The IT Access Control Gap
You are auditing Northwind Retail, a listed company with a 30 June year-end. During IT general controls testing you find that 14 of 60 terminated employees still had active access to the general ledger system, some for up to seven months after termination. The system administrator is also able to post journal entries and approve them. Management says the access review is performed quarterly by the finance manager, but no evidence of the review can be produced for the last three quarters. The company relies on a third-party payroll provider whose controls are covered by a SOC 1 Type 2 report with no exceptions. Journal entries are the main risk area because manual top-side adjustments total $9 million against materiality of $450,000.
1. Assess the implications of these IT deficiencies for the audit strategy and the reliance you can place on controls.
Read the worked answer
The deficiencies are pervasive rather than isolated:
- Terminated-user access undermines the assumption that only authorised users can initiate or post transactions. It is a deficiency in the control environment for the financial system.
- Segregation of duties is broken because the administrator can both post and approve journal entries. This is a classic incompatible-duties conflict.
- No evidence of the quarterly review means a key detective control cannot be tested; an undocumented control is, for audit purposes, not operating.
The SOC 1 report on the payroll provider is helpful but irrelevant to the general ledger, which is where the risk lies. Do not let a clean service organisation report create a halo effect.
Because manual journal entries of $9 million are 20 times materiality, the auditor cannot simply rely on the ledger. The strategy should shift toward substantive testing of journal entries, with the IT findings documented as a control deficiency communicated to those charged with governance. The auditor should not conclude controls are effective.
2. Design the journal entry testing approach and explain how the IT findings shape the criteria you will use.
Read the worked answer
Journal entry testing should be risk-based and data-driven:
- Extract the full journal entry population from the general ledger for the year.
- Apply selection criteria informed by the IT findings: entries posted by the administrator, entries posted and approved by the same user, entries posted by terminated users, entries around period-end, round-number entries, and entries with unusual account combinations.
- Vouch selected entries to supporting documentation and assess business rationale.
- Test the completeness of the extract by reconciling to the trial balance.
Because segregation of duties is broken, the usual assumption that approval implies independent review fails. The auditor should therefore treat all entries posted by the administrator as high risk and test them, not just a sample. The terminated-user population should also be tested for entries after the termination date.
The IT findings do not by themselves prove misstatement. They change the risk of material misstatement and therefore the nature and extent of substantive work. The conclusion should state whether the journal entries tested were supported, and whether the deficiencies represent a significant deficiency or material weakness for reporting to governance.