MacrosLM Audit & Controls
SOX 404(b)  /  ICFR  /  CASE: PEABODY PROPERTIES
AUDIT TEARSHEET · SOX 404(b) CONTROL TESTING · FY2024

Peabody Properties · SOX control testing — year-end results

42 in-scope controls tested across revenue, P2P, payroll, ITGC, and close. 38 effective, 3 deficient, 1 escalated to material weakness candidate.
CLIENT  PEABODY PROPERTIES LLC  ·  PERIOD  FY DEC-2024  ·  SCOPE  ICFR 404(b)  ·  TEAM  MacrosLM Audit
Controls in scope
42
7 business cycles
Effective
38
90.5% pass rate
Deficiencies
3
Process / design gaps
MW candidates
1
Pending audit committee
01SCOPE MAP 02RESULTS BY CYCLE 03SAMPLE DETAIL 04DEFICIENCY ANALYSIS 05MW CANDIDATE

§ 01Scope and control inventory

Per PCAOB AS 2201, the in-scope control population was identified through top-down risk assessment. Coverage spans 7 transaction cycles plus IT general controls. Frequency mix: 17 daily, 14 monthly, 8 quarterly, 3 annual.
Engagement parameters
Standard
PCAOB AS 2201
Filer status
Accelerated · 404(b)
Materiality
$1.85M · 5% PBT
Pop. materiality
$370K
Method
Risk-based, top-down
Test approach
Inquiry + inspection + reperformance
Period
Roll-fwd Sep-Dec 2024
Controls in scope · by cycle
Cycle Controls Auto Manual Key Risk rating
Revenue (rental income) 9 3 6 5 High
Procure-to-Pay 8 2 6 4 High
Payroll 5 2 3 2 Moderate
Treasury & Cash 4 1 3 2 Moderate
Financial close 7 1 6 3 High
Fixed assets / Real estate 4 0 4 2 Moderate
IT general controls 5 5 0 5 High
Total 42 14 28 23 —

§ 02Test results by cycle

Aggregated test outcomes across all 42 in-scope controls. Pass criteria: zero unexpected exceptions on key controls; deviation rate below 5% on routine controls. Sample sizes computed per AICPA AAG-SAM table.
Control test summary · by cycle
Cycle Controls Sample size Pass Deviations Rate Cycle status
Revenue 9 405 8 1 11.1% 1 deficient
Procure-to-Pay 8 360 7 1 12.5% 1 deficient
Payroll 5 225 5 0 0.0% All pass
Treasury 4 120 4 0 0.0% All pass
Financial close 7 84 7 0 0.0% All pass
Fixed assets 4 90 4 0 0.0% All pass
ITGC 5 75 3 2 40.0% 2 deficient · 1 escalated
Total 42 1,359 38 4 9.5% —

Of the 4 raw deviations, 1 was determined to be a non-deficiency (single occurrence on a routine control with offsetting compensating controls); 3 are flagged as control deficiencies for management response.

§ 03Selected key control results

Detail of the 7 highest-risk key controls. These drive the audit opinion — exceptions here would impair our ability to rely on management's ICFR assertion.
Key control test detail · selected
ID Cycle / Description Freq Owner Sample Dev Status
REV-01 Monthly rent roll reconciliation to GL revenue, signed off by Property Controller Monthly P. Walsh 12 0 Effective
REV-03 Tenant concession authorization reviewed and approved by VP Operations Per event M. Ortiz 45 1 Deficient
P2P-04 Three-way match exception report reviewed monthly by AP Manager Monthly D. Kim 12 1 Deficient
CLO-02 Journal entry sub-certification: all manual JEs reviewed by Asst. Controller Monthly A. Reyes 12 0 Effective
CLO-05 Account reconciliation review · >$50K balance accounts Monthly A. Reyes 36 0 Effective
ITG-02 Quarterly user access review · NetSuite ERP Quarterly IT (3rd party) 4 1 Deficient
ITG-04 Privileged access review · NetSuite admin role + DB-level access Quarterly IT (3rd party) 4 1 MW candidate

§ 04Deficiency severity analysis

Each deficiency is evaluated against the PCAOB framework: likelihood (reasonable possibility) × magnitude (could result in material misstatement). The combination, not either alone, drives the classification.
Severity matrix · deficiencies
Control Likelihood Magnitude Classification
REV-03 Tenant concessions Reasonably possible Inconsequential Deficiency
P2P-04 3-way match review Reasonably possible Inconsequential Deficiency
ITG-02 User access review Reasonably possible More than inconsequential Significant deficiency
ITG-04 Privileged access Reasonably possible Material MW candidate
Recommendation summary
  • REV-03, P2P-04: management response & remediation plan; no opinion impact.
  • ITG-02: elevate to significant deficiency — communicate to audit committee in writing.
  • ITG-04: pending closing meeting outcome; if MW confirmed, ICFR opinion would be adverse at the relevant assertion level.
  • All identified deficiencies are operating effectiveness in nature; control design assessed as adequate.

§ 05Material weakness candidate · ITG-04

The single material-weakness candidate centers on quarterly privileged-access review. The deficiency itself is design-acceptable but operating-failed in Q2 and Q3. Mitigating factors: no actual unauthorized access detected; compensating monitoring controls partially effective.
ITG-04 · Issue detail
Control
Quarterly privileged access review · NetSuite admin and DB
Owner
IT Director (3rd party MSP)
Designed
Quarterly · 4× per year
Performed Q1
Documented · pass
Performed Q2
Not documented
Performed Q3
Not documented
Performed Q4
Documented · 2 stale accounts found
Compensating
SIEM log monitoring (partially effective)
Path to classification

Two of four quarterly cycles failed in operating effectiveness. The Q4 catch-up review identified 2 stale privileged accounts in active state — a reasonably possible route to a material misstatement.

Mitigating evidence: review of NetSuite audit logs across Q2-Q3 found no transactions executed by the stale accounts. No actual misstatement occurred.

Final disposition  pending the audit committee closing meeting. If confirmed as material weakness, the ICFR opinion will be adverse at the ITGC assertion. If downgraded to significant deficiency on compensating-control evidence, the ICFR opinion can remain unmodified.

ENGAGEMENT · PEABODY PROPERTIES FY2024 ICFR AUDIT · CONFIDENTIAL DRAFT · INTERNAL USE · AUDITOR: MacrosLM. Fictional engagement for illustration. Control population, deficiencies, severity analysis, and material-weakness logic are representative of a typical accelerated-filer SOX 404(b) procedure.MacrosLM · Audit & Controls Series →