Finance Ethics
Menu

Catch control failures the week they happen

Automated tests over every transaction, exceptions reviewed by a person, and owners who close them with evidence.

Start a conversationSee ten tests we automate
Part of
Finance Technology
Runs as
5 stages, from connect the data to review each quarter
You receive
6 deliverables, listed below
Pricing
Quoted after a scoping call

Periodic reviews find problems too late

Many small finance teams check their controls in bursts: a review before the audit, a cleanup before a board meeting, a scramble after a near miss. Between those moments nothing is watching. A vendor's bank details change on a Tuesday and the first payment to the new account goes out on Friday. A new hire is given administrator rights to cover a colleague's leave and keeps them. Manual journal entries pile up in the last two days of the quarter.

Enterprise monitoring software can catch these things, but it assumes someone will tune the rules, read the alerts and chase the owners. In a team of three, that person does not exist. Continuous Controls Monitoring gives you the outcome without the hire: we run the tests, review the results and route only real exceptions to the people who must act.

Engraving of a seismograph drum tracing a steady line with one sharp spike in magenta.
Watch the line, not just the quarter.

Tests cover four data sources

  • Ledger tests

    Manual journal entries posted and approved by the same user, entries made outside working hours or after the close, round-number and just-below-limit amounts, sequence gaps and reversals.

  • Payables and vendor tests

    Duplicate invoices, vendor bank-detail changes followed by a payment, vendors sharing a bank account or address with employees or with each other, and payments to vendors outside the approved master.

  • Bank tests

    Payments released by a single user where two are required, payments outside the usual run, accounts unreconciled past their deadline and new payees in the bank portal, read from BAI2, camt.053 or CSV files.

  • Access tests

    New users, role changes, administrator rights, dormant accounts, leavers still active in the accounting system, bank portal or payroll, and service accounts, including AI agents, that hold conflicting rights.

  • Exception routing and evidence

    Each confirmed exception goes to a named owner with a due date and is closed with a reason code and evidence, recorded as explained, corrected or control failure.

  • Reporting and review

    A monthly exception report for management and a quarterly review that retunes thresholds, retires noisy tests and adds tests for new risks.

Monthly reports, quarterly reviews, full evidence

DeliverableWhat it isWhen
Test libraryDocumented tests with their logic, thresholds, data source, frequency and owner, approved by you before go-liveWeek 4
Exception queueReviewed exceptions routed to named owners by email or in your ticketing tool, each with an explanation and a due dateWeekly or monthly from week 7
Monthly exception reportExceptions by test, owner and outcome, open items by age and repeat failures, in two pages plus detailMonthly
Quarterly reviewTrend summary for management or the board, threshold changes made and proposed, and new risks to testQuarterly
Evidence archiveEvery test run, result and resolution retained in a form your auditors can inspectOngoing
RunbookHow each test works and how to run it yourself, so the program can move in-houseWeek 6, updated quarterly

Setup takes about six weeks

  1. Weeks 1 to 2

    Connect the data

    We set up read-only connections or scheduled exports from your accounting system, bank and payroll provider, and confirm the data is complete for the past twelve months.

  2. Weeks 3 to 4

    Build and calibrate

    We configure the tests that matter for your risks, run them over the past year, and set thresholds so that the exceptions are worth reading.

  3. Weeks 5 to 6

    Run in parallel

    Tests run on live data while we review every result with your owners, agree routing and reason codes, and remove false positives.

  4. Weekly or monthly

    Run and report

    Tests run on schedule, an analyst reviews each exception before routing it, owners resolve it with evidence, and you receive the monthly exception report.

  5. Every quarter

    Review each quarter

    We meet management to review trends, retune thresholds, retire tests that no longer earn their place and add tests for new systems or risks.

Read-only access is enough

  • Read-only API access or scheduled exports from QuickBooks Online, Xero, NetSuite, Sage Intacct or Business Central
  • Bank statement files in BAI2, camt.053 or CSV, and user listings from each bank portal
  • Payroll provider reports and a monthly list of leavers from HR
  • Your approval matrix and payment release limits, even if they are informal
  • A named owner for each test area, with time each week to resolve the exceptions routed to them

Is this the right fit?

A good fit

  • Finance teams too small to employ an internal auditor or a systems administrator
  • Companies that have had a controls review and want the fixes to stay fixed
  • Venture-backed companies working toward SOX readiness that need evidence of controls operating over time
  • Organizations using AI agents or automation in AP and the close that need those actions checked

Not the right fit

  • Companies whose accounting data cannot be exported or read through read-only access
  • Organizations that want software to run alone; this is a service, with people reviewing the results

Every exception has an owner

An alert with no owner is noise. Before a test goes live, we agree who receives its exceptions and what they must do. A duplicate invoice goes to the AP lead, who confirms it was not paid twice or recovers the payment. A journal entry posted and approved by the same person goes to the controller, who reviews it and signs it off. A leaver still active in the bank portal goes to whoever administers the portal, who removes the user that day. Each exception closes with a reason code and evidence, and anything open past its due date appears by name in the monthly report.

A person reviews before routing

Raw test output always contains false positives: a weekend entry that was a scheduled accrual, a round payment that was a contractual retainer. A Finance Ethics analyst reviews every exception before it is routed. Expected items are documented and suppressed by rule. Real ones go to the owner with a one-line explanation. That review is the difference between monitoring people read and monitoring people mute.

Thresholds are tuned, not guessed

During setup we run every test over the past twelve months to see what it would have flagged. If a just-below-limit test would have fired forty times a month, the threshold or the test is wrong. The quarterly review keeps tuning, because new vendors, new systems, a new approval limit or a new AI agent in AP each change what should be tested.

The archive is built for auditors

Every test run is stored with its date, data source, parameters and result, and every exception with its owner, reason code, evidence and closing date. When an auditor, lender or acquirer asks how a control operated in a given quarter, the answer is a filtered export, not a reconstruction from inboxes. If an owner disputes an exception, the dispute and its outcome are kept in the record as well.

Results can back public statements

If you publish an Integrity Center, monitoring results support its attestations. When the dual-release test fails, the officer who signed the dual-release statement knows within the same cycle. Monitoring often begins after a one-off full-ledger analysis, which clears out the historic problems so the weekly tests start from a clean baseline. For the tests most programs start with, see continuous controls monitoring: ten automated tests.

What people ask before hiring us

How is this different from buying a monitoring tool?

A tool gives you alerts. This service gives you resolved exceptions. We configure and tune the tests, an analyst reviews every result before it reaches your team, and owners receive only items that need a decision. You get the evidence trail without hiring someone to run the tool.

Weekly or monthly?

It depends on the test. Payment and vendor bank-change tests usually run weekly, because money moves quickly. Access reviews and close-related tests usually run monthly. We set the frequency for each test during setup and revisit it at every quarterly review.

Can our auditors use the results?

Your auditors decide what they rely on. The evidence archive records every test run, exception and resolution, so they can see how controls operated across the year. We are not your auditor and do not issue an opinion.

What happens when a test points to fraud?

The exception leaves the normal queue. We tell the person you named for that purpose during setup, such as the CFO, owner or audit committee chair, so it never lands with someone who may be involved.

Also in Finance Technology

Continuous controls monitoring, AI governance and client-owned dashboards for finance teams without the staff to run enterprise tools, delivered as working controls rather than licenses.

  • AI Governance for Finance

    An inventory of every AI tool and agent touching finance, a usable AI policy, and controls that treat agents as users, mapped to COSO's 2026 guidance, NIST AI RMF and ISO/IEC 42001.

  • Transparency Dashboards & Custom Software

    Board and funder dashboards, accounting data pipelines and custom finance tools that tie to the ledger, live in your own accounts and come with the code and documentation.

Related work and reading

Services

  • Full-Ledger Analytics

    A two-to-four-week diagnostic that runs a library of explainable tests and outlier models over every transaction in the period, then reports only the flags an analyst has reviewed.

  • Segregation of Duties & Approval Design

    A six-to-eight-week project that maps every user's access against their duties, removes conflicting rights, redesigns the approval matrix and adds compensating controls where the team is too small to split.

  • Integrity Center

    A public page on your own domain that shows how your organization governs money, with dated policies, management's control attestations and a change log, kept current by subscription.

Articles and scenarios

Sectors

Tell us what you are seeing

A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.

Start a conversation
Writehello@financeethics.com
Call(307) 365-5252
Office7124 Commons Dr, Cheyenne, WY 82009
HoursMonday to Friday, 9:00 to 17:00 Mountain Time