impact and likelihood. You may use the template inFig. 3 to complete both questions B1 and B2.� B2. For each risk identified in question B1, recommend controls that will mitigate the identified

risks.

Impact Classification Definition Low • Minimal damage, loss, or delay

• Easily remedied • Little or no effect on reputation

Medium • Significant damage, loss, or delay • Medium term impact, expensive to recover • Adverse impact on reputation

High • Serious impact on costs and ability to meet objectives • Medium to long-term effect and expensive to recover • Serious impact on reputation

Likelihood Classification Definition Low Unlikely

• Has not occurred • Unlikely to occur

Medium Likely • History of occurrence • External influences may make it difficult to control

High Certain/imminent • Potential to occur in the next year • Has occurred recently

Fig. 2. Definitions of risk ratings.

Risk exposure (strategic, compliance, operational, and financial reporting risks)

Risk impact (with explanation)

Risk likelihood (with explanation)

Recommended controls

Sunnyside project St. Mary’s project Trades In Demand

Fig. 3. Risk assessment and recommended controls template.

180 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

� B3. To complete your overall assessment of risk, map the risks that you have identified in questionsB1 and B2 on the 3 � 3 risk matrix in Fig. 4 (number your risks as R1, R2, etc.). For example, if thefirst risk you identified, R1, has a high likelihood and a low impact, R1 would be inserted in theupper-left quadrant of the matrix. Based upon this categorization, indicate which risks should beaddressed by SCI on a priority basis.

2.3. Part C: Assessing the pre-acquisition due-diligence process and the BEI purchase decision

� C1. What risks did the pre-acquisition due-diligence review fail to identify? Based upon your anal-ysis, what is your conclusion about the overall quality of the pre-acquisition review? What was theimpact of overlooked risks on the decision to purchase BEI?� C2. What recommendations do you have for future pre-acquisition due-diligence reviews?

3. Case teaching notes

3.1. Overview and learning objectives

Although SCI, BEI, and Vermillion are hypothetical companies, all are based upon the issues andexperiences of several companies in the construction industry. For instance, details of Sunnysideare based upon two projects in Ontario and BC. When details of both the projects were released, therewas a public outcry and the Auditors General of Ontario and BC did perform a review of the contracts(Office of Auditor General of British Columbia, 2011; Office of Auditor General of Ontario AnnualReport, 2008). The details related to Vermillion are based upon a UK contractor involved in a numberof controversial P3 contracts (Canadian Union of Public Employees (CUPE), 2003). Also, rusheddue-diligence reviews are not uncommon in the case of mergers and acquisitions and this case high-lights the fallout that can occur when some key issues are missed or not assessed thoroughly duringthe due-diligence review. The case also highlights that if the internal audit group has a ‘‘proactive’’rather than an ‘‘after-the-fact’’ mindset, the audit group can significantly improve the quality of thepre-acquisition due-diligence review.

Lik

elih

ood

High R1

Medium

Low

Low Medium High

Impact

Fig. 4. Risk matrix.

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 181

After completing this case the student should be able to:

1. Perform relevant research and apply that understanding to the analysis of pre- and post-acquisi-tion due-diligence reviews (A1, A2, A3, C1 and C2).

2. Understand the differences between a pre-acquisition and a post-acquisition due-diligence auditand the role of internal auditors in these engagements (Parts A1, A2, A3, and C2).

3. Explain how reporting relationships can impact internal auditors’ objectivity (A4).4. Identify and rank strategic, operating, compliance and financial reporting risk exposures specific to

a set of case facts, and consider the implications of the risk exposures in developing control recom-mendations that effectively mitigate the identified risks to a level within the organization’s risk tol-erance (B1, B2, and B3).

5. Assess a pre-acquisition due-diligence review and make recommendations that demonstrate anunderstanding of the role of internal auditors and how they add value (C1 and C2).

3.2. Implementation guidance

We suggest using the case either in an undergraduate or graduate internal auditing course. If usedin an internal auditing course, the assignment is best given later in the course and after the concepts ofrisk assessment and controls have been covered. It also can be used in an undergraduate or graduateexternal auditing course that includes a module on internal auditing.2 When we have used the case inan external auditing course, we have stressed that students need to focus on more than financial report-ing risk and that they need to address the Audit Committee’s concerns.3 To assist students in an externalaudit course, we provide a reading on how to conduct a risk assessment (see Fig. 1). For an internal auditcourse, these resources may not be necessary since the textbook would have adequate coverage of therisk-assessment process.

Instructors may assign this case as a pair-writing assignment, for a group case competition, or foran in-class discussion only. One of the authors used an earlier version of the case as an out-of-classpair-writing assignment in an advanced external auditing undergraduate course that had a moduleon internal audit. The average time to complete the case was 14.2 h. The earlier version of the case,however, had more issues and requirements and, therefore, we anticipate the time to complete thepresent version of the case assignment to be 10 h. The first time we used the assignment, we foundthat students did minimal background research. To address this weakness, we now provide back-ground readings and research instructions so that the students will have the necessary knowledgeregarding the engagement and P3 contracts (see Fig. 1). The readings provided for an overview ofthe due diligence engagement are ‘‘easy reads.’’ If instructors wish for students to have a more in-depth understanding of the role of internal audit in mergers and acquisitions, they may refer themto Dounis (2002). Likewise, if instructors require students to prepare a written report, they shouldbe directed to IIA Standard 2410 and IIA Practice Advisory 2410-1.

We also have used the case as a group assignment for a 1-day case competition. In the case com-petition, groups of three to four students were given the case in the morning and were required to pre-pare a 20-minute oral presentation later in the day.4 Judges, who were all professional accountants,evaluated the quality of students’ presentations and the students’ responses to their questions.

3.3. Case efficacy

In both the pair-writing assignment and the case competition, the students’ responses to the casewere positive.

2 We have used the case in an advanced external auditing course; feedback from students indicated that the case gave them anappreciation for the type of work that internal auditors perform.

3 The first time we administered the assignment in an external audit course, some students thought that they were being askedto prepare a financial statement audit planning memo for an audit partner.

4 The students were given five hours to analyze the case and prepare a 20-min presentation to a panel of five judges.

182 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

3.3.1. Feedback on pair-writing assignmentWhen the case was used as a pair-writing assignment, 44 students in two sections of an advanced

undergraduate auditing course completed an evaluation of the case (see Table 1). Students rated eachcase component on an 11-point Likert scale, ranging from 0 to 10. In addition, students were asked theopen-ended question: ‘‘Would you recommend instructors at other universities use this case? Why orwhy not?’’ Of the 44 students who answered the question, 41 (93%) said that they would recommendthe case. When asked ‘‘why,’’ the general themes of students’ responses were that the case was real-istic and that it provided a good example of how internal auditors add value to organizations. The stu-dents also indicated the time required to complete the case as well as their level of interest in the case.

3.3.2. Feedback on case competition assignmentWe obtained informal feedback from the five judges who evaluated the case competition presen-

tations. The judge’s work experience ranged from 5 years to in excess of 20 years as professionalaccountants. There was unanimous agreement that the case was both challenging and realistic. Onejudge with a health care background commented on the realism of the Sunnyside project. The studentsin the case competition also found the case challenging.

4. Suggested solutions

4.1. Due diligence process and role of internal audit

Due diligence is the process of identifying and confirming or disconfirming the rationale for a po-tential acquisition. The due-diligence process covers all major issues related to strategic, operational,compliance and financial risks associated with the potential acquisition. The due-diligence processconsists of two phases. In the pre-acquisition phase, the acquiring company assesses the potentialacquisition to determine the purchase price and to determine the various risks associated with theacquisition. In the post-acquisition phase, the acquiring company focuses on integrating the acquiredcompany and determining whether any significant risks were missed in the pre-acquisition review.Critical components of this phase are: a transition manager, business process and control experts,an initial comprehensive business process, and a control review and audit of those controls (Aldhizer& Bechara, 2011).

Table 1Student feedback on pair assignment (n = 44).

Questionsa Mean SD median

How much did the case help you understand the complexity of issues related to acquisitions? 7.81 (1.23) 8.00How much did the case help you understand the complexity of valuing an acquisition of a company? 7.55 (1.63) 8.00How much did the case help you understand the importance of due diligence in the purchase of a

business?8.12 (1.37) 8.00

How much did the case help you identify control weaknesses? 6.89 (4.25) 7.00How much did the case help you understand the dilemmas that internal auditors face when

completing an internal audit assignment?7.59 (1.52) 8.00

How much did the case help to encourage critical thinking about resolving ambiguities anddevelop recommendations?

7.42 (1.78) 7.00

How interesting was the case? 6.83 (2.18) 7.00How realistic was the case? 7.98 (1.46) 8.00Completing this assignment was a positive learning experience 7.68 (1.58) 8.00How many hours did you spend on the case?b 14.24 (1.76) 10.00

a Students rated each case component on an 11-point Likert scale, ranging from 0 to 10, where 0 = ‘‘unhelpful’’ to10 = ‘‘helpful.’’ Students also rated the overall case on a scale of ‘‘not interesting’’ (0) to ‘‘very interesting’’ (10) and a scale of ‘‘notrealistic’ (0) to ‘‘very realistic’’ (10) as well as ‘‘the degree to which the assignment was a positive learning experience.’’

b The ‘‘hours to complete’’ is based upon an earlier version of the case. We estimate that it would take around 10 h tocomplete this version of the case.

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 183

A key role for internal audit in the pre-acquisition stage is the risk assessment and evaluation ofcontrols. This assessment can identify unmitigated risks that can influence the purchase decision, esti-mate the cost of implementing controls, factoring in such costs when establishing a purchase price,and considering the compatibility of the two companies’ systems. In the post-acquisition stage, inter-nal audit can audit the pre-acquisition review and identify any significant risks that have been missed.The acquiring company can then take corrective actions before incurring substantial losses.

4.2. Brief overview of pre-acquisition due diligence and the role of internal audit

A team led by the CFO and consisting of members from accounting, finance, and legal, conductedthe pre-acquisition due-diligence review of the BEI acquisition. Given the tight deadlines involved, theteam did minimal work assessing the effectiveness of internal controls. The team also assessed theoverall corporate governance and reputation of BEI, although little time was spent on governancesince the owner and his family controlled all major decisions. The due-diligence team did not visitBEI’s subsidiary, Vermillion; instead, it relied upon BEI’s audited financial statements and interviewswith BEI’s management. Due to the timing of the BEI acquisition and resulting year-end conflicts, theInternal Audit Group was not involved in the pre-acquisition stage of the due-diligence process.

4.3. Objectives of the post-acquisition review of the BEI purchase

The Audit Committee has requested that the Internal Audit Group perform a post-acquisition re-view of the BEI purchase, which was completed on January 15, 2012. The objectives of the post-acqui-sition due-diligence review are to:

� Perform a risk assessment of BEI, focusing on operational, strategic, compliance, and financialreporting risks.� Recommend internal controls to mitigate the identified risks.� Assess the quality of the pre-acquisition due diligence review.� Evaluate the BEI purchase decision.� Make recommendations on how to improve future pre-acquisition due diligence reviews.

4.4. Threats to auditor independence and recommendations

Steve has asked the internal audit team to review its report to the Audit Committee with him priorto its release to the Committee. However, Steve led the due-diligence review for the acquisition andhas been rewarded for the work he performed. Therefore, the concern is that the report is partiallyevaluating Steve’s performance and decisions and this may compromise the Audit Committee’s per-ception of the internal audit team’s objectivity. The Internal Audit Department should advise Steveof these concerns and explain that his review and input into the report would severely limit the valueof the report to the Audit Committee. An appropriate safeguard would be to advise Steve that he canreview the final report prior to its issuance and that he will be given the opportunity to add a man-agement response or ‘‘comments’’ to the report. He will not be able alter the original report content.This threat to the internal auditor’s independence is a subtle, but key, point that many students miss.

4.5. Risk exposures related to the BEI acquisition and recommended controls

Table 2 identifies the risks, assesses the impact and likelihood of those risks, and provides controlrecommendations to mitigate those risks. (Please note that Panel B of Table 2, in conjunction with thediscussion of R7: Misstatements in revenues and gross margin recognized as a result of the uncertain-ties that exist in long-term construction projects, makes reference to Fig. 5.)

4.6. Recommended controls to mitigate risks

See Table 2.

Table 2Risk assessment and recommended controls.

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

Panel A: Sunnyside projectR1. Services not performed to a

predetermined government standard(operational risk)

Medium Medium

Vermillion will breach its contract with thegovernment if it is unable to provide thenon-clinical support services inaccordance with the pre-determinedgovernment standard. In this situationthe government can impose deductionsto the monthly payment for services toVermillion.

Explanation: This could cause a significantreduction in the amount of remunerationthat Vermillion will receive for the non-clinical services it provides. However, itappears to be only related to portering,which has a fixed contract of $9.3 million;therefore, the reduction in revenue maynot occur.

Explanation: Since there is a history ofoccurrence, the problem could reoccur.However, the likelihood is reduced sincethe incident mentioned by the unionhappened over 5 years ago and therehaven’t been any more incidents since thattime.

1. The proposed government standard foreach service should be reviewed andapproved by key operational personnel foreach service area (laundry, housekeeping,food services, and porter services). Thereview should identify areas of ambiguityand these areas should be clarified andredefined with the government officialsprior to signing of the contract.

2. The government standard for eachservice should be communicated to allappropriate employees. Attendance attraining sessions and review of regularcommunication updates should berequired of all employees involved in thedelivery of the services. Employees shouldbe required to sign a statement indicatingthat they understand the governmentservice standards and are committed tomeeting or exceeding these standards.

This would also have a negative impact onBEI’s and Vermillion’s reputation, whichwould impact the success of future bids.

3. Each service area shall establish servicelevel benchmarks, which will be tracked,monitored and reported in a timely fashion(i.e., weekly). Any deviations from thebenchmarks should trigger a predefinedremediation process.

4. Regular operational audits addressingthe efficiency and effectiveness ofVermillion’s services should be performedannually in order to identify and remediateany process deficiencies.

184J.Jones,S.Iacobelli/J.of

Acc.Ed.30

(2012)173–

193

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

R2. Reduced popularity in outsourcing ofnon-clinical health services (strategicrisk)

High Medium

Changes to the governing political party ofthe day or swings in popular opinioncould result in an overall decline in thepopularity of these concession-typearrangements. Requests to renegotiateexisting arrangements also could occur.The success of BEI and Vermillion arebased on the assumption that thegovernment plans to continue with thisfunding model.

Explanation: If the government decidesthat it will no longer partake inconcessionary arrangements, thenVermillion will lose its largest customerand the long-term viability of Vermillionwill be at risk.

Explanation: There are variousorganizations applying pressure on thegovernment to reconsider the use of thesetypes of contracts. Currently there arerumours that the government is planningto significantly alter the terms of theSunnyside contract. The BC AuditorGeneral also is conducting aninvestigation.

5. Ensure that all customer contractsstipulate that any requests to alter theoriginal terms of the contract will triggersevere penalties to the requesting party.Before signing, all contracts should bereviewed by the legal department toensure that these terms have beenincluded in the contract.

6. Invest in lobbying funds to ensure thatgovernment officials are aware of thevarious benefits of concessionary-typearrangements and of outsourcing non-clinical services.

7. Invest in advertising and public relationsfunds to ensure that the general public isaware of the various benefits ofconcessionary arrangements.

8. Various controls to ensure that non-clinical services performed are inadherence to the government standard.Refer to control recommendations 1 to 4.

R3. Potential Reduction in Size ofSunnyside by one-third (operationalrisk)

High Medium

Given the public outcry about Sunnyside,there are rumours that the constructionproject will be reduced by one-third.

Explanation: Given that the contract issignificant, a one-third reduction wouldhave a serious impact on revenues.

Explanation: Given the current publicpressure and the fact that the Ontariogovernment has made reductions, it islikely that the BC government will requestsome changes to the contract.

9. Control recommendations 5, 6 and 7 alsoserve to mitigate this risk.

R4. Unexpected cost overruns causingreduced gross margins and/or losses tolong-term projects (operational risk)

Medium Medium

(continued on next page)

J.Jones,S.Iacobelli/J.ofA

cc.Ed.30(2012)

173–193

185

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

Given the protests, BEI may not be ablecomplete the project within 30 monthsand, thus, may incur penalties of $6750per day for each day over the deadline.

Explanation: BEI will be unable to recoverunexpected costs associated withconstruction projects and will incur a$6750 per day penalty for each delayedday.

Explanation: Delays are likely but difficultto predict with certainty, given that theproject has not started. BEI may be able torenegotiate the terms of the contract.

Control recommendations 10–16 related toSt. Mary’s Hospital serve to mitigate thisrisk.

Panel B: St. Mary’s project

R5. Unexpected cost overruns causingreduced gross margins or losses to long-term projects (operational risk)

Medium Medium

Actual construction costs incurred will besignificantly higher than the originalestimates, thus resulting in lost marginand/or the project being in an overallloss position. All of the risk associatedwith cost overruns is assumed by BEI. Inthe case of St. Mary’s, the risk of a delayhas significant implications on theactual final cost of the project.Currently, it is anticipated that theproject will be delayed by 30 days. Thecosts of the delay, approximately$150,000 ($5000 per day @ 30 days),will reduce the expected margin on theproject.

Explanation: BEI would be unable torecover the unexpected costs associatedwith construction projects. This couldresult in a significantly reduced marginand/or an overall loss position.

Explanation: BEI appears to have strongcontrols over the bid development processand has historically maintained highmargins on its construction projects.However, legal counsel is unclear as towhether BEI will be able to fully recovercosts.

10. In the contract negotiation stage, BEIshould ensure that late penalties can onlybe imposed if the client is not responsiblefor the delay. In the case where the clientcaused the delay (i.e., from a change orderor unexpected audit), the contract shouldstipulate that the original project timelinesshould be revised.

11. BEI should prepare a control sheetwhich lists all legal clauses which are non-negotiable or ‘‘standard contract terms’’that must be included on all BEI contracts.Prior to entering into any new contracts,the contract should be reviewed by in-house legal counsel and an operationsmanager to ensure that all clauses listed inthe control sheet have been included in thefinal contract. Each of theserepresentatives should sign-off indicatingthat this task was completed prior tosigning of the contract.

12. Prior to signing new contracts thecontracts should be reviewed and approvedby various members of the project team(e.g., project manager, legal counsel,estimators, engineers and accounting). Thedesign features and building requirementsshould be stated clearly and be based onfinal building drawings.

186J.Jones,S.Iacobelli/J.of

Acc.Ed.30

(2012)173–

193

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

13. During the bid development the projectmanager should prepare a detailed costingschedule whereby all materials,subcontractor, and labour costs have beenidentified.

14. Costing schedules should be reviewedand approved by all key project personnelwho are experienced professionals in thearea of construction cost estimation.

15. Project management tools should beemployed for all long-term constructionprojects. Timelines and major projectmilestones should be created andapproved by all key project personnel.Project schedules should be reviewed andmonitored on a regular basis by the projectmanager.

16. Internal audit should perform post-engagement reviews in order to identifyareas requiring improvement for futureprojects.

R6. Disagreements with clients on theterms of the construction agreement(operational risk)

Medium High

Since the BC Province (i.e., the projectfunder) has not agreed to the $15million claim, there is a risk that BEIwill not recover the $14 million spenton the recent installation of specialequipment. BEI has been successful inresolving past disputes. However, basedupon discussion with the projectmanager and legal counsel, it is unclearwhether BEI will recover the costs and,if they are unsuccessful, then theproject will again be in a loss position.

Explanation: BEI would not be able torecover the costs incurred as a result ofchanges to the original plans.

Explanation: The likelihood of occurrenceis high since these are common industryrisks and there have been several instanceswhere changes to the initial plans weremade without client approvals. Suchchanges frequently result in customerdisputes.

17. Any work related to changes from theinitial plans should not be performed untilBEI receives written client approval statingthat the client has agreed to the requestedchange and the associated cost of thechange.

(continued on next page)

J.Jones,S.Iacobelli/J.ofA

cc.Ed.30(2012)

173–193

187

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

R7. Misstatements in revenues and grossmargin recognized as a result of theuncertainties that exist in long-termconstruction projects (financialreporting risk)

High Medium

a. Uncertainties related to totalestimated costs to complete: Therevenue and costs for long-termcontracts are recognized by stage ofcompletion. The stage of completion isdetermined by actual costs incurred as apercentage of total estimated cost tocomplete. Inaccuracies in the estimatedcost to complete will causemisstatements in total revenue andgross margin recognized. For example,the St. Mary’s estimated costs tocomplete did not include the costsassociated with the known delays. Theestimated costs to complete should beincreased by the anticipated $150,000late penalties. See Fig. 5 for the detailedcalculation on the impact on revenuesand margin recognized.

Explanation: Material misstatements inrevenues and gross margin will result inlost investor confidence.

Explanation: Factors that decrease thelikelihood include: (1) BEI has strongcontrols in the review and approvalprocess of all new bids; (2) BEI hashistorically maintained high margins on allcontracts; (3) all of BEI’s accounting staffhave been trained on revenue recognitionstandards for long-term projects. However,BEI’s tendency to incur costs prior toobtaining customer approval increases therisk of a misstatement in total contractrevenue.

18. At the end of the reporting period, thekey project personnel as well as theDirector of Operations (or equivalent)should review and approve the detailedcosting schedule to ensure completeness ofthe total estimated costs to complete.

19. External project engineers shouldperform a review to confirm achievementof major project milestones.

20. Controls identified inrecommendations 10–17 also serve toaddress these risks.

b. Uncertainties related to total contractrevenue: The determination of totalcontract revenue in long-term projectsalso involves a level of uncertainty.Variations or changes to the initial planare a common occurrence inconstruction projects. For financialreporting purposes, it must bedetermined if any variations to theoriginal contract should be included intotal contract revenue for the project.The special equipment at the St. Mary’sproject is an example of this type ofsituation. BEI is requesting the Provinceto compensate it for work not included

188J.Jones,S.Iacobelli/J.of

Acc.Ed.30

(2012)173–

193

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

in the original contract. InternationalFinancial Reporting Standards forConstruction Contracts under IAS 11,paragraph 14, indicates that, due to thesignificant uncertainty of claims, therevenue related to the claim shouldonly be included in total contractrevenue when ‘‘. . .negotiations havereached an advanced stage such that itis probable that the customer willaccept the claim; and the amount canbe measured reliably.’’ Since the claimhas not yet been resolved and the nextstep is arbitration, the uncertaintyrelated to the collection of the $15million claim is high and, in accordancewith IAS 11, BEI should not recognizeany revenue related to the claim. Thecosts associated with the claim wouldbe expensed in the current year. Theaccounting treatment under IFRS isconsistent with the guidance providedby SOP 81-1 in US GAAP.

As a result of the above two financialreporting risks, revenue is overstated by$11.74 million and total gross marginrecognized to date is overstated by$11.74 million. Fig. 5 provides thedetails relating to this calculation

Panel C: Trades in Demand

R8. Non-compliance with laws andregulations associated with the use ofillegal employees (compliance risk)

Medium Medium

The significantly lower wages paid toTrades in Demand’s workers and thegovernment investigation both suggestthat there is a strong possibility that thecompany may be employing illegalimmigrants. It is not appropriate for theVP to assume that, since it is a

Explanation: It is not certain whether BEIwill be considered at fault if it is found thatthe workers are illegal immigrants. BEIwill, however, suffer reputational damageand it is unlikely that any provincial,federal or international governments willwant to hire BEI for any future projects.

Explanation: The current investigation andthe unexplained low wages would suggestthat the company might have beenemploying illegal workers.

21. Appropriate measures and proceduresshould be established for the screening ofall new subcontractors. The criteria shouldbe more than the price of the services; itshould also include assessing risks that thesubcontractor may expose BEI to becauseof the relationship.

(continued on next page)

J.Jones,S.Iacobelli/J.ofA

cc.Ed.30(2012)

173–193

189

Table 2 (continued)

Risk exposure (strategic, compliance,operational and financial reporting risks)

Risk impact (with explanation) Risk likelihood (with explanation) Recommended controls

subcontractor, ‘‘it is not BEI’s concern.’’BEI’s association with Trades inDemand causes BEI to be at risk of non-compliance with regulations. Non-compliance with regulations couldresult in BEI suffering significantgovernment-imposed penalties andfines

22. BEI should implement a code ofconduct, which explicitly requires that allemployees of BEI be eligible to lawfullywork in Canada. BEI should require allsubcontractors and outsourcers to assert(sign off) that they acknowledge and willfollow BEI’s code of conduct.

23. BEI should ensure that the contractwith Trades in Demand explicitly providesBEI with the right to regularly performcompliance audits. From time to time, BEIshould perform an audit of thesubcontractor to obtain a high level ofassurance that the subcontractor is incompliance with all contractualrequirements and laws.

190J.Jones,S.Iacobelli/J.of

Acc.Ed.30

(2012)173–

193

Fig. 5. Revised calculations of total revenue and gross margin recognized to date.

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 191

4.7. Risk matrix

Fig. 6 plots the risks identified in questions B1 and B2 (see Table 2) on a risk matrix. Instructors maywish to highlight that these risk ratings are inherently subjective and are dependent upon the type ofcompany and its risk appetite. Other ratings may be acceptable as long as students provide adequaterationale to support their risk mappings.

The matrix demonstrates that there are several medium and high risks associated with BEI. Further,the following high risks should be given high priority for timely implementation of the recommendedcontrols in those areas in order to mitigate the risks and to avoid reoccurrence of the same issues:

� Risks related to Sunnyside Health Care Centre:– R2: Reduced popularity in outsourcing of non-clinical health services.– R3: Potential reduction in Sunnyside contract.� Risks related to St. Mary’s Hospital:

– R6: Disagreements with client on the terms of the construction contract.– R7: Misstatements in recognized revenues and gross margins.

Lik

elih

ood

High R6

Medium R1, R4, R5, R8 R2, R3, R7

Low

Low Medium High

Impact

Fig. 6. Risk matrix.

192 J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193

4.8. Assessment of pre-acquisition due-diligence review

Based upon the internal audit team’s review, it appears that the pre-acquisition due-diligence re-view was not conducted in a rigorous manner. It appears that the lack of rigor can be partially attrib-uted to assessing risk based primarily upon quantitative assessment, and not considering the impactof lax internal controls, and failing to investigate Vermillion. When insufficient due diligence proce-dures are performed, significant risks can remain undetected. This will expose SCI to risks that maybe beyond its own risk-tolerance level and that will likely cause significant damage to the organiza-tion. Since these factors remain unknown to SCI at the time of purchase, they are not considered inthe determination of the purchase price causing SCI to overpay.

The due diligence review conducted by Steve and his team was unsuccessful in identifying severalsignificant risks associated with the purchase of BEI. Had these issues been identified in the pre-acqui-sition due-diligence review, the BEI purchase decision may have been altered and/or the price paidlikely would have been reduced. Below is a summary of the significant risks keyed to Table 2 that werenot identified by the due-diligence team at the time of acquisition and the related impact the over-sight would have on the purchase decision.

� Unidentified risks associated with Sunnyside project– R1: One of the main reasons SCI purchased BEI was to become a full-service provider. If SCI had

been aware of the possibility that Vermillion’s services were not being performed in accordancewith the government standard, SCI would have performed further investigations to confirm thatthe incidents reported were isolated. If it was found that the incidents were not isolated andreflected Vermillion’s normal service levels, SCI likely would have reconsidered the entirepurchase.

– R2, R3, and R4: SCI would not have paid a premium for BEI if it had considered the likelihood ofthe reduced popularity of non-clinical health services and its impact on BEI’s continued successin the P3 market and on potential cost overruns.

� Unidentified risks associated with St. Mary’s project– R5, R6, and R7: The valuation of BEI included the valuation of backlog related to the St. Mary’s

project. However, the increased costs due to delays and the impact of the current $15 millionclaim were not considered in the valuation of the backlog. The valuation was based on the St.Mary’s original projection of an overall gross margin of $24 million. If the current claim of$15 million isn’t recovered and the delay costs of $150,000 are incurred, the margin for this pro-ject is reduced to $8.85 million (see Fig. 5). Given the significance of this reduced margin, SCIoverpaid for the backlog associated with the St. Mary’s project.

� Unidentified risks associated with Trades in Demand– R8: BEI’s practice of subcontracting with Trades in Demand which, in turn, may employ illegal

immigrants, could damage SCI’s reputation in the market and expose SCI to fines or penaltiesimposed by governments. SCI would have further investigated the matter in order to confirmor dispel this accusation. If the accusation was confirmed, SCI would have re-considered thepurchase, as involvement in these practices would cause reputational damage to the entireorganization. If SCI decided to proceed with the purchase, it would have paid less for the com-pany in order to compensate it for the reputational damage and for the penalties or fines thatcould be imposed in the future.

4.9. Recommendations for future pre-acquisition due-diligence reviews

The following provides a summary of recommendations for future due-diligence reviews:

1. When risks related to construction projects are not identified the project can be overvalued by thedue diligence team. A thorough review of all ‘‘in-progress’’ construction contracts should be con-ducted. This would include a review of the original contracts, discussions and inquiries with keypersonnel involved on the project (such as project managers and engineers), a physical examina-

J. Jones, S. Iacobelli / J. of Acc. Ed. 30 (2012) 173–193 193

tion of the project site, review of project approvals and certifications received from regulatoryauthorities, discussion or review of correspondence related to the project, review of the estimatedcosts to complete, and actual costs to date.

2. The due diligence review should not focus on areas that are considered material based solely upona quantitative assessment. A thorough review of a company’s key business practices and its con-trols is necessary in order to properly assess the organization. The review should be conductedfor all business units and for all major transaction cycles. The review should be conducted utilizingan established framework such as the COSO framework. We have learned that, without this type ofdetailed review, there is risk that the company acquired has engaged in illegal activities that canexpose Superior to significant liabilities.

3. The internal audit team should be involved in the due-diligence process from the onset. Internalauditors have specialized expertise relating to the identification of key business risks and howthese risks can be mitigated. If someone with this type of expertise had been involved duringthe pre-acquisition due-diligence review, the key issues that existed at BEI would have beenexposed. For example, the due-diligence team noted that the internal controls were strong sincethe family had a tight rein on most activities. An internal auditor would have identified this factoras a serious risk of management override – the family made the decisions without regard for propercontrol. As such, we have learned that the Internal Audit Department should be involved in thedue-diligence process from the beginning. Should the Internal Audit Department lack sufficientresources, some of its audits or consulting engagements should be put on hold or, if this is not pos-sible, alternate resources should be secured from one of the many reputable consulting firms whooffer these services.

Acknowledgements

The authors would like to thank the guest editors, Audrey Gramling and Jack Krogstad, for theirinsightful comments and guidance. The authors would also like to thank Larry Yarmolinsky, GarySpraakman and Ingrid Splettsoessor-Hogeterp for their comments on earlier versions of this case.

References

Aldhizer, G., & Bechara, M. (2011). Auditing the due diligence process. Corporate Compliance Insights. <http://www.corporatecomplianceinsights.com/2011/auditing-the-due-diligence-process/.

Canadian Union of Public Employees (CUPE) (2003). The health care infrastructure company of Canada. <https://cupedocs.cupe.ca/docushare/dsweb/GetRendition/Document-344html>.

Dounis, N. (2002). The role of internal audit during mergers and acquisitions: The European Union experience. Altomonte Springs, FL:Institute of Internal Auditors Research Foundation. <www.iia.nl/SiteFiles/Publicaties/M_A_EuropeanExperience.pdf>.

International Accounting Standards Board (IASB) (2012). International accounting standard (ISA) 11: Construction contracts.London, England: IASB.

Murphy, T. J. (2008). Structuring and managing construction risks in private public partnerships. Toronto, Canada: McMillian LLP.<http://www.lexology.com/library/detail.aspx?g=2df14e78-234b-460a-921d-44b4e02fce39>, <http://www.auditor.on.ca/en/reports_en/en08/303en08.pdf>.

Office of Auditor General of British Columbia (2011). Audit of the Academic Ambulatory Care Centre public private partnership:Vancouver Coastal Health Authority. <www.bcauditor.com/oagbc-understanding-p3-public-private-partnerships>.

Office of Auditor General of Ontario Annual Report (2008). Brampton Civic Hospital public-private partnership project.<www.auditor.on.ca/en/reports_en/en08/303en08.pdf.

Price Waterhouse Coopers (PWC). A Practical Guide to Risk Assessment.<http://www.pwc.com/us/en/issues/enterprise-risk-management/publications/guide-to-risk-assessment-risk-management-from-pwc.jhtml>.