Aggregating ITGC Deficiencies Before Year-End at Calder Health

Framework, applied rather than recited. A deficiency exists where a control is missing or not operating such that a misstatement could occur and not be prevented or detected timely. A significant deficiency is less severe than a material weakness but important enough to merit audit committee attention. A material weakness is a reasonable possibility that a material misstatement would not be prevented or detected timely. The test is about the possibility of a material misstatement - not about whether one occurred, and not about how many people were affected.

Individual evaluation

• User termination, 3 of 40 (7.5%). On its own this might be a deficiency. Two facts escalate it: the control is pervasive - it governs access to the general ledger, purchasing, and payroll, not one module - and it was reported as remediated in Q2 and is now failing again. A remediation that is asserted and then not tested into operation is worse than an open issue, because management and the auditor both relied on it for part of the year. At minimum a significant deficiency; the repeat nature makes material weakness arguable.
• Change approval, 8 of 60 (13%). On its own, moderate. Combined with the shared privileged account, it means changes could be made without approval and without attribution.
• Shared privileged database account. This is the most serious single item in isolation. There is no accountability for any action taken under it, it can alter data directly without application controls, and it defeats the change-approval control entirely because a direct data change needs no deployment.
• Warehouse badge logs. Physical, and further from financial reporting. A deficiency, likely not significant on its own - unless inventory at those warehouses is material and shrinkage or custody is a risk area.

Why aggregation matters. The access findings - terminations, shared privileged ID - are not two isolated events; they affect the same assertion (unauthorised transactions and unauthorised changes to financial data) across the same system. Aggregating deficiencies that share an assertion or a process is required, and a set of individually moderate deficiencies can collectively constitute a material weakness. My preliminary view: the combination of uncontrolled logical access (terminations failing on a repeat basis) and an unattributable privileged account on a financially significant ERP, absent strong detective controls, is likely at least a significant deficiency and plausibly a material weakness.

What moves it one way or the other: whether a competent person reviews audit logs and reconciles key accounts in a way that would detect an unauthorised transaction before the financial statements are issued. If that control exists and operates, material weakness becomes harder to argue. If it does not, the access findings sit on top of a system with no detection layer, which is the classic material weakness pattern.

The argument is not responsive to the standard. Severity is assessed on whether a material misstatement could occur and go undetected - not on the number of users involved. The logic fails on its own terms:

• A single shared privileged account can post any journal entry, alter any table, and change any configuration. The population size is one and the potential impact is the entire ledger. Fewer users means less accountability, which aggravates rather than mitigates.
• The 7.5% termination failure rate is not evidence that 92.5% is fine. A control with a 7.5% tested failure rate cannot be relied upon at all; the auditor must treat the population as uncontrolled and extend testing. 'Isolated' is the wrong frame - the finding is about the reliability of the control, not the count of individuals.
• A repeat finding contradicts the claim that the issues are unrelated one-offs. They share a root: no reliable join between HR status and system access, and no periodic access recertification to catch what automation misses.

Compensating controls that would genuinely change the conclusion

• Independent review of application and database audit logs, performed by someone outside IT, with evidence of follow-up on exceptions - this creates a detection layer and is the single most important one.
• Automated reconciliation and analytical review over the accounts most exposed to a fraudulent entry (payroll, purchasing, revenue cut-off), performed monthly with documented review.
• Periodic access recertification by business owners, with removal evidenced - this is detective and would catch termination failures within a month rather than 22 days.
• Monitoring of direct database changes against the approved change population, which would detect use of the shared account.

Controls that would not change my conclusion: policies, training, and management's assertion of oversight. None of them detect anything.

Judgement: the argument should be rejected politely but firmly, and the response should shift from 'why this is minor' to 'here is the detection layer we will operate before year-end, and here is the evidence.' That is the response that both satisfies the auditor and actually reduces risk.

Before year-end (sequenced by what reduces risk fastest)

1. Emergency access sweep within a week. Reconcile the HR roster to every directory and application account, disable all terminated users, and produce a signed reconciliation. This is a day of work and removes the largest live exposure.
2. Kill the shared privileged account. Issue individual named accounts to the three administrators, vault the credentials, rotate, and log. Then review what was done under the shared ID during the period - activity review, not just closure.
3. Rebuild the termination control properly. The HR feed exists but is evidently not reliable: add a daily exception report of feed failures reviewed by a named person, plus a monthly access recertification by business owners. Test the feed - find out why three terminations did not flow, because the failure mode will recur.
4. Retrospective change and journal review for the period, focusing on entries and changes made outside the approved population. If nothing is found, that is itself a compensating-control result worth documenting.
5. Badge logging at the two warehouses - either implement retention or document a compensating physical control (supervised access, cycle counts) and accept the residual risk in writing.

To the auditor

• Disclose all four findings, the aggregation analysis, and management's own conclusion on classification, promptly. Do not wait to be asked whether the Q2 remediation worked - volunteers that it did not, and explain why.
• Provide the results of the retrospective reviews. An auditor who sees a detection layer find nothing is in a very different position from one who sees no detection layer.
• Flag that the previously reported remediation was asserted without effective testing; the auditor will evaluate management's monitoring competence, and being forthright is far better than being caught.

To the audit committee (in writing)

• The findings, their root causes, and whether management believes a material weakness exists as of the reporting date, with reasoning.
• The remediation plan with owners and dates, and what will be tested and by whom.
• An honest statement on the prior-year remediation: what was reported, what was tested, and why it did not hold. That is the sentence that determines whether the committee trusts the next remediation plan.
• The residual risk accepted, with a named owner - not a general assurance that everything is under control.