Findings
Agents draft the finding, root cause and recommendation from the tested evidence. Nothing is issued to management until a human approves it.
Credit memo approval routing gap after workflow change
- Drafted by
- Morgan (Audit Manager)
- Owner
- Director, Revenue Accounting
- Remediation due
- Dec 31, FY26
- Root cause
- Change to the returns queue removed approval routing without control impact assessment.
- Recommendation
- Restore approval routing for returns-queue credit memos and add a control impact assessment step to ERP change management.
- Management response
- Pending — draft awaiting human approval AP-311.
Finding rated high based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.
Terminated user access not removed within standard
- Drafted by
- Rowan (Senior Auditor)
- Owner
- IT Operations Lead
- Remediation due
- Nov 30, FY26
- Root cause
- Contractor terminations processed outside Workday are excluded from the automated feed.
- Recommendation
- Extend the termination feed to contractor records and add a weekly reconciliation of active accounts to HR status.
- Management response
- Pending — awaiting approval AP-304.
Finding rated medium based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.
Segregation of duties conflicts without mitigating controls
- Drafted by
- Rowan (Senior Auditor)
- Owner
- CIO
- Remediation due
- Jan 31, FY27
- Root cause
- SoD ruleset not refreshed after the FY25 role redesign.
- Recommendation
- Remediate the 41 conflicts without mitigating controls and refresh the SoD ruleset quarterly.
- Management response
- Agreed. Role redesign wave 2 will remediate 34 conflicts by December; 7 will be accepted with documented mitigation.
Finding rated high based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.
Third-party logistics contingency plan untested
- Drafted by
- Priya (Audit Manager)
- Owner
- VP Supply Chain
- Remediation due
- Dec 15, FY26
- Root cause
- Contingency plan exists but no tabletop or failover test since onboarding.
- Recommendation
- Perform an annual failover test with the secondary carrier and document results.
- Management response
- Agreed. Tabletop exercise scheduled for November with the secondary carrier.
Finding rated medium based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.
Duplicate vendor checks not evidenced
- Drafted by
- Kai (Staff Auditor)
- Owner
- Procurement Controller
- Remediation due
- Nov 15, FY26
- Root cause
- Procedure does not require retention of duplicate check results.
- Recommendation
- Require retention of duplicate check output in the vendor onboarding record.
- Management response
- Agreed. Onboarding checklist updated effective October.
Finding rated low based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.
Bank reconciliation review evidence incomplete
- Drafted by
- Dev (Senior Auditor)
- Owner
- Treasurer
- Remediation due
- Aug 31, FY26
- Root cause
- Reviewer sign-off captured by email rather than in the reconciliation tool.
- Recommendation
- Capture reviewer sign-off within the reconciliation platform.
- Management response
- Completed. Sign-off now recorded in the platform; validated by retest.
Finding rated medium based on the tested evidence, prevalence in the population, and whether compensating controls detected the matter. Rating and issuance require human approval.