Internal, External and IT Audit Case Studies
Finance5 Case StudiesUpdated Sep 2026
Finance work tends to break at the seams, where two numbers that should agree do not, or where a plan meets cash it did not expect. The five cases here cover that ground. One traces a ledger that would not reconcile. Another tests a forecast after revenue slipped. The rest look at a payment pattern that tripped a screen, a credit request that read well on paper, and a set of review findings that needed owners and proof. Each is written from the seat of the person doing the work. The organizations are fictional, but the pressures will be familiar.
Case Study 1
Ledger variance across three payables systems
Calder Ridge Hospitality Group, a privately held operator of eleven hotels and two conference centers.
The situation
Calder Ridge runs eleven hotels and two conference centers, and its shared services group closes the books for all of them from one office. At month end the general ledger carried $2,184,600 in accrued liabilities. The payables subledger supported only $2,097,350. The bank statements for the two operating accounts showed disbursements that matched neither figure cleanly. The gap of $87,250 sat across three systems: the purchasing platform, the payables subledger, and the ledger itself. The close was already four days late when the controller asked for a trace that could be defended to the external auditors.
The challenge
The obvious explanation was timing, a batch of invoices received late and posted after cutoff. That explained part of it. But the team could not tie the remaining amount to specific documents, and two bank debits carried descriptions that did not name a vendor. Some purchase orders were marked received without a matching receiving report, and an approver had released payment on a few invoices with no three-way match on file. The open question was which of these were real errors and which were only the wrong dates.
Analysis
The first step was to stop treating the $87,250 as one number. The team broke it into sixty-one reconciling items and sorted them by source document, then by age and by exposure. Eleven items were timing differences that cleared once the late invoices posted. Nineteen were duplicate entries from a vendor portal feed. The remaining items carried real exposure: payments without receiving evidence, and two debits totaling $31,400 that had no supporting invoice at all. Ranking by dollar value and by how hard each item was to verify gave a clearer picture of where the risk actually sat than the raw total did.
Teams grounded in Internal, External and IT Audit usually ask a second question at this point: what evidence would have prevented the gap, and does that evidence exist today? Here the answer was partly yes. The purchasing platform logged approvals with timestamps, but receiving was optional for service purchases, which is where the missing receiving reports clustered. The policy required controller sign off on any unmatched payment above $10,000, yet the threshold had been applied only to invoices, not to manual journal entries. The two debits were booked by manual entry, so they passed without notice.
Actions taken
- Obtain bank confirmation and remittance detail for both unexplained debits before any entry is proposed, and hold the accrual adjustment until the documents are in the file.
- Require receiving evidence or a documented service acceptance for every purchase order above $2,500 before it can be paid, and configure the platform to block payment otherwise.
- Extend the $10,000 controller approval threshold to manual journal entries and to any payment that fails three-way match, with the approval captured in the ledger rather than by email.
- Run a weekly subledger to ledger tie-out for the three largest accounts, with each unreconciled item assigned an owner and a due date no later than five business days out.
Results
The two unsupported debits were traced within the first week. One was a duplicate payment to a linen supplier, recovered through a credit memo. The other was a standing transfer set up under a retired account number, and the bank reversed it once the account was verified. Of the $87,250 gap, all but $4,900 cleared before the close was finalized, and the remainder was documented with a named owner and a dated plan. The threshold change went live before the following close, and the first month under the new rule flagged six manual entries for review, two of which were corrected before posting.
Questions for discussion
- Which of the sixty-one reconciling items would you have resolved first, and what would have changed your order?
- How would the team's conclusion have differed if the bank descriptions had named the vendor?
- Where in your own close process does a threshold apply to one entry type but not another?
Case Study 2
Revenue shortfall tests a rolling cash forecast
Marrow Creek Dental Partners, a network of fourteen clinics sharing one billing office.
The situation
Marrow Creek runs fourteen dental clinics under one billing office and a shared supply contract. The annual plan assumed patient volume would rise six percent, and the finance group rebuilt the forecast each month from appointment data, collections, and payroll. Three months into the year, visits were flat at nine clinics and down at five. Collections were lagging because insurance remittances had slowed, and the cash balance the plan projected at $1,860,000 by the end of the quarter now looked closer to $1,410,000. The board wanted a view before the next lending covenant test.
The challenge
The forecast had three moving parts that interacted. If the volume drop was seasonal, cash would recover on its own. If it reflected a lost referral source, the shortfall would persist. And if remittance delays were a payer processing backlog, collections might arrive in a lump that hid the underlying trend. Dani, the group finance lead, needed scenarios showing when covenant headroom would break, and she had to say which assumptions she trusted and which she did not.
Analysis
The first pass separated what was known from what was assumed. Appointment counts and completed procedures were recorded in the practice system and could be checked against the daily schedule. Collections were recorded too, but they trailed service by about nine weeks, so the timing of cash was itself a modeling choice. Dani built three scenarios on that base. The base case kept the decline in the five weak clinics and assumed remittances normalized within two months. The downside extended the delay to four months. The severe case added the loss of a referral partner whose patients made up a fifth of new visits at two sites.
The credit agreement required at least $1,200,000 of unrestricted cash at every month end, and it allowed one waiver request per year without penalty. Those thresholds turned the scenarios into a decision. Under the base case, headroom stayed about $180,000 above the minimum. Under the downside, it dipped below in the fourth month. Under the severe case, the breach came in the second month. Dani treated the downside as the planning case because the remittance delay was already visible in actual receipts, and she asked for the trigger signals in writing. The covenant was the hard line, and the operating reserve was the buffer to use before reaching it.
Actions taken
- Adopt the downside scenario as the planning case for the next two months and reset the cash forecast to it, rather than waiting for the base case to prove wrong.
- Ask the payer relations team for a claim-level aging report from each of the five weak clinics, so the delay can be separated from a true drop in billable work.
- Set a trigger at $1,350,000 of projected unrestricted cash, and if two consecutive weekly updates fall below it, open waiver talks with the lender before the test date.
- Hold discretionary hiring and equipment purchases at the five weak sites until headroom is restored, and record each exception with the approving partner's name and the reason.
Results
The downside became the working plan in the first week. Claim aging showed that roughly two-thirds of the delayed balance sat with one regional payer, and the billing office escalated those files through the payer's provider line. Remittances began moving in the sixth week, slower than the base case had assumed but faster than the downside. Headroom bottomed about $95,000 above the trigger, and no waiver was needed. The hiring hold stayed in place at the five weak sites through the end of the quarter, and the forecast was rebuilt each month on the same three-scenario structure.
Questions for discussion
- Which assumption in the base case would you have tested first, and what data would have changed your mind?
- When a covenant threshold is close, how should a team decide between an early waiver request and waiting for better data?
- How would you separate a true drop in billable work from a collections timing problem in your own forecast?
Case Study 3
Payment pattern triggers a sanctions screen review
Northgate Commodity Trading, a mid-sized firm that buys and resells agricultural inputs through two regional offices.
The situation
Northgate buys agricultural inputs from suppliers in three countries and resells them to distributors. Over six weeks, the treasury team noticed that a long-standing distributor had begun sending payments from a bank account in a different country than the one on the master file. Nine payments totaling $412,800 arrived over eleven days, and each sat between $45,000 and $49,000, just under the $50,000 level that triggered enhanced review at the company's bank. The monitoring system flagged the pattern, and compliance had to decide whether to hold, report, or release.
The challenge
Nothing in the pattern proved wrong on its own. Distributors do change banks, and buyers sometimes split large orders. But the combination of a changed origin, amounts stacked just under a threshold, and a counterparty whose order volume had not grown made the file look like something that needed a documented decision. Compliance had to decide within the day whether the payments could be released, whether a report was required, and whether the relationship should continue.
Analysis
The review began with the master file, the signed supply agreement, and three months of invoices. The master file showed a distributor with steady volume and a consistent account in its home country. The new payments came from an account opened eleven weeks earlier, held by a company whose registered address matched a service office rather than a warehouse. Exposure ran in two directions. Goods shipped on credit and still unpaid stood at $688,000, and if the payments were later tied to a sanctioned party, the legal and reputational exposure could not be estimated. That unknown was itself a reason to slow down.
The written procedure set three escalation triggers: a change in payment origin for an existing counterparty, a run of payments that individually fell below a reporting threshold, and a mismatch between the paying party and the contracting party. This file hit all three. The procedure also required the relationship manager to record the business reason for the change, and that note was missing. Teresa, the compliance officer, sent the file to the reporting officer that day and kept the payments on hold until the distributor supplied a bank letter confirming the account and beneficial ownership. Release would need sign off from both compliance and the chief financial officer, recorded in the case file.
- 1Pattern flaggedSystem alert on origin change and split payment amounts.
- 2Hold paymentsRelease stopped until ownership and source are confirmed.
- 3Request documentsBank letter, beneficial owner details, and business reason.
- 4Report decisionCompliance files a report if the explanation fails.
- 5Release or exitDual sign off required before any release or termination.
Actions taken
- Freeze the three pending payments and record the hold in the case file with the time, the approver, and the specific triggers that applied.
- Obtain written confirmation from the distributor's bank of the account holder and the beneficial owner, and check both against the registry extract the company already holds.
- Prepare the suspicious activity assessment within the internal reporting window, separating facts from inference and attaching the invoices, shipping records, and bank correspondence.
- Review every payment received from the distributor in the prior twelve months and every account opened by the same beneficial owner, and report any further matches to the reporting officer.
Results
The bank letter arrived in the second week. It confirmed the account belonged to a sister company with no disclosed link to the distributor, and the beneficial owner check did not resolve the question. Compliance filed an internal report and then a suspicious activity report through the company's standard channel. The relationship moved to enhanced monitoring, and new orders required prepayment from the home-country account. The look-back over the prior twelve months found no other payments from the new account, but it did turn up two earlier invoices that had been paid in split amounts, which was logged as a separate training issue.
Questions for discussion
- Which of the three escalation triggers would you weigh most heavily if only one had fired, and why?
- What would a relationship manager need to provide to justify a change in payment origin without triggering a report?
- How should a team document a decision to release payments that it is not fully able to explain?
Case Study 4
Expansion loan request for a bakery group
Pellhurst Bakery Holdings, a family-owned group running six production sites and two distribution hubs.
The situation
Pellhurst wanted $3,400,000 to acquire a competing bakery with two production sites and a regional delivery fleet. Its own statements showed revenue of $19,700,000 over the last year, with an operating margin that had narrowed from 9 percent to 6 percent across two years. The seller's summary showed higher margins, and the acquisition model assumed the target would converge with Pellhurst's best site within eighteen months. The lending committee had a credit memo drafted, and the question for the group was whether to recommend approval, approval with conditions, or decline.
The challenge
The request looked reasonable on the surface: a growing customer base, a trade name worth keeping, and a seller willing to carry part of the price. But the target's statements for the last year were unaudited, the fleet lease obligations were not clearly disclosed, and the forecast had not been tested against swings in flour and energy costs. Marisol, the credit analyst, had to say how much the company could repay from cash flow if the margin never recovered.
Analysis
The analyst rebuilt the target's earnings before using the lender's own model. Reported profit was adjusted for two items. A one-time equipment write-down the seller treated as non-recurring was accepted only after the invoices were checked, and a fleet lease had been expensed at less than the cash payments implied. After those adjustments, normalized EBITDA came to about $2,150,000, not the $2,600,000 in the seller's summary. Debt service at the proposed terms would absorb roughly 70 percent of that figure, which left thin room for fleet replacement. Exposure sat mostly in the two sites with the thinnest margins and the oldest ovens.
Credit policy capped leverage at 3.0 times normalized EBITDA for acquisition financing and required debt service coverage of at least 1.25 in the downside case. The proposed structure came in at 3.4 times leverage and 1.08 coverage in that downside, both outside policy. Marisol's downside raised flour costs 15 percent with no margin recovery, and coverage fell below 1.0 in the second year. The committee could accept a larger equity injection, a seller note subordinated to the senior loan, or a lower purchase price. Any of those would bring the structure inside policy. A straight approval on the original terms did not fit the thresholds.
- Week zeroSeller data received, unaudited statements flagged as a gap.
- Week twoNormalized earnings rebuilt, lease obligations added to model.
- Week fourDownside scenarios run against policy leverage and coverage limits.
- Week sixCommittee reviews revised structure with equity and seller note.
- Month threeConditions met before funds are released, or request declined.
Actions taken
- Require reviewed statements for the target's last full year as a condition before funding, with the lease schedule attached and reconciled to actual cash payments.
- Restructure the request with a larger equity injection or a subordinated seller note until leverage is at or below 3.0 times and downside coverage reaches 1.25.
- Add a covenant that tests coverage quarterly and allows the lender to block distributions to shareholders while coverage remains under 1.25 times.
- Hold a post-close review at the end of the first full year, comparing the two weakest sites against the acquisition model before any further growth capital is approved.
Results
Pellhurst accepted a revised structure in the sixth week. The seller agreed to carry $500,000 as a subordinated note, and the company added $600,000 of its own equity, which brought leverage to 2.9 times and downside coverage to 1.28. The statements review was completed before funds moved, and the lease reconciliation exposed a $140,000 understatement in lease obligations that was added to the model. The committee approved the amended request with a quarterly coverage covenant. Had the original terms gone forward, the first downside year would have needed a waiver.
Questions for discussion
- Which adjustment to reported earnings would you want documented most carefully before relying on it?
- If the seller would not accept a subordinated note, what other structure would you test against the same policy limits?
- How much weight should a committee give to a management case that assumes margin recovery within a fixed window?
Case Study 5
Ranking review findings and closing them with evidence
Corvane Utilities Cooperative, a member-owned electric cooperative serving 48,000 accounts.
The situation
Corvane's internal review covered the procurement-to-payment cycle and the fixed asset register. The review team logged fourteen findings. Three concerned vendor master file changes that were not approved by a second person. Two concerned capitalization of work that looked like routine maintenance, totaling $418,000. The rest ranged from missing approvals on small purchase orders to a fixed asset register that did not agree with the general ledger at the category level. The audit committee asked for a remediation plan with owners and closure dates before its next meeting.
The challenge
Management had already begun fixing some items before the report was issued, and the team had to separate what was truly remediated from what was only described as fixed. Several owners said a control was in place, but the evidence was a policy document rather than a log. The committee wanted findings ranked by materiality so that effort went first to the items that could mislead the financial statements, and it wanted each closure tested against evidence, not a status update.
Analysis
Ranking began with the effect on the financial statements rather than the count of occurrences. The capitalization issue scored highest, since $418,000 of expense sat on the balance sheet and would reduce reported operating results if reversed. The vendor master changes scored high on exposure rather than amount. A fictitious vendor with a changed bank account could divert payments of any size, and eleven changes had gone live without a second approval. Three smaller findings were grouped because they shared a root cause, a purchase order workflow that allowed overrides without a reason code. Materiality was judged against the committee's planning threshold of $250,000 for the period.
Each finding was assigned to one accountable manager rather than a team, and that manager was the person who controlled the process, not the person who would later report on it. The vendor master finding went to the accounts payable supervisor. The capitalization finding went to the controller, since the threshold decision sat with that role. Closure tests were written before any remediation began. For vendor changes, closure required a system report showing no single-approver changes over sixty consecutive days, plus a sample of twenty-five changes traced to signed requests. For capitalization, the test was a re-review of reclassified projects against a written threshold rule approved by the committee.
Actions taken
- Remove single-user edit rights to vendor bank fields and require a second approver with a system-recorded reason for every change, live within the next thirty days.
- Trace the eleven unapproved vendor changes to their source requests and to the payments made after each change, and report any payment to a changed account that lacks support.
- Document the capitalization threshold in a signed policy, re-review the $418,000 of reclassified projects, and reverse any item that does not meet the revised test.
- Add a reason-code requirement to purchase order overrides and review the override log monthly, with the controller signing the summary and listing any repeat approvers.
Results
Of the fourteen findings, nine closed within the period and passed independent retest. Two of the capitalization items were reversed, reducing the asset base by $96,000 and bringing the category into agreement with the ledger. The vendor change investigation traced all eleven changes to valid requests except one, which was a clerk's typo in an account number and was corrected after a documented call-back to the vendor. Five findings remained open at the committee's next meeting, each with a named owner and a retest date. The committee accepted the closure approach, and the remaining items were tracked in the same format as the first nine.
Questions for discussion
- How would your ranking change if the planning threshold had been set at half the amount?
- What evidence would convince you that a control described as in place is actually operating?
- Who should own a finding that spans two functions, and how would you keep that owner from being the only person who tests it?
Learning Resources
Finance CASE STUDIES
China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.