Global SOX

One risk and control library

Upload your existing RCM or build it on screen. Each control carries its type, frequency, COSO component, assertions, sampling criteria and testing steps. A master control can be rolled out to sub-entities, cloned to another entity, or edited once and applied everywhere.

• Automated, manual or semi-manual; preventive, detective or corrective
• Classified as Operational, Financial, ITGC, ELC or Stat Compliance

Excel upload that checks your file first

Nothing is saved until the file is clean. You see every error in a preview grid, fix it right there, and then commit. If you'd rather fix it in Excel, download the error report.

• Templates for RCM, Risk Master and Control Master
• Full history of every upload and who did it

Changes to the library need approval

When an Audit Manager edits, adds, deletes or links a risk or control, it goes to the CAE as a change request. The CAE sees exactly which fields changed and either approves it or sends it back with a note.

• Deleted records can be restored
• Every change is logged with the old and new value

SOX applicability for the year

List every entity and sub-entity, mark each one Yes or No, and send it to the CAE. Once approved it's locked. If scope changes mid-year, you raise a new version, say SOXA-2026-000001 v2, and the old one is archived.

Projects the CAE approves before work starts

Pick control-wise or entity-wise, the audit period, and the processes and entities in scope. Drop any controls you're deferring, assign staff by entity, process or control with start and due dates, and send it to the CAE.

• The CAE can defer or bring back controls while approving
• Can be limited to the entities marked Yes in the applicability
• Close or reopen a project when you need to

Evidence requests and uploads

The data requirements on each control become its IDR. Staff send it to the Audit Manager, who approves it and releases it now or on a date you pick. Control owners then upload files against each line, or drop everything in one go and let the system match files to requests by name.

• Process Owner and Business Head are copied as escalation contacts
• Need more? Raise an Additional Data Request
• Return a file with a reason if it isn't what you asked for

Workpapers and review

Staff record the population, sample, exceptions and test steps, rate design and operating effectiveness, and mark the control Pass or Fail. A failed control gets a gap analysis with root cause and recommendation. Review then goes to the Audit Manager and on to the CAE.

• Nobody can approve a control they tested
• Approve or send back several controls at once

Management response

Responses open for all failed controls together, once the whole project is tested. The control owner fills in the response, action plan, owner and target date. The Process Owner or Business Head approves it first, then audit staff, the Audit Manager and the CAE.

Reports and analytics

Each project has a live view of testing progress, effectiveness rate, deficiencies by process and staff workload. The final report is issued once everything is approved, and downloads as a PDF, laid out by entity or by control.

Chat and reminders

Every control has its own chat thread with the client contacts, so questions about a document stay next to it. Your admin decides which reminders go out, on which days and to whom, so overdue items get chased without anyone doing it by hand.