Inventory is both an asset and an estimate. Quantities come from counts, values come from costing and reserves, and the records sit in a perpetual system that someone can edit. Controls must cover all four. This post gives an RCM, test steps and a worked count scenario. The statutory anchor for issuers is Section 13(b)(2)(B)(iv) of the Exchange Act, which requires that recorded accountability for assets be compared with the existing assets at reasonable intervals and that appropriate action be taken on differences. Physical counts are the usual way inventory meets it.
The RCM
| ID | Risk | Control | Type | Assertion | Test step |
|---|---|---|---|---|---|
| INV-01 | Receipts recorded for goods not received | Receiving clerk records quantity against PO; discrepancy report reviewed | Preventive, detective | Existence | Trace receipts to delivery documents; test receiving discrepancies |
| INV-02 | Unauthorized access to stock | Warehouse access restricted; entry logged; high-value items caged | Preventive | Existence | Observe; review access list against roles |
| INV-03 | Perpetual records differ from physical stock | Cycle count program by ABC class; variances investigated and adjusted only with approval | Detective | Existence, accuracy | Observe counts; reperform; test variance approvals |
| INV-04 | Unauthorized inventory adjustments | System adjustments require approval above a threshold by someone outside the warehouse; monthly adjustment report reviewed | Preventive, detective | Existence | Full adjustment log; compare approver to authority matrix |
| INV-05 | Cost of inventory misstated | Standard costs updated and approved; variance accounts reviewed; costing method applied consistently | Preventive, detective | Valuation | Recompute cost for sample; test variance analysis |
| INV-06 | Obsolete or slow-moving stock not reserved | Quarterly reserve computed from aging and sales history; reviewed by controller | Detective | Valuation | Reperform the computation; test aging report completeness |
| INV-07 | Goods held at third parties not tracked | Third-party stock confirmed or counted at least annually | Detective | Existence | Obtain confirmations; observe count |
| INV-08 | Cutoff errors for shipments and receipts | Last-document-number procedures at count date; cutoff review | Detective | Cutoff | Trace documents around count date |
| INV-09 | Transfers between locations lost | In-transit report reviewed weekly | Detective | Existence | Test in-transit aging |
| INV-10 | Scrap or returns misrecorded | Scrap approved and witnessed; returns inspected | Preventive | Existence, valuation | Sample scrap documents |
Analytics
- Adjustments by user and time. Count by user, after-hours entries, adjustments just below approval limits.
- Negative on-hand quantities and zero-cost items.
- Count variances by item and location against thresholds, trended over time.
- Aging versus reserve. Compare the reserve percentage by age bucket to actual write-offs.
- Receipts without POs and POs closed without receipt.
- Margin outliers that suggest costing errors.
Worked scenario: cycle counts
A company with $22 million of inventory in two warehouses runs ABC cycle counts: A items monthly, B items quarterly, C items annually. Internal audit observes counts at both sites and reperforms.
- Warehouse 1: 30 A-item counts observed; 2 tag errors found; system quantities adjusted for both after approval by the inventory manager, who also supervises the warehouse. The approver is not independent of the custodian.
- Warehouse 2: A-item count variances averaged 1.2 percent in value; four items showed repeated negative variances over six months, totaling $186,000 of adjustments. No one investigated the pattern.
Findings: INV-04 is deficient in design (approval by custody-side manager) at Warehouse 1; INV-03 is deficient in operation at Warehouse 2 (variances adjusted without investigation, contrary to the objective that action be taken on differences). Standard 14.3 Evaluation of Findings requires internal auditors to work with management to identify root causes where possible, which is why the second recommendation asks for a root cause note. Recommendations: route adjustments above a threshold to the controller; require a root cause note for repeat variances; run a targeted review of the four items for theft or process failure. The SEC's interpretive guidance for management lists the susceptibility of an asset to loss or fraud as a risk factor, so these items warrant more attention.
Observation versus counts
An internal audit observation of counts supports the company's control. The external auditor's observation of counts is separate. See /us/blog/inventory-observation-audit-procedures for audit-side procedures and /us/blog/inventory-costing-asc-330-fifo-average-lifo-nrv for the costing accounting.
Count day procedures
- Freeze movements or document them.
- Pre-numbered count tags issued and accounted for.
- Two-person counts with independent recounts for high-value items.
- Supervisors review tags before they are collected; blank and voided tags are accounted for.
- Reconciling quantities to the perpetual record with approval by someone independent.
- Third-party stock confirmed.
Systems and spreadsheets
Many perpetual systems and spreadsheet-based inventory logs rely on controls over who can edit quantities and costs. See /us/blog/ipe-and-it-dependent-controls-testing-reports-used-in-key-controls for testing the reports behind reserve calculations.
Mistakes to avoid
- Testing counts without testing who approves adjustments.
- Accepting the aging report as complete for the obsolescence reserve.
- Skipping goods held at third parties.
- Treating negative variances as shrink without a review for theft.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- Securities Exchange Act of 1934, section 13(b)(2)(B)(iv), 15 U.S.C. 78m(b)(2)(B): https://www.law.cornell.edu/uscode/text/15/78m
- SEC, Release No. 33-8810, Section II.B.1 (risk factors: susceptibility of the asset to loss or fraud): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- The IIA, Global Internal Audit Standards (2024), Standard 14.3 Evaluation of Findings: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error