Control Map
A working reference we use to frame trail audits and walkthroughs—not a generic controls catalogue.
Each point names the usual story, the evidence we look for, and the engagement that clarifies it.
The help screen shows amount bands and named approvers. Sampled documents follow acting roles, leftover delegates, or a rule set from the last reorganisation. An approval-trail audit starts with completed requests, not the policy PDF.
Requester, approver, receiver, and payer can sit on a single account even when the organisation chart looks clean. A segregation walkthrough names the accounts and the compensating control, if one exists.
Invoice approval judges the document. It rarely asks whether a second vendor record shares the same bank account. Vendor-master reviews sit before the trail you are proud of.
Budget screens print a message users can click past. Commitment testing asks whether over-limit and split orders actually stop, including year-end and cost-centre transfers.
Force-approve buttons are not the failure. Unreviewed logs are. Override examinations sample the exceptions and ask who last opened the report.
Pick the point closest to the debate in your next sitting, then request the matching engagement. The map frames the sample; it does not replace your application data.
Which module runs purchase-to-pay, and which committee paper you are preparing.
We confirm whether the usual story fits, or whether a different point better explains the documents.
Trail audit, walkthrough, master-data review, budget testing, or override examination—scoped to the decision you need to table.
