Policies tell you what should happen
Most integrity work starts with documents and interviews. The policy says invoices over $10,000 need two approvals, and the controller confirms that they get them. The Open Ledger Method starts with the record instead. It asks what actually happened to every invoice, every vendor bank change and every manual journal entry in the period, and then asks the people involved to explain what the data shows.
The method has four stages, always in the same order. Diagnostics and projects run all four. A research commission leans on Trace, Test and Disclose. A training cohort leans on Teach, built on your own policies and data. Whatever the mix, each stage leaves evidence behind, so anyone who relies on the work, including your auditors, can see how a conclusion was reached.
The same tests can keep running after an engagement ends. Our article on ten automated monitoring tests shows what that looks like in practice.
Four stages, each feeding the next
Trace
We map how money moves: who starts, approves, changes and records each transaction, and in which systems. That means short interviews with the people who do the work, an inventory of bank accounts, systems and integrations, and user listings from the accounting system, bank portals and payroll provider. The result is a map of each money flow with its owners and hand-offs.
Test
We run full-population analytics over the ledger, the vendor master and system access, using explainable rules and statistical outlier models. A person reviews every flag. We then walk real transactions from request to ledger, some flagged and some not, to confirm whether each control works in practice.
Disclose
We write findings in plain language and rank them by consequence and likelihood. Management sees a draft and adds its response before anything is final. Then we report to whoever needs the result: management, the board, auditors, funders, or the public when you choose to publish.
Teach
We train the people who run the controls, using your own policies and anonymized examples from your own data. Each control gets a runbook entry stating who performs it, how often and what evidence it leaves, so the improvement keeps working after we leave.
Every finding points to a transaction
A finding that says "approval controls are weak" is hard to act on and easy to dispute. A finding that says "this journal entry was posted on a Sunday at 23:48 and approved by the same user who keyed it" is neither.
Every finding we report carries a reference to its source: the transaction, the access listing, the walkthrough note or the document that supports it. A second reviewer who did no fieldwork checks those references before the deliverable leaves the firm. If the evidence does not hold, the finding does not go out.
What you see and keep
Each stage has a visible output for you and a record that stays with the engagement file.
| Stage | What you see | Evidence it leaves |
|---|---|---|
| Trace | A draft map of each money flow for you to correct, and a short list of questions about access and hand-offs | Process maps with owners and systems, an inventory of systems and bank accounts, and user and role listings as received |
| Test | Specific questions about specific entries, vendors and users, rather than a questionnaire | Test scripts and parameters, extract reconciliations, an exception log with the disposition of each flag, and walkthrough notes |
| Disclose | A draft for factual review, then a readout to management and, if you want one, to the board | A findings register linked to source evidence, management responses, and a record of who received which version |
| Teach | Training built on your own policies and examples, and a runbook your team helped write | Runbook entries for each control, training materials, an attendance record and a date for an optional follow-up check |
The method has fixed limits
Some things it will not do, whatever the engagement.
No audit opinion
The method tests whether controls work. It does not express an opinion on your financial statements, and nothing we deliver should be presented as one.
No legal conclusions
Where a finding raises a legal question, we say so and hand it to your counsel. We describe what the records show, not who is liable.
No unreviewed flags
Analytics produce leads, not findings. Nothing a rule or model flags reaches a deliverable until a person has examined the underlying record.
No sampling where the full record exists
When the full population is available, we test all of it. Walkthroughs use selected transactions, but never as a substitute for the data.
No tools you cannot run
If we build a test, a dashboard or a monitoring routine, your team is trained on it, holds the documentation and can run it without us.
See the method on your ledger
A fixed-fee diagnostic applies all four stages to your core money flows in two to four weeks.