One finance job, tested on periods you already closed, before anything touches the ledger.

One desk answers for four things. The CFO or controller owns the close calendar, the controls behind each balance, the audit, and the cash the business runs on. This page is for a company with a real back office: an AP team keying vendor invoices, someone working the aging report, bills that go out on a cycle, and a month-end package built by hand. Any new tool on one of those desks raises the same three questions: what it touches, who approves what it produces, and what the auditors will see.

Controls already have a vocabulary. COSO's internal control framework, refreshed in 2013, sorts every control into five components: the control environment, risk assessment, control activities, information and communication, and monitoring activities. Seventeen principles sit under them, and a 2016 COSO and ACFE guide says a system of internal control is effective only when each principle is present, functioning and working with the rest. Principle 8 asks a company to consider the potential for fraud when it assesses risk, which is one reason a new outside party near the payables desk gets a hard look.

Segregation of duties decides where a new tool can sit. The GAO's Green Book, which follows the same five components, describes it as splitting four duties among different people: authorizing a transaction, processing and recording it, reviewing it, and handling the related assets. Where a team is too small for a clean split, it calls for other controls that cover the risk. Our drafts only ever prepare. A person on your team approves, and during the test nothing is recorded at all.

If the company is public, the calendar has a statute behind it. Every SEC issuer puts management's report on internal control over financial reporting in its annual report under Section 404(a). The auditor's attestation under Section 404(b) applies only to accelerated and large accelerated filers, as the SEC's 2010 release on the Dodd-Frank change sets out. Form 10-Q is due 40 days after quarter-end for those two filer types and 45 days for everyone else, and no 10-Q is filed for the fourth quarter. A private company files none of this, so its deadlines come from its owners, its lenders and its auditors.

A test can't change a closed period. Its entries are posted and reviewed, and at many companies already audited. The test reads copies and exports from it and writes nothing back, so it plays no part in any control over that period and leaves nothing for anyone to reverse. The IRS tells most businesses to keep records for three years and employment tax records for at least four, and notes that creditors or an insurer may want them kept longer. The documents the test needs are ones you already hold under that policy, and the originals never leave your files.

Auditors test the review, and the report behind it. A 2013 PCAOB staff alert on audits of internal control lists what makes a management review precise enough to rely on, among them the objective of the review, how far the figures are aggregated, how consistently it runs and the threshold for investigating a difference. It adds that when a control relies on system-generated reports, or on other information the company produces, the auditor should get evidence that the information is complete and accurate. That is why every draft in the test carries its source document, and anything that won't tie is listed instead of forced.

Your reviewer scores it like a control test. Before it starts, you name the reviewer, the person who knows this job best: usually the controller or the AP lead. The success criteria go in writing the way a test of a control would: which totals must tie, which exceptions must be caught, and what counts as a miss. The 20 to 30 documents are not a random sample. Your reviewer picks them, and the hard ones belong in it: credits, partial receipts, short payments and entries your team corrected later.

In the live run, approval stays with your people. After a yes, the job runs for about 30 days on new documents, and a person on your team approves every item before it posts. The draft prepares, your approver approves, and whoever releases payments today keeps doing it. How approved drafts reach your ERP is agreed and priced before you sign, so you can walk your auditors through the design first.