Billing Migration: Scoping a Revenue Engagement With 220 Hours Left
MidCap Software has 14,200 subscribers and $38 million of annual recurring revenue. In March it migrated billing from a legacy system to a new SaaS platform, and the deferred-revenue reconciliation is still performed in a 41-tab spreadsheet. Manual credits and refunds total $2.1 million year to date and can be approved by any of six account managers. The CFO has asked internal audit to "cover revenue end to end" before the year-end audit. You have two auditors, 300 budgeted hours, and 40 hours already consumed on walkthroughs. A separate IT audit team completed a review of the new platform's change management controls eight weeks ago. The prior revenue audit, three years ago, raised two low-rated issues, both closed. The external auditor has set overall materiality at $650,000.
1. Write the engagement objective and scope, and justify what you exclude.
Read the worked answer
Objective (risk-based, not title-based): determine whether revenue is recorded completely and accurately, whether credits and refunds are properly authorized, and whether deferred revenue is reliably reconciled - the three areas where the migration and manual processes concentrate risk.
In scope: quote-to-cash transaction flow; the $2.1M credit/refund population; the deferred-revenue spreadsheet, including its formula integrity and the manual journal entries feeding it.
Excluded, with documented rationale: full IT general controls for the new platform (change management was covered by the IT audit team eight weeks ago - re-performing it is duplication, not coverage); income-tax treatment of deferred revenue (specialist area, low residual risk).
Why this is defensible: 220 hours remaining must be allocated where inherent risk is highest - a mid-year system migration plus a manual reconciliation plus decentralized credit authority. "End to end" is a client aspiration, not an audit objective. Document the prioritization in the planning memo, confirm it with the audit committee chair rather than only the CFO, and note the residual risk that ITGCs outside change management were not re-tested this cycle.
2. How should the team decide between full-population analytics and sampling for (a) the $2.1M of credits and (b) the pricing on 240,000 invoice lines?
Read the worked answer
Match the technique to the population's size, homogeneity, and the assertion at risk.
(a) Credits/refunds - test the full population. At $2.1M across a modest number of transactions, 100% testing is cheaper than designing a sample and removes sampling risk entirely. Run: duplicate-credit detection (same subscriber, same amount, within 30 days); a segregation-of-duties test against the approval matrix; stratification by approver and by amount; round-number/just-below-threshold clustering; time-of-day and month-end concentration (a classic pressure indicator).
(b) Invoice pricing - sample, but not before testing completeness. First reconcile invoice line count and value to the billing-system control totals and the general ledger; if the population is incomplete, no sample is valid. Then use attribute sampling for price-against-contract accuracy, stratified so contract amendments and non-standard pricing are over-weighted.
Document the population definition, completeness check, and parameters in the workpapers. The judgment being tested is not "which tool" but whether you can articulate why each technique gives sufficient, appropriate evidence for the specific assertion.
3. Two weeks later the CFO asks you to add a review of the pricing engine's cybersecurity and says that otherwise he will tell the board internal audit "did not cover revenue end to end." How do you respond?
Read the worked answer
Separate the legitimate request from the pressure.
Legitimate part: cybersecurity of the pricing engine may be a real risk. Acknowledge it, and treat it as a candidate for a separate engagement or the next annual risk-based plan.
Pressure part: scope is set by risk assessment and approved by the audit committee, not by a client's framing of the report. Adding a technical cyber review now would require skills the team does not have, would not be delivered to a professional standard within the remaining 220 hours, and would crowd out the revenue testing that is already under way.
Action: respond in writing - restate the approved objective and scope, note the cyber risk as logged and carried into plan development, and offer a scoping meeting for a discrete engagement with an IT specialist. If the CFO persists in threatening to characterize the work publicly as incomplete, inform the CAE and, if unresolved, raise it with the audit committee chair, since a client's mischaracterization of scope impairs the function's ability to report objectively. Document the conversation in the engagement file.