Controls review: walkthroughs, the risk and control matrix and segregation of duties

Several of the reporting issues in Lesson 5 arose because controls failed: a bill-and-hold sale was booked without proper approval, a warranty estimate was not checked against claims data, and payment terms were extended without finance approval. The controls workstream, led by Priya, asks whether Bluestem's key controls over its most important processes are designed well and operating as intended. ACCT-240 taught accounting information systems and internal control, and ACCT-431 taught IT general controls and the evaluation of deficiencies. This lesson applies them in an advisory review that is narrower than an audit but more focused on improvement.

Scoping the controls review

A twelve-week student engagement cannot review every control. Priya scopes the work by linking the risk profile from Lesson 2 to processes: revenue recognition and receivables link to the order-to-cash process; slow-moving inventory to inventory management; the unusual journal entries the analytics in Lesson 7 will look for to the financial close; and payment risks to procure-to-pay. Information technology underlies all four, so the review includes the IT general controls over the ERP system. Payroll, treasury and tax are out of scope, and the report says so.

The review uses the COSO Internal Control Integrated Framework (2013) as its reference, as Bluestem's management does for management's report on internal control over financial reporting and the auditor's attestation under section 404 of the Sarbanes-Oxley Act. COSO's five components are the control environment, risk assessment, control activities, information and communication, and monitoring activities. Most of the team's work is on control activities, but the findings on governance in Lesson 2 belong to the control environment, and the one-person internal audit function reporting to the chief financial officer is a monitoring weakness.

Walkthroughs

A walkthrough follows one transaction from start to finish through the process and the systems, using the same documents and screens the staff use. It shows how the process really works, which is often different from the written procedures. For order-to-cash, Priya and Liam follow a municipal sensor order from the customer's purchase order through contract review, order entry, credit check, shipping, invoicing, revenue recognition and cash receipt. At each step they ask what could go wrong, what control prevents or detects it, who performs the control and what evidence it leaves.

The walkthrough produced three surprises. First, sales staff can override the credit block in the ERP system by entering a manager's code, which several staff know. Second, month-end revenue cut-off relies on a spreadsheet in which the billing coordinator matches shipping records to invoices; it was not prepared for December 2026 because the coordinator was on leave. Third, the procedure for bill-and-hold sales requires finance approval against the criteria, but the sales director approved the December arrangement himself, and finance learned of it from the team.

The risk and control matrix

The risk and control matrix (RCM) lists, for each process, the risks of misstatement, the controls that address them, the type and frequency of each control, the owner, and the results of testing. It is the central document of a controls review. For each key control, the team tests a sample of instances to see whether the control operated: did the reviewer actually sign the reconciliation, and did the approval happen before the transaction? Sample sizes follow guidance used in practice: for a control performed many times a year, about 25 instances; for a monthly control, two or three months; for an automated control, one instance, provided the IT general controls over that system are effective.

# Bluestem Water Instruments Inc. (invented), in thousands of dollars, years ended December 31.
YEARS = [2024, 2025, 2026]
IS = {'Hardware revenue': [138000, 149500, 161200], 'Subscription revenue': [44000, 55600, 69800],
      'Hardware cost of sales': [82800, 92700, 104800], 'Subscription cost of sales': [11000, 13300, 16100],
      'Selling, general and admin': [42000, 48500, 56900], 'Research and development': [18200, 21000, 23600],
      'Depreciation': [6200, 6900, 7600], 'Amortization of intangibles': [3000, 4800, 4800],
      'Interest expense': [2100, 3900, 4600], 'Income tax expense': [3300, 2500, 2500]}
BS = {  # balances at December 31, 2023 to 2026
      'Cash': [18000, 24200, 25500, 23400], 'Receivables': [26000, 30000, 39800, 52100],
      'Inventories': [22000, 26000, 31500, 41900], 'Other current assets': [2800, 3000, 3600, 4100],
      'Property, plant and equipment': [45000, 48000, 51000, 53500], 'Right-of-use assets': [13000, 12000, 15500, 14800],
      'Intangible assets': [9000, 6000, 19200, 14400], 'Goodwill': [8000, 8000, 24000, 24000],
      'Payables': [15000, 17000, 19500, 22700], 'Accrued liabilities': [8000, 9000, 10500, 11200],
      'Deferred revenue': [11000, 14000, 18500, 21000], 'Warranty provision': [2300, 2500, 2700, 2600],
      'Income taxes payable': [1200, 1300, 900, 700], 'Lease liabilities': [13500, 13000, 16800, 16300],
      'Borrowings': [28000, 25000, 57000, 60000], 'Deferred tax liabilities': [1800, 2000, 2300, 2700],
      'Share capital': [40000, 40000, 40000, 42000], 'Retained earnings': [23000, 33400, 41900, 49000]}
CF = {'Cash from operations': [20900, 15900, 5800], 'Capital expenditure': [-8000, -8400, -8400],
      'Acquisition of Merrow Lane': [0, -34000, 0], 'Dividends paid': [-3000, -3000, -3000]}
def rev(i): return IS['Hardware revenue'][i] + IS['Subscription revenue'][i]
def cogs(i): return IS['Hardware cost of sales'][i] + IS['Subscription cost of sales'][i]
def ebit(i): return rev(i) - cogs(i) - sum(IS[k][i] for k in ('Selling, general and admin', 'Research and development', 'Depreciation', 'Amortization of intangibles'))
def ni(i): return ebit(i) - IS['Interest expense'][i] - IS['Income tax expense'][i]
ASSETS = ['Cash', 'Receivables', 'Inventories', 'Other current assets', 'Property, plant and equipment', 'Right-of-use assets', 'Intangible assets', 'Goodwill']
CUR_A = ASSETS[:4]
CUR_L = ['Payables', 'Accrued liabilities', 'Deferred revenue', 'Warranty provision', 'Income taxes payable']
LIABS = CUR_L + ['Lease liabilities', 'Borrowings', 'Deferred tax liabilities']
def tot(keys, t): return sum(BS[k][t] for k in keys)

# Lesson 6: risk and control matrix (RCM) and deficiency evaluation for the order-to-cash process.
rcm = [  # (risk, control, type, frequency, tested result: deviations, sample)
    ('Revenue recorded before control passes', 'Shipping documents matched to invoices before month-end close', 'Manual detective', 'Monthly', 2, 12),
    ('Sales to customers over credit limit', 'ERP blocks orders above approved limits', 'Automated preventive', 'Each order', 0, 1),
    ('Unapproved price changes', 'Price master changes approved by sales director', 'Manual preventive', 'As needed', 3, 25),
    ('Credit notes conceal errors or fraud', 'Credit notes over 5,000 approved by controller', 'Manual preventive', 'As needed', 1, 25),
    ('Bill-and-hold criteria not met', 'Finance reviews bill-and-hold requests against criteria', 'Manual preventive', 'As needed', 1, 3),
]
def judge(dev, n, kind):
    if kind.startswith('Automated'):
        return 'effective (tested one instance, relies on ITGCs)' if dev == 0 else 'not effective'
    rate = dev / n
    if dev == 0: return 'effective'
    if rate <= 0.05: return f'deviation rate {rate:.0%}: likely control deficiency, assess severity'
    return f'deviation rate {rate:.0%}: control not operating effectively'
print(f"{'Risk':42}{'Type':22}{'Result'}")
for risk, ctl, kind, freq, dev, n in rcm:
    print(f"{risk:42}{kind:22}{dev}/{n} -> {judge(dev, n, kind)}")
print("\nSeverity questions for each deficiency: how large could a misstatement be (magnitude), how likely is it,"
      "\nand do other controls compensate? Combine related deficiencies before concluding.")

Risk                                      Type                  Result
Revenue recorded before control passes    Manual detective      2/12 -> deviation rate 17%: control not operating effectively
Sales to customers over credit limit      Automated preventive  0/1 -> effective (tested one instance, relies on ITGCs)
Unapproved price changes                  Manual preventive     3/25 -> deviation rate 12%: control not operating effectively
Credit notes conceal errors or fraud      Manual preventive     1/25 -> deviation rate 4%: likely control deficiency, assess severity
Bill-and-hold criteria not met            Manual preventive     1/3 -> deviation rate 33%: control not operating effectively

Severity questions for each deficiency: how large could a misstatement be (magnitude), how likely is it,
and do other controls compensate? Combine related deficiencies before concluding.

The output shows the team's evaluation of five order-to-cash controls. The automated credit block worked in the instance tested, but its value is undermined by the known override code, and an automated control can only be relied on if IT general controls are effective, which is in doubt below. Three manual controls failed at high rates: the monthly cut-off match failed in two of twelve months, the price-change approval in three of 25 instances, and the bill-and-hold approval in one of three arrangements. The credit note approval failed once in 25, which may be an isolated lapse but still needs explanation.

Evaluating deficiencies

A control deficiency exists when a control is missing or does not operate as designed, so that a misstatement could fail to be prevented or detected on a timely basis. Under PCAOB AS 2201, a significant deficiency is less severe than a material weakness but important enough to merit the attention of those overseeing financial reporting, and a material weakness is a deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. Management must disclose material weaknesses in Item 9A. The team does not classify deficiencies formally, because that is management's and the auditor's role, but it ranks them using the same logic.

Applying that logic, the revenue cut-off and bill-and-hold failures rank highest. The potential misstatement is large: the December arrangement alone was 4.8 million, well above materiality. The likelihood is real: the failures occurred in the year under review, in a period of pressure on revenue targets. No compensating control caught the December sale; the team did. Considered together with the extended payment terms that bypassed contract review, they suggest a pattern of sales overriding finance controls at period end. That combination is the most important finding of the controls review.

Segregation of duties in the ERP system

Segregation of duties means that no single person can authorize a transaction, record it and control the related asset, because that person could both commit and conceal an error or fraud. In a modern ERP system, segregation is enforced through user roles. Over time, roles accumulate: staff change jobs and keep old access, backups are given broad rights, and temporary access becomes permanent. Priya obtained an extract of user roles from the ERP system and ran a conflict check against a matrix of incompatible combinations.

# Bluestem Water Instruments Inc. (invented), in thousands of dollars, years ended December 31.
YEARS = [2024, 2025, 2026]
IS = {'Hardware revenue': [138000, 149500, 161200], 'Subscription revenue': [44000, 55600, 69800],
      'Hardware cost of sales': [82800, 92700, 104800], 'Subscription cost of sales': [11000, 13300, 16100],
      'Selling, general and admin': [42000, 48500, 56900], 'Research and development': [18200, 21000, 23600],
      'Depreciation': [6200, 6900, 7600], 'Amortization of intangibles': [3000, 4800, 4800],
      'Interest expense': [2100, 3900, 4600], 'Income tax expense': [3300, 2500, 2500]}
BS = {  # balances at December 31, 2023 to 2026
      'Cash': [18000, 24200, 25500, 23400], 'Receivables': [26000, 30000, 39800, 52100],
      'Inventories': [22000, 26000, 31500, 41900], 'Other current assets': [2800, 3000, 3600, 4100],
      'Property, plant and equipment': [45000, 48000, 51000, 53500], 'Right-of-use assets': [13000, 12000, 15500, 14800],
      'Intangible assets': [9000, 6000, 19200, 14400], 'Goodwill': [8000, 8000, 24000, 24000],
      'Payables': [15000, 17000, 19500, 22700], 'Accrued liabilities': [8000, 9000, 10500, 11200],
      'Deferred revenue': [11000, 14000, 18500, 21000], 'Warranty provision': [2300, 2500, 2700, 2600],
      'Income taxes payable': [1200, 1300, 900, 700], 'Lease liabilities': [13500, 13000, 16800, 16300],
      'Borrowings': [28000, 25000, 57000, 60000], 'Deferred tax liabilities': [1800, 2000, 2300, 2700],
      'Share capital': [40000, 40000, 40000, 42000], 'Retained earnings': [23000, 33400, 41900, 49000]}
CF = {'Cash from operations': [20900, 15900, 5800], 'Capital expenditure': [-8000, -8400, -8400],
      'Acquisition of Merrow Lane': [0, -34000, 0], 'Dividends paid': [-3000, -3000, -3000]}
def rev(i): return IS['Hardware revenue'][i] + IS['Subscription revenue'][i]
def cogs(i): return IS['Hardware cost of sales'][i] + IS['Subscription cost of sales'][i]
def ebit(i): return rev(i) - cogs(i) - sum(IS[k][i] for k in ('Selling, general and admin', 'Research and development', 'Depreciation', 'Amortization of intangibles'))
def ni(i): return ebit(i) - IS['Interest expense'][i] - IS['Income tax expense'][i]
ASSETS = ['Cash', 'Receivables', 'Inventories', 'Other current assets', 'Property, plant and equipment', 'Right-of-use assets', 'Intangible assets', 'Goodwill']
CUR_A = ASSETS[:4]
CUR_L = ['Payables', 'Accrued liabilities', 'Deferred revenue', 'Warranty provision', 'Income taxes payable']
LIABS = CUR_L + ['Lease liabilities', 'Borrowings', 'Deferred tax liabilities']
def tot(keys, t): return sum(BS[k][t] for k in keys)

# Lesson 6: segregation of duties check on ERP user roles (synthetic extract, 40 users).
import random
random.seed(499)
roles = ['create_vendor', 'approve_invoice', 'release_payment', 'post_journal', 'approve_journal',
         'create_customer', 'issue_credit_note', 'receive_cash', 'adjust_inventory', 'count_inventory']
conflicts = [('create_vendor', 'release_payment', 'fictitious vendor payments'),
             ('approve_invoice', 'release_payment', 'pay own approvals'),
             ('post_journal', 'approve_journal', 'unreviewed journal entries'),
             ('issue_credit_note', 'receive_cash', 'conceal skimming with credits'),
             ('adjust_inventory', 'count_inventory', 'hide inventory losses')]
users = {}
for n in range(1, 41):
    k = random.choice([1, 2, 2, 3])
    users[f'U{n:02d}'] = set(random.sample(roles, k))
users['U07'] |= {'create_vendor', 'release_payment'}          # the AP clerk the walkthrough found
users['U31'] |= {'post_journal', 'approve_journal'}           # controller's backup login
hits = []
for u, r in sorted(users.items()):
    for a, b, risk in conflicts:
        if a in r and b in r: hits.append((u, a, b, risk))
print(f"Users reviewed: {len(users)}; role assignments: {sum(len(r) for r in users.values())}")
print(f"Conflicting combinations found: {len(hits)} across {len({h[0] for h in hits})} users\n")
for u, a, b, risk in hits: print(f"  {u}: {a} + {b}  ({risk})")
by = {}
for _, a, b, risk in hits: by[risk] = by.get(risk, 0) + 1
print("\nBy risk:", ", ".join(f"{k} {v}" for k, v in sorted(by.items(), key=lambda x: -x[1])))

Users reviewed: 40; role assignments: 85
Conflicting combinations found: 6 across 5 users

  U07: create_vendor + release_payment  (fictitious vendor payments)
  U07: approve_invoice + release_payment  (pay own approvals)
  U20: post_journal + approve_journal  (unreviewed journal entries)
  U25: post_journal + approve_journal  (unreviewed journal entries)
  U31: post_journal + approve_journal  (unreviewed journal entries)
  U38: create_vendor + release_payment  (fictitious vendor payments)

By risk: unreviewed journal entries 3, fictitious vendor payments 2, pay own approvals 1

Five of 40 users hold conflicting combinations. User U07, an accounts payable clerk, can create vendors, approve invoices and release payments, so could create a fictitious vendor and pay it. User U38 can also create vendors and release payments. Three users, including the controller's backup login, can both post and approve journal entries. The finding links directly to the analytics in Lesson 7, which looks for duplicate payments and unusual journals, and to the fraud risk discussion in Lesson 2. The team recommends removing the conflicts immediately, assigning a named owner for each role, and running a quarterly access review signed off by process owners.

IT general controls

IT general controls (ITGCs) support every automated control and every report the business relies on. They usually cover access to programs and data, program changes, program development and computer operations. ACCT-431 covered them in depth. Bluestem's ERP system is a cloud product configured by an outside partner. The team asked for the service organization's controls report for the hosting provider and for evidence of Bluestem's own controls.

The findings were mixed. Bluestem received the provider's SOC 1 Type 2 report, which covered the hosting environment and found its controls effective, subject to complementary user entity controls that Bluestem must operate, such as reviewing user access. Bluestem was not performing those reviews. Program changes to the ERP configuration are made by the partner on request by email, with no formal approval or testing record. Two former employees still had active accounts six months after leaving. These weaknesses mean the team cannot rely on automated controls such as the credit block without further evidence.

Communicating control findings

Control findings are written in a standard format: condition (what the team found), criteria (what should happen), cause (why it happened), effect (the risk or actual consequence) and recommendation. Writing in this format makes findings clear and actionable, and it forces the team to understand the cause, which is where the fix lies. Here is the team's draft of the main finding.

Condition: in 2026, finance approval was bypassed for at least one bill-and-hold sale and for extended payment terms on major contracts, and the December revenue cut-off review was not performed. Criteria: company policy requires finance approval of non-standard terms and bill-and-hold arrangements, and a monthly cut-off review. Cause: sales incentives reward revenue booked by year end; the finance team is small and lost a key member to leave in December; and there is no system enforcement of the approvals. Effect: revenue of 4.8 million was recognized a year early, and receivables and cash flow were affected. Recommendation: require finance approval in the ERP workflow before any non-standard term or bill-and-hold invoice can be issued; assign a backup for the cut-off review; and report exceptions to the audit committee quarterly.