19  Auditing the Customer Credits Cycle

Learning Objectives

After completing this chapter, you will be able to:

1. Plan an integrated audit of a business cycle by mapping its documents and control points from the records, reconciling each population to the general ledger, and setting materiality and tolerable deviation rates.
2. Assess the risks of the cycle, including the fraud risks of unauthorized credits, diverted refunds, and lapping, and link each risk to a test and to the evidence it needs.
3. Distinguish tests of controls from substantive tests, and decide when a query of the whole population replaces a sample and when evidence outside the database requires document examination, using a sample or a census.
4. Size an attribute sample, select it at random with key items taken in full, and evaluate the result with an upper deviation limit.
5. Use descriptive and diagnostic analytics to explain the growth of returns and to rank refunds for follow-up, allowing for timing and for periods the data do not complete.
6. Classify control deficiencies by likelihood, magnitude, and compensating controls, and report them to an audit committee with the action plans and the tests that will keep watching them.

Chapter slides View slides Download PowerPoint

Opening Scenario

It is September 2027. Customer returns rarely get a second look at Charles River: the controller’s team nets them against sales at every close and moves on. Yet the ledger shows why someone should look: returns and allowances have grown faster than sales for three years, Furniture above all.

At its September meeting, the audit committee asked the chief audit executive for an audit of the customer credits cycle: the returns customers send back, the credit memos that reverse their sales, the refunds paid to customers who had already paid, the commission taken back from the sales representatives, and the cash application that decides whether a customer has paid at all. A refund is cash that leaves the company on the strength of a record, and the committee wants assurance on both the controls and the balances, not a review.

You are back on the internal audit team of Chapters 8, 12, and 16. Those chapters aged the receivables and set aside, as credits on paid invoices that were refunded, the few hundred invoices whose balances had turned negative. Nobody has audited those credits and refunds since. This chapter is a case, and it has no tutorials. Each requirement states what the audit needs and names the chapters it draws on, and you decide how to produce it, choosing among the tools you have learned and explaining your choices.

19.1 The Engagement

The chief audit executive sets the scope. The analytics and the tests of controls cover fiscal 2024 to 2026, so that a pattern can be seen as it grows, and the conclusions on controls are stated as at the end of fiscal 2026. Fieldwork runs through September, and the report goes to the committee’s November meeting. The owners of the cycle, who will respond to the findings, are the controller, the customer service manager, and the accounting manager.

The chief audit executive wants five questions answered:

• whether the returns, credits, refunds, clawbacks, and cash applications are complete and agree with the ledger;
• whether credits and refunds are approved by people entitled to approve them, and whether incompatible duties are separated;
• whether the cycle could hide a fraud, such as a diverted refund, lapping, or a credit that covers stolen cash, and whether the records show any sign of one;
• why returns grow faster than sales, and what that means for revenue and inventory;
• what the committee should hear, how severe each finding is, and what should be monitored from now on.

Three conditions come with them. Materiality starts from a benchmark of 5% of fiscal 2026 income before income taxes as the ledger records it, and a fraud or governance risk can matter below it. Every finding is worded as what the records show, such as “a refund dated before the customer’s payment was received”, and never as what someone did, until evidence from outside the database settles the question. And the substance of management’s responses belongs to the owners, but you draft the action plans you will ask them to accept.

19.2 The Credits Cycle and Its Risks

An integrated audit tests controls and balances together, so that the evidence on one informs the other. The standard for audits of public companies’ internal control over financial reporting, AS 2201 of the Public Company Accounting Oversight Board (PCAOB, n.d.-a), is built on that idea, and internal auditors apply it to a cycle. A test of controls asks whether a control operated; a substantive test asks whether an amount is right. One procedure can serve both, but each purpose needs its own design and its own evaluation: the query that finds every credit approved above its approver’s authority tests the control, recomputing each credit from its return and its invoice tests the amount, and sharing a population does not make one result evidence for the other. The PCAOB’s standard on audit evidence now says so directly: an auditor who uses a procedure for more than one purpose should achieve each of its objectives (PCAOB, 2024). Testing every record removes the risk of sampling, not the risk that the records, or the test, are wrong.

Figure 19.1 maps the cycle as its records show it. Each document is recorded by one department: the warehouse receives the goods back, customer service records receipts, applies cash, approves credits, and approves the commission clawbacks, and accounting approves refunds. The control points C1 to C9 are what a well-designed cycle would check at each step. The ledger meets the cycle at account 2060 Customer Deposits and Unapplied Cash: every receipt passes through it on the way to the receivable, a credit on an invoice that has been paid lands in it, and every refund is paid out of it.

Figure 19.1: The customer credits cycle.

Asset misappropriation appeared in 90% of the more than two thousand occupational fraud cases investigated for the study of the Association of Certified Fraud Examiners (ACFE, 2026), far more often than financial statement fraud. The study shows which schemes those cases involved, not how likely a fraud is at Charles River. In receivables and refunds it takes a few recognizable forms, listed in Table 19.1, each of which leaves traces that a query can look for. The fraud standard for public company audits, AS 2401 (PCAOB, n.d.-c), frames the brainstorming you will do in Requirement 3 around three conditions that are usually present when fraud occurs: an incentive or pressure, an opportunity, and an attitude or rationalization.

Table 19.1: Fraud schemes in the credits cycle and the traces they can leave

Scheme	How it works	What it can leave in the records
Lapping	A stolen receipt is covered with a later customer’s payment	Receipts applied to another customer’s invoices; growing delays between receipt, deposit, and application
False credit	A customer’s payment is taken and the invoice closed with a credit	Credits with no return received; the credit’s approver also handled that customer’s cash
Diverted refund	A credit balance is refunded to an account the customer does not control	Refunds by a method unlike the customer’s payments; refunds of credits not yet paid for; concentration by approver or customer
Unauthorized credits	Credits are granted without authority, often to a few customers	Credits above authority; concentration by approver and customer; return rates out of line
Commission manipulation	Clawbacks are skipped or mistimed	Credit lines without clawbacks; clawbacks at the wrong rate

TipIn Practice

The ACFE’s latest study found that anti-fraud controls are associated with lower losses and with frauds detected sooner (ACFE, 2026). The Fraud Risk Management Guide of the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the ACFE, whose second edition expanded its treatment of data analytics, describes how an organization assesses its fraud risks and designs preventive and detective controls against them (COSO & ACFE, 2023). In a refund process, preventive controls would pay refunds only to the payment instrument the customer used or to an account verified independently, offset any open balance first, and keep the approval of credits away from the people who handle the customer’s cash. Detective controls, like the ones you will build in this chapter, look for the traces in Table 19.1.

19.3 The Data You Will Use

You will reuse what the audit chapters built: Audit.sql from Chapter 12, with its approval and trace tests; Chapter 8’s sampling and disposition methods; and, if you built it, Audit Monitoring.pbix from Chapter 16, with its exception register and the dispositions that survive each refresh. The cycle’s tables are mostly new to your tests: SalesReturn and SalesReturnLine; CreditMemo and CreditMemoLine; CustomerRefund; and the commission tables SalesCommissionRate, SalesCommissionAccrual, SalesCommissionAdjustment, SalesCommissionPayment, and SalesCommissionPaymentLine. CashReceipt and CashReceiptApplication, SalesInvoice, Shipment, Employee, and the ledger are familiar.

You will keep the files in Table 19.2. Requirement 4’s query flags each refund, and Requirement 5’s report loads those flags as a CSV file: the query decides, and the report lets the committee see and drill into what it decided.

Table 19.2: Tools and files

Tool	File	Holds	Hand-off
SQL	Credits.sql, run on CharlesRiver_Capstone.sqlite	The map of the cycle, reconciliations, control and substantive tests	Export to CSV of the refund flags
Excel	Credits Audit.xlsx	Materiality, the risk-and-control matrix, the sample, the evaluation of deficiencies	Tables for the report’s appendix
Power BI	Credits Analytics.pbix, plus an updated Audit Monitoring.pbix or a small register in Credits Analytics.pbix	Returns analytics and refund ranking; the continuing tests	Reads CharlesRiver.xlsx and the refund flags

WarningWatch out

The ledger needs care in this cycle. The year-end closes post to account 4060 Sales Returns and Allowances and to 6290 Sales Commission Expense, so leave them out of every reconciliation. Account 2060 is a hub, with large flows in and out and a small balance, so reconcile each flow separately rather than the balance alone. Postings follow each document’s own date: the receipt date, not the deposit date; the refund date, not the date the refund cleared. A credit can post to receivables, to 2060, or to both. And GLEntry.CreatedByEmployeeID is not evidence of who keyed a credit or a refund: on these documents it names the approver every time, as it names the chief executive on every sales invoice.

WarningWatch out

Time runs through every measure. Returns arrive weeks after shipment, credits days after returns, and refunds days to weeks after credits, so a refund can fall in a later year than its credit, and a return in a later year than its sale. The data stop at the end of 2026, so the last weeks’ returns and the next year’s refunds are missing, and fiscal 2024 had no earlier sales to return. Compare rates over complete windows. When you ask what was true on the day of a refund, such as whether the customer had paid or owed money, use only the payments and credits dated by that day, as Chapter 8 aged receivables. And do not confuse the year’s credit memos with the three years’ refunds: the two populations happen to be close in size.

WarningWatch out

Some of what an audit needs is not in the database. MaxApprovalAmount in Employee is a general authority limit; the delegation of authority for credits and refunds, if one exists, is a document outside the records. No table holds a payee’s name, a bank account, or the customer’s request for a refund. And some patterns may reflect how the records were produced rather than how people behaved, so word every finding as what the records show.

19.4 Getting Started

Set up your files before you begin. Make a working copy of the downloaded CharlesRiver.sqlite named CharlesRiver_Capstone.sqlite, and open the copy in DB Browser for SQLite, so that the download is never changed and the CharlesRiver_Work.sqlite of Part III keeps its views. Start Credits.sql with a header comment that states its purpose, the database file, the preparer and the date, and the checks it performs, and write two comment lines above every query: what it tests, and its population and expected result. Create Credits Audit.xlsx with a Documentation worksheet that states the purpose, the sources, and the date through which the data run, and create Credits Analytics.pbix. You need DB Browser for SQLite, Excel for Microsoft 365 (for RANDARRAY, SORTBY, and BETA.INV), and Power BI Desktop, which runs only on Windows; if you work on a Mac, plan to use a Windows computer for Requirements 5 and 10.

Work in three milestones, one for each phase of the requirements. Your instructor may ask you to hand in each milestone and may then release checkpoint values, so that an early error does not carry through the rest of the audit.

1. Plan the audit (Requirements 1 to 3): the map of the cycle, the reconciliations, materiality, and the risk-and-control matrix.
2. Test controls and balances (Requirements 4 to 7): the control tests, the analytics report, the sampling plan with its frozen selection, and the substantive tests and timeline.
3. Evaluate and report (Requirements 8 to 10): the evaluation of deficiencies, the report to the committee, and the continuing tests.

19.5 Requirements

The requirements fall into three phases: planning the audit, testing controls and balances, and evaluating and reporting. Each phase uses what the one before it established.

19.5.1 Phase 1: Plan the Audit

Requirement 1: Map the cycle from its records (Chapters 3, 10, and 12).

The map comes from the records, not from a description of how the process should work. That takes joins, anti-joins, and counts over the cycle’s tables and the ledger, which is work for a query.

• In Credits.sql, profile each of the cycle’s tables with the tests of Chapter 10’s data profile.
• Test every link with anti-joins: return lines to shipment lines, credits to returns and invoices, credit lines to return lines, refunds to credits, and clawbacks to credit lines and accruals. Test the document numbers for gaps, as Chapter 8 did.
• Build a matrix of the ledger’s postings by source document and account, and list who records each document, by job title.
• Mark on Figure 19.1 what the records can evidence at each control point and what they cannot.

Requirement 2: Reconcile each population to the ledger (Chapters 8 and 12).

Every later test relies on the recorded populations agreeing with the ledger. Two-sided totals by year, without the closes, are a query.

• By fiscal year, reconcile the credits to the ledger: their subtotal to 4060, freight to 4050, tax to 2050, and their totals to the credits to receivables and 2060. Reconcile the returns’ standard cost to inventory and to cost of goods sold by account, the refunds to cash and 2060, the clawbacks to 2034 and 6290, and the receipts and applications to cash and receivables.
• Roll 2060 forward to each year-end and name the items in each balance, and reconcile 2034 at the end of fiscal 2026.
• State what you excluded and why.

Requirement 3: Assess the risks and set materiality (Chapters 6 and 8).

A planning workbook keeps its parameters in cells that every later test refers to, which is what Excel is for.

• Compute overall materiality under the chief audit executive’s condition, performance materiality at 75% of it, and a clearly trivial threshold at 5% of it.
• Build an analytical expectation of fiscal 2026 returns from the 2025 return rate (the debits to account 4060 over the revenue that sales invoices posted to the product and service accounts), and compare it with the ledger. Say what size of difference would lead you to investigate, and why. Explain why the 2024 rate would make a poorer expectation.
• Brainstorm the fraud risks with Table 19.1 and AS 2401’s three conditions, mapped to the people and documents of Figure 19.1.
• Build a risk-and-control matrix: risk, assertion, control point, test, tool, and whether the evidence lies in the database or outside it.

19.5.2 Phase 2: Test Controls and Balances

Requirement 4: Test the controls on every document (Chapters 10 to 12).

Each test joins a document to the people who handled it and to the cash on the invoice behind it, across the whole population. Write each test under a two-line comment, as in Audit.sql, stating its population and its expected result.

• Test authority for credits and for refunds against the approver’s recorded limit, and the approvers’ employment dates.
• Test separation of duties: the credit approver against the people who applied cash to the credited invoice, the refund approver against the credit approver, and the person who received the return against the credit approver. Try to test the preparer against the approver, and explain why the records cannot answer.
• Test whether each refund was paid before the customer’s payments on the credited invoice had arrived. Decide whether a payment counts from its receipt (ReceiptDate) or from its application to the invoice (ApplicationDate), and state the definition you use: the records hold dates, not times, and nothing in them shows when a payment cleared the bank. Then test whether the customer had a past-due balance on the refund date that could have been offset.
• Compare each refund’s method with the methods of the receipts on the credited invoice, and test the clawbacks for completeness and accuracy and the refunds for one per credit.
• Combine the exceptions in one list by year with UNION ALL, and export the refund flags as RefundFlags.csv.

Requirement 5: Explain the returns and rank the refunds (Chapters 13 to 15).

The committee will want to see where returns grow and which refunds deserve a second look, and to move from a pattern to the documents behind it. That is a report.

• Build Credits Analytics.pbix: credit lines with their reason, customer, approver, shipment date, and carrier; revenue from the invoice lines; Item, Customer, and Date; GLEntry and Account for the Tests tab; and the refunds with the flags of RefundFlags.csv. Add a Tests tab that ties credits to account 4060 by year. Turn off Auto date/time and Autodetect new relationships after data is loaded under Current File, as Tutorial 13.1 did, so that Power BI does not add hidden date tables or relationships you did not choose.
• Show return rates by year, item group, product family, and reason, and compare rates by the month of the credit with rates by the month of the shipment. Explain why the last months and fiscal 2024 mislead.
• Look for concentration by carrier, warehouse, and customer, as a share of each customer’s sales.
• Score each refund on its flags, one point for each, and let a reviewer drill through from the score to the refund, its credit, and its invoice.

Sampling still has a place when the evidence lies outside the database. The records cannot show whether a customer asked in writing for a refund, whether someone independent checked the payee, or whether anyone inspected the goods that came back damaged; those need documents, which are examined one at a time, in a sample or, when the population is small, all of them. AS 2315 (PCAOB, n.d.-b) and the American Institute of Certified Public Accountants’ audit sampling guide (AICPA, 2025) set out the judgments involved: the risk of overreliance you accept, which sets the confidence level; the tolerable deviation rate, the highest rate at which you would still rely on the control; and the expected deviation rate. Table 19.3 gives the sample sizes the binomial distribution implies for large populations, with the number of deviations each size allows (the expected rate times the size, rounded up). After testing, the upper deviation limit for k deviations in a sample of n is BETA.INV(confidence, k + 1, n - k) in Excel for a whole number k less than n (if every item deviates, it is 100%); if it exceeds the tolerable rate, the sample does not support reliance.

Table 19.3: Sample sizes for tests of controls, with the deviations each allows

Expected deviation rate	95% confidence, 5% tolerable	95% confidence, 10% tolerable	90% confidence, 5% tolerable	90% confidence, 10% tolerable
0%	59 (0)	29 (0)	45 (0)	22 (0)
1%	93 (1)	46 (1)	77 (1)	38 (1)
2%	181 (4)	46 (1)	132 (3)	38 (1)

Requirement 6: Sample what the database cannot show (Chapter 8).

The selection and its evaluation are worksheet work, with the random selection Chapter 8 taught.

• Define three attributes that need evidence outside the database: a written request from the customer, a payee checked against the customer master by someone independent, and, for refunds of returns coded Damaged, an inspection record of the goods. The third applies only to the refunds of Damaged returns, so define its population and size its sample, or test it in full, on its own: a refund of another return is not a successful test of an inspection.
• Choose the confidence level, tolerable deviation rate, and expected deviation rate, and take the sample size from Table 19.3.
• Write the evaluation rule before you select or test anything: the upper deviation limit for zero to three deviations, or up to one more than your plan allows if that is more. Do not change it after you see the results.
• From the refunds of fiscal 2024 to 2026, take the key items in full: every refund of $5,000 or more, and every refund to a customer whose refunds over the three years exceed $10,000. Evaluate the key items apart from the sample. Select the rest with RANDARRAY and SORTBY, freeze the selection with Paste Values, and record the selected IDs, the date, the parameters, and the method.
• Apply the same sample to one attribute the data can test, the refund dated before the customer’s payment as you defined it in Requirement 4, and compare the sample’s conclusion with Requirement 4’s result for the same remaining refunds. A sample drawn from three years does not show by itself how the controls operated at the end of 2026.
• The database holds no documents, so you cannot complete the three attributes here. Deliver the sampling plan, the frozen selection, and the rule for evaluating it, and do not invent results.

Requirement 7: Test the balances, and follow the largest refund (Chapters 8 and 12).

• Recompute each credit line from its return, shipment, and invoice lines: the quantity no more than was shipped, the price and discount equal to the invoice’s, and the credits on any invoice no more than its total. Recompute the tax on each credit at the rate its original invoice charged, and the amount of each clawback. Compare each credit’s freight with the invoice’s freight, recompute a share of it only under a stated freight-credit policy, and if no policy is available, report the limit of the test. List the open items in 2060 at the end of 2026.
• Measure what returned goods were put back into inventory at, by reason.
• Test for lapping: receipts applied to another customer’s invoices, delays from receipt to deposit and from receipt to application, and receipts applied to invoices dated after them. Explain, using Chapter 8’s criteria, whether a first-digit test suits these populations.
• Build a timeline of the largest refund, from the shipment to the last receipt on its invoice, with who did each step. Record a disposition, and list the evidence outside the database that would settle it.

19.5.3 Phase 3: Evaluate and Report

A control deficiency exists when the design or operation of a control does not allow management or employees, in the normal course of their work, to prevent or detect misstatements on a timely basis. Its severity depends on whether there is a reasonable possibility that the control will fail to prevent or detect a misstatement, and on how large that misstatement could be, not on whether a misstatement actually occurred (PCAOB, n.d.-a). Compensating controls reduce the severity only if they operate precisely enough to catch what the deficient control would miss, and deficiencies that affect the same account, assertion, or component of internal control are evaluated in combination. Table 19.4 abridges the three classifications, and Figure 19.2 lays out the evaluation. Internal auditors then evaluate the significance of their findings and agree on action plans with management under the Global Internal Audit Standards of the Institute of Internal Auditors (IIA, 2024). The PCAOB classifications give this case a framework for comparison, and the engagement does not issue an external auditor’s opinion on internal control over financial reporting.

Table 19.4: Classifying control deficiencies under AS 2201

Classification	Abridged definition	What tips the severity	Who hears about it
Deficiency	A control’s design or operation does not allow timely prevention or detection of misstatements	Likelihood and potential magnitude that do not merit the attention of those who oversee financial reporting	Management in writing, with notice to the audit committee
Significant deficiency	Less severe than a material weakness, but important enough to merit the attention of those who oversee financial reporting	Likelihood, potential magnitude, and circumstances that merit that attention	Management and the audit committee, in writing
Material weakness	A reasonable possibility that a material misstatement of the annual or interim statements will not be prevented or detected on a timely basis	A reasonable possibility of a material misstatement that no compensating control catches precisely enough	Management and the audit committee in writing, and for a public company an adverse opinion on internal control

Figure 19.2: Evaluating a control deficiency.

Requirement 8: Evaluate the deficiencies (Chapter 8).

An evaluation matrix computes each deficiency’s exposure against the materiality cells of Requirement 3, which keeps the judgment and its arithmetic together in the workbook.

• For each pattern from Requirements 4 to 7, record the control, whether the deficiency is in design or in operation, its frequency, its exposure in fiscal 2026 and over the three years, the likelihood of a misstatement, the compensating controls and the evidence that they operate, and the deficiencies it combines with.
• Classify each, provisionally until its cause, the policy, and any compensating review are known, say what evidence your classification rests on and what evidence could change it, and give it a disposition in Chapter 8’s terms.
• Report the clean results with the same care as the exceptions.

Requirement 9: Report to the audit committee. Write a report of no more than three pages, with an appendix of selected, condensed exhibits, for the committee’s November meeting. Open with an executive summary and an overall conclusion that says what the tests covered and what they could not. State the scope and how each population reconciled. Present each finding with its condition, criteria, cause, effect, rating, and recommendation, and report the clean results. Close with the action plans, each with an owner by role and a date, the response you expect from each owner, and where you expect them to disagree. The audit partners Cohen et al. (2020) interviewed describe managers who resist a finding of a weakness when no error has been detected and who argue that a review control would have caught the problem, so prepare the evidence for each compensating control they may point to.

Requirement 10: Keep the tests running (Chapter 16).

The register in Audit Monitoring.pbix already runs the rule tests of Chapters 8 and 12 with every refresh. Adding this cycle’s rules there, under the change control Chapter 16 described, turns the audit into monitoring.

• Add four rule tests to the Tests table: credits above authority, credits approved by someone who applied cash to the invoice, refunds above authority, and refunds dated before the customer’s payment as Requirement 4 defined it. Add the processes Credit memos and Refunds to the populations.
• Keep the refund method and the missing offset as anomaly tests, outside the register of rules.
• Where the historical exceptions of a new test share a cause the evidence supports, link them to one finding, as Chapter 16 treated the payroll registers’ self-approval, so that they do not flood the review, while each exception stays in the register with its document, amount, and disposition. Say whether the finding concerns the control’s design or its operation, and record the period it covers, the date the fix is due, the date it is made, and the retest. Keep reviewing the exceptions dated after the covered period as they arrive, and close the finding only when the retest shows that the fixed control works.
• If you did not build Audit Monitoring.pbix in Chapter 16, build a small register in Credits Analytics.pbix instead: a Tests table entered with Enter data, and an exceptions table that appends the documents each of the four tests flags.
• Recheck the date through which the register’s data run, and record the change.

19.6 Deliverables and Checklist

Before you submit, check that you have each of these:

1. Credits.sql, with its header complete and two comment lines above every test that state its population and its expected result.
2. Credits Audit.xlsx, with worksheets for materiality, the risk-and-control matrix, the sample, and the evaluation of deficiencies, and the Documentation sheet with the date through which the data run.
3. Credits Analytics.pbix, with its Tests tab, and the continuing tests, in Audit Monitoring.pbix with a record of the change or in a register of your own.
4. The report to the audit committee, of no more than three pages, with an appendix of no more than three pages: the map of the cycle with what the records evidence at each control point, the reconciliation by year, the test results, the sample plan, the evaluation of deficiencies, and the action plans.

19.7 What a Strong Submission Includes

• Populations reconciled to the ledger, to the cent, before any test relies on them.
• A map of the cycle built from the records rather than assumed, with what the records cannot show stated at each control point.
• Every test with its population, its definition, and its result, clean or not.
• Sampling used only where the evidence lies outside the database, with the rule for evaluating it written before the sample is drawn.
• Timing and incomplete periods handled explicitly, and every measure taken as of the date that matters.
• Deficiencies classified by likelihood, magnitude, and compensating controls rather than by counts, with the clean results reported too.
• Findings worded as what the records show, with the evidence that would settle them, and continuing tests that will not flood the register.

NoteConnecting the Dots

This audit reused Chapter 8’s random selection and dispositions, Chapter 12’s approval and trace tests and its query library, and Chapter 16’s exception register and change control. The audit also leaned on the rest of the book: the reconciliations of Chapter 6, the joins and anti-joins of Chapter 10, and the as-of measures of Chapter 11 decided what each test could trust.

19.8 Looking Ahead

This audit tested a cycle’s controls and balances on whole populations, and kept sampling for the evidence the records cannot hold. Most of the work was descriptive and diagnostic analytics, in the terms of Table 1.1: the map, the reconciliations, and the tests describe what the records show, and the analytics of returns and the timeline of the largest refund diagnose where the risks sit. The expectation of returns is a small predictive model, resting on the assumption that the prior year’s return rate still holds; the upper deviation limits are statistical inference about the population a sample was drawn from, not forecasts; and the recommendations and action plans are prescriptive.

An audit like this does not end with the report. The owners agree on actions and dates, the committee asks for their status at its next meetings, and the tests you added to the register show, every month, whether the exceptions they cover come back, though only a retest shows that a fix works. Findings that are worded carefully and rest on evidence are the ones management accepts and fixes.

19.9 Further Reading

American Institute of Certified Public Accountants. (2025). Audit sampling: Audit guide. https://www.aicpa-cima.com/cpe-learning/publication/audit-sampling-audit-guide The practitioner’s guide to statistical and nonstatistical sampling in audits, with step-by-step guidance, tables, and case studies. It sets out the judgments behind a sample of the kind Requirement 6 plans: the risk accepted, the deviations tolerated, and how to evaluate what the sample finds.

Association of Certified Fraud Examiners. (2026). Occupational fraud 2026: A report to the nations. https://www.acfe.com/fraud-resources/report-to-the-nations The ACFE’s study of more than two thousand occupational fraud cases from over a hundred countries. It finds asset misappropriation in nine cases out of ten, and associates anti-fraud controls with lower losses and earlier detection, which is the case for the detective tests this chapter builds.

Cohen, J. R., Joe, J. R., Thibodeau, J. C., & Trompeter, G. M. (2020). Audit partners’ judgments and challenges in the audits of internal control over financial reporting. Auditing: A Journal of Practice & Theory, 39(4), 57–85. https://doi.org/10.2308/ajpt-18-088 Interviews with twenty audit partners about how they evaluate control deficiencies. The partners describe managers who find it hard to accept that a material weakness can exist without a detected error and who argue that a review control would have caught the problem, the pushback Requirement 9 asks you to anticipate.

Committee of Sponsoring Organizations of the Treadway Commission & Association of Certified Fraud Examiners. (2023). Fraud risk management guide (2nd ed.). https://www.aicpa-cima.com/cpe-learning/publication/fraud-risk-management-guide A blueprint for an organization’s fraud risk management program, from governance and risk assessment to preventive and detective controls and the monitoring of the program. The second edition expanded its treatment of data analytics and explains how fraud risk management relates to internal control.

Elder, R. J., Akresh, A. D., Glover, S. M., Higgs, J. L., & Liljegren, J. (2013). Audit sampling research: A synthesis and implications for future research. Auditing: A Journal of Practice & Theory, 32(Suppl. 1), 99–129. https://doi.org/10.2308/ajpt-50394 A synthesis of research on the decisions auditors make when they sample: whether sampling applies, which kind, how large a sample, and how to evaluate the errors found. It reports that auditors may understate risk to reduce testing, though some of that research predates the current risk assessment standards, and that they sometimes fail to project the errors in a sample, cautions worth keeping beside Table 19.3.

Institute of Internal Auditors. (2024). Global internal audit standards. https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/ The standards that govern internal auditing, in effect since January 2025. Their domain on performing engagements covers how internal auditors evaluate the significance of findings, develop recommendations and action plans with management, and communicate the results, the work of Requirements 8 and 9.

Public Company Accounting Oversight Board. (n.d.-a). AS 2201: An audit of internal control over financial reporting that is integrated with an audit of financial statements. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201 The standard for integrated audits of public companies. Its appendix defines a control deficiency, a significant deficiency, and a material weakness, and its section on evaluating identified deficiencies explains how likelihood, magnitude, compensating controls, and combination decide a deficiency’s severity.

19.10 References

American Institute of Certified Public Accountants. (2025). Audit sampling: Audit guide. https://www.aicpa-cima.com/cpe-learning/publication/audit-sampling-audit-guide

Association of Certified Fraud Examiners. (2026). Occupational fraud 2026: A report to the nations. https://www.acfe.com/fraud-resources/report-to-the-nations

Cohen, J. R., Joe, J. R., Thibodeau, J. C., & Trompeter, G. M. (2020). Audit partners’ judgments and challenges in the audits of internal control over financial reporting. Auditing: A Journal of Practice & Theory, 39(4), 57–85. https://doi.org/10.2308/ajpt-18-088

Committee of Sponsoring Organizations of the Treadway Commission & Association of Certified Fraud Examiners. (2023). Fraud risk management guide (2nd ed.). https://www.aicpa-cima.com/cpe-learning/publication/fraud-risk-management-guide

Institute of Internal Auditors. (2024). Global internal audit standards. https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

Public Company Accounting Oversight Board. (n.d.-a). AS 2201: An audit of internal control over financial reporting that is integrated with an audit of financial statements. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201

Public Company Accounting Oversight Board. (n.d.-b). AS 2315: Audit sampling. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315

Public Company Accounting Oversight Board. (n.d.-c). AS 2401: Consideration of fraud in a financial statement audit. https://pcaobus.org/oversight/standards/auditing-standards/details/AS2401

Public Company Accounting Oversight Board. (2024). Amendments related to aspects of designing and performing audit procedures that involve technology-assisted analysis of information in electronic form (PCAOB Release No. 2024-007). https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket-052/2024-007-adoptingrelease.pdf