| Course | AC314 Accounting Information Systems and Enterprise Risk Management |
|---|---|
| Unit | Unit 6 |
| Paper type | Internal control matrix |
| Length | About 740 words, 5 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | BS in Accounting |
| Updated | October 2026 |
Free sample paper for AC314 Unit 6
Twelve Threats, Sixteen Controls, Three Honest Limits: A Unit 6 Internal Control Matrix for a Wholesale Nursery
[Student Name]
Purdue University Global
AC314: Accounting Information Systems and Enterprise Risk Management
Unit 6 Internal Control Matrix
[Instructor Name]
[Date]
Stillbrook Nursery, its staff roles and every figure are composite; the framework, textbook and guidance cited are real.
How to Read Each Row
Each row gives the threat as an event, then its controls in this order: what the control does; who performs it; when; evidence left; prevent or detect; COSO component and principle (Committee of Sponsoring Organizations of the Treadway Commission, 2013).
The Matrix
1. Plants delivered to chain stores are never scanned or paid; $450,000 unexplained last season. Control A: match delivery counts to scans by store and plant; receivables supervisor; every Monday; signed match report; detect; information and communication, principle 13. Control B: cap replenishment shipments at each store's past sell-through; sales manager; at order; override log; prevent; control activities, principle 10.
2. Growing mix paid without proof of weight; about $161,000. Control C: payables software refuses to pay a mix invoice until a scale ticket number is entered; system; at invoice entry; blocked-invoice report; prevent; principle 11. Control D: reconcile the supplier's monthly tonnage statement to scale tickets; controller; monthly; signed reconciliation; detect; principle 16.
3. Dead-plant credits issued without evidence; $130,000 above last year. Control E: credits require a photograph or returned plants, and credits over $250 need the sales manager's approval in the system; sales staff and sales manager; at credit; attached evidence and approval stamp; prevent; principle 10. Control F: monthly credit report by salesperson; owner; monthly; initialed report; detect; principle 16.
4. Signed delivery tickets never invoiced; $41,300. Control G: weekly report of printed ticket numbers not yet invoiced, with gaps investigated; billing clerk; weekly; annotated exception report; detect; principle 13.
5. Will-call cash taken and covered by lapping. Segregation limit: the receivables clerk also staffs the counter on busy days. Control H: owner compares the daily deposit slip with the cash receipts register; daily; initialed slip; detect; principle 10. Control I: customer statements mailed by the office manager, not the receivables clerk; monthly; mailing log; detect; principle 16.
6. Supplier bank details changed by a fraudulent email. Control J: the office manager phones the supplier at its known number before keying any change, and the controller confirms it in the system; office manager and controller; at change; change log with call notes; prevent; principle 11.
7. Supplier prices above blanket terms; about $22,000. Control K: blanket prices loaded, and invoices more than 2 percent over are held; system; at invoice entry; variance report; prevent; principle 11.
8. Chain deductions accepted without detail. Control L: undocumented deductions disputed within 30 days; receivables clerk; weekly; dispute log; detect; principle 10.
9. Liner shortages never claimed. Control M: planting crews enter tray counts on handhelds, and short trays route to the buyer; crew lead; at planting; shortage report; detect; principle 13.
10. One owner approves every disbursement and signs supplier contracts. Segregation limit. Control N: the second owner reviews the monthly payment register and vendor master changes; monthly; signed register; detect; principle 16.
11. The receivables clerk maintains customer records and posts sales. Segregation limit. Control O: monthly review of the customer master change log; controller; monthly; initialed log; detect; principle 16.
12. Orders shipped to customers over their credit limit. Control P: system credit hold released only by the credit manager; at order; release log; prevent; principle 10. This control already works and is kept.
Where a four-person office cannot split a duty, the matrix does not pretend it can; it names the conflict and places a detective control in the hands of someone who has no access to the asset at risk.
Notes on the Matrix
Preventive controls are favored where the system can enforce them cheaply, as in rows 2, 6 and 7. Detective controls carry the load where people must judge, such as credits and chain deductions. Every control leaves evidence an auditor could inspect, because a control that leaves no trace cannot be tested (Romney & Steinbart, 2018). Fraud risk, COSO's eighth principle, is addressed directly in rows 5 and 6, which follow the anti-fraud guidance on pairing controls with the schemes most likely in a business of this size (Committee of Sponsoring Organizations of the Treadway Commission & Association of Certified Fraud Examiners, 2016).
References
Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework. https://www.coso.org
Committee of Sponsoring Organizations of the Treadway Commission & Association of Certified Fraud Examiners. (2016). Fraud risk management guide. https://www.coso.org
Romney, M. B., & Steinbart, P. J. (2018). Accounting information systems (14th ed.). Pearson.
AC314 Unit 6 instructions, in plain terms
The sixth AC314 unit asks for a control matrix built from the threats found in earlier units. Write each threat as an event with its exposure, and order rows from the largest. For each threat, describe one or more controls with six attributes: what the control does, who performs it, when, what evidence it leaves, whether it prevents or detects, and the COSO component and principle it serves. Prefer system-enforced preventive controls where they are cheap. Use detective controls where judgment is needed. Be honest about segregation of duties in a small organization, naming the conflict and the compensating control. Keep controls that already work. Add notes explaining the overall design. Make sure every control leaves evidence an auditor could test. Cite COSO 2013, the textbook and fraud risk guidance in APA 7.
How this AC314 Unit 6 example is built
The sample explains the order of attributes in each row, citing COSO. Twelve numbered rows follow. Row 1 pairs store-level matching with sell-through caps. Row 2 pairs a payables block on mix invoices without scale ticket numbers with a monthly tonnage reconciliation. Row 3 requires photographs or returned plants for credits and a monthly credit report. Rows 5, 10 and 11 name segregation limits, the will-call clerk, the owner who signs and approves, and the clerk who maintains customer records, each with a detective control by someone else. Row 6 adds a call-back for bank changes, and row 12 keeps the working credit hold. The highlighted sentence explains the approach to segregation limits. Notes explain where preventive and detective controls were chosen and cite the 2016 COSO and ACFE fraud risk guide.
Where the points sit in the AC314 Unit 6 rubric
AC314 control matrices are graded row by row, so every control needs all six attributes; a control without a performer or evidence earns little. Controls must address the threat in their row, not a neighboring one. A mix of preventive and detective controls, chosen for reasons, shows design judgment. Tying each control to a COSO component and principle, not just the framework's name, earns precision credit. Honest treatment of segregation limits with compensating controls is valued in small-business cases, while claiming separation that the staff size cannot support loses points. Ordering by exposure shows priorities. Notes that explain the design add analysis. Evidence that an auditor could test is a recurring check. Purdue Global's AC314 instructors expect COSO 2013, the textbook and fraud risk guidance cited in APA 7.
AC314 Unit 6 help: mistakes that cost points
Control matrices often list controls as slogans, such as segregate duties or review invoices, with no one named to perform them. Students attach several controls to one threat while leaving others uncovered. Every control is preventive, which a small business could never afford. Segregation of duties is demanded in a four-person office without any compensating control. COSO is cited by name with no component or principle. Evidence is not mentioned, so nothing could be tested. Existing controls that work are ignored. Rows are in random order. If your threats come from a different case, such as a clinic or a restaurant, a writer can build the matrix with every attribute filled and the segregation limits handled honestly.
Get an AC314 Unit 6 example written to your instructions
Include the threats from your earlier units, or the list handed out with Unit 6, plus the rubric and the matrix layout your section uses. Each threat gets a control with an actor, a timing and evidence behind it, returned within 24-48h. Your first custom sample is free and built on your case alone. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More AC314 papers and BS in Accounting samples
- AC314 Unit 1: What an AIS Owes Its Users Post
- AC314 Unit 2: Order-to-Invoice System Flowchart
- AC314 Unit 3: Data Flow Diagram Set
- AC314 Unit 4: Revenue Cycle Analysis
- AC314 Unit 5: Expenditure Cycle Analysis
- AC314 Unit 7: Fraud Scenario Analysis
- AC314 Unit 8: Risk Register
- AC314 Unit 9: Seminar Reflection
- AC314 Unit 10: Systems Recommendation Report
- AC312 Unit 6: Full-Population Exception Tests
- AC302 Unit 6: Cash Flow Interpretation Memo
- AC301 Unit 6: Lease Classification Analysis
- AC300 Unit 6: Bank Reconciliation
AC314 Unit 6 questions, answered
How many rows does a control matrix need?
As many as the threats your earlier analysis identified, or the number the prompt sets. The AC314 sample carries twelve because the two cycle analyses ranked twelve threats. More rows with thinner controls score worse than fewer with complete ones, since each row is tested for actor, timing and evidence. Where your prompt names a count, the sample keeps the highest-ranked threats and says which were left out.
What is the difference between a preventive and a detective control?
A preventive control stops a threat before it produces a loss or an error, such as a system that refuses an order over the credit limit. A detective control finds the problem afterward, such as a daily report of delivery tickets never billed. Both are needed. Graders check the labels because a reconciliation called preventive signals the distinction was missed.
Should the matrix cite COSO?
When the prompt asks, cite it precisely: the 2013 Internal Control Integrated Framework, its five components and, ideally, the principle each control serves. Citing the framework by name without a component adds nothing. The sample uses principle numbers because they show which part of the framework a control actually belongs to, and a one-line key explains them for the reader.
Where can I find a free AC314 Unit 6 sample paper?
This page gives a complete AC314 Unit 6 internal control matrix for a composite wholesale nursery, twelve threats with sixteen controls, segregation limits, COSO principles and APA 7 references.
How does the AC314 Unit 6 matrix handle a four-person office?
Where one person must hold conflicting duties, the matrix names the conflict and adds a detective control run by someone with no access to the asset, such as an owner comparing deposits with the receipts register.