In most organisations the internal control system exists as a document: a control matrix, a description, an owner. What is missing is the running state — which control was executed in this period, what evidence exists for it, which exception is open, and who judged its effectiveness. Before an audit that gets reconstructed rather than retrieved.
It describes what should apply. It does not describe the state of the period.
Screenshots, emails, exports. They get collected once an audit is announced.
It gets discussed and fixed at some point. Whether it was retested is a question for someone's memory.
The data is usually there. It just takes effect in different systems at different times.
Four steps, and the same cross-functional capabilities across every one of them.
Every module is a standalone entry point. This chain shows what comes together once several of them run on the same finance data model.
Verified in product
Carries segregation of duties, approval authority and evidence on the record. The server-side check of the approval is the part we can evidence.
In active development
Every control exception becomes a record with an owner, a deadline and a decision — and stays visible until it is remediated.
Pilot / validation
Payment approval is where effectiveness shows most clearly: the check happens server-side, not in the form.
In active development
Reconciliation, accrual and sign-off in the close are tasks with an owner and a date — and therefore auditable controls.
Pilot / validation
The document behind a control hangs on the record instead of sitting in an evidence folder.
Accept, retest, escalate or carry as a risk — inside the authority that applies to this control and this entity. A judgement on effectiveness is a decision with a basis; it is not an audit opinion.
Roles and rights stay in the leading system. FinanceOS checks the approval inside its own record and changes no ERP permission.
Where a GRC tool carries the control matrix, it stays there. FinanceOS supplies the state and the evidence out of day-to-day operation.
Audit's judgement stays audit's. This chain makes it supportable, not unnecessary.
What is not marked, we do not claim. The full state per capability is on the module pages and under what we can evidence today.
No. Where a control matrix or a risk register is already maintained, it stays there. What appears here is the running state: which control took effect this period, what evidence hangs on it, and which exception is open.
No, and no system can. Audit opinions are for auditors. What FinanceOS contributes is an evidence position you can retrieve instead of assembling it before the audit.
It differs by capability, which is why it is marked below. We can evidence the server-side check of the approval — observed independently in a controlled environment. The effectiveness judgement and the risk register we carry as defined capabilities, not as running operation.
Bring this case as it looks in your organisation. We work through it on your example and say where a common finance layer holds and where it does not.