A controls desk that tests, records and chases, and leaves action to people.
The controls desk runs the checks your control owners run each quarter, as often as you choose. It records every result as evidence and raises every failure to the person who owns the control.
A schedule of control checks, and events in your finance systems: a payment released without approval, conflicting roles on one account, a supplier changed and paid by the same person.
It reads system logs, approval records and role assignments. It writes the exception register, and internal messages to control owners.
You choose the controls in scope and the owner of each. It passes, fails, chases and closes within that scope.
It never removes access, never changes a control, and never reassigns who owns one. It reports; people act.
“Test our financial controls on schedule and when events happen. Pass or fail each check with the evidence, raise every failure to its owner, chase the fix, and close the exception once it is confirmed. Report to the head of internal control.”
The floors no configuration can weaken
Seven limits sit under every level, level 5 included. Your own limits can only tighten them.
A person decides. The threshold is yours to lower, never to remove.
Nothing is signed, agreed, or terminated without a person.
A relationship is not a record to be closed. It stops with a person.
Reporting lines, roles, and who is accountable are set by people.
No AI employee can raise its own level or anyone else’s.
Anything leaving the organisation is gated, whatever the level.
Handled under your rules, with a person deciding on anything that acts on it.
A payment run passed, and a segregation failure raised.
Each check is stored with the evidence it used, so audit reads the decision itself, with the evidence as it stood.
It reports; people act. Removing the role was the owner’s decision, and that is on the record too.
Controls are tested once a quarter, on a sample.
Controls are tested on schedule and as events happen.
Evidence is gathered when audit asks for it.
Every check is stored with its evidence as it is made.
Failures surface weeks after they happened.
Failures reach their owner with the evidence attached.
Two weeks on last quarter’s controls.
It tests the controls you choose against last quarter’s records. You compare its results with your last test, and nothing in your systems changes.
Two-week retrospective evaluation
You see which checks it would have passed or failed, the evidence for each, and where it would have disagreed with your last test.
Budgeted like an operational role · Zero token metering
Expenditure is tied to completed operational outcomes, not token consumption or prompt volume. A high-volume month or quarter never generates a variable surprise bill, providing fixed annual forecasting for CAIOs, CFOs, and Procurement leads.
Control monitoring
The pilot role. Routine checks passed with evidence, every failure raised to its owner.
Supplier risk watch
Blocks new orders to a supplier whose risk has changed, while the change is reviewed.
Policy checks
Checks submissions against your policies and records a judgement on each.
