Costco Wholesale Corporation (Costco) is a large multinational retailer headquartered in Washington. The company operates by selling memberships that allow consumers to shop at their retail warehouses. On October 4, 2018, Costco executives shared the companys fourth quarter operating results. Although the company had strong financial results, significant control issues were identified. Despite the positive earnings, the companys shares of stock dropped approximately 4% after the announcement of major internal control issues.

The company reported a material weakness over information technology general controls. One of the major control deficiencies involved user access issues. The company noted that authorized users had excessive system access that was beyond what was required. In addition, both internal users and contractors had unnecessary access to systems that supported the companys financials. The company believes that access was needed at one point in time, but was not removed in a timely manner.

1. What were the access control issues that Costco was facing?

2. What can happen when users have this type of access?

3. What internal controls could the company put in place to detect this user access issue?