Controls in practice
Evidence before conclusion.
What does the evidence actually support?
Connect a business risk to a test, investigate what the records show and form a conclusion the evidence can support.
Explore the walkthroughA control name is only a starting point. The work involves understanding the business process, defining the test and investigating the results in context.
I worked on audits involving business-process controls. These selected procurement, payment and inventory examples demonstrate the reasoning used to move from a risk to a supported finding.
- Selected controls
- 4Procurement, payments and inventory
- Evidence changes the finding
- Follow-upInspect initial flags and supporting documents
- Records and findings
- FictionalReconstructed examples for this portfolio
01 / The approach
How a flag becomes a finding.
A screening result needs investigation. Each example separates what the initial data suggests from what supporting evidence establishes.
- 01
Understand the risk
Identify the business exposure and the expected control.
- 02
Define the test
Translate the control into a question the records can answer.
- 03
Inspect the evidence
Follow up initial flags with the relevant documents and context.
- 04
Conclude and act
Explain the finding, its limitations and the action or retest needed.
02 / Explore in practice
Work through the selected controls.
Choose a control and inspect the sample records. Switch to the follow-up evidence to see how the conclusion changes.
The control names come from the supplied control list. Organizations, records, amounts and findings are fictional. These examples do not claim actual engagement results or responsibility for designing the original controls.
Choose a control to explore
Protect cash
Are we about to pay for the same invoice twice?
A manufacturer receives supplier invoices through both email and an invoice portal. The same invoice can enter accounts payable twice under slightly different references.
What could go wrong
A second posting can lead to a second payment, overstated costs, and time spent recovering cash.
What the control should do
Accounts payable blocks duplicate entries and independently reviews suspected duplicates before releasing payment.
01 / Define the test
Translate the risk into a question the data can answer.
Compare invoice pairs within the same legal entity, vendor, currency, gross amount, and invoice date. Normalize case, spaces, and punctuation in invoice references. Inspect both the original documents and the payment ledger before deciding.
Scope, data checks, and source control
- Sample scope
- Six illustrative invoice pairs from September 2026. Each pair compares two distinct postings; these are 12 invoice records in total. All amounts are USD. Credits and reversals are checked during follow-up.
- Before relying on the data
- Reconcile invoice counts and gross totals to the AP ledger for the period. Preserve original references and document IDs so normalization cannot hide distinct invoices.
- Source control
- Control List.xlsx · RedFlag!B264
“Detect duplicate vendor invoices”
The workbook provides the control name. The scenario, test details, thresholds, records, and findings here are illustrative.
02 / Inspect the evidence
A flag starts the investigation.
Switch to “After follow-up” to see how documents change the conclusion. Select a record to inspect the reasoning.
Count one extra invoice per flagged pair. This is a posting amount, not a realized cash loss.
| Invoice pair | Vendor | References | Amount each | Invoice dates | Screen result | Evidence |
|---|---|---|---|---|---|---|
| AP-101 / AP-108 | ACME Components | NC-784 / nc 784 | 24,000 | 08 Sep / 08 Sep | Review needed | |
| AP-112 / AP-119 | ABC Property | RENT-09 / rent 09 | 8,500 | 01 Sep / 01 Sep | Review needed | |
| AP-125 / AP-126 | XYZ Packaging | WP-901 / WP-902 | 6,200 | 10 Sep / 10 Sep | No screen flag | |
| AP-130 / AP-131 | ACME Logistics | ML-501 / ML-501 | 4,800 | 12 Sep / 19 Sep | No screen flag | |
| AP-140 / AP-141 | ABC Metals | EM-610 / EM-611 | 12,000 | 15 Sep / 15 Sep | No screen flag | |
| AP-145 / AP-146 | XYZ Tools | VT-201 / VT-202 | 3,600 | 18 Sep / 18 Sep | No screen flag |
AP-101 / AP-108
Review neededThe normalized references, vendor, dates, currency, entity, and amounts match.
03 / Reach a supported conclusion
What the screen allows us to say.
Two pairs need investigation. Matching fields establish candidates for duplicate posting; the screen alone cannot establish a duplicate obligation or payment.
Boundary of the conclusion. An exact-key test can miss changed dates, amounts, vendor records, or references. These six pairs do not support a population-wide error rate.