ACC 4150 Module 1 Internal Control Deficiencies Written Assignment Example

Three Findings at Ironbound Precision Castings: Classifying Control Deficiencies in an Integrated Audit

Student Name

Bachelor of Science in Business Administration, Thomas Edison State University

ACC-4150: Advanced Audit

Mentor Name

Month Day, Year

Three Findings at Ironbound Precision Castings: Classifying Control Deficiencies in an Integrated Audit

Introduction

Ironbound Precision Castings, Inc. makes aluminum and steel castings for aerospace and pump manufacturers and reports about $310 million in annual revenue. As an accelerated filer, it receives an integrated audit: an opinion on its financial statements and an opinion on the effectiveness of its internal control over financial reporting as of year end. Overall materiality for 2025 has been set at $1.5 million. During interim testing, the engagement team found three deficiencies. This assignment evaluates their severity, the evidence still needed and the effect on the reports.

The Severity Framework

A deficiency exists when a control's design or operation does not allow management or employees, in performing their normal duties, to prevent or detect misstatements on a timely basis. The most serious category, a material weakness, applies when one gap or several together make it reasonably possible that a misstatement large enough to matter slips through before anyone catches it. One step down sits the significant deficiency, a gap that falls short of that threshold yet still belongs in front of the audit committee (Messier et al., 2017). The evaluation turns on two questions: how likely is it that the deficiency could lead to a misstatement, and how large could that misstatement be, considering any compensating controls? Whether a misstatement actually occurred does not decide the question.

Finding 1: Manual Journal Entries Without Review

The controller can post manual journal entries of any size, and the policy requiring a second person to review entries above $50,000 was not followed for 11 of 25 entries tested. The controller has access to every account, including revenue and reserves. A compensating control exists in part: the chief financial officer reviews account fluctuations above $500,000 each month. But that review would not catch several entries below that size, which together could exceed materiality, and it does not address an entry designed to look normal. Because management override of controls is a recognized fraud risk and the potential misstatement is unlimited, there is a reasonable possibility of a material misstatement. The fact that the 25 entries tested were all supported by documentation does not change the conclusion, since the deficiency concerns what the control could fail to catch, not what the sample happened to contain. Finding 1 is a material weakness.

Finding 2: The Inventory Count at the Paterson Plant

At the smallest of three plants, count teams did not use prenumbered tags and the supervisor did not perform blind recounts. Paterson holds about $2.1 million of inventory, roughly 7% of the total. The auditors observed the count and traced 40 items with no exceptions, and the company runs a cycle count program that would reveal large errors within a quarter. The magnitude of a possible misstatement is limited by the size of the plant's inventory, and the cycle counts reduce its likelihood. The deficiency deserves correction but does not create a reasonable possibility of a material misstatement. It is a deficiency, reported to management in writing, and not a significant deficiency.

Finding 3: Programmers With Production Access

Two developers who maintain the enterprise resource planning system have unrestricted access to the live production environment, and changes are not formally approved or tested. The system calculates revenue for long-term contracts recognized over time. No unauthorized changes were found in a review of the change log, but the log itself can be altered by the same developers. This information technology general control deficiency affects the reliability of every automated control and report that depends on the system. If it stood alone, it might be a significant deficiency, because the team found no evidence of misuse and the business staff reconcile contract revenue to billing each month. Combined with Finding 1, however, the two deficiencies weaken the control environment around revenue in the same direction. The engagement team should evaluate them together, and the combination supports the material weakness conclusion already reached.

Tests of Controls Still Needed

Controls that were found effective must be tested for operating effectiveness through year end. Sample sizes depend on how often a control operates.

For each control, the team will inquire, observe, inspect documentation and, for key automated controls, reperform. Because Finding 3 casts doubt on the system, automated controls in the revenue cycle cannot be relied on until the access problem is fixed and the team tests the corrected controls, so substantive testing of contract revenue must be expanded.

Effect on the Reports

Unless the journal entry review is fixed and working before December 31, Ironbound's own assessment must conclude that its controls were not effective, and the firm's opinion on those controls will be adverse, with the weakness described in the report. The financial statement opinion can still be unmodified if expanded substantive procedures, such as testing all manual entries above a lower threshold and confirming contract terms, give enough evidence that the statements are fairly presented. The two opinions answer different questions: whether controls could have prevented a misstatement and whether the statements, after audit adjustments, are actually misstated.

Research shows why the distinction matters to users. Doyle et al. (2007) found that material weaknesses were more common in smaller, younger, more complex and rapidly changing companies, and Ashbaugh-Skaife et al. (2008) reported that companies disclosing control problems had noisier accruals, and that the noise shrank once the problems were fixed. An adverse internal control opinion therefore tells investors something about the reliability of future earnings, not only this year's.

Conclusion

Of the three findings, the unreviewed journal entries are a material weakness, the Paterson count is a deficiency and the access problem is at least a significant deficiency that compounds the first. The team's next steps are a written letter to Ironbound's audit committee describing both serious findings, wider substantive work on contract revenue and manual entries, and a draft adverse control opinion that stands unless the fixes are in place and tested by year end.

References

Ashbaugh-Skaife, H., Collins, D. W., Kinney, W. R., & LaFond, R. (2008). The effect of SOX internal control deficiencies and their remediation on accrual quality. The Accounting Review, 83(1), 217-250. https://doi.org/10.2308/accr.2008.83.1.217

Doyle, J., Ge, W., & McVay, S. (2007). Determinants of weaknesses in internal control over financial reporting. Journal of Accounting and Economics, 44(1-2), 193-223. https://doi.org/10.1016/j.jacceco.2006.10.003

Messier, W. F., Glover, S. M., & Prawitt, D. F. (2017). Auditing and assurance services: A systematic approach (10th ed.). McGraw-Hill Education.