AC550 Unit 9 Internal Control Gap Assessment Example

Two Breaks Between the Handheld and the Bill: A Unit 9 Control Gap Assessment of a Cylinder Rent Cycle

[Student Name]

Purdue University Global

AC550: Accounting Information Systems

Unit 9 Control Gap Assessment

[Instructor Name]

[Date]

Halvorsen Welding Supply and every figure are composite; the framework, standard and textbooks cited are real.

Summary

Two points in the cylinder rent cycle allow the record that drives billing to change without evidence. First, a driver can void a stop's scans and rescan before the handheld syncs, leaving no record of the first count. Second, the nightly transfer overwrites each account's holdings count, replacing manual corrections and late-keyed counter swaps without logging the prior value. Accounts where the billing count disagrees with the last physical scan of each cylinder number 468, and the rent attached to the disputed cylinders is about $18,000 a month.

Step Table

The cycle was followed through nine steps. For each, the assessment asked what evidence the step leaves, whether that evidence survives to the bill, and what application or general control is expected.

Steps one to three, order entry, dispatch and loading, leave a sales order and route sheet; both survive. Step four, the driver's scan, leaves a serial-level record, but the void-and-rescan feature means the evidence may not reflect the first count. Step five, the sync, transfers scans intact. Step six, the nightly transfer, replaces holdings with a total and leaves no prior value; evidence does not survive. Steps seven to nine, counter swaps, rent billing and ledger posting, depend on step six and inherit its weakness.

Gap 1: Handheld Void and Rescan

An application control should prevent a recorded transaction from being deleted without trace. The handheld allows voids without a reason code and does not keep voided scans. The risk is that a driver who disputes a count with a customer, or who misplaced a cylinder, can make the record agree with whatever he chooses. Exposure is hard to size directly because voids leave nothing, but drivers interviewed estimate several voids a week across all routes.

Fix: configure the handheld to require a reason code for every void and to retain voided scans in the synced data, visible to the branch operations manager. Owner: IT administrator. Date: within thirty days, before the new package's cutover.

Gap 2: Nightly Overwrite

A general control over data processing should ensure automated jobs change records only through authorized, logged transactions. The nightly job writes totals directly, so a correction made at 9 a.m. can be undone at 2 a.m. with no record. This gap explains most of the 468 disagreeing accounts.

Fix: retire the job with the old system; until then, run a daily report comparing each account's billing count with the scan database and hold rent bills for accounts that differ by more than two cylinders. Owner: controller. Date: report within two weeks; retirement at cutover.

Both gaps sit at the point where serial-level evidence becomes a summary number, which is why monthly reviews of the ledger never found them: the ledger was right about the numbers it received, and the numbers were wrong before they arrived.

Other Steps Reviewed

The other seven steps were reviewed and found adequate for now. Sales orders require a customer number and are approved by customer service. Route sheets are printed from the system and signed by drivers. The sync from handheld to scan database is complete and logged. Ledger posting reconciles daily. The weaknesses are concentrated at the two points where serial data becomes totals, which is also where the new package will make its biggest change.

Why These Gaps Persisted

Both gaps have existed for years. Nobody designed them; they grew from reasonable choices, a void button added to help drivers fix mis-scans and a nightly job written when the scan database was added. Neither choice was reviewed as a control decision, because no one owned the holdings field until the governance brief assigned it.

Severity

For Halvorsen's financial statements, $18,000 a month of disputed rent is about $216,000 a year against $4.9 million of rent revenue. Individually and together, the gaps create a reasonable possibility that rent revenue and receivables are misstated by more than a trivial amount, and the auditors should be told in writing. Whether the combined deficiency is a material weakness depends on materiality for the year, which the auditors will set (American Institute of Certified Public Accountants, 2012).

Monitoring After the Fix

The branch operations manager will review void reason codes weekly, and the controller will review the daily comparison report until cutover. After cutover, the change log in the new package replaces both (Committee of Sponsoring Organizations of the Treadway Commission, 2013; Romney et al., 2021).

References

American Institute of Certified Public Accountants. (2012). Communicating internal control related matters identified in an audit (AU-C Section 265). AICPA.

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework. COSO.

Romney, M. B., Steinbart, P. J., Summers, S. L., & Wood, D. A. (2021). Accounting information systems (15th ed.). Pearson.