A wired control tests every transaction in its population, so you only review the exceptions
A failed control usually surfaces months later, in an auditor's sample.
A payment goes out with one signature instead of two. A journal entry books to the wrong period. A vendor's bank details change the week before a large run. In most companies none of this surfaces until an auditor pulls a sample months later, and a sample cannot see what it did not pick.
In Fintra each run of a control covers every transaction in its population, and each failure opens an exception with its evidence already sealed.
| How controls are tested | What it covers |
|---|---|
| Sampling | About 25 of 2,400 items, once a quarter. A breach outside the sample is not seen. |
| A spreadsheet control matrix | Written down, and rarely tested again between audits. |
| Fintra | All 2,400, each time the test runs. Only the failures surface, each with its sealed record. |
Set a control once, and each run tests it against every transaction in its population.
Each control is a test of the whole population, built on the same approvals and the same sealed record Fintra uses for every payment, and each failure it seals can be recomputed.
Set the control once
A spend ceiling, a two-signature rule, a three-way match or segregation of duties: one of nine kinds of control, on the same approvals that govern every payment.
Test the whole population
A wired control tests its whole population, not a sample, each time the test runs.
Open an exception
Items that pass stay quiet. Each failure opens an exception, ranked by the money at risk and routed to an owner.
Seal the record
The failure is written to an append-only, hash-linked record: the database refuses updates and deletes.
Map it to SOX 404
The record is linked to the SOX 404 control objective it breaks, with its COSO component.
Let the auditor check it
Anyone with access to your company can recompute the record end to end to confirm nothing was changed.
20 SOX 404 control objectives, 13 of them with an automated test.
The objectives are mapped to the five COSO components. The other seven are entity-level and attestation controls a person owns, and we would rather show the split than imply it is all automated.
| COSO component | Objectives | Automated test | Examples |
|---|---|---|---|
| Control environmentSegregation of duties, tone at the top, the audit committee | 3 | 1 | Segregation of duties, tone at the top, the audit committee |
| Risk assessmentFraud risk assessment | 1 | 0 | Fraud risk assessment |
| Control activitiesDual approval, three-way match, journal-entry review, period cutoff, bank reconciliation, the close checklist | 14 | 12 | Dual approval, three-way match, journal-entry review, period cutoff, bank reconciliation, the close checklist |
| Information and communicationIntegrity of the audit trail | 1 | 0 | Integrity of the audit trail |
| MonitoringManagement review of exceptions | 1 | 0 | Management review of exceptions |
Tested against your own transactions
- Segregation of dutiesThe person who created a payment is not the one who approved it. SOX-CE-03
- Spending limitA single payment above the declared ceiling opens an exception. SOX-CA-02
- AP three-way matchPurchase order, receipt and invoice agree. SOX-CA-03
- Revenue cutoffRevenue lands in the period it was earned. SOX-CA-05
- Bank reconciliationEvery bank transaction is matched to a posted journal line. SOX-CA-06
The exception list
You work the short list of what failed, not the whole population. Every exception carries its severity, the money at risk, the control it broke, a plain explanation and a fix-then-recheck step. Repeated failures fold together and escalate.
- Ranked by the money at risk
- Fed by control tests, fraud checks and anomalies
- Fixed, then checked again, with a trail
- Repeat failures escalate
Access for your auditor
Give your external auditor time-limited, revocable, read-only access to Fintra Trust, with no login to your finance system and no binder assembled by hand. Every view is logged.
- Time-limited, revocable access
- A log of every view
- Each record mapped to its control
- The record can be recomputed to prove it is intact
What runs, and what a person signs off
Of the 20 SOX 404 objectives, 13 have automated tests that check the whole population each time they run; the other 7 are entity-level or attestation controls a person signs off. Where a control's population is not connected, Fintra marks the control as not tested instead of reporting a pass, so it never fakes coverage. A test runs when it is started; nothing runs it on a schedule for you. Continuous assurance sits beside your GRC tools and your external audit; it does not replace the auditor or issue an opinion. The population tests, the seals, the linked record and the control map can be recomputed today. The auditor's view does not show every finance finding, and a finding does not change the mapped control's status.
Common questions
What is continuous controls monitoring?
Continuous controls monitoring tests a control against every transaction instead of an auditor sampling a handful of items once a quarter. Fintra runs each control as a full-population sweep: it checks every payment, journal entry, or reconciliation in the population against the rule, opens an exception only for the items that fail, and seals each failure as tamper-evident evidence mapped to the SOX 404 control it violates. Each run covers the whole population, so a breach is not missed because a sample skipped it.
Does Fintra do SOX 404?
Fintra ships a SOX 404 control catalog of 20 COSO-mapped control objectives spanning the control environment, risk assessment, control activities, information and communication, and monitoring. Thirteen of them have an automated test in the catalog, and the remaining seven are entity-level or attestation controls a human signs off. Against your own transactions, Fintra tests segregation of duties, a spending limit on single payments, AP three-way match, revenue cutoff and bank-to-ledger reconciliation over the whole population each time the test runs. Fintra complements your external audit and SOX program; it does not replace the auditor.
How is this different from a GRC tool like Vanta or Drata?
GRC tools collect evidence after the fact: screenshots, policy attestations, and integration checks that confirm a control exists. Fintra tests the control itself against the financial data in your books and produces the evidence as a by-product of the test. Because every failing item is sealed into a hash-chained ledger and mapped to its control, an auditor can recompute the chain to show nothing was altered. Fintra keeps the books the control reads; it complements a GRC stack rather than duplicating it.
Can my external auditor use it?
Yes. Fintra Trust includes an auditor portal that issues a time-boxed, revocable, read-only access token and logs every view. Your auditor sees the controls and the evidence kept against them in Fintra Trust, without a login to your production finance system. A finance control finding is sealed in Fintra’s hash-chained ledger, which your team can recompute and share; the portal does not show every finance finding.
See your own controls tested against the whole population.
Run it as software, with a copilot, or managed by Fintra. The evidence is ready before the board meeting.