ACCT 650 Week 7 Individual Learning Project Example

Evaluating the Month-End Close and Journal Entry Controls at Pinecrest Medical Distribution Against the COSO Framework

Introduction

This paper evaluates how Pinecrest Medical Distribution controls its monthly close and the entries posted during it; Pinecrest is a private company that supplies hospitals and clinics with surgical and patient-care products and earns about $180 million a year. The proposal for this project, submitted in Module/Week 3, identified the problem: a close that takes eleven business days and relies heavily on manual entries prepared and posted by a small team. The question is whether those controls, as designed and as actually run, are strong enough to stop or catch a material error in the monthly and annual statements that Pinecrest's lenders, owners and prospective buyers rely on.

The question matters beyond Pinecrest. Research on public companies found that internal control deficiencies were associated with lower accrual quality and that remediation improved it (Ashbaugh-Skaife et al., 2008), and that weaknesses were concentrated in smaller companies with fewer accounting resources (Doyle et al., 2007). A private distributor preparing for a possible sale has the same reasons as a public company to want reliable numbers, and fewer outside checks to catch the errors.

The Financial Reporting Process

Pinecrest's close begins on the first business day after month-end, when the warehouse and sales systems cut off shipments and invoices. On days one through three, staff accountants reconcile the receivables and payables subledgers to the general ledger, record accrued payroll and post depreciation from a fixed asset schedule maintained in a spreadsheet. On days four through seven, the team prepares the estimates: the customer rebate accrual, which reflects volume rebates owed to hospital purchasing groups; the inventory obsolescence reserve; the freight allocation between cost of goods sold and inventory; and various accrued expenses. On days eight through ten, the controller reviews account fluctuations against the prior month and budget, posts final adjustments and produces the financial statement package. On day eleven, the package goes to the owners and, quarterly, to the bank with a covenant compliance certificate. The accounting system allows any user with posting rights to enter and post a journal entry directly; approval workflow exists in the software but has never been switched on. Supporting documents are kept in shared folders organized by month rather than attached to entries.

Method

The evaluation used the five components of the COSO internal control framework as its criteria (Committee of Sponsoring Organizations of the Treadway Commission [COSO], 2013). Evidence came from three sources. First, I walked through the close with each of the five members of the accounting team, documenting who performs each step, in what order and with what review. Second, I reviewed the written close procedures, the chart of accounts and the user access listing for the accounting system. Third, I selected 40 manual journal entries from the last two quarters, weighted toward large and unusual entries, and tested each for evidence of preparation, independent approval and supporting documentation. The 40 entries represented about 18 percent of manual entries by count and 46 percent by value in the two quarters. For each entry I recorded who prepared it, who posted it, whether a reviewer's initials or system approval appeared, whether support existed and whether the support agreed to the amount. I also recalculated the rebate accrual for one month from the underlying rebate agreements and sales data. Findings were rated using the deficiency categories familiar from internal control audits: control deficiency, significant deficiency and material weakness.

Findings by COSO Component

Control environment

Pinecrest's leadership communicates a clear commitment to accurate reporting, and the controller is respected for integrity. The weakness is capacity rather than intent. Five people perform the close for a business that has grown by roughly half in four years, and two of them are new. Overtime during the close is routine, and the controller personally prepares several of the most judgmental entries. A control environment that depends on overworked staff is one in which review is the first task to be skipped. The COSO framework's principles for this component include a commitment to attract, develop and retain competent people, and Pinecrest's growth has outpaced that commitment. The effect is not visible in any single entry, but it explains several findings below.

Risk assessment

Pinecrest has no documented assessment of where the financial statements could be misstated. The close checklist lists tasks but does not identify which accounts carry the most risk. As a result, review effort is spread evenly rather than concentrated on the entries that matter most: the customer rebate accrual, the inventory obsolescence reserve and the freight allocation, all of which rely on estimates and recur monthly. The framework expects an organization to identify and analyze risks to its objectives, including the risk of fraud, and to consider how changes in the business, such as Pinecrest's new product line, alter those risks. Without that analysis, the close treats a $300 accrued utility bill and a $1.1 million rebate estimate with the same level of care.

Control activities

The entry testing produced the most significant findings. Of the 40 entries tested, nine were posted by the person who prepared them with no evidence of independent review; all nine were below the $25,000 informal review threshold, but together they totaled about $140,000 in the quarter tested. Three entries, including a $62,000 reclassification, lacked any supporting documentation. The rebate accrual, which averaged about $1.1 million a month, is computed in a spreadsheet maintained by one staff accountant and posted without review of the underlying calculation. The largest estimate in the close was the one no second person ever checked. The access listing showed that three of five accounting users can both post journal entries and change vendor master data, a combination that allows a single person to create a vendor and record a payment to it. My recalculation of one month's rebate accrual found it about $48,000 lower than the amount supported by the rebate agreements, because two new purchasing-group contracts had not been added to the spreadsheet. The difference was not material to that month, but it shows how an unreviewed estimate can drift.

Information and communication

Information flows adequately within the accounting team, but the operational data feeding the rebate accrual and the inventory reserve arrive late and in inconsistent formats from sales and warehouse staff. The inventory reserve uses an aging report whose categories have not been updated since the company added a new product line, so slow-moving items in that line are not captured. The framework expects the organization to obtain and use relevant, quality information to support internal control, and information that arrives late or in shifting formats forces the team to estimate under time pressure. The effect falls on exactly the estimates the risk assessment should have flagged, which makes this weakness a multiplier of the others rather than a separate problem.

Monitoring activities

There is no ongoing monitoring of the close. No one reviews the population of manual entries for unusual patterns, and the annual audit is the only independent check. The framework's monitoring component expects ongoing or separate evaluations to confirm that controls are present and functioning, with deficiencies communicated to those who can correct them. At Pinecrest, a deficiency in the close would come to light only if the auditors happened to sample the affected entry, months after the statements had been used. Research suggests that monitoring technology can help: Masli et al. (2010) found that companies implementing internal control monitoring technology were less likely to report material weaknesses and showed other benefits, and Kuhn and Sutton (2006), analyzing the WorldCom entries, argued that automated rules applied to the ledger could flag unusual journal entries as they are recorded.

Severity Assessment

Taken individually, most findings are control deficiencies. Two rise higher. The unreviewed rebate accrual is a significant deficiency, because an error in a monthly estimate of more than $1 million could be material to quarterly results and would not be caught by any existing control. The combination of self-posted entries and broad posting and vendor rights is a significant deficiency that approaches a material weakness, because it creates both a risk of undetected error and an opportunity for fraud. Research on fraud cases shows that the ability to override or bypass controls is a recurring element of fraud, and that weaknesses in the control environment often precede it (Hogan et al., 2008). A COSO-sponsored review of a decade of fraud cases found improper revenue recognition and overstated assets among the most common techniques (Beasley et al., 2010), both of which can be executed through journal entries like those tested here.

Recommendations

Recommendations are listed in priority order. First, remove vendor master access from users who post journal entries, and require system-enforced approval for every manual entry, regardless of amount; the controller should own this change and complete it within 30 days. Second, assign the assistant controller to review the rebate accrual calculation monthly, with a documented reconciliation of the accrual to rebate agreements and to subsequent payments. Third, require supporting documentation to be attached to each entry in the system before posting. Fourth, prepare a short risk assessment identifying the five highest-risk accounts and focus review effort on them. Fifth, update the inventory aging categories and the reserve methodology to include the new product line. Sixth, introduce a monthly report of all manual entries sorted by preparer, amount and account, reviewed by the controller, as a first step toward continuous monitoring. Finally, the owners should consider adding one accountant before a sale process begins, since the capacity problem underlies several of the findings. Pinecrest should also publicize its existing ethics reporting line to the accounting team, since research on corporate fraud found that employees were among the most effective detectors of misconduct (Dyck et al., 2010).

Implementation and Cost

Most recommendations require little money. Turning on the accounting system's approval workflow and narrowing access rights is a configuration change. Attaching support to entries changes habits rather than budgets. The risk assessment and the manual entry report can be prepared by the controller in a few days. The one recommendation with a material cost, an additional accountant at a salary of roughly $75,000, should be weighed against the value at stake: a buyer's diligence team that finds unreviewed estimates and broad system access will either lower its offer or demand a lengthy escrow, and either outcome could cost the owners far more than a year's salary. The sequence matters as well. Access and approval come first because they address the risk of both error and fraud immediately; the estimate reviews come second because they address the largest numbers; the monitoring report and staffing change follow because they sustain the improvements once made. I would recommend that the controller report progress to the owners at the end of each month until all seven items are complete, which also builds the habit of monitoring that the findings showed to be missing.

Biblical Application

Writing to the church at Corinth, Paul names faithfulness as the one thing asked of anyone entrusted with another's goods (English Standard Version Bible, 2001/2016, 1 Corinthians 4:2). Pinecrest's accounting team are stewards of the owners' resources and of the trust lenders place in the company's statements. Faithfulness in that role is not only personal honesty, which this team displays, but also the humility to accept that honest people make mistakes and need review. Controls such as independent approval and segregation of duties are a practical expression of that humility. They protect employees from suspicion as much as they protect the company from error, and they allow the owners to rely on the numbers with confidence. Designing the close so that no one person's work goes unchecked is an act of care for both the people who do the work and the people who rely on it.

Limitations

This evaluation was performed by a single employee over a few weeks. The sample of 40 entries was judgmental rather than statistical, so its results indicate the nature of the weaknesses rather than their exact frequency. I did not test the revenue and procurement cycles beyond their entries in the close. An independent evaluation by the company's auditors would provide greater assurance.

Conclusion

Pinecrest's close is performed by capable and honest people, but its controls depend too heavily on those people never making mistakes. The most important weaknesses, the unreviewed rebate accrual and the combination of self-posted entries with broad system access, are fixable at modest cost. Implementing the recommendations in order would shorten the close, strengthen the reliability of the statements and prepare the company for the scrutiny of a sale. The broader lesson for a growing private company is that controls designed for a smaller business do not scale on their own; they have to be revisited as the business changes, and the time to do so is before an outside party, a lender, an auditor or a buyer, discovers the gap first.

References

Ashbaugh-Skaife, H., Collins, D. W., Kinney, W. R., Jr., & LaFond, R. (2008). The effect of SOX internal control deficiencies and their remediation on accrual quality. The Accounting Review, 83(1), 217-250. https://doi.org/10.2308/accr.2008.83.1.217

Beasley, M. S., Carcello, J. V., Hermanson, D. R., & Neal, T. L. (2010). Fraudulent financial reporting: 1998-2007: An analysis of U.S. public companies. Committee of Sponsoring Organizations of the Treadway Commission.

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework.

Doyle, J., Ge, W., & McVay, S. (2007). Determinants of weaknesses in internal control over financial reporting. Journal of Accounting and Economics, 44(1-2), 193-223. https://doi.org/10.1016/j.jacceco.2006.10.003

Dyck, A., Morse, A., & Zingales, L. (2010). Who blows the whistle on corporate fraud? The Journal of Finance, 65(6), 2213-2253. https://doi.org/10.1111/j.1540-6261.2010.01614.x

English Standard Version Bible. (2016). Crossway. (Original work published 2001)

Hogan, C. E., Rezaee, Z., Riley, R. A., Jr., & Velury, U. K. (2008). Financial statement fraud: Insights from the academic literature. Auditing: A Journal of Practice & Theory, 27(2), 231-252. https://doi.org/10.2308/aud.2008.27.2.231

Kuhn, J. R., & Sutton, S. G. (2006). Learning from WorldCom: Implications for fraud detection through continuous assurance. Journal of Emerging Technologies in Accounting, 3(1), 61-80. https://doi.org/10.2308/jeta.2006.3.1.61

Masli, A., Peters, G. F., Richardson, V. J., & Sanchez, J. M. (2010). Examining the potential benefits of internal control monitoring technology. The Accounting Review, 85(3), 1001-1034. https://doi.org/10.2308/accr.2010.85.3.1001