R2C-014 — Credit memos above $25K require secondary approval
All credit memos exceeding $25,000 are reviewed and approved by the Revenue Accounting Director prior to posting. NetSuite workflow enforces approval routing based on amount thresholds.
Control attributes
- Type
- Business process
- Nature
- IT dependent manual
- Frequency
- Ongoing
- Key control
- Yes
- Assertions
- Occurrence, Accuracy
- System
- NetSuite
- Owner
- Director, Revenue Accounting
- SOX scope
- In scope
- Last tested
- Sep 15, FY26
- Testing status
- Exception
- Samples tested
- 45
- Exceptions
- 1
AI scoping reasoning
In scope — direct link to revenue occurrence, prior-year finding
Linked risk
New CPQ pricing rules plus two prior-year findings on contract review completeness.
Sample testing
Attributes tested by Tessa (Staff Auditor Agent)
| # | Document | Amount | Date | Approver | Approval obtained | Approver authorized | Approval before posting | Amount agrees to support | Business reason documented | Tickmarks | Result |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | CM-114208 | $48,200 | Jul 06 | L. Trent | ✓ | ✓ | ✓ | ✓ | ✓ | A B | Pass |
| 2 | CM-114331 | $92,750 | Jul 14 | L. Trent | ✓ | ✓ | ✓ | ✓ | ✓ | A B C | Pass |
| 3 | CM-114402 | $27,400 | Jul 19 | M. Ozturk | ✓ | ✓ | ✓ | ✓ | ✓ | A | Pass |
| 4 | CM-114577 | $310,900 | Aug 02 | — | ✗ | — | — | ✓ | ✗ | A X | Exception |
| 5 | CM-114612 | $35,000 | Aug 07 | L. Trent | ✓ | ✓ | ✓ | ✓ | ✓ | A B | Pass |
| 6 | CM-114744 | $61,300 | Aug 15 | R. Salas | ✓ | ✓ | ✓ | ✓ | ✓ | A B | Pass |
| 7 | CM-114890 | $29,850 | Aug 23 | L. Trent | ✓ | ✓ | ✓ | ✓ | ✓ | A | Pass |
| 8 | CM-115003 | $154,600 | Sep 01 | R. Salas | ✓ | ✓ | ✓ | ✓ | ✓ | A B C | Pass |
Evidence
1 requests
Reconciled to GL 41200; completeness verified against system record count.
Exceptions
1 identified
Root cause: August workflow change removed the approval routing rule for memos created from the returns queue.
Population impact: 7 of 11,402 credit memos ($1.9M gross / $0.4M net) processed through the returns queue without approval.
Review notes
2 on this control
Document why the returns queue population was not separately stratified before sampling.
Confirm human approval of the deficiency severity conclusion is captured before finalization.