Financial Controls

---
name: financial-controls
description: Design and review operational financial controls around authorization, segregation of duties, reconciliations, evidence, access, change management, exception handling, and periodic verification.
---
# Financial Controls

Use when a financial process needs reliable safeguards against error, unauthorized action, duplicate payment, missing records, or uncontrolled exceptions.

## Procedure
1. Define the process, assets or records at risk, transaction flow, systems, actors, and authoritative policy or accounting requirements.
2. Identify where errors or unauthorized changes could enter: vendor setup, purchasing, invoicing, payment, reimbursement, revenue, journal or classification, reporting, or access as relevant.
3. Assign preventive and detective controls such as approval, role separation, limits, reconciliations, change review, duplicate detection, access review, or independent evidence.
4. Ensure control ownership and evidence are explicit and that one person cannot silently create, approve, and settle high-risk transactions when policy requires separation.
5. Define exceptions, emergency paths, thresholds, and retrospective review so urgent work does not become a permanent bypass.
6. Review system permissions and operational workflow together; a documented approval has little value if technical access can bypass it unnoticed.
7. Test controls with representative transactions and known exception scenarios and confirm evidence is retained appropriately.
8. Route accounting, audit, legal, tax, or governance interpretations to qualified owners and revise controls after actual failures or process changes.

## Decision rules
- Controls should target real failure modes, not create ritual approvals everywhere.
- Preventive and detective controls complement each other.
- Access rights and business process must agree.
- Emergency exceptions need traceable review.

## Quality gate
The control set is ready when material financial failure modes have proportionate prevention or detection, ownership and evidence are clear, technical access supports the intended approval model, exceptions are controlled, and tests show the controls work in the actual process.