The methodology says “monthly review,” but the Northstar file has no exception list.
ADVISORY QUALITY CONTROL
Standardize the Northstar review without flattening client detail.
Large advisory groups can keep the same method, risk scoring, and control language across teams while preserving the exact payroll access facts from the client.
Review gates
6
Method gaps
14
Locked packs
23
NORTHSTAR PAYROLL / UK PROVISION 29
42 rows ready| Control | Risk | Activity | Frequency | Framework | Status |
|---|---|---|---|---|---|
| CTRL-027 | RISK-011 | Northstar leaver access review is signed by IT Controls monthly. | Monthly | SOX 404 | Reviewed |
| CTRL-041 | RISK-018 | Monthly exception list is missing for payroll leavers. | Monthly | UK P29 | Needs evidence |
| CTRL-088 | RISK-024 | MFA enforcement covers all payroll administrator entry points. | Realtime | ISO A.9 | Suggested |
WHAT THIS REPLACES
What the advisory reviewer catches earlier
Reviewers catch inconsistent access-risk wording after the team drafts the workbook.
Client-specific controls are hard to compare with similar payroll reviews.
DELIVERY OUTCOMES
A review file that stays linked from interview to client delivery.
Each buyer page follows the same Northstar payroll example, then changes the proof points for the team using it.
Built-in methodology checks
Tie each control row to framework language, evidence strength, and reviewer notes before export.
Portfolio-level consistency
Compare similar process areas across clients without hiding local process differences.
Earlier quality gates
Catch missing owners, weak evidence, and duplicated controls while the team is still mapping the process.
SAMPLE REVIEW ROWS
Real payroll review rows, not placeholder charts.
The rows show what happened to the Northstar example: ready export, blocked evidence, suggested control, or reviewer sign-off.
| Process area | Current result | Status |
|---|---|---|
| Northstar SOX readiness | Payroll review checked against shared method | Ready |
| Leaver access | Missing evidence blocked before client review | Blocked |
| Framework switch | UK P29 mapped without rewriting the control | Suggested |