AC557 Unit 10 Internal Control Assessment Report Example

Nine Designed Well, Eight Shown to Operate: A Unit 10 Control Assessment Report on Scrap Purchasing

[Student Name]

Purdue University Global

AC557: Internal Control Design, Development, and Evaluation

Unit 10 Control Assessment Report

[Instructor Name]

[Date]

Rookwood Metal Recovery, its parent and every figure and date are composite; the framework, standard and guidance cited are real.

To the SOX Program Office and, Through It, the Audit Committee

This report sets out management's assessment of internal control over the scrap purchasing process at Rookwood Metal Recovery as of December 31, prepared for the parent company's annual assessment of internal control over financial reporting.

Scope

The assessment covers scrap purchasing at Rookwood's three yards, Harbor Road, Kiln Street and Millrace Avenue, from the arrival of a seller to payment and the recording of inventory. It uses the 2013 internal control framework (Committee of Sponsoring Organizations of the Treadway Commission, 2013). The assessment date is December 31. The work included a walkthrough, a design review of fourteen controls, testing of nine key controls, a deficiency evaluation in July, and retesting after remediation.

Conclusions

Design. All nine key controls were suitably designed at December 31 to address the risks they are meant to address. Two controls were redesigned during the year: the override review became a preventive approval, and the grade photo is now locked to the truck's position on the scale.

Operation. Eight of the nine key controls operated effectively through the periods tested. For the ninth, the monthly scale calibration check at Kiln Street, the remediated control had not operated long enough before year-end to be tested, so management cannot conclude on its operating effectiveness at December 31. Management has evaluated that gap and concludes it is a deficiency that is not significant, for the reasons below.

Control by Control

C-02, scale calibration: designed suitably; operated effectively at Harbor Road and Millrace Avenue for all twelve months; at Kiln Street, the new reminder and escalation went live on October 20 instead of September 1, so only the November check could be tested before the retest window closed. Not concluded at Kiln Street.

C-03, grade photo: redesigned October 1; sixty loads tested from November 15 to December 5; no exceptions. Effective.

C-05, price table changes: twenty-five changes tested; no exceptions. Effective.

C-06, C-08 and C-12, automated controls over weights, posted prices and seller identification: tested once each, with general controls over the scale software tested and found effective by IT. Effective.

C-07, override approval: redesigned as preventive and live on September 15; forty yard-days tested in November; no exceptions. Effective.

C-10, net realizable value review: five months tested, including the three largest price movements. Effective.

C-11, kiosk loading: redesigned with badge-linked codes on September 1; thirty loadings tested in October; no exceptions. Effective.

Separating design from operation lets the report be precise about what management knows: every key control is built correctly, eight have been shown to work, and for one the honest statement is that the evidence is not yet in, not that the control has failed.

The Significant Deficiency Found in July

In July, management concluded that the override review, grade photo and Kiln Street scale check failures, taken together, were a significant deficiency affecting the cost at which scrap enters inventory. The override and grade photo controls have since been redesigned, operated for the required periods and passed retesting. With those two remediated, the remaining Kiln Street gap does not combine with anything else to affect the same assertion at more than an inconsequential level. Management therefore considers the significant deficiency remediated as of December 31.

Why the Kiln Street Gap Is Not Significant

The scales at Kiln Street were found within tolerance at every check that did occur, including the November check after remediation and the May check after the missed months. Scale drift is gradual, and a twenty-pound tolerance on loads averaging several thousand pounds limits any weight error to a fraction of a percent. Kiln Street handles about a quarter of Rookwood's purchases. Even an undetected drift at the tolerance limit for two months would affect purchases by well under $100,000, far below any threshold of concern for the consolidated statements (Public Company Accounting Oversight Board, 2007).

What the Audit Committee Should Watch

Three matters remain. First, the December scale check at Kiln Street, which will be tested in January to complete the evidence. Second, the general manager's role in price decisions: overrides above $150 now require the yard controller's approval in the system, and the number of overrides has fallen from 214 in the first quarter to 61 in the fourth, but the control environment concern raised at the start of the year, leaders' instructions entering the system under other people's names, should be revisited in a year. Third, the reliance on IT general controls for three automated controls, which means any change to the scale software must go through the tested change process.

How the Year Unfolded

The assessment began in March with a review of the control environment, prompted by the 214 overrides coded per GM in the first quarter. The objectives and risks were documented in April, the control matrix in May and the walkthrough in June, which found the grade photo and kiosk problems before any testing. Interim testing from January to June found the override review failing on three of forty yard-days and the report omitting overrides entered after midnight. The July evaluation combined those findings with the Kiln Street scale gap into a significant deficiency. Remediation ran from August to October, with interim measures in place throughout, and retesting ran from October to early December.

The sequence matters for the audit committee because it shows the deficiency was found by management's own process, early enough in the year to fix and retest, rather than by the external auditor at year-end. The parent's external auditor has reviewed the workpapers for the override and grade photo controls and has indicated it will rely on management's retesting for its own work, subject to its normal procedures.

Lessons for Next Year

Three lessons carry into next year's assessment. Walkthroughs should be performed before testing is planned, since this year's walkthrough removed two controls from the test plan and saved effort. Reports used by reviewers should be tested before the review is, since the override report's date filter would have made any review incomplete. And remediation dates should be set by counting back from year-end, so that monthly controls are fixed early enough to operate twice before testing.

Basis for the Conclusions

Management's conclusions are based on evidence obtained through the walkthrough, design review and testing described above, documented in the workpapers referenced in the appendix, and on the evaluation of deficiencies required for management's assessment (Securities and Exchange Commission, 2007).

References

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework. COSO.

Public Company Accounting Oversight Board. (2007). An audit of internal control over financial reporting that is integrated with an audit of financial statements (Auditing Standard No. 5). PCAOB.

Securities and Exchange Commission. (2007). Commission guidance regarding management's report on internal control over financial reporting under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Release No. 33-8810). SEC.