Build a Control Design in Four Lines
Construct a control design with objective, risk, activity, and evidence.
A vague control over vendor master changes. COSO Internal Control - Integrated Framework The common trap is documenting activity without proving the control objective or root cause. Objective Vendor master data is complete, valid, and authorized before payments are released. The objective states the condition protected. Risk A fake or altered vendor could receive payment if changes bypass approval. The risk explains why the control exists. Activity AP manager reviews weekly vendor changes against approved request tickets. The activity is specific enough to test. Evidence Exception report with ticket IDs, reviewer sign-off, and cleared exceptions. Evidence proves the review addressed…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in