Lesson 4 of 5
Defect risk
7 min
By the end of testing, a few defects are still open. That is normal. The question for sign-off is not "are there defects?" but "could any of them misstate the financial statements?" A cosmetic field label and a wrong revenue account can both be called "medium" in a generic severity scale. For R2R they are not remotely the same. Finance defects should be classified by misstatement risk.
Thinking like an auditor
Auditors look at financial statement assertions: are the recorded amounts real (existence or occurrence), is everything recorded (completeness), are amounts right (accuracy and valuation), are they in the right period (cut-off), and in the right accounts (classification)? Ask which assertion a defect could break and how big the effect could be. A defect that might put May revenue into June breaks cut-off. One that posts inventory to the wrong segment breaks classification in segment reporting.
| Defect | Assertion at risk | Potential effect | Risk |
|---|---|---|---|
| Billing posts revenue to the wrong G/L account for one customer group | Classification | Revenue misclassified; statements wrong | High |
| FX valuation not posted in the IFRS ledger | Valuation | IFRS statements misstated | High |
| Accrual reversal date defaults to the wrong day | Cut-off | Expense in wrong period | High |
| Report column heading misspelled | None | None | Low |
| Payment run proposal slow | None directly | Operational delay | Medium (operational) |
| Default profit center used for one rare transaction type | Classification (segment) | Small segment misstatement | Medium: fix or monitor |
Classifying Contoso's open defects by misstatement risk (examples).
Materiality
"Material" is a judgment the controller and auditors make, usually anchored on a percentage of profit, revenue or assets. You do not need the exact figure to triage defects, but you do need Dan to state a working threshold for testing, for example an amount below which a one-off difference can be accepted with monitoring. Remember that small errors that repeat every day can add up to a material amount over a year.
Deciding must-fix
- Could it misstate the statements, any ledger or any segment?No → operational or cosmetic; normal triage · Yes → next question
- Could the misstatement be material, alone or accumulated?Yes → must fix before sign-off · No → next question
- Is there a reliable compensating control (a check that would catch it each period)?No → must fix · Yes → next question
- Is the control owned, documented and tested?Yes → accept with conditions · No → must fix
A compensating control is not "we will keep an eye on it." It is a named check, with an owner, a frequency and evidence: for example, "Every month-end, the G/L accountant runs a report of postings on the default profit center, reclassifies them before the period closes, and files the report." If the control would itself need testing to be trusted, test it.
Keep the classification separate from the priority the project uses for development work. A defect can be low priority for developers (easy workaround, few users) and still high misstatement risk for finance, or the reverse. Add a field to the defect record for misstatement risk and the assertion at risk, and let Dan, not the project, own its value. In the defect review meetings, sort by that field first. This simple change usually reorders the last two weeks of a project's fix list in favor of the defects that actually matter for the statements.
What would you do?
A defect causes some freight surcharges on customer invoices to post to other revenue instead of freight revenue. It happens about 20 times a month, at around USD 300 each. Grace wants to accept it. What is the best classification?
- Classify R2R defects by misstatement risk, using the assertions: occurrence, completeness, accuracy and valuation, cut-off, classification.
- Combine likelihood and possible size; repeating small errors can become material.
- Material misstatement risk without a reliable compensating control means must-fix.
- Compensating controls need an owner, a frequency and evidence.
Check your understanding · not graded
Lesson check
1. A defect may misstate revenue by segment. How should it be classified?
2. A defect posts some May accruals to June. Which assertion is at risk?
3. What makes a compensating control acceptable?
4. Why can a small defect still be must-fix?