Internal Audit Newswire - October 04, 2026

Kiteworks urges customers to shut down their servers amid 'imminent' threat of cyberattack

Source: TechCrunch

Summary: On September 25, 2026, Kiteworks (formerly Accellion) warned customers it had received credible law‑enforcement threat intelligence that a threat actor may target some Kiteworks systems, and advised a precautionary shutdown window that weekend. The company said it knew of no compromises and urged customers to run its latest 9.5.1 release addressing known vulnerabilities. TechCrunch noted Kiteworks serves thousands across healthcare, technology, education, automotive, and government, and some customers took servers offline. The report was updated with responses from the FBI and CISA.

Internal Audit Implications: Treat this as a live‑fire test of third‑party operational risk governance. A vendor‑directed shutdown based on law‑enforcement intelligence triggers decision rights, emergency change processes, and continuity planning—all of which internal audit should independently verify. Actions this quarter: - Map where Kiteworks is used, what data classes transit the platform, and which business processes depend on it; update the risk register and vendor criticality tiering accordingly. - Review incident‑response playbooks for vendor‑originated advisories: who can approve shutdowns, what evidence is required, how legal/comms/IT coordinate, and how logs are preserved. - Test emergency change management around the shutdown/patch cycle, including approvals, backout plans, and documentation of downtime impact. - Validate compensating IT controls: version currency to 9.5.1 where applicable, network allowlisting/egress filtering around Kiteworks nodes, least‑privilege access, and centralized logging/alerting. - Assess continuity: documented workarounds for file transfers, tested RTO/RPO for dependent workflows, and vendor communication SLAs. Controls to test: third‑party risk intake and ongoing monitoring, vulnerability and patch governance, incident notification intake, DR/BCP testing, data loss prevention at integration points, and change‑freeze exception approvals. Expect audit committee questions: Do we use Kiteworks, and what sensitive data resides there? Did we apply 9.5.1 and for how many instances? Who authorized any shutdowns and were incident‑response and continuity controls effective? What was business impact and how was it tracked? Do contracts require timely security advisories, patch SLAs, and cooperation with law enforcement? What lessons are captured and by when will remediation close?

Guilty Plea by Air Force Reservist for PPP Loan Fraud is Another Win for National Fraud Enforcement Division

Source: U.S. Department of Justice (USAO - Northern District of Florida)

Summary: On September 29, 2026, the U.S. Attorney’s Office (N.D. Fla.) announced Ray Anthony Pearson II, 32, pleaded guilty to one count of wire fraud tied to Paycheck Protection Program funds. Court filings state that in 2021 he falsely claimed self‑employment and obtained $20,142; a second PPP application was denied. Sentencing is set for December 17, 2026. The case—investigated by Air Force OSI and prosecuted by AUSAs Jessica Etherton and Walter Narramore—ties to DOJ’s National Fraud Enforcement Division, which reports over 150 prosecutions and $75M seized.

Internal Audit Implications: Another guilty plea in PPP fraud underscores how easily benefit programs can be abused when eligibility and disbursement controls are weak. Internal audit should press for measurable fraud deterrence in any channel touching government funds, customer/vendor onboarding, or relief‑program reimbursements. Do this now: - Refresh the fraud risk assessment for federal‑program exposure; quantify where our processes could enable false self‑employment or payroll claims. - Test application intake controls: identity proofing, bank‑account ownership, EIN/SSN validation, and document verification against authoritative records. - Run analytics for duplicates and anomalies (shared addresses, devices, IPs, or bank accounts; rapid repeat applications; round‑number requests). - Evaluate segregation of duties and maker‑checker reviews for approvals and disbursements; confirm denial rationales are documented and override logs reviewed. - Confirm post‑disbursement monitoring and clawback/referral procedures exist, with clear thresholds and escalation to Legal/Compliance. - Check whistleblower hotline coverage, training, and case triage specific to program‑benefit fraud. Controls to test: customer/vendor due diligence, sanctions and exclusion screening, exception approval workflows, transaction monitoring rules, case management integrity, and periodic model tuning/validation. Expect audit committee questions: What is our exposure to PPP‑like fraud vectors across current programs? What red flags are monitored today and how many cases did monitoring generate? How quickly can we suspend disbursements or offboard counterparties? What recoveries and referrals have we achieved? What control remediation will be delivered this quarter and how will we measure reduced residual risk?

FORM 8-K (Current report) — Feel The World, Inc. (D.B.A. XERO Shoes)

Source: U.S. Securities and Exchange Commission (EDGAR)

Summary: Feel The World, Inc. (d/b/a XERO Shoes) reported via Form 8‑K that its audit committee concluded the 2025 and 2024 audited statements and certain interims must be restated. Management determined Series A Preferred Stock (2020) was carried at par rather than at required redemption amount, and Senior Preferred (2025) at par rather than at net proceeds. The company disclosed a material weakness in ICFR over accounting for equity instruments and filed restated financials as Exhibits 99.1 and 99.2. In Q3 2026, it engaged independent experts and strengthened processes prospectively.

Internal Audit Implications: Restatement tied to misclassified preferred stock is a direct signal that equity‑accounting controls were not designed or executed to handle complex instruments. This is a SOX 404 and ICFR issue internal audit should treat as a top‑tier financial reporting risk. Prioritize: - End‑to‑end process mapping for equity issuances and modifications, from term‑sheet intake to journal entry and disclosure. - Design assessment of technical‑accounting controls: required redemption amount vs. par, net proceeds vs. par, classification (equity, mezzanine, liability), and disclosure assertions. - Evidence of qualified review: checklists, contemporaneous technical memos, and second‑partner style reviews by competent personnel or engaged experts. - Cap‑table governance: source‑of‑truth ownership, reconciliation to GL, and tie‑outs to exhibits and filings. - Close controls: period‑end disclosure committee procedures, precision of review controls, and deferral of issuance accounting until documentation is complete. - Look‑back testing: apply enhanced controls to previously issued instruments to confirm no additional misstatements. - Deficiency evaluation: severity assessment, remediation plan with owners and milestones, and monitoring of interim compensating controls. Controls to test: accounting policy governance, deal‑approval workflows, segregation of duties around recording equity financing, system configuration for instrument attributes, and disclosure controls and procedures. Expect audit committee questions: What was the precise root cause and why weren’t review controls detecting par vs. redemption amount/net proceeds errors? What’s the remediation timeline to clear the material weakness? Do we have sufficient in‑house expertise and when should we use external specialists? Has a full population look‑back been completed and what did it find?

Disclaimer: This content is provided for general informational purposes only and does not constitute legal, accounting, tax, investment, or other professional advice. Portions were generated using AI tools from public web sources and may contain errors or omissions — verify important details against the primary sources linked above before relying on them. Any example prompts, scripts, templates, or other artifacts are provided “as is” without warranty of any kind, express or implied; test them on non-production data and apply your own professional judgement before use. Cherry Hill Advisory disclaims all liability for any loss or damage arising from the use of, or reliance on, this content or any artifact it contains.