Brightline Retail: post-go-live IT general control failures and the effect on the audit

Classification.

• Access: 12 shared generic logins destroy accountability and make the audit trail unattributable; a developer with production access holds incompatible rights, since the person who can change code can also change data without detection. Both are access-management deficiencies.
• Change management: 47 emergency changes, 9 without testing evidence, means changes could reach production untested and unapproved. This is one of the most serious categories, because it undermines every automated control the changes touched.
• Operations: the interface error folder is unmonitored, so failures in the price file are not detected or corrected; the unreconciled 2.6 million suspense account shows the reconciliation control does not operate.
• Segregation of duties: one user can create and approve journal entries, which permits unrecorded or unsupported adjustments.

Reliance. These deficiencies are pervasive rather than isolated, and management's assertion of effective operation throughout the year is not supportable. Automated application controls cannot be relied on: a control cannot be effective when the access, change and operations controls that protect it have failed, and one cannot test a control that was switched off for six weeks.

Consequences. Take a substantive approach for the affected cycles - revenue, inventory and payables. Expand sample sizes, use full-population data analytics instead of samples, perform cutover reconciliation procedures for the six-week match-off period, and treat the journal entry population as high risk for management override. Assess whether the deficiencies amount to a material weakness in internal control, report in writing to those charged with governance, and ensure the file documents why reliance was withdrawn.

Revenue. Compare daily sales by store for the four weeks before and after go-live, looking for duplicated invoices from the price-file interface and for a spike or trough at cutover. Reconcile the legacy closing balances to the ERP opening balances, agreeing store-level totals to the last legacy trial balance. Test a sample of invoices with no dispatch note in the six-week match-off window to delivery data held by the carriers, since internal matching evidence does not exist.

Inventory. The 4,000 negative on-hand SKUs are the entry point: extract them, trace each to the receipts and shipments that produced the negative, and identify whether the cause is a cut-off error, a unit-of-measure conversion fault or a duplicated transaction. Recompute the inventory roll-forward from opening balance plus receipts less cost of sales. Test the cost of goods sold calculation for the affected SKUs, because negative quantities mask misstated cost.

Suspense account. Obtain the itemized listing behind the 2.6 million, age every item, and trace each to source. At 2.9 times overall materiality this account alone could cause a misstatement, so it must be cleared or quantified as an uncorrected misstatement.

Journal entry criteria. Extract the full population and filter for: entries posted by the shared generic logins or by the developer's account; entries to the suspense account; round-dollar and just-below-threshold amounts; entries posted outside normal business hours or in the last five days of the period; and entries to accounts rarely used. Investigate each hit against support, and treat anything unsupported as a misstatement rather than waiving it.

Opinion. If the 2.6 million suspense balance cannot be substantiated after performing the reconciliation and alternative procedures, and the misstatement is uncorrected, the effect is material at 2.9 times overall materiality. The auditor cannot obtain sufficient appropriate evidence over that balance, and the likely outcome is a qualified opinion for a scope limitation on a material but not pervasive item. If the roll-forward analysis shows the error contaminates revenue and cost of sales across the year, the effect becomes pervasive and a disclaimer would be considered. If management's own analysis supports a quantifiable correction that they refuse to record, qualify for material misstatement instead, with the amount stated.

Fraud consideration. The developer's production access combined with the create-and-approve journal entry rights raises a fraud risk under management override. Document whether the journal entry testing found any evidence, and if it did, treat the matter as suspected fraud and escalate.

Communications to those charged with governance. In writing: the deficiencies found, their classification and their potential effect on the financial statements; the withdrawal of reliance on automated controls and the consequential increase in scope and cost; management's assertion that controls operated effectively throughout the year as unsupported; the unreconciled suspense account and the unremediated access and change-management issues; and the fraud risk arising from the developer's access. Include a recommendation to remediate the generic logins, developer access and journal approval rights immediately, and set a timetable. Where the entity is subject to an audit committee or regulator, ensure the material weakness conclusion is reported, not buried in a management letter.