Super Users, Late Journals and Thirty-Seven ECL Spreadsheets
You are auditing Tamweel Consumer Finance KSC, a CBK-licensed finance company with 350,000 active loan accounts. Revenue is KWD 42 million and profit before tax KWD 6.8 million; overall materiality is KWD 340,000. The core lending platform is outsourced but administered by Tamweel's IT team. Your IT specialist found 14 'super user' accounts, including three belonging to leavers whose access was never revoked; the CFO can post manual journals to the general ledger without a second approval; and the spreadsheet used to calculate the IFRS 9 expected credit loss allowance exists in 37 versions, with the finance manager selecting the final one. Journal-entry analytics identified 2,100 manual entries above KWD 5,000; 46 were posted on 31 December after 22:00, and nine of those were reversed on 2 January 2026. Management says these were 'year-end accrual clean-ups'.
1. Assess the risks of material misstatement and identify the ISA references that drive your response.
Read the worked answer
The dominant risk is management override of controls under ISA 240. The combination of super-user access, leaver accounts, an unrestricted CFO journal capability and nine after-hours entries reversed immediately after year-end is a textbook override pattern. Revenue recognition is also a presumed fraud risk for a consumer lender. The ECL allowance is a significant risk under ISA 540 because it is an accounting estimate with high subjectivity and a spreadsheet model with no version control.
The IT findings are relevant to ISA 315 (Revised). The auditor must understand the IT environment and the general IT controls that support automated application controls. If access management and change management are ineffective, automated controls and system-generated reports cannot be relied on, and the audit response shifts to substantive testing. ISA 330 then requires procedures responsive to the assessed risks, including tests of details and substantive analytical procedures.
The 37-version spreadsheet raises ISA 500 and ISA 540 issues: completeness and accuracy of data, formula integrity, and management bias. The nine reversals also require an ISA 240.35 journal-entry investigation: understand the business rationale, inspect approvals and supporting documents, and interview the CFO. The KWD 340,000 materiality is only 5% of profit, so individually small entries can still be material in aggregate.
2. Design the data analytics and substantive procedures you would perform on the journal entries and the ECL model.
Read the worked answer
For journals, run the test on the full population rather than a sample. Extract all manual entries to the general ledger, then isolate entries posted by super users and by the CFO, entries after normal working hours, round-number entries, entries with unusual account combinations, and entries reversed within five working days after year-end. For the 46 late entries and nine reversals, obtain the journal, the supporting calculation, the approver and the business explanation, and trace each to third-party evidence. Use CAAT to profile the 2,100 entries by user, amount and account, and compare the pattern with prior years.
For the ECL model, obtain all 37 versions and reconcile them. Identify which version produced the recorded allowance and why. Recalculate the model independently and test the key inputs: probability of default, loss given default, exposure at default, macroeconomic overlays, and the ageing of the loan book. Agree the loan data to the core lending system and test completeness and accuracy of the extract. Engage a credit modelling specialist to challenge the methodology and management overlays. Compare the final allowance with the prior year and with industry data, and test whether any post-year-end write-offs or recoveries corroborate the estimate.
For the super-user and leaver accounts, obtain the user list, confirm the leavers' status with HR, and inspect access logs for activity after the leavers' termination dates. Test whether the CFO's journals were reviewed by anyone else.
3. Can you rely on Tamweel's controls? What are the reporting consequences if the journal entries prove to be unsupported?
Read the worked answer
Reliance is not available at the level management would like. The ITGC deficiencies in access and the lack of segregation over CFO journals mean the automated controls and system reports are not reliable. The audit should adopt a predominantly substantive approach, expand sample sizes, and consider whether the deficiencies themselves constitute a significant deficiency in internal control. ISA 265 requires written communication to those charged with governance.
If the nine reversed entries prove to have no business rationale and were used to adjust revenue or the ECL allowance, the issue becomes fraud, not error. The auditor should quantify the effect, evaluate whether it is material individually or in aggregate, and consider the implications for the reliability of management representations. ISA 240 requires communication to those charged with governance and, where appropriate, to regulators; for a CBK-licensed entity, there may also be a duty to report matters to the Central Bank. The auditor should consider the impact on the opinion under ISA 705, and whether continuing the engagement is appropriate. At a minimum, the management letter should describe the access weaknesses, the manual journal control gap and the spreadsheet version control failure, with specific recommendations.