Too Big to Audit?
RISKINTERNAL AUDITSOXBUSINESSFEATUREDCOMPLIANCE
The “passive flows”, the 401K stream of money into index funds, have created “zombie” equities whose stock prices, and the perceived company competency, seem to continually walk slowly up and to the right no matter what happens in reality.
How do you audit that which has no life?
When $200 Million isn’t enough
Every auditor will determine their own thresholds for materiality, but just for fun let's create a hypothetical with the largest retailer in the world: Walmart.
Planning materiality based on their $19.4 billion in net income runs approximately $970 million. Applying a 25% tolerable error threshold yields $242.5 million. We can even tighten the screws and take tolerable error down to 2.5% of planning materiality which would get you roughly $24 million, slightly less than what the Walmart CEO made in 2024. The joke used to be if we found an error less than the CEO’s compensation, immediate immaterial.
Imagine being on the EY team in Rogers, Arkansas and doing an inventory count at a Walmart facility.
It's 4:00 a.m. on a Saturday in late October. You're standing in a Walmart distribution center in Ochelata, Oklahoma, reviewing 38 pages of inventory count documentation with your third pumpkin spice latte of the morning, which is getting charged to the Amex.
Ted, the distribution center manager, is your local contact for the annual inventory observation.
"The records indicate 9,374 packs of Oscar Meyer hot dogs, but I'm counting 9,370, is there another storage location?"
"That sounds about right," Ted responds.
"What happened to the missing four packs?"
"Not sure. We may have used some for the employee cookout last night."
You document the variance. Four packs of hot dogs. You've potentially identified either a material control deficiency, fraud, or nothing at all. The discrepancy receives an "m" notation, immaterial, and you continue testing. Walmart would need to misstate inventory by a quarter billion dollars before the discrepancy becomes “material” to the financial statements.
That represents 242.5 million packs of hot dogs, almost enough for every non-vegan person in America! That’s a lot of hot dogs. Of course these are all hypothetical numbers but you get the point. What exactly is the EY Rogers team expected to do for a $57.7 billion dollar inventory balance? Better make sure all those SOX controls work!
Speaking of hot dogs and SOX controls, we’ve seen this before. In 2018, Costco announced they found a “material weakness” in internal controls related to “access provisioning”, an IT general control “weakness”. Can you spot the “material weakness below?
The Importance of Data
If traditional audit methods struggle with these giants, what's the solution? Trying to stumble upon a $200 million dollar whoopsie at a Walmart or Costco seems like a fool's errand. Sure, there is always audit fruit to be found, but if I was the CAE at Walmart I sure would love to know if someone was eating my hotdogs long before EY figured it out.
Continuously monitoring and tracking risks across large enterprises like Walmart requires more than a CoPilot plugin for SAP. The value of clean data has only increased as enterprises become larger and larger. Walmart did not get this big overnight and has been utilizing technology to optimize operations for a while. I’m sure Sam would be proud.
Is your enterprise data ready for AI?
Brian Kuenzi is a leader in the finance and technology space. Brian's experience spans SOX and Audit leadership, finance transformation, process automation, and business operations across both consulting and in-house leadership roles. You can learn more about Brian on LinkedIn.
These are the opinions of the editors of Internal Audit Next and/or the writer who authored this article. Any use of this copyrighted material without permission of Internal Audit Next - including training for AI Models - is prohibited. Copyright 2026.
Related Articles
Internal Audit Next © 2026
Internal Audit Next is a site containing thought leadership articles for the GRC (Governance, Risk, and Compliance) industry. Staffed and written by volunteers looking to change this industry for the better.