SmartSuite for the Controls Testing Lead

Compliance management. Schedules and executes recurring control tests from a testing engine with procedures and evidence attached to each test.

Internal audit. Keeps workpapers and sign-offs traceable for audit reliance.

Issues and actions. Logs exceptions and routes them to deficiency evaluation and remediation.

Reporting. Reports testing completion and exception trends by control, owner and period.

What does a Controls Testing Lead own and answer for?

The Controls Testing Lead owns the control testing program: the testing calendar and sampling approach for key controls, the written test procedures and evidence standards, tester assignments, the quality review of workpapers and the logging of exceptions for deficiency evaluation. The aim is that every key control is tested on schedule and that results are consistent enough for the Head of Internal Controls, internal audit and the external auditor to rely on. Reporting testing status and exception trends completes the remit.

How does SmartSuite schedule and run recurring control tests?

Compliance Assessments & Testing schedules and executes recurring control tests from a testing engine, with the procedure and the evidence attached to each test. The Controls Testing Lead sets the calendar by control frequency, assigns testers and tracks completion against the schedule, and each tester works from the written procedure rather than their own interpretation of it. Because the evidence sits on the test record, a reviewer can check the work without asking the tester to find it.

How does SmartSuite keep workpapers traceable for audit reliance?

Internal Audit Management keeps workpapers and sign-offs traceable, so a reviewer, the Internal Auditor or the external auditor can see who tested what, against which procedure, with what evidence and who reviewed it. That is the re-performance standard PCAOB AS 2201 expects and the basis on which internal audit decides how much to rely on management's testing. The Controls Testing Lead's quality review is recorded as a sign-off on the workpaper rather than a note in an email.

What happens to a test exception in SmartSuite?

An exception is logged against the test and routed to deficiency evaluation and remediation in SOX Compliance, so the Controls Testing Lead does not have to carry it across by hand. The exception keeps its link to the control, the sample and the evidence, which is what the SOX Program Manager needs when evaluating severity and aggregation. The Control Owner then documents the response and remediation in Issues Management, and the re-test can be scheduled once the fix is in place.

How does a Controls Testing Lead report progress to the Head of Internal Controls?

SmartSuite reports testing completion and exception trends by control, by owner and by period, straight from the test records. The Head of Internal Controls and the Internal Controls Manager can see how far through the calendar the program is, which owners carry the most exceptions and whether a control is failing repeatedly across periods. That replaces the status spreadsheet most testing leads maintain and gives the deficiency conversation a factual starting point.

How do I move an existing testing calendar into SmartSuite?

Begin with the key control list, the test frequencies and the procedures you already have; these become the controls, the schedule and the attached procedures in Compliance Assessments & Testing. Sampling rules and evidence standards are written once against each control and then apply to every cycle. Testers and Compliance Analysts are assigned to their controls, Control Owners respond to requests in the same records, and the first cycle run in the system gives you the baseline for completion and exception reporting.