SOX
Risk & Control Matrix
Imported from your prior-year RCM and kept current by the AI team as processes, systems and risks change.
Controls
128
96 key
ITGCs
25
12 ITACs
Entity level
8
14 key reports
Tested
74
66 effective
Exceptions
6
2 deficiencies
Matrix
12 controls
| Control | Risk | Process | Type | Nature | Frequency | Assertions | System | Owner | Status |
|---|---|---|---|---|---|---|---|---|---|
| R2C-014 Credit memos above $25K require secondary approval Key | R-01 | Order to Cash | Business process | IT dependent manual | Ongoing | Occurrence, Accuracy | NetSuite | Director, Revenue Accounting | Exception |
| R2C-002 Contract review for revenue recognition conclusions Key | R-01 | Order to Cash | Business process | Manual | Per contract | Occurrence, Cutoff, Presentation | Salesforce CPQ | Revenue Manager | In testing |
| R2C-021 Automated three-way match on shipments Key | R-01 | Order to Cash | ITAC | Automated | Continuous | Occurrence, Accuracy | NetSuite | VP Revenue Operations | Effective |
| P2P-008 Vendor master additions independently verified Key | R-08 | Procure to Pay | Business process | Manual | Ongoing | Occurrence, Rights & obligations | NetSuite | Procurement Controller | In testing |
| FCR-003 Monthly revenue analytic review by Controller Key | R-01 | Financial Close & Reporting | Business process | Manual | Monthly | Completeness, Accuracy | NetSuite | Corporate Controller | Effective |
| FCR-011 Journal entries reviewed and approved by preparer's supervisor Key | R-08 | Financial Close & Reporting | Business process | IT dependent manual | Ongoing | Occurrence, Accuracy | NetSuite | Assistant Controller | Effective |
| INV-006 Cycle count results reconciled and variances approved Key | R-06 | Inventory & Cost Accounting | Business process | Manual | Monthly | Existence, Accuracy | NetSuite | Plant Controller | Not started |
| ITGC-004 Privileged access reviewed quarterly Key | R-07 | NetSuite ERP | ITGC | Manual | Quarterly | All | NetSuite | IT Security Manager | Exception |
| ITGC-009 Changes tested and approved before production release Key | R-07 | NetSuite ERP | ITGC | IT dependent manual | Ongoing | All | NetSuite | IT Change Manager | In testing |
| ITGC-017 Terminated user access removed within 3 business days Key | R-02 | Azure Cloud Platform | ITGC | Manual | Ongoing | All | Azure AD | IT Operations Lead | Deficiency |
| ELC-002 Quarterly disclosure committee certification Key | R-01 | Entity level | Entity level | Manual | Quarterly | Presentation, Completeness | Workiva | General Counsel | Effective |
| IPE-005 Aged AR report completeness and accuracy validated Key | R-01 | Order to Cash | IPE / Key report | IT dependent manual | Monthly | Valuation, Accuracy | NetSuite | AR Manager | In testing |