Controls

Design internal controls for "$ARGUMENTS". Establish preventive and detective controls to safeguard assets, ensure accuracy, and maintain compliance.

Prerequisites

None — utility skill, run anytime. Most effective after Phase 1 (analyze) to understand the entity's operations and risk areas.

Process

1. Assess control environment:

   • What processes handle cash, inventory, payroll, and financial reporting?
   • Where are the highest-risk areas for errors or fraud?
   • What controls currently exist (if any)?
   • What is the entity's size and complexity?

2. Design preventive controls:

   • Segregation of duties — separate authorization, custody, and recording
   • Authorization controls — approval limits and signing authority
   • Physical controls — locks, safes, restricted access, inventory counts
   • IT controls — access permissions, password policies, audit logs
   • Documentation — standardized forms, sequential numbering, required fields

3. Design detective controls:

   • Reconciliations — bank reconciliation, intercompany, sub-ledger to GL
   • Reviews — management review of reports, exception reports
   • Audits — internal audit schedule, surprise counts
   • Variance analysis — budget vs. actual monitoring

4. Map controls to risks:

   • For each identified risk, assign one or more controls
   • Classify controls by type (preventive/detective) and frequency (daily/weekly/monthly/annual)
   • Identify any gaps where risks lack adequate controls

5. Write the artifact to .metapowers/accounting/$ARGUMENTS/controls.md with sections:

   • Control Environment Assessment — current state and risk areas
   • Control Matrix — risks mapped to controls with type, frequency, and owner
   • Implementation Plan — priority order for implementing new or improved controls
   • Monitoring — how to verify controls are operating effectively

Output

The controls design written to .metapowers/accounting/$ARGUMENTS/controls.md. Present a summary highlighting:

• Number of controls designed by type
• Highest-risk areas and their mitigating controls
• Implementation priorities