← THE PORTAL
FINANCIAL TRUTH & TRUST · INTERNAL CONTROLS / AUDIT SUPPORT

From periodic testing to a continuous-evidence loop.

Today, controls are tested periodically and gaps are found after the work moved on. In Future Finance, controls monitor inside the workflow, gaps surface as packets with owner, fix, and proof attached, and audit support becomes retrieval, not reconstruction.
LEARNING RETURN 01 SIGNAL control signal · gap detected in-workflow 02 EXPOSURE control risk · deficiency sized 03 CHOICE remediate {D} escalate 04 OWNER ACTION control owner 05 OUTCOME was the fix proven? EVIDENCE GATE 06 · VALUE PROOF remediation evidence complete The governed loop, cast for this function – the same circuit as every Finance function, carrying control gap risk instead of a report.
01 · THE TRANSFORMATION

From periodic testing to a continuous-evidence loop.

TODAY
Periodic testing and evidence requests.
Gaps found after the work moved on.
Audit support reconstructed under deadline.
Evidence gathered by email.
IN FUTURE FINANCE
Controls monitor inside the workflow {D} not after it
Gaps surface as packets {D} owner, fix, and proof attached
Evidence continuous {D} audit support becomes retrieval
Remediation tracked to proven fix
CONTROL GAP → ACTION ROUTE
02 · WHERE TO START – THE WORKFLOWS, RANKED

Four workflows. One operating pattern.

Every workflow in this function becomes the same governed loop – cast differently. Below, each one in full: what it becomes, who does what, what it needs, and where the human boundary sits.
RANKED BY · ownership (who holds the lever) · value (from this domain’s sizing) · autonomy ceiling (Tier 1 = human-only → Tier 4 = highest permitted autonomy) · control sensitivity · scope (core vs conditional)   weighting leans value + ownership
AGENTS prepare DETERMINISTIC SYSTEMS calculate HUMANS approve OWNERS execute FINANCE validates
1Tier 2 of 4
SOX control execution support
Control execution becomes continuous evidence {D} controls monitored inside the workflow, evidence assembled as the work happens, and testing kept human.
Who does what
Agentsassemble control evidence continuously
Systemsmonitor control execution in-workflow
Humanscontrol testing and signoff stay human
ARCHETYPE policy-to-complianceCADENCE continuousDATA control matrix · evidenceSENSITIVITY high
THE BOUNDARY · testing and signoff are human; evidence is assembled continuously, the control opinion is not automated.
OWNERSHIP Finance stewardVALUE High – feeds the sized poolAUTONOMY Tier 2 of 4CONTROL High sensitivitySCOPE Core
2Tier 3 of 4
Control deficiency remediation
Deficiency handling becomes a routed remediation workflow {D} gaps surfaced as packets with owner and fix, and remediation tracked to a proven fix.
Who does what
Agentssurface deficiencies as packets with context
Systemstrack remediation status
Humansapprove the remediation
Ownerscontrol owners execute the fix
Financevalidates the fix is proven
ARCHETYPE signal-to-actionCADENCE event-drivenDATA control · evidence · ownersSENSITIVITY high
THE BOUNDARY · control owners execute the fix; Finance validates it is proven, the remediation is not self-attested.
OWNERSHIP Finance validatorVALUE Control valueAUTONOMY Tier 3 of 4CONTROL High sensitivitySCOPE Core
3Tier 2 of 4
Audit request management
Audit support becomes retrieval, not reconstruction {D} requests met from continuous evidence, tied to the control, and delivered without the scramble.
Who does what
Agentsretrieve and package requested evidence
Systemstie evidence to controls and lineage
Humansreview and release to the auditor
ARCHETYPE signal-to-actionCADENCE audit cycleDATA evidence repositorySENSITIVITY high
THE BOUNDARY · release to the auditor is human; agents retrieve and package, they do not represent to the auditor.
OWNERSHIP Finance stewardVALUE Effort + defensibilityAUTONOMY Tier 2 of 4CONTROL High sensitivitySCOPE Core
4Tier 2 of 4
Control design review for agent workflows
Agent workflows get designed-in controls {D} each new automated workflow reviewed for control design before it runs, keeping trust ahead of autonomy.
ranked last: the control layer for the rest of the vision.
Who does what
Agentssurface the workflow’s control touchpoints
Systemsmap controls to the workflow
Humanspolicy owner approves the control design
ARCHETYPE policy-to-complianceCADENCE change-drivenDATA control metadata · workflow registrySENSITIVITY high
THE BOUNDARY · control design is policy-owner-approved; this is the workflow that keeps trust ahead of autonomy.
OWNERSHIP Finance policy ownerVALUE Trust enablementAUTONOMY Tier 2 of 4CONTROL High sensitivitySCOPE Core
03 · THE SIZING – FULL EVIDENCE TRAIL

The number, carried the way every claim is carried.

The figure on the front page arrives here as what it is – a governed packet. Range, basis, inputs, benchmarks, derivation, assumptions, and the strongest objection to it, all in one place.
INTERNAL CONTROLS SIZING PACKET
IC-SZ-12 · CONTROL-EVIDENCE POOL
OUTSIDE-IN
RANGE
$0.7–1.9M / yr · effort redeployment
BASIS
Hybrid · Confidence: Medium
WHAT IT IS
Continuous evidence redeploys manual control-evidence effort and reduces external-audit friction. Anchored on disclosed external audit fees (a primary-filing figure) plus benchmarked internal SOX cost, with an assumed addressable share. The tightest, most conservative packet in the set.
INPUTS
Disclosed external audit and audit-related fees of a representative large-cap SaaS company (primary-filing figure); internal SOX-compliance cost benchmarked
BENCHMARKS
External audit fees (disclosed, primary filing – the Tier-1 anchor) · internal SOX-compliance cost surveys (KPMG / Protiviti SOX Survey)
DERIVATION
1 · internal SOX cost benchmarked at ~$2.5–4.0M
2 · 15–30% of evidence effort addressable via continuous evidence
3 · plus 5–10% external-audit friction reduction → ~$0.7M–1.9M/yr
ASSUMPTIONS
(1) internal SOX cost $2.5–4.0M (benchmarked) · (2) 15–30% addressable (assumed) · (3) 5–10% external-fee friction (assumed)
SENSITIVITY
The addressable-share assumption moves it most – the external-fee anchor is exact and disclosedsanity bound: cannot exceed the benchmarked internal SOX cost plus the disclosed external-fee base
THE ATTACK
“This is a rounding error.” — Deliberately so: it is the most conservative packet, anchored on a disclosed external-fee figure with a modest addressable share. The value here is defensibility and audit-friction reduction, sized honestly small rather than inflated.
OUTSIDE-IN · ILLUSTRATIVE · SUBJECT TO VALIDATION
Modeled on a Representative SaaS Company · outside-in, illustrative
A target-state vision · every value claim subject to validation