AC557 Unit 8 Compensating Control Seminar Reflection Example

The Margin Review Would Catch It, I Said: A Unit 8 Seminar Reflection on What Makes a Compensating Control

[Student Name]

Purdue University Global

AC557: Internal Control Design, Development, and Evaluation

Unit 8 Seminar Reflection

[Instructor Name]

[Date]

Rookwood Metal Recovery, the classmates and every figure are composite; the framework, standard and guidance cited are real.

My Case

The seminar asked whether Rookwood's grading weakness, photos taken after unloading, could be offset by another control, which would lower the severity of the finding. I argued yes. Each month the controller compares gross margin by grade family for each yard with the prior three months, and any swing above four percentage points is investigated. If graders were systematically upgrading loads, Rookwood would be paying copper-one prices for copper-two metal, and when that metal was sold at its true grade, margins would fall. A four-point swing in copper margin at a single yard is about $45,000 a month at current volumes. I thought that made the margin review a reasonable compensating control.

The Objections

Leila made two points.

First, margin is measured by family, not by grade. Copper is one family; number one and number two copper are grades within it. An upgrade from number two to number one raises cost, but if the yard also sells a mix of both grades, the family margin moves only by the share of upgraded loads times the price gap. At a 30-cent gap and one load in twenty upgraded, the effect on family margin is well under one point, far below the four-point threshold. The review is too coarse to see the very manipulation I said it would catch.

Second, the review is monthly and looks at margins, which arise only when the metal is sold, often weeks after it was bought. By the time a pattern appeared, the purchases would be paid and the inventory valued at the inflated cost for at least one quarter-end.

Where My Defense Failed

I tried to save the argument by saying the review would still catch a large manipulation. Leila agreed, and asked how large. Working it through on the whiteboard, a yard would need to upgrade about one load in four for the copper margin to move four points. Anything less passes. My compensating control compensated only for a failure so big that someone in the yard would probably have noticed anyway.

A control compensates for a weakness only if it operates at a precision fine enough to detect the misstatement the weakness allows, and a family-level, four-point, monthly margin review would let a grader upgrade most of the loads that matter without ever crossing its threshold.

What the Framework Says

The framework's guidance on smaller companies treats compensating controls as acceptable only when they operate at a level of precision that would prevent or detect a misstatement that could be material, and it asks evaluators to document that precision rather than assume it (Committee of Sponsoring Organizations of the Treadway Commission, 2006). The auditing standard makes the same point: a compensating control must operate effectively and at a sufficient level of precision (Public Company Accounting Oversight Board, 2007). I had assumed precision because the control looked rigorous.

Why I Believed It

I think I believed in the margin review because it was the most senior control in the process. It was performed by the controller, it covered every yard and it had a numerical threshold, which made it feel rigorous. Leila's point was that seniority and coverage are not the same as precision. A control performed by the most experienced person can still be too coarse to see what matters, and in this case the threshold was set to catch market swings, not grading behavior. Nobody had ever asked what size of grading error four points corresponded to, because the review was designed for a different purpose. Reusing a control for a purpose it was not built for is how compensating controls get overstated.

What Changed in How I Evaluate

I now ask four questions before calling any control compensating. At what level is it performed, family, grade or load? What threshold triggers investigation, and what misstatement would that threshold miss? How soon after the error does it operate? And has it been tested, or only described? Rookwood's margin review fails the first two and is weak on the third.

What I Would Recommend

The margin review should stay, as a useful monitoring control for large problems, but it should not be cited as compensating for the grading weakness. A better detective control would be a weekly regrade of ten random loads per yard from their photos by the yard controller. Once photos are taken before unloading, that regrade is precise at the load level, and it could be added to the matrix as a key control.

What I Take Into Practice

I learned to calculate a control's threshold in terms of the error it is supposed to catch before I trust it (Securities and Exchange Commission, 2007).

References

Committee of Sponsoring Organizations of the Treadway Commission. (2006). Internal control over financial reporting: Guidance for smaller public companies. COSO.

Public Company Accounting Oversight Board. (2007). An audit of internal control over financial reporting that is integrated with an audit of financial statements (Auditing Standard No. 5). PCAOB.

Securities and Exchange Commission. (2007). Commission guidance regarding management's report on internal control over financial reporting under Section 13(a) or 15(d) of the Securities Exchange Act of 1934 (Release No. 33-8810). SEC.