The payroll owner changes, but the old spreadsheet still names the wrong person.
INTERNAL RISK OPERATING FILE
Keep Northstar’s payroll owners and evidence in one durable review file.
Internal audit, SOX, compliance, and risk teams can carry the same payroll access example across quarters without losing owners, evidence rules, or what changed.
Control owners
64
Evidence aging
9
Signed off
87%
NORTHSTAR PAYROLL / UK PROVISION 29
42 rows ready| Control | Risk | Activity | Frequency | Framework | Status |
|---|---|---|---|---|---|
| CTRL-027 | RISK-011 | Northstar leaver access review is signed by IT Controls monthly. | Monthly | SOX 404 | Reviewed |
| CTRL-041 | RISK-018 | Monthly exception list is missing for payroll leavers. | Monthly | UK P29 | Needs evidence |
| CTRL-088 | RISK-024 | MFA enforcement covers all payroll administrator entry points. | Realtime | ISO A.9 | Suggested |
WHAT THIS REPLACES
What the in-house team stops chasing
The leaver access exception list is split between email and a shared folder.
Management asks what changed since Q3, but the team only has a fresh export.
DELIVERY OUTCOMES
A review file that stays linked from interview to client delivery.
Each buyer page follows the same Northstar payroll example, then changes the proof points for the team using it.
Persistent control memory
Carry owners, evidence rules, risk scores, and process changes forward without losing the review trail.
Clear blocked work
Show the missing owner, file, or control decision beside the process step that needs it.
Management-ready status
Summarize open risks and evidence gaps without sending stakeholders into the full work file.
SAMPLE REVIEW ROWS
Real payroll review rows, not placeholder charts.
The rows show what happened to the Northstar example: ready export, blocked evidence, suggested control, or reviewer sign-off.
| Process area | Current result | Status |
|---|---|---|
| Leaver access | Owner change captured with evidence rule | Ready |
| Manual journals | Late review risk still missing sign-off | Review |
| Vendor master | Automated duplicate vendor check suggested | Suggested |