| Course | AC557 Internal Control Design, Development, and Evaluation |
|---|---|
| Unit | Unit 3 |
| Paper type | Control design matrix |
| Length | About 750 words, 5 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Accounting |
| Updated | October 2026 |
Free sample paper for AC557 Unit 3
Fourteen Risks, Fourteen Controls, Nine Marked Key: A Unit 3 Control Design Matrix for Scrap Purchasing
[Student Name]
Purdue University Global
AC557: Internal Control Design, Development, and Evaluation
Unit 3 Control Design Matrix
[Instructor Name]
[Date]
Rookwood Metal Recovery and every control are composite; the framework, standard and guidance cited are real.
How the Matrix Is Laid Out
The matrix runs fourteen rows and eleven columns: risk reference, control reference, control statement, preventive or detective, automated, manual or IT-dependent manual, entity or process level, frequency, precision, key or non-key, evidence produced, and the framework principle served, 10 for control activities, 11 for general controls over technology or 12 for policies and procedures (Committee of Sponsoring Organizations of the Treadway Commission, 2013). A control statement is written as who does what, how often, to what threshold, and what happens when an exception appears. A statement missing any of those cannot be tested.
The Rows
C-01, tare weight (R-01). The scale software requires an outbound tare weigh for every ticket; stored tare weights are accepted only for registered fleet trucks re-verified quarterly. Preventive, automated, per load. Non-key.
C-02, scale calibration (R-02). Each month the yard supervisor tests each scale with certified test weights at three load levels and records results; a deviation above 20 pounds takes the scale out of service until recalibrated. Detective, manual, monthly. Key.
C-03, grade photo (R-03). Before unloading, the grader photographs the load in the truck bed; the software will not complete the ticket without a photo time-stamped before the unload event. Preventive, IT-dependent manual, per load. Key.
C-04, duplicate tickets (R-04). The software blocks a second ticket for the same vehicle within thirty minutes without supervisor release. Preventive, automated. Non-key.
C-05, price table changes (R-05). The purchasing director approves every change to the posted price table in the system before it takes effect; the system logs user, time and prior value. Preventive, IT-dependent manual, per change. Key.
C-06, weights from the scale (R-06). Weights can enter a ticket only through the scale interface; manual weight entry is disabled. Preventive, automated. Key.
C-07, override review (R-07). Each operating day, the yard controller reviews the system's override report for the prior day, signs it by 10 a.m. on the next business day and documents an investigation of every override above $150, escalating any without a written reason to the regional controller. Detective, IT-dependent manual, daily, precision $150. Key.
C-08, posted price applied (R-08). The software applies the posted price for the grade selected; operators cannot key a price except through the override function. Preventive, automated. Key.
C-09, cutoff (R-09). Tickets take the system timestamp at weigh-in; at month-end the accounting manager reviews the last day's tickets against the gate log. Detective, manual, monthly. Non-key.
C-10, net realizable value (R-10). Each month the controller compares inventory cost by grade with the published market index less processing and freight, and writes down any grade above net realizable value. Detective, manual, monthly, precision $10,000 per grade. Key.
C-11, kiosk loading (R-11). Payment kiosks are loaded by two employees using separate codes, and the cash loaded is counted and signed by both. Preventive, manual, each loading. Key.
C-12, seller identification (R-12). The software will not release payment until the seller's identification and vehicle plate are scanned and matched. Preventive, automated. Key.
C-13, split payments (R-13). The software flags a seller with more than one ticket in a day whose combined cash exceeds the legal limit, and the yard supervisor reviews flags daily. Detective, IT-dependent manual. Non-key.
C-14, restricted items (R-14). Restricted items, such as catalytic converters and utility wire, require documentation of lawful ownership and a holding period before payment. Preventive, manual. Non-key.
Every key control states a performer, a frequency, a threshold and a response, because a control described only as "management reviews overrides" gives a tester nothing to check and gives the reviewer no reason to act on what she sees.
Notes on Key Selection
Key controls are those that, alone or together, address the risk of material misstatement in the purchase and inventory assertions and would be tested for the parent's assessment (Public Company Accounting Oversight Board, 2007). The five non-key controls either support a key control, as C-04 supports C-06, address compliance rather than reporting, as C-13 and C-14 do, or cover lower risks. The automated controls rely on general controls over the scale software, which are tested separately; if those fail, C-06, C-08 and C-12 cannot be relied on as key (Securities and Exchange Commission, 2007).
References
Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework. COSO.
Public Company Accounting Oversight Board. (2007). An audit of internal control over financial reporting that is integrated with an audit of financial statements (Auditing Standard No. 5). PCAOB.
Securities and Exchange Commission. (2007). Commission guidance regarding management's report on internal control over financial reporting under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Release No. 33-8810). SEC.
What the AC557 Unit 3 assignment asks for
Unit 3 of AC557 asks you to design controls that respond to the risks you identified. Build a matrix with one row per risk and columns for the control reference, the control statement, preventive or detective, automated or manual or IT-dependent manual, entity or process level, frequency, precision, key or non-key, evidence produced and the framework principle served. Write each control statement so that a tester could decide whether it operated: who performs it, what they do, how often, at what threshold and what happens to exceptions. Mark key controls and explain the selection. Note dependencies, such as automated controls that rely on general controls over technology. Avoid controls described only as reviews without precision. Tie the design to COSO's control activity principles, AS 2201 and Release 33-8810, listed in APA 7.
How the AC 557 Unit 3 example is put together
The sample's layout section explains eleven columns and the who, what, how often, threshold and response formula for each statement. Fourteen rows follow: an outbound tare requirement, monthly scale checks with test weights and a 20-pound tolerance, grade photos time-stamped before unloading, blocks on duplicate tickets, approval of price table changes, weights only from the scale interface, the daily override review with a $150 threshold, automatic posted prices, cutoff review, monthly net realizable value review, two-person kiosk loading, identification scans before payment, split-payment flags and restricted-item holds. The highlighted sentence explains why precise statements matter. Notes explain key selection and IT dependence.
Reading the AC557 Unit 3 grading rubric
Control design matrices in AC557 earn points for testable control statements and sound classification. Graders check that every risk has a control, that each statement names a performer, frequency, threshold and response, and that type, nature and level are classified correctly. The rubric rewards clear reasoning about which controls are key and attention to dependencies such as reports used by reviewers and general controls behind automated ones. Evidence columns that describe what a tester would inspect show practical design. Matrices with vague statements such as management reviews, missing thresholds or every control marked key lose substantial credit. Clear layout and APA 7 references to the framework, standard and guidance complete the work.
AC557 Unit 3 help: mistakes that cost points
Common Unit 3 errors include control statements that describe intentions rather than actions, such as management monitors pricing, which cannot be tested. Thresholds are omitted, so the reviewer's precision is unknown. Controls are misclassified, for example calling a review of a system report fully manual. Every control is marked key, which wastes testing effort, or none is explained. Automated controls are relied on without noting their dependence on general IT controls. Some risks are left without a control. If your section's process or risk list differs, a writer can design a matrix around your risks with statements written to be tested.
Get an AC557 Unit 3 example written to your instructions
Bring the risks from your Unit 2 work or the list the Unit 3 prompt hands out, with the rubric and any matrix template the section uses. Each risk gets one control with performer, frequency, precision and exception response written out, delivered within 24-48h. The first custom matrix is free. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More AC557 papers and MS in Accounting samples
- AC557 Unit 1: Control Environment Discussion
- AC557 Unit 2: Control Objectives and Risks Worksheet
- AC557 Unit 4: Process Walkthrough
- AC557 Unit 5: Test Plan
- AC557 Unit 6: Testing Workpaper
- AC557 Unit 7: Deficiency Evaluation Memo
- AC557 Unit 8: Seminar Reflection
- AC557 Unit 9: Remediation Plan
- AC557 Unit 10: Control Assessment Report
- AC550 Unit 3: Accounting System Flowchart
- AC507 Unit 3: Partnership Outside Basis Problem
- AC505 Unit 3: Service Department Cost Allocation
- AC501 Unit 3: Exposure Draft Comment Letter
AC557 Unit 3 questions, answered
What does precision mean for a review control?
The size of error a review would detect. A controller who investigates every override above 150 dollars has a stated precision; one who looks over the report for anything unusual has none. Precision matters because a detective control supports a conclusion only if it would catch misstatements smaller than what could matter, which is why the matrix gives it a column.
What makes a control IT-dependent manual?
A person performs it, but using system-generated information, such as a report of overrides. If that report omits tickets, the review fails without anyone knowing. The matrix flags these controls so the testing units cover the report itself, checking that it is complete and accurate, as well as the person's review of it.
Why only one control per risk?
Many AC557 prompts ask for a clean mapping, and one control per risk forces the analysis to decide which control actually addresses the risk. Where two controls seemed necessary, the sample found two risks hiding in one row. Real organizations layer controls, and later units return to that when compensating controls come up.
Where can I find a free AC557 Unit 3 sample paper?
This page holds a full AC557 Unit 3 control design matrix for scrap purchasing at Rookwood Metal Recovery with fourteen controls, nine key, precise statements and APA 7 references.
Why are some controls marked non-key?
Key controls are the ones relied on to address the risk of material misstatement in the assertions. The five non-key controls support a key control, address compliance rather than reporting, or cover lower risks.