Armoiries GaspozLAURENT GASPOZ
Skip directly to CV

Animated experience — Internal control

From risk to effective control

  1. 01 — Process understanding

    Map the end-to-end process, its objectives, actors and systems, to ground the control framework in operational reality.

    • Process objectives — Link operational, financial and compliance objectives to the organization's stakes.
    • Flow mapping — Describe the process steps, inputs, outputs and decision points.
    • Actors and systems — Identify roles, delegations, segregation of duties and supporting applications.
    Deliverables
    Process map · Role descriptions · Systems inventory
    Interactions
    Process owners · Finance · IT · Compliance
    Competencies
    Process & risk mapping · Operational analysis · Segregation of duties · Listening and reporting
    Expected outcomes
    A shared view of the process, the common foundation of the control framework

  2. 02 — Risk identification

    Identify the risks likely to prevent the achievement of objectives, assess them and prioritize them by impact and likelihood.

    • Risk events — Formulate risks for each process step, including fraud risks.
    • Assessment — Rate impact and likelihood, before and after controls.
    • Prioritization — Focus the framework on significant risks and key assertions.
    Deliverables
    Process risk register · Impact / likelihood rating · List of significant risks
    Interactions
    Risk management · Process owners · Internal audit
    Competencies
    Risk assessment · Fraud risks · Prioritization · Professional judgment
    Expected outcomes
    A prioritized set of risks, ready to be covered by controls

  3. 03 — Control design

    Design proportionate controls: preventive or detective, manual or automated, with an identified owner and a frequency suited to the risk.

    • Key controls — Link each significant risk to one or more key controls.
    • Control attributes — Define nature, frequency, owner, expected evidence and supporting system.
    • Risk-control matrix — Formalize the matrix and identify gaps or redundant coverage.
    Deliverables
    Risk-control matrix · Control descriptions · Gap analysis
    Interactions
    Control owners · Finance · IT · Management
    Competencies
    Internal control architecture · Financial & operational controls · Automation · Proportionality
    Expected outcomes
    A documented, proportionate and assigned control framework

  4. 04 — Execution and evidence

    Make the control demonstrable: what is not documented cannot be tested; evidence must be dated, attributable and retained.

    • Control execution — Perform the control according to the defined frequency and owner.
    • Evidence of execution — Retain a dated, attributable and verifiable record of execution.
    • Documentation quality — Verify the completeness, legibility and archiving of evidence.
    Deliverables
    Evidence register · Documented procedures · Archiving rules
    Interactions
    Operational staff · Internal control · IT
    Competencies
    Traceability · Documentation · IT, data & automation · Execution discipline
    Expected outcomes
    Executed and demonstrable controls, ready to be tested

  5. 05 — Effectiveness testing

    Separately test the design and operating effectiveness of key controls, then qualify observed gaps as deficiencies.

    • Design test — Verify that the control, if properly executed, adequately covers the risk.
    • Operating effectiveness test — Sample occurrences and verify actual execution over the period.
    • Deficiency qualification — Classify gaps by severity and potential cumulative effect.
    Deliverables
    Test program · Test sheets · Deficiency summary
    Interactions
    Internal control · Internal audit · External auditors · Control owners
    Competencies
    Assessment & remediation · Sampling · Data analysis · Severity judgment
    Expected outcomes
    A well-supported assessment of the control framework's effectiveness

  6. 06 — Remediation and monitoring

    Turn deficiencies into tracked action plans, then set up continuous monitoring with indicators and reporting to management.

    • Remediation plans — Define actions, owners and deadlines proportionate to severity.
    • Control indicators — Track execution, exceptions and coverage using stable indicators.
    • Reporting and assurance — Report to management and governance bodies on effective risk control.
    Deliverables
    Action plans · Control dashboard · Internal control report
    Interactions
    Senior management · Audit committee · Process owners · Internal audit
    Competencies
    Governance & coordination · Indicators & reporting · Leadership & transformation · Execution follow-up
    Expected outcomes
    A living control framework, measured and durably steered