Audit and controls software documents the controls a company relies on to produce accurate financial statements, schedules and records the testing of those controls, and runs the internal audit plan. It is also where companies and their auditors exchange the long list of requests and documents that an audit involves.
What it does
A public company in the United States reports on its internal control over financial reporting under the SEC rules adopted in Release 33-8238, on management's report on internal control and certification of disclosure. The work behind that report is a programme: a risk assessment, a list of key controls mapped to accounts and assertions, walkthroughs, tests each year, deficiencies tracked to remediation, and sign-offs. Which companies also need an auditor's attestation depends on filer status, which the SEC sets out in its accelerated filer and large accelerated filer definitions.
Controls software holds that programme. It stores the risk and control matrix, assigns tests, collects evidence, records results and produces the reports management and the audit committee read. Most products sold in this category are broader governance, risk and compliance (GRC) platforms that also cover enterprise risk, policy management, third-party risk and IT compliance frameworks.
Two narrower kinds of product sit alongside. Access control tools analyse who can do what in the ERP and flag separation-of-duties conflicts. Request and evidence portals let auditors send their requests (often called the PBC list, for "prepared by client") and let the company answer them in one place.
Who uses it
The SOX or internal controls team runs the programme. Internal audit plans and performs audits in it. Control owners across finance and IT upload evidence. External auditors receive evidence and, in some products, test in it. The audit committee reads the reports.
The parts a typical product has
- Risk and control matrix, mapped to accounts and processes
- Test plans, sampling, evidence collection and review
- Deficiency tracking and remediation workflow
- Internal audit planning, workpapers and findings
- Access and separation-of-duties analysis for ERP users
- Request lists and document exchange with auditors
- Reporting for management and the audit committee
Where it meets other categories
Many key controls live in the close: reconciliations, journal approvals and review sign-offs, whose evidence controls software collects. Access controls depend on roles in the ERP. Disclosure controls connect to financial reporting. Controls over payments touch accounts payable and treasury.
Questions to ask a vendor
- Can we import our existing risk and control matrix, and in what format?
- How is evidence collected from the ERP and the close tool: by upload, or by integration?
- Can our external auditors work in the product, and on what terms?
- Which frameworks beyond SOX come configured?
- How are deficiencies aggregated for the year-end assessment?
- If you test controls automatically, how is each automated test documented for the auditor?