SmartSuite for the Internal Controls Manager
The Internal Controls Manager owns control design, documentation, consistency and ongoing effectiveness. They maintain standardized control definitions and frequencies, review test results and evidence, approve outcomes, and track control changes and the re-testing they require.
What you own
The Internal Controls Manager owns control design, documentation, consistency and ongoing effectiveness.
- Maintain standardized control definitions, owners and frequencies
- Review control design for completeness and alignment to risks
- Review test results, validate evidence and approve outcomes
- Track control changes and trigger re-testing
- Evaluate deficiencies and coordinate remediation
- Support SOX, SOC and other certification cycles
- Report control health to the Head of Internal Controls
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
Compliance management. Maintains control libraries with standardized definitions and frequencies, and tracks control updates and re-testing requirements with version control.
Internal audit. Keeps testing history and evidence repositories traceable for auditors.
Issues and actions. Logs deficiencies with severity, owners and remediation tracked to re-test.
Reporting. Reports control health, testing completion and open deficiencies.
Products this role uses most
Industry reference
COSO's 2013 framework defines what a well-designed control looks like; PCAOB AS 2201 defines how the external auditor will evaluate it and the SEC's management guidance (2007) how management should assess it. Control changes, re-testing and deficiency aggregation follow those standards.
The same discipline applies beyond SOX. Banks maintain controls under FDICIA and heightened standards; healthcare providers evidence HIPAA safeguards and CMS billing controls; public bodies apply GAO's Green Book; technology companies document controls for SOC 1 and SOC 2, where design and operating effectiveness are tested on the same model.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What is the Internal Controls Manager accountable for?
The Internal Controls Manager owns control design, documentation, consistency and ongoing effectiveness. They maintain standardized control definitions, owners and frequencies, review control design for completeness and alignment to risks, review test results, validate evidence and approve outcomes, track control changes and the re-testing they require, evaluate deficiencies and coordinate remediation. They support SOX, SOC and other certification cycles and report control health to the Head of Internal Controls.
How does SmartSuite help an Internal Controls Manager maintain the control library?
SOX Compliance maintains control libraries with standardized definitions and frequencies and tracks control updates and re-testing requirements with version control. Every control has one definition, one owner and one frequency, so the Control Owner, Controls Testing Lead and Internal Auditor are testing the same thing. When a control changes, the version history shows what changed and the re-test it triggers, and Control Framework & Regulatory Libraries supplies the framework the controls map to.
How is testing history kept traceable for auditors?
SmartSuite keeps testing history and evidence repositories traceable for auditors, so each control shows every test performed, the evidence accepted and the outcome approved, period after period. An external auditor evaluating controls under PCAOB AS 2201 can follow a control from definition to test to evidence without asking for a reconstruction. Compliance Assessments & Testing holds the same model for SOC and other certification cycles, so the evidence collected once serves each of them.
How are deficiencies logged and tracked to re-test?
Deficiencies are logged in Issues Management with severity, owners and remediation tracked to re-test, so a failed control carries its rating, the owner responsible for fixing it, the remediation steps and the date the re-test is due. The Internal Controls Manager evaluates and aggregates deficiencies from one list rather than from emails, and closure means the re-test passed, with that evidence attached, not that someone said it was fixed.
How does this role report control health to the Head of Internal Controls?
SmartSuite reports control health, testing completion and open deficiencies from the control library, test records and issues as they stand. The Internal Controls Manager can show the Head of Internal Controls which controls are tested and passed this period, which tests are outstanding and which deficiencies remain open by severity. The SOX Program Manager and Compliance Manager work from the same records, so the status reported upward is the status in the system.
What does a controls team need to get started with SmartSuite?
A controls team needs its current control matrix, with definitions, owners and frequencies, and the test plan for the coming period. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a controls team the first workflow is the control library and its testing cycle. Prior test results and open deficiencies can be loaded so the history and the remediation queue start complete. SOC 1 and SOC 2, FDICIA and Green Book controls follow the same model.
See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.