Control Deficiency or Significant Deficiency? 1790



  • The auditors are saying the fact an accounting manager prepared and approved journal entries when one of the accountants was out is a ‘significant deficiency’ because some of the journal entries were quite large. Doesn’t the fact that many members of management reviewed the financials provide an offsetting control making the it only a control deficiency?



  • Hi and welcome to the forums 🙂 I’m more of IT person, but I’ll share some ideas below:
    The auditors are most likely looking at classical ‘Separation of Duties’ and ‘Autonomy Controls’ standards, (e.g., so that folks don’t approve their own transactions and go coast-to-coast in the capabilities to create potentially fraudulant transactions).
    I see this as a control deficiency. The transactions in question were subject to management review, although it’s perhaps on an ‘after the fact basis’.
    From an auditing standpoint, it may even be a ‘significant’ deficiency given the large monies involved. However, as the accounting manager was pinch hitting for an absent employee and is entrusted with the function – I have difficulty with some the adjectives our friends from audit sometimes use 😉
    I would recommend developing more formalized approval procedures when folks are out, (e.g., in this case someone should approve even the accounting managers work when staff are out of the office).



  • I agree with Harry.
    Interestingly we do not have a blanket segregation of duties when it comes to our journaling. In our environment we have relied upon higher level reviews by senior management to detect material errors. This has been accepted by our auditors.
    Not that I’m recommending this because maybe our company structure or the nature of our business might permit such flexibility given our controls with customer services, etc.



  • There’s a lot of potential avenues on this one.

    1. Is it inappropriate for this person to be approving JE’s? If not then you should look at a process where he doesn’t approve his own JE’s. It is a wholly correct finding that JE’s should not be prepared and approved by the same person.
    2. It is valid to have a process kick-in where you need to cover for holidays, illness, etc. You can make this more robust by having the regular approver retrospectively reviewing the JE’s on return from leave/illness.
    3. You may have mitigating/compensating controls e.g. review of financial statements, as you mention, could pick up erros. This would not necessarily have the level of sensitivity to pick up all errors but may be enough to get you out of signficant deficiency territory.
    4. Unless this happened around the year end I would also be tempted to argue that ongoing reconciliations, etc would reverse any error caused by these journals.


  • Another control you could look at would be to have someone review a listing of JE’s for the month at each period end for large and unusual items and/or reasonableness. This is good practice if you don’t have systems enforced segregation.



  • Hi,
    To add to the feedback provided to this question…
    COSO developed a useful guidance document, ‘Guidance for Smaller Public Companies Reporting on Internal Controls over Financial Reporting’, November 2005.
    On page 134 of the document, the following provides relevant guidance:
    Contrcl Objective
    Period-end closing adjustments are recorded completely and accurately.
    Risk
    When preparing period ending closing adjustments, personnel do not record all of the appropriate transactions into the general ledger. This may result in incomplete financial statements.
    When preparing period ending closing adjustments personnel do not accurately capture all appropriate information. This may result in inaccurate financial statements.
    Control Activity
    The Senior Accountant maintains a listing of recurring journal entries monthly, including adjusting, reversing, consolidating, and eliminating journal entries, to ensure that all journal entries required have been accounted for.
    FS Assertions:
    Existence, completeness
    Control Type:
    Preventive, Manual
    Additionally, another control activity that can be used…
    At the end of the month the Senior Accountant prints out a listing of manual journal entries from GL and compares it with the journal entry log to ensure that there are no differences.
    The control above is detective, but provides some risk reduction in the event that unauthorized journal entries have been posted to the GL.
    Hope this further helps,
    Milan


Log in to reply