Published control frameworks are generally written for finance teams much larger than a growing company has. With three, the question is narrower and more useful: which handful of controls would actually have caught the thing that went wrong, and can one person run them without the month taking twice as long.
A payment process needs clear responsibility for preparation, approval and release, with safeguards appropriate to the team.
Everyone remembers agreeing to it. Nothing records who, or when, or how much.
A number is adjusted outside the ledger and the reason lives in somebody's head.
What an engagement includes depends on scope. These are the parts that come up most.
Sized to the team you have, not to the team a framework assumes.
In the system that already holds the transaction, so the evidence is where the auditor looks.
Every adjustment traceable from the statement back to the source, with the reason attached.
No, and we cannot. A statutory audit is the work of a licensed CPA firm. We get the books, the trail and the schedules into the state where an audit goes smoothly, and we work with the auditors through it.
Putting agreed controls in place before a review gives the team time to operate them and retain evidence. The specific requirements depend on the engagement and the reviewer.
The effort depends on the process, transaction volume, systems and review requirements. We agree responsibilities and assess the ongoing workload when designing the controls.
We will say plainly whether this is work we should be doing for you, and what it would cost.
