SOX Control Testing — Peabody FY2024 · Deficiency analysis

MacrosLM Audit & Controls

SOX 404(b) / ICFR / CASE: PEABODY PROPERTIES

DEFICIENCY & MATERIAL-WEAKNESS ANALYSIS · FY2024

§ 03Selected key control results

Detail of the 7 highest-risk key controls. These drive the audit opinion — exceptions here would impair our ability to rely on management's ICFR assertion.

Key control test detail · selected

ID	Cycle / Description	Freq	Owner	Sample	Dev	Status
REV-01	Monthly rent roll reconciliation to GL revenue, signed off by Property Controller	Monthly	P. Walsh	12	0	Effective
REV-03	Tenant concession authorization reviewed and approved by VP Operations	Per event	M. Ortiz	45	1	Deficient
P2P-04	Three-way match exception report reviewed monthly by AP Manager	Monthly	D. Kim	12	1	Deficient
CLO-02	Journal entry sub-certification: all manual JEs reviewed by Asst. Controller	Monthly	A. Reyes	12	0	Effective
CLO-05	Account reconciliation review · >$50K balance accounts	Monthly	A. Reyes	36	0	Effective
ITG-02	Quarterly user access review · NetSuite ERP	Quarterly	IT (3rd party)	4	1	Deficient
ITG-04	Privileged access review · NetSuite admin role + DB-level access	Quarterly	IT (3rd party)	4	1	MW candidate

§ 04Deficiency severity analysis

Each deficiency is evaluated against the PCAOB framework: likelihood (reasonable possibility) × magnitude (could result in material misstatement). The combination, not either alone, drives the classification.

Severity matrix · deficiencies

Control	Likelihood	Magnitude	Classification
REV-03 Tenant concessions	Reasonably possible	Inconsequential	Deficiency
P2P-04 3-way match review	Reasonably possible	Inconsequential	Deficiency
ITG-02 User access review	Reasonably possible	More than inconsequential	Significant deficiency
ITG-04 Privileged access	Reasonably possible	Material	MW candidate

Recommendation summary

REV-03, P2P-04: management response & remediation plan; no opinion impact.
ITG-02: elevate to significant deficiency — communicate to audit committee in writing.
ITG-04: pending closing meeting outcome; if MW confirmed, ICFR opinion would be adverse at the relevant assertion level.
All identified deficiencies are operating effectiveness in nature; control design assessed as adequate.

§ 05Material weakness candidate · ITG-04

The single material-weakness candidate centers on quarterly privileged-access review. The deficiency itself is design-acceptable but operating-failed in Q2 and Q3. Mitigating factors: no actual unauthorized access detected; compensating monitoring controls partially effective.

ITG-04 · Issue detail

Control: Quarterly privileged access review · NetSuite admin and DB
Owner: IT Director (3rd party MSP)
Designed: Quarterly · 4× per year
Performed Q1: Documented · pass
Performed Q2: Not documented
Performed Q3: Not documented
Performed Q4: Documented · 2 stale accounts found
Compensating: SIEM log monitoring (partially effective)

Path to classification

Two of four quarterly cycles failed in operating effectiveness. The Q4 catch-up review identified 2 stale privileged accounts in active state — a reasonably possible route to a material misstatement.

Mitigating evidence: review of NetSuite audit logs across Q2-Q3 found no transactions executed by the stale accounts. No actual misstatement occurred.

Final disposition pending the audit committee closing meeting. If confirmed as material weakness, the ICFR opinion will be adverse at the ITGC assertion. If downgraded to significant deficiency on compensating-control evidence, the ICFR opinion can remain unmodified.

ENGAGEMENT · PEABODY PROPERTIES FY2024 ICFR AUDIT · CONFIDENTIAL DRAFT · INTERNAL USE · AUDITOR: MacrosLM. Fictional engagement for illustration. Control population, deficiencies, severity analysis, and material-weakness logic are representative of a typical accelerated-filer SOX 404(b) procedure.MacrosLM · Audit & Controls Series →