| Course | ACC 640 Auditing |
|---|---|
| Module | Module 5 |
| Paper type | graduate internal control assignment under AS 2201 |
| Length | About 1,020 words, 6 pages |
| Format | APA 7 student paper |
| School | Southern New Hampshire University |
| Program | MS Accounting |
| Updated | October 2026 |
Free sample paper for ACC 640 Module 5
Internal Control Testing and Deficiency Evaluation: Online Order-to-Cash
[Student Name]
Southern New Hampshire University
ACC 640: Auditing
Module Five Assignment
[Instructor Name]
[Date]
The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.
Internal Control Testing and Deficiency Evaluation: Online Order-to-Cash
Introduction
Online sales of about $247 million, 60 percent of revenue, flow through the company's e-commerce platform into its ERP system. Last year the predecessor reported a material weakness in IT general controls because developers had unrestricted access to the production order database. This assignment plans and evaluates our tests of controls over online order-to-cash for the integrated audit, following the top-down approach in AS 2201 (Public Company Accounting Oversight Board, 2016).
Entity-Level Controls
Entity-level controls affect how much we can rely on process controls. The audit committee meets quarterly, includes a former audit partner and received the predecessor's weakness report. The interim CFO introduced a monthly close checklist with controller sign-off. The company's risk assessment process identified the IT weakness and funded remediation. These are effective but not precise enough to detect a misstatement in online sales on their own, so they support rather than replace process-level controls.
Key Controls and Assertions
Walkthroughs of three orders, from cart to shipment to settlement, identified the controls that matter.
Key controls over online order-to-cash
| Control | Type and frequency | Assertion | Test approach |
|---|---|---|---|
| Platform prices orders from the approved price table | Automated, each order | Accuracy | Test one instance of each pricing scenario, relying on ITGCs |
| Order released for shipment only when payment is authorized | Automated, each order | Occurrence | Test configuration and one instance, relying on ITGCs |
| Revenue recognized only when carrier confirms pickup | Automated, each order | Cutoff, occurrence | Test configuration; reperform with year-end data |
| Daily reconciliation of processor settlements to recorded sales, reviewed by accounting manager | Manual, daily | Completeness, occurrence | Sample of 40 days |
| Monthly controller review of sales, returns and margins by channel | Manual, monthly | All, at a less precise level | Sample of 2 months plus December |
The daily reconciliation is the key manual control because it catches orders recorded without payment and payments not recorded as sales. A sample of 40 for a daily control is consistent with the firm's guidance for controls performed many times a year.
IT General Controls
The three automated controls are reliable only if IT general controls over the platform and ERP work: access to programs and data, program changes and computer operations. The weakness was in access. In July the company removed developer write access to production, moved deployment to a separate release team and introduced quarterly access reviews. We tested the new controls from August through December: a review of all users with production access at two dates, a sample of 25 program changes for approval and testing, and the September and December access reviews. All operated effectively. Five months of operation of a quarterly review gives only two instances, so we also tested the system log for any unauthorized changes over the period, which found none.
Deficiency One: The Remediated Access Weakness
For the first half of the year, the weakness existed. AS 2201 requires the auditor's opinion on internal control as of year end, so a weakness remediated and tested for a sufficient period before December 31 does not result in an adverse opinion. Because the new controls operated effectively for five months and the change log showed no unauthorized changes, we concluded the weakness was remediated as of year end. The substantive testing of revenue for January through June will still treat automated controls as unreliable for that period.
Deficiency Two: The Unreviewed Reconciliation
Our sample found that from July 7 to July 28, while the accounting manager was on leave, the daily reconciliations were prepared but not reviewed. This is a deficiency in operating effectiveness. To classify it, AS 2201 asks whether there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. Online sales in that period were about $14 million; the reconciliations themselves showed differences of only $9,000, and the controller's monthly review of sales by channel would detect a difference approaching our $1.1 million materiality, because it compares recorded sales to processor totals and investigates variances above $100,000. That compensating control operated in July. We therefore classify the lapse as a deficiency, not a significant deficiency, and will communicate it to management in writing.
Testing the Daily Reconciliation
For each of the 40 sampled days, we will obtain the reconciliation, agree the processor settlement total to the processor's report downloaded by our own staff, agree recorded sales to the ERP sales journal, recompute the difference, and inspect evidence of the manager's review, including follow-up on any item above the $5,000 investigation threshold. A review signature alone is not enough evidence of a precise review. For a sample of reconciling items, we will check that the explanation was supported and resolved within the following week. If we find one exception in the sample beyond the July lapse, we will expand testing, and two exceptions would lead us to conclude the control is not operating effectively. The control's precision matters too: a $5,000 threshold on daily sales of about $680,000 is precise enough to catch errors far below materiality.
Communications
AS 2201 and AS 1305 require written communication to management of all deficiencies and to the audit committee of significant deficiencies and material weaknesses before the auditor's report is issued. We will report the July reconciliation lapse to management in our letter of recommendations. Because the predecessor's material weakness was disclosed publicly, we will also brief the audit committee on our evaluation of its remediation, including the testing window and the reliance we placed on the change log. Management's own report on internal control must reach the same conclusion; if it describes the weakness as remediated, we will review the evidence management used, since our opinion covers management's assessment as well as the controls.
Conclusion
With the access weakness remediated and the new lapse limited to a deficiency, we expect to report no material weakness in online order-to-cash at year end. Ashbaugh-Skaife et al. (2008) found that companies that remediated control weaknesses showed improved accrual quality, which supports giving weight to effective remediation. Our substantive procedures will still cover the first half of the year with less reliance on controls (Arens et al., 2020).
References
Arens, A. A., Elder, R. J., Beasley, M. S., & Hogan, C. E. (2020). Auditing and assurance services (17th ed.). Pearson.
Ashbaugh-Skaife, H., Collins, D. W., Kinney, W. R., & LaFond, R. (2008). The effect of SOX internal control deficiencies and their remediation on accrual quality. The Accounting Review, 83(1), 217-250. https://doi.org/10.2308/accr.2008.83.1.217
Public Company Accounting Oversight Board. (2016). An audit of internal control over financial reporting that is integrated with an audit of financial statements (AS 2201). Author.
What the ACC 640 Module 5 instructions ask for
The Module Five assignment in ACC 640 usually asks you to plan or evaluate tests of internal control over financial reporting for a significant process. Plan to apply the top-down approach in AS 2201: start with entity-level controls, identify significant accounts and assertions, understand the flow of transactions through walkthroughs, select key controls and decide how to test their design and operating effectiveness. Many versions include IT general controls and ask you to evaluate deficiencies, classifying each as a deficiency, significant deficiency or material weakness based on likelihood and magnitude. Explain why each control is key and how compensating controls affect severity, and note how long any remediated control has operated.
How this ACC 640 Module 5 internal control assignment example is built
The paper walks through online order-to-cash. Key controls include an automated price check against the approved price table, an automated match of orders to payment authorizations and carrier shipments, and a daily manual reconciliation of payment processor settlements to recorded sales. The automated controls rely on IT general controls; developer access, last year's weakness, was remediated in July and tested over a five-month window. A new deficiency appears: the daily reconciliation went unreviewed for three weeks in July. Because a monthly controller reconciliation would detect a material difference, the lapse is a deficiency, not a significant deficiency. With access remediated, no material weakness remains, and the paper lists what will be communicated to management and the audit committee.
Where the ACC 640 Module 5 rubric puts the points
Rubrics for the internal control assignment typically score the top-down approach, identification of key controls, testing approach and sample sizes, treatment of IT general controls, deficiency evaluation and use of the standards. Top papers explain why each control addresses a specific assertion, link automated controls to the IT controls they depend on, use sample sizes consistent with control frequency and evaluate severity with both likelihood and magnitude while considering compensating controls. Graders also reward attention to how long a remediated control must operate and to the written communications the standard requires. Common deductions include testing every control rather than key ones, ignoring IT dependencies and classifying deficiencies without reasoning.
ACC 640 Module 5 help: the mistakes that cost points
Internal control papers most often slip on severity: a deficiency is classified by whether there is a reasonable possibility of a material misstatement, not by whether one occurred, and compensating controls must operate at a level of precision that would prevent or detect such a misstatement. A second weak spot is automated controls, which can be tested with a single instance only if the IT controls over them are effective. If your case is a private company audit, internal control is evaluated for planning, not opined on, but the same reasoning applies. Write the assertion beside every control before choosing tests; a control that cannot be tied to an assertion is not key.
Get ACC 640 Module 5 written to your instructions
Send the ACC 640 Module 5 assignment and the process facts. The paper will identify key controls, design tests with sample sizes, evaluate any deficiencies for severity and support each step with AS 2201. Plan on roughly two days; your first costs nothing. The paper above is an original model document written by our desk, not a submitted student paper and not an official Southern New Hampshire University document.
More ACC 640 papers and related MS Accounting samples
- ACC 640 Module 1 Discussion: Who Audits the Auditors?
- ACC 640 Module 2 Client Acceptance Assignment: Taking Over After a Resignation
- ACC 640 Module 3 Milestone One: Materiality and the Risks That Matter
- ACC 640 Module 4 Discussion: Skepticism and the Returns Reserve
- ACC 640 Module 6 Milestone Two: Inventory at Someone Else's Warehouse
- MBA 540 Module 6 Project Milestone Three Buy Build Ally
- MBA 687 Module 3 Milestone One Change Readiness Assessment
- ACC 550 Module 9 Transfer Pricing Assignment: What Should Candy Pay for Halves?
- ACC 610 Module 7 Discussion: What IFRS Would Do Differently With Impairments
ACC 640 Module 5 questions, answered
Where can I find a free ACC 640 Module 5 Internal Control sample?
This page includes a full ACC 640 Module 5 assignment testing controls over online sales and evaluating deficiencies.
What is the top-down approach under AS 2201?
Starting with the financial statements and entity-level controls, then focusing on significant accounts, relevant assertions and the controls that address the risks to them.
How are control deficiencies classified?
As a deficiency, a significant deficiency or a material weakness, depending on whether there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis.
Why do automated controls depend on IT general controls?
Because an automated control can be relied on consistently only if access, change management and computer operations controls ensure it has not been altered or bypassed.
How long must a remediated control operate before it can be tested?
Long enough to provide sufficient evidence of operating effectiveness, which depends on the control's frequency; a daily control needs fewer weeks than a quarterly one.