What a health check looks for
A control is only useful if it runs every time, is done by someone who did not create the transaction, and leaves evidence. We check every control we review against those three tests. A control that exists on paper but has no evidence is recorded as partial, not present.
The five questions we answer for every process
- Who can start a transaction? For example, creating a vendor, raising an invoice or keying a journal entry.
- Who can approve it, and is that a different person?
- Who can change the record after approval?
- What would tell you if one of those steps were skipped?
- How quickly would you find out?
When any answer is "the same person" or "we would not know", that is a finding. We then rank it by what it could cost and how likely it is, given who has access and how often the process runs.
Why we test against your data, not a questionnaire
Questionnaires measure what people believe happens. Data shows what happens. As part of every health check we scan the full year of journal entries and the vendor master for patterns that point to a control not working. Examples include entries posted outside working hours, entries approved by the person who keyed them, vendors that share a bank account with an employee, and round-number payments just under an approval limit. The scan does not replace the walkthroughs. It tells us where to look harder.
Built for small teams
Textbook segregation of duties assumes more people than most finance teams have. Where splitting duties is not realistic, we design compensating controls that fit how you work: a monthly review of a system report by an owner or board member, bank rules that require a second approver above a threshold, or alerts on changes to vendor bank details. Every fix in the plan states who does it, how often, and what evidence it leaves.