SmartSuite for the Head of Internal Controls

Documentation, frequency and evidence standards are set on the control template, so a control added by any program meets your design standard before it is accepted into the library.

Control Framework & Regulatory Libraries shows which controls lack an owner, a frequency or a mapped risk, so gaps in the framework are visible to you rather than discovered by the external auditor.

Control updates, process changes and the decisions to retest are captured with full version history, so you can show why a control changed and whether its operating effectiveness was re-established.

The Internal Controls Manager's framework work, the SOX Program Manager's cycle and the Controls Testing Lead's calendar run from the same control library, so you see one plan for the team rather than three trackers.

Reconciliations and approvals completed in the Controller's close are linked to the controls they support, so evidence for testing comes from finance's own records rather than from a separate request.

Controls are linked to the risks they mitigate, so the Chief Risk Officer's register shows control effectiveness beside each risk and the Audit Director plans assurance from the same data.

Progress across interim testing, quarters and year-end readiness is visible without status reports, so the Chief Financial Officer's question about readiness is answered from the dashboard.

Where the UK Corporate Governance Code's declaration on material controls or FDICIA reporting applies, the controls in scope, their testing and open deficiencies are evidenced from the same record as SOX.

The AI Assistant in a SmartDoc field drafts testing summaries, deficiency narratives and auditor responses from the record, so the audit committee paper starts from the evidence rather than from last quarter's template.

Chief Financial Officer

The Head of Internal Controls owns the internal control framework: the control library, the design, documentation and testing standards, the SOX program and other control certification programs, deficiency evaluation, aggregation and remediation, the coordination with internal and external audit on reliance and testing and the reporting of control effectiveness to the CFO and audit committee. The Internal Controls Manager and SOX Program Manager report in, with the Controls Testing Lead reporting through the Internal Controls Manager. COSO 2013 is the structure and SOX Sections 302 and 404 make it a certified, audited duty.

SOX Compliance maintains the control library with design standards, frequencies and framework mappings as the single source for every control program, so a control that serves SOX, SOC 1 and an operational framework is defined once and mapped to each through Control Framework & Regulatory Libraries. The Head of Internal Controls sets the design and documentation standards in the library and every program inherits them, which is how the UK Corporate Governance Code's material-controls declaration or J-SOX can be run from the same framework.

Compliance Assessments & Testing runs the testing program from the frequencies and procedures held in the library, so the Controls Testing Lead schedules and executes tests against the controls the Head of Internal Controls defined, with the procedure and evidence attached to each test. Testing standards set once in the library apply to every tester, and the SOX Program Manager sees completion against the certification calendar. Results feed deficiency evaluation directly rather than through a separate exception log.

SmartSuite evaluates and aggregates deficiencies with remediation tracked to re-test, so each exception is assessed for severity, deficiencies on related controls can be aggregated for the material-weakness judgment and remediation carries an owner through to the re-test that closes it. Issues Management holds the remediation actions, with the Controller coordinating the finance ones. The Head of Internal Controls sees the deficiency population as it stands at any point in the year, which is what the quarter-end and year-end conclusions need.

SmartSuite shares control status, testing history and evidence with internal and external auditors for reliance, through Internal Audit Management for the Audit Director's team and controlled access for the External Auditor. Because the auditors see the library, the tests and the evidence as management maintains them, the reliance conversation is about the quality of the work rather than the completeness of the file. The Chief Audit Executive and the Head of Internal Controls agree the reliance scope against the same records.

SmartSuite reports control effectiveness and certification readiness to the CFO and audit committee from the library, the test results and the deficiency population, so the report shows which controls have been tested, what failed, how deficiencies aggregate and whether the certification can be signed. The Chief Financial Officer and the Chief Audit Executive read the same figures, and the Compliance Director and Chief Risk Officer see the control picture alongside their own programs. The report reflects the position on the day, not at the last compilation.

Because the control library is the single source for every program, non-financial controls are added to the same library with their own frequencies and framework mappings and tested with the same standards. For a bank reporting under FDICIA, a university under the Uniform Guidance or a technology company extending to SOC 1, the Head of Internal Controls adds the framework mapping rather than a parallel program. To start, load the existing SOX control matrix and its testing calendar, then add other programs as their frameworks are mapped.