Auditing Santa: “Snow Assurance”

20 December 2020

We have recently started working for a new client outside of Yorkshire. Santa Claus has operated a successful organisation for a number of years, but we could provide no assurance that there was a suitable control environment in place to successfully achieve the organisation’s objectives.

Some key findings of the audit were:

• Santa was unable to provide any timesheet records for the elves that work for the organisation.
• However we have evidence that the elves work exceptionally long hours in October, November and December, and are likely to be breaking the Working Time Directive.
• The work status of elves was also unclear. There was no evidence of any Right to Work checks or any checks on the IR35 status of the elves.
• Potentially there has been fraudulent timesheet claims by Mr Claus. We have evidence of duplicated claims where Mr Claus has allegedly been working at a number of large retail outlets at the same time on the same day.
• We were presented with a list of who has been naughty and nice but could not reconcile this to a list of ‘gifts’ made by the organisation.
• There was no evidence of any income recording system. Mr Claus claims that no income is received for the items produced. No bank reconciliation could be provided.
• There was no declaration of gifts received and accepted by team members. A number of clients reported that gifts had been accepted on frequent occasions by members of the Santa Claus team. There is a suggestion that Mr Claus and his team will withdraw services from clients who do not leave a suitable inducement for the team.
• Mr Claus has not carried out a health and safety assessment for his sleigh driving and is potentially frequently driving under the influence of alcohol.
• Mr Claus and his organisation have an increasing reliance on IT and an increasing online presence. However there is no IT policy, cyber security policy or business continuity policy. Santa is known to operate in a challenging physical environment and no contingency plan is in place for bad weather or a shortage of reindeers to pull his sleigh on key evenings.

Although the organisation has a very poor control environment, there is no record of failure to meet the key objectives of the organisation. However, unless you have similar magical powers to Santa Claus you may not be so lucky if your control environment is so poor.