Costco generated US$200.0 billion of revenue in the United States and US$36.9 billion in Canada in its 2025 financial year. Net sales rose 8 per cent to US$269.9 billion. KPMG identified the sufficiency of audit evidence over US and Canadian revenue as a critical audit matter. The reason was not unusual accounting. It was the highly automated movement of significant transaction volumes across multiple interfacing IT systems.
The immediate interpretation is an audit burden, but there is a broader operating implication worth examining. A transaction path that must already support reconstructable financial evidence may provide a reusable foundation for consequential AI applications. The question is whether that controlled path can support additional decisions without each application rebuilding its own version of the record. Before applying that argument to Costco, we need to establish what the auditor's paragraph actually tells us.
The paragraph is a template
This critical audit matter should be read in the context of similar findings across the auditor's client base. Its value for the argument lies partly in the recurring operating conditions it describes. "Sufficiency of audit evidence over revenue" is standard KPMG language. It appears across the firm's client base in the same filing season, with the same structure. Involve IT specialists. Test general IT and automated controls over the systems that process and record revenue. Test the reconciliation of system output to the general ledger. Then assess whether the resulting evidence was enough.
A sample from FY2025 filings shows how little the wording moves.
| Company | Auditor | Substance of the revenue critical audit matter |
|---|---|---|
| Costco Wholesale | KPMG | High volumes moving across multiple interfacing systems; highly automated processes; IT specialists engaged; subjective judgement on sufficiency |
| QVC | KPMG | IT specialists test general IT and automated controls over the systems used to process and record revenue, plus the controls reconciling system output to the ledger |
| RingCentral | KPMG | IT controls over the subscription revenue process; auditor judgement on which IT applications to test; IT specialists engaged |
| Euronet Worldwide | KPMG | Multi-country revenue; software-assisted data analysis to test relationships among transactions; sufficiency assessed on nature and extent of evidence |
The same language also appears in the FY2025 filings of Reddit, Cloudflare, TD SYNNEX, Expensify, LiveRamp, National Research and Neuronetics. The businesses have almost nothing in common. The paragraph is nearly identical. The recurring paragraph does not identify an AI platform or establish what any company has built internally. It does provide a basis for examining a class of transaction paths as potential reusable capabilities, rather than considering their controls solely within the annual audit.
What the template actually marks
The pattern provides an architectural filter: high transaction volume, extensive automation, movement across system interfaces and financial consequences that require reconstructable evidence. Together, those conditions identify a bounded path through the company where the organisation must be able to establish source identity, transformations and control results.
That path is where the company must already be able to answer questions that every consequential AI application will ask later. Which source event is this? Which systems touched it? Which controls ran? Which version of the logic applied?
The audit requires evidence about that path. If the underlying controls and records can also support recurring commercial or operational decisions, their value may extend beyond the assurance exercise. The practical question is what can safely be reused, under which authority and at what incremental cost.
For Costco, the answer matters more than for most of the peer set, because the same transaction carries a member identity across every workflow the company runs. That is the reason to work the argument through Costco rather than through Cloudflare. It is an illustration, not a discovery.
The same transaction is being asked four questions
Consider four decisions Costco faces. The first is financial: did revenue move completely and accurately from the transaction through the relevant systems and into the ledger? The second is commercial: why do some memberships renew while others do not?
Costco reported a 92.3 per cent renewal rate in the US and Canada and 89.8 per cent worldwide at the end of 2025. Both were down about 40 basis points on the quarter. It also said that newer international markets and memberships sold online, including through digital promotions, renew at a slightly lower rate on average.
The distinction between market and channel cohorts matters because a small movement in the blended renewal rate can conceal a much larger difference within the population. The blended worldwide rate is a weighted average of the US and Canada rate and everything else. Costco does not disclose how the renewal base splits. But warehouse counts put the US and Canada at roughly four-fifths of the estate, so take 80 per cent as a working weight and solve for the remainder.
| Assumed US/Canada share of the renewal base | Implied rate everywhere else | Gap to US/Canada |
|---|---|---|
| 75 per cent | 82.3 per cent | 10.0 points |
| 80 per cent | 79.8 per cent | 12.5 points |
| 85 per cent | 75.6 per cent | 16.7 points |
Those are illustrative figures, not disclosed ones. The renewal base is not the same as paid member accounts, and Costco publishes neither split. But the direction is not sensitive to the assumption. Under those illustrative weightings, a 2.5-point difference in the headline rates implies a gap of roughly ten to seventeen points for the remaining renewal population. The public figures do not establish which cohorts produce it or why. That distinction matters to the decision: a change in the composition of the population calls for a different response from a change in member behaviour.
One is mix: more members are entering from cohorts that structurally renew at a different rate. The other is behaviour: some members may be receiving less value, encountering more friction or responding differently to the proposition.
The 2026 data sharpens the question rather than settling it. By the first quarter of fiscal 2026 the rates were 92.2 per cent and 89.7 per cent, each down a further 10 basis points. By the third quarter the US and Canada rate had ticked back up 10 basis points to 92.2 per cent while the worldwide rate held at 89.7 per cent. Deferred membership fees rose from US$2.854 billion at 31 August 2025 to US$3.157 billion by 10 May 2026, so new members kept arriving throughout.
A worldwide renewal number cannot separate mix from behaviour. A cohort analysis can, but only if member identity, acquisition channel, market, purchase activity and renewal status can be joined without creating another version of transaction truth.
The third decision is operational: who bought an item affected by a product-safety event? Costco already uses membership and purchase records to contact members about recalls, and has done so publicly for years. The question is not whether it has discovered targeted notification. It is how precisely, quickly and consistently a product, lot or purchase window can be connected to the right member across channels and markets—and what evidence supports the decision to notify, withdraw or stop sale.
The fourth decision is strategic: is a new international warehouse creating a durable membership business? Costco's foreign square footage is growing from a smaller base. A warehouse opening is usually discussed as a real-estate and operating event. Economically, it also creates a new member cohort. Its sign-ups, purchase patterns, Executive-member penetration and renewals begin a clock that can outlast the opening programme. Executive members were 47.8 per cent of paid accounts at the end of 2025 and drove 73.6 per cent of worldwide net sales, so the composition of a new cohort matters as much as its size.
Financial control, renewal analytics, recall traceability and international performance can appear to be separate systems requirements. Yet they ask different questions of overlapping member and transaction records. That creates a case for examining which underlying capabilities can be shared while retaining the authority appropriate to each decision.
The visible applications are not the platform
An enterprise AI programme is naturally drawn to what a user can see. A retention model can identify members at risk of not renewing. An agent can recommend outreach. A product-safety model can find anomalous complaints or returns. A new-market dashboard can compare warehouse cohorts. A finance model can flag unusual transactions.
Each application can create value, but building them independently can also create separate member identifiers, feature stores, reconciliation logic and exception processes. The organisation may then have several systems interpreting the same commercial activity through different versions of the record. That adds a reconciliation obligation which needs to be priced and assigned, rather than assuming the applications together constitute a reusable platform.
The distinction matters because the applications do not have equal consequences. A renewal recommendation can be wrong without changing the accounts. A recall decision can affect member safety. A revenue classification can affect financial reporting. An international performance view can redirect capital. The same transaction may appear in all four, but the authority to act on it is different each time.
Putting the data in one warehouse does not resolve that difference. Nor does attaching a lineage product after the applications have been built. The shared capability required here is bounded: a transaction record with controlled lineage, reconciliation, evidence and changes, available to the relevant workflows. I refer to that combination as a certified transaction spine. It is more demanding than a clean data set, but its remit is narrower than a universal enterprise data platform.
What certification means here
"Certified" does not mean that every analytical output is audited or that an external auditor endorses an AI model. It means the path underneath the output can repeatedly answer a bounded set of questions, and that a named person will sign that it did.
Those answers require several things to be built once: an interface and lineage map; continuous reconciliation and integrity detection; control evidence captured when the control runs; governed changes to interface and reconciliation logic; and tested failure, offline-capture and resynchronisation procedures.
Member-level uses add consent, purpose and geography. Financial uses add materiality and certification authority. Safety uses add stop-sale and recall authority. The controls are not interchangeable, even when the underlying transaction is. The reusable capability therefore combines the transaction record with explicit rules about what each workflow may infer and who has authority to act. The database supports that capability; the accountabilities and controls determine how it can be used.
The instrument: a transaction spine attestation
The attestation below turns those requirements into a management document. Complete one page for each consequential workflow, identifying the evidence, accountable owner and abstention condition for each of the seven tests. Written answers and named sign-offs make the proposed reuse assessable before further applications are funded.
| # | Test | Evidence required | Accountable owner | Abstain if |
|---|---|---|---|---|
| 1 | Source identity | The workflow cites the same transaction identifier the ledger cites, traced from the originating event | Controller | The workflow constructs or re-keys its own identifier |
| 2 | Interface path | Current inventory of the systems and interfaces that handled the transaction, with an owner per interface | CIO | The map predates the most recent change release |
| 3 | Control evidence | Completeness and integrity control results, captured at the time the control ran | Internal audit lead | Evidence is reconstructed after the fact |
| 4 | Logic version | The version of transformation and reconciliation logic active at the time, and the diff since the last accepted version | Head of data engineering | Proposed and accepted logic share a branch |
| 5 | Interpretation | The model or deterministic rule that read the record, with its entry in the AI inventory | Named model owner | No owner is named |
| 6 | Authority | Who may approve the resulting action, stated separately for financial, safety, member-contact and capital consequences | A named officer per consequence class | One approver spans two or more classes |
| 7 | Failure | The documented stop condition when reconciliation fails, and the resynchronisation procedure | The row 6 officer for that class | No stop condition exists |
Required output. One page per workflow, signed by the owners named in rows 1, 2, 5 and 6, carrying the count of unresolved reconciliation exceptions and the date of the last successful reconciliation.
Decision rule. Run it for financial reporting, membership, product safety and international operations against the same member transaction. If the four pages give four different answers to row 1, the company has applications. If they give one answer to row 1 and four different answers to row 6, the company has the beginning of a platform.
Row 6 requires particular attention because sharing the record does not settle who may act on it. The attestation should preserve distinct authority for financial reporting, safety, member contact and capital decisions, even where those decisions rely on the same transaction.
Auditability can create option value
Controls are part of the cost of deployment, but a control built for reuse can also lower the cost of subsequent applications. That changes how its investment should be assessed. If transaction lineage has already been mapped, a renewal model does not have to reconstruct it. If integrity evidence is captured continuously, a product-safety workflow can distinguish a missing signal from a missing transaction. If change control already separates proposed logic from accepted logic, an analytical model can be replaced without silently changing the financial record beneath it.
Where the control can safely be reused, the initial investment supports several workflows. Its value includes the incremental cost and risk avoided in those later uses. The value of the first application is no longer only the benefit it produces in its own workflow. It includes the options created for the applications that can safely reuse its capability. Conversely, an apparently cheap application becomes more expensive if it creates a second identity map, a second transaction history or a second definition of an accepted number.
This provides a more specific investment rationale than centralising data in anticipation of unspecified future uses. The renewal, safety and international-performance workflows already described require overlapping capabilities for different decisions. Management can test the common requirement, compare shared and application-specific costs, and fund reuse where the evidence supports it, while retaining the authority appropriate to each consequence.
The controls should change the workflow
A controlled transaction foundation could also permit changes in the workflows themselves. The opportunity extends from making existing analysis easier to changing how renewal interventions, recall response and international performance are managed.
Renewal becomes an experiment rather than a score
The immediate temptation is to predict which members will lapse. The prior question is whether the apparent decline is behavioural at all. The arithmetic above says the international and online cohorts sit ten to seventeen points below the domestic base. If that gap is structural, a retention model trained on the blended population will learn the mix and call it behaviour.
Separate market, channel and tenure effects first. Pre-register a small number of retention interventions. Route only eligible members under the consent rules that apply in their country. Preserve which version of the cohort definition and transaction record produced the recommendation. Compare renewal and member economics against a control group.
The model supplies a recommendation within that governed process. The relevant accountable owners still determine eligibility for contact, interpret the experiment and approve any change to the reported metric.
Recall response becomes traceable rather than merely fast
An anomaly model can help find unusual returns, complaints or transaction patterns. Speed alone is not the product. The useful output connects the signal to the product and affected purchase population; preserves the evidence; routes uncertainty to a qualified person; records who authorised withdrawal, notification or no action; and later captures whether the scope was correct.
The member identity is valuable because it can become a safety channel. That value depends on the integrity of the purchase connection and the authority around the response.
International expansion becomes a membership programme rather than an opening count
Every new warehouse can create a cohort record at opening: how members were acquired, how they purchase, when they upgrade and whether they renew. That changes the management question from whether the site opened on schedule to whether it is producing the membership economics assumed when the capital was committed.
The warehouse remains a physical operating asset, while the member cohort provides evidence of whether it is generating the commercial outcomes assumed at approval.
Why Costco is an unusually instructive case
Costco's model makes the connection unusually visible. Membership identity reaches across the transaction. Merchandise economics depend on volume and trust. Product safety can affect the Kirkland Signature name as well as an individual item. International expansion creates both physical capacity and new member cohorts. Revenue integrity sits beneath the reported economics of all of them.
Management is also on the record about AI, and what it says is worth reading carefully. Chief financial officer Gary Millerchip has described using AI to improve online product pages so that the company's real value shows up in AI-mediated search. His example was appliance pricing. Costco quotes appliances with delivery, installation and haul-away included, and conventional search did not surface that. He has said AI is changing how consumers research products and called it a significant opportunity given Costco's pricing authority and quality focus. The company reported that AI-driven online traffic roughly tripled in a recent quarter, converting better than its other digital channels, with digitally enabled comparable sales up 21.5 per cent in the third quarter of fiscal 2026.
That is a front-end programme. It concerns discovery, presentation and traffic. It is not inference over the member record, and nothing in it requires the spine this essay describes. The company separately says its information systems and networks, and the secure processing and maintenance of data, are critical to operations and strategy. Its US privacy notice, as published at the evidence cut-off of this essay, says personal information may be used to improve systems and processes and to train Costco-specific artificial-intelligence tools and large language models supporting business operations. Privacy notices change without announcement, so that sentence should be re-checked against the live notice before this argument is relied on.
Together those two facts describe a company whose visible AI work does not yet touch the member record, and whose disclosures reserve the right to train on it. That does not establish what Costco has built internally. The public evidence does not reveal its complete system map, control coverage, member-data architecture or AI deployment plan.
For a company applying AI to member and transaction information, the design decision is whether each application reconstructs its own record or reuses a controlled foundation with established lineage, change procedures and authority. The public evidence cannot tell us which approach Costco has adopted. It does make the proposed distinction concrete enough to test against internal facts.
The decision this should change
Before funding another consequential member-facing AI application, management should determine whether its inputs can be produced from the controlled transaction path. Complete the seven-row attestation and obtain the accountable signatures so that the reuse decision rests on evidence about the record, controls and authority.
Fund the lineage, reconciliation, integrity evidence and governed interfaces once. Require renewal, safety and international-performance applications to reuse that capability unless a documented difference makes reuse unsafe or uneconomic. Reject any application that creates a second version of member, purchase or revenue truth without naming who will reconcile it, who may change it and what happens when the two versions disagree.
Model replacement should then occur within that governed framework, preserving the accepted transaction record unless a separately authorised change is required. That makes reuse an operating capability with defined accountabilities, rather than an assumption attached to the next AI application.
Research note
This essay was developed from an outside-in compilation of Costco Wholesale's public record—filings, the annual report, published privacy and recall material, and management commentary reported in the financial press. Peer critical audit matter language was read directly from FY2025 Form 10-K filings. The renewal arithmetic is the author's own and is explicitly illustrative: Costco does not disclose how its renewal base divides between the US and Canada and the rest of the world, so the implied rates are derived from stated weightings, not from disclosure.
The compilation was produced in CER—continuous enterprise recompilation—a system the author is building. CER reads a company's own documents, and for a public company its filings alone, and compiles them into an operating model: the workflows that carry the strategy, how each could be redesigned, the capabilities that redesign needs, what it is worth, and the decisions that follow, each with a named owner. It states what the documents do not describe and traces each claim to the sentence supporting it. As sources are re-read, a change that removes the basis for a claim triggers recompilation of the conclusions that depend on it; this is the purpose of continuous recompilation.
The Costco compilation ran on 14 September 2026 and produced seven workflows, eight shared capabilities and thirty-three decisions, with a proposed next strategy still undecided. The argument in this essay emerged from the shared-capability step, where four Costco workflows converged on the same transaction path. CER's investment logic is to fund a capability once when several workflows require it; this essay develops the implications of that convergence.
CER is in development, it is the author's own, and readers should weigh the argument accordingly. It read only public material here. The essay uses no private Costco information. It does not claim that the proposed architecture is absent, adopted or validated inside the company. Every conclusion above remains a hypothesis until the missing internal facts are supplied and an accountable person decides what to do with it.
Evidence cut-off is 14 September 2026. Costco's Form 10-K for fiscal 2026 is expected in early October 2026 and will supersede several figures used here. It will also provide the first reading on Test 1.