What It Does Products How It Works Controls Industries Pricing About Sign In Sign up for early access

Audit Aware Controls

The checks that protect your books

Advisacor prepares work for you, but nothing reaches your books until it has passed a set of checks. Each check is built into the product, runs every time, and leaves a record you can look at later.

Below: the full control library, where each control sits in your accounting processes, how the controls line up with the COSO 2013 framework, and what is live today and what is still being built.

controls live: 72
in early access: 2
process maps: 7
COSO principles tagged: 17

How it fits together

Audit Aware Controls is one list of controls, used four ways. Each control is tied to the code that enforces it, so what this page shows is what the product runs.

The control library
Each control names the risk it covers, whether it prevents or detects, and the record it leaves. The library is checked against the code: a control is shown as live only when the code that enforces it exists.
Control packs
The library grouped by accounting process, such as procure to pay or payroll. Each pack says what Advisacor checks, what your team does, and the records kept.
Process maps
A flowchart for each pack: the steps of the process, who does each step, where Advisacor's checks sit, and which duties should be kept apart.
COSO 2013 tags
Each control is tagged with the COSO 2013 principles it supports, so you can see which principles Advisacor helps with and which stay with your company.

How an entry gets to your books

Prepared.
Advisacor (or someone on your team) prepares the entry. We confirm the person has access to your company, take a fingerprint of the exact entry, and check that the same receipt or bill isn't already in your books.
Approved by a person.
A person with approval rights reviews it. The person who prepared an entry can't approve it. Larger amounts need a two-factor confirmation, and if your company has set a second-approver amount, a second person approves too.
Checked before posting.
Debits must equal credits. The supporting documents must be saved. What gets posted must be exactly what was approved.
The final check.
Right before anything is written to QuickBooks, one last control confirms every earlier check passed, re-checks your company's automation settings, and records the authorization. Only then is the entry sent. It also refuses entries dated in a locked or closed period, entries to inactive accounts, and a second post of the same approval.
Checked after posting.
We read the entry back from QuickBooks and compare it with what was approved, keep a full history of who did what and when, and save the support package with the entry.

Checks around your books

Your accounting data:
we confirm we're connected to the right company, watch the connection's health, pick up changes made directly in QuickBooks, and tie figures back to your accounting system's own reports. If a figure can't be supported, we show that it isn't available instead of guessing.
Documents and bills coming in:
files are screened before they are stored, unclear readings are flagged for a person, receipts are matched to the right transaction, and bills are checked for duplicates, unusual patterns and changed vendor bank details.
Books health:
we look for amounts left in suspense or uncategorized, unreconciled bank and card accounts, old undeposited funds, a balance sheet that doesn't balance, cash that doesn't match the bank, and large changes from one period to the next.
Reconciliation and close:
reconciliations show any unexplained difference, balance sheet, receivable and payable balances are tied out, and the close checklist is verified against the books.

Process maps: see where each check sits

Here is the procure to pay map as it appears inside Advisacor. Each lane is a role in your company. Boxes in the Advisacor lane are steps Advisacor does; the codes under a box are the controls on that step. This is the standard template with no company data.

Procure to pay

Bills are checked from purchase to payment.

Start or end of the process
A step your team does
A step Advisacor does
Optional step (for example, if you don't use purchase orders)

Scroll the chart sideways to see every step.

Step by step

1.
Purchase needed
Who: Requester
2.
Request the purchase
Optional step
Who: Requester
What Advisacor checks
- Where approval chains are turned on, each purchase is approved by its assigned approver, in order and within budget. AAC-I12
COSO 2013 principles: 3 · 10
3.
Approve the purchase
Optional step
Who: Approver
What Advisacor checks
- Where approval chains are turned on, each purchase is approved by its assigned approver, in order and within budget. AAC-I12
What your team does
- Approve purchases and bills before they are paid.
COSO 2013 principles: 3 · 10
4.
Receive the goods or services
Optional step
Who: Requester
No Advisacor check on this step.
5.
Enter the vendor bill
Who: Accounts payable
What Advisacor checks
- We check for the same bill or receipt entered twice. AAC-P03 · AAC-I04
- We flag unusual bills and coding that doesn't fit the vendor's history. AAC-I05 · AAC-I08
What your team does
- Make vendor and bill changes through Advisacor. Changes made directly in your accounting system don't pass these checks.
COSO 2013 principles: 8 · 10 · 13 · 16
6.
Match the bill to the order and receipt
Optional step
Who: Advisacor
What Advisacor checks
- Where three-way matching is turned on, we compare each bill with its purchase order and what was received. AAC-I11
COSO 2013 principles: 8 · 10
7.
Check vendor bank details
Who: Accounts payable
What Advisacor checks
- We flag changed vendor bank details, and flagged bills are held until the required checks are done. AAC-I06 · AAC-I07
What your team does
- Confirm new vendor bank details by calling the vendor on a number you already have.
COSO 2013 principles: 8 · 10
8.
Approve the bill
Who: Approver
What Advisacor checks
- The person who prepared an entry can't approve it. Larger amounts need a two-factor confirmation, and if your company has set a second-approver amount, a second person approves too. AAC-A03 · AAC-A04 · AAC-A06 · AAC-A07
What your team does
- Approve purchases and bills before they are paid.
COSO 2013 principles: 3 · 5 · 8 · 10 · 11
9.
Release the vendor payment
Who: Business owner
No Advisacor check on this step.
What your team does
- Release vendor payments in your bank or bill-pay system.
10.
Tie payables to the ledger
Who: Advisacor
What Advisacor checks
- We tie your payables aging to the ledger. AAC-R07
COSO 2013 principles: 13 · 16
11.
Bill paid and recorded
Who: Accounts payable

Duties to keep apart

Small teams often can't separate every duty. The map names each pair of steps one person shouldn't both do, what could go wrong, and the compensating control to use when one person does both, with the record to keep.

Enter the vendor bill (Accounts payable) and Approve the bill (Approver)
The person who enters a bill also approves it, so a false or inflated bill can be approved without a second look.
Compensating control
The business owner reviews each month's vendor payments against the approved bills.
Record to keep
The payments list, signed and dated by the reviewer.
Advisacor findings that help
AAC-I04 · AAC-I06 · AAC-R07
Approve the bill (Approver) and Release the vendor payment (Business owner)
The person who approves a bill also releases the payment, so one person controls the whole payment.
Compensating control
The business owner reviews each month's vendor payments against the approved bills.
Record to keep
The payments list, signed and dated by the reviewer.
Advisacor findings that help
AAC-I04 · AAC-I06 · AAC-R07
Check vendor bank details (Accounts payable) and Release the vendor payment (Business owner)
The person who checks vendor bank details also releases payments, so a changed bank account can be paid without an independent check.
Compensating control
Someone other than the person who changed them confirms new vendor bank details by calling the vendor on a number already on file.
Record to keep
A call record with the date, who called and the number used.
Advisacor findings that help
AAC-I06
Request the purchase (Requester) and Approve the purchase (Approver)
The person who requests a purchase also approves it.
Compensating control
The business owner reviews the purchases approved each month.
Record to keep
The purchase list, signed and dated by the reviewer.
Advisacor findings that help
AAC-I12

The other six maps

Each control pack has its own map. Open one to see its chart.

Cash applicationCustomer payments are deposited, applied and tied back to the bank and your receivables.

1. Customer payment received (Bookkeeper)
2. Deposit the payment (Bookkeeper) AAC-H03
3. Apply the payment to the invoice (Bookkeeper)
4. Follow up short or unidentified payments (Bookkeeper)
5. Reconcile the bank account (Bookkeeper) AAC-H02 · AAC-H04
6. Tie receivables to the ledger (Advisacor) AAC-R07
7. Review the bank reconciliation (Controller)
8. Cash applied and reconciled (Controller)

Duties to keep apart

Apply the payment to the invoice (Bookkeeper) and Review the bank reconciliation (Controller)
The person who applies payments also reviews the bank reconciliation, so a misapplied or missing payment can go unnoticed.
Compensating control
The business owner reviews each bank and card reconciliation every month.
Record to keep
The reconciliation, signed and dated by the reviewer.
Advisacor findings that help
AAC-H02 · AAC-H04

Order to cashRevenue lands in the right period and receivables tie to your books.

1. Work delivered (Bookkeeper)
2. Invoice the customer (Bookkeeper) AAC-H08
3. Approve credit memos (Controller) AAC-H08
4. Deposit customer payments (Business owner) AAC-H03
5. Follow up overdue accounts (Bookkeeper)
6. Tie receivables to the ledger (Advisacor) AAC-R07
7. Revenue recorded in the right period (Controller)

Duties to keep apart

Invoice the customer (Bookkeeper) and Approve credit memos (Controller)
The person who invoices customers also approves credit memos, so revenue can be reversed without a second look.
Compensating control
The business owner reviews the credit memos issued each month.
Record to keep
The credit memo list, signed and dated by the reviewer.
Advisacor findings that help
AAC-H08
Invoice the customer (Bookkeeper) and Deposit customer payments (Business owner)
The person who invoices customers also handles their payments, so a payment can be kept and the invoice written off.
Compensating control
The business owner reviews the receivables aging and any write-offs each month.
Record to keep
The aging report, signed and dated by the reviewer.
Advisacor findings that help
AAC-R07 · AAC-H03

Expenses and company cardsReceipts and card spending are checked before they reach your books.

1. Card purchase made (Requester)
2. Send the receipt (Requester) AAC-I01 · AAC-I02
3. Match the receipt to the card transaction (Advisacor) AAC-I03
4. Code the expense (Bookkeeper) AAC-I09 · AAC-H01
5. Approve the expense (Approver) AAC-A03 · AAC-A04
6. Check the period is open (Advisacor) AAC-K05
7. Reconcile the card account (Bookkeeper) AAC-H02
8. Review the card statement (Controller)
9. Expense recorded with its receipt (Bookkeeper)

Duties to keep apart

Send the receipt (Requester) and Approve the expense (Approver)
The person who makes card purchases also approves them.
Compensating control
The business owner reviews each card statement, including the purchases of anyone who approves expenses.
Record to keep
The card statement, signed and dated by the reviewer.
Advisacor findings that help
AAC-I03 · AAC-H02
Reconcile the card account (Bookkeeper) and Review the card statement (Controller)
The person who reconciles the card account also reviews the card statement.
Compensating control
The business owner reviews each bank and card reconciliation every month.
Record to keep
The reconciliation, signed and dated by the reviewer.
Advisacor findings that help
AAC-H02 · AAC-H04

Payroll to ledgerPayroll in your books is explained and checked each month.

1. Pay period ends (Payroll provider)
2. Run payroll (Payroll provider)
3. Check payroll in the books (Advisacor) AAC-H07
4. Approve the payroll accrual (Approver) AAC-A06
5. Post the payroll accrual (Advisacor) AAC-K01
6. Review payroll liabilities paid (Controller)
7. Payroll recorded and explained (Bookkeeper)

Duties to keep apart

Run payroll (Payroll provider) and Review payroll liabilities paid (Controller)
The person who runs payroll also reviews the payroll liabilities paid, so a payroll error or extra payment can go unnoticed.
Compensating control
The business owner reviews the payroll register for each pay run before it is paid.
Record to keep
The payroll register, signed and dated by the reviewer.
Advisacor findings that help
AAC-H07

CompletenessNothing is left out of the period.

1. Period ends (Controller)
2. Report goods or services received but not billed (Requester)
3. Propose accruals (Advisacor) AAC-R06
4. Approve the accruals (Controller)
5. Check revenue and bill cut-off (Advisacor) AAC-H08
6. Run the accounting rules (Advisacor) AAC-H06
7. Check readiness to close (Advisacor) AAC-R03 · AAC-R04
8. Sign off the month-end close (Controller)
9. Review the month-end close (Business owner)
10. Period closed (Controller)

Duties to keep apart

Sign off the month-end close (Controller) and Review the month-end close (Business owner)
The person who signs off the close is also the only person who reviews it.
Compensating control
An outside accountant reviews the month-end close each quarter.
Record to keep
The accountant's review notes, dated.
Advisacor findings that help
AAC-R03 · AAC-R04
Report goods or services received but not billed (Requester) and Approve the accruals (Controller)
The person who reports goods received but not billed also approves the accruals.
Compensating control
The business owner reviews the accruals before they are approved.
Record to keep
The accrual list, signed and dated by the reviewer.
Advisacor findings that help
AAC-R06

Data driftYour data in Advisacor stays tied to your accounting system.

1. Accounting system connected (Business owner)
2. Verify the connected company (Advisacor) AAC-D01 · AAC-D02
3. Keep the connection authorized (Business owner) AAC-D03
4. Pick up changes made in the accounting system (Advisacor) AAC-D04 · AAC-D09
5. Tie figures to the accounting reports (Advisacor) AAC-D05 · AAC-D06 · AAC-D07 · AAC-D08
6. Flag coding and price drift (Advisacor) AAC-I08 · AAC-I05
7. Report account changes before making them (Controller)
8. Data stays tied to the accounting system (Controller)

Duties to keep apart

No duties to keep apart on this map.

Live Process maps are live inside Advisacor on the RA Pro plan as standard templates. Adding your own people to the lanes, live status on each step, sign-off, printable charts and asking Pulse about a step are planned.

Mapped to the COSO 2013 framework

COSO's Internal Control — Integrated Framework (2013) sets out five components and seventeen principles. Each Advisacor control is tagged with the principles it supports.

COSO publishes the components and principles, not a mapping of any product to them. This mapping is Advisacor's own. It shows where our controls help; it is not an assessment of your company's internal control.

1Control environment

Principle 1Commitment to integrity and ethical values
Stays with your company. No Advisacor control supports this principle; it is about your people, leadership and oversight.
Principle 2Independent oversight by the board
Stays with your company. No Advisacor control supports this principle; it is about your people, leadership and oversight.
Principle 3Structures, reporting lines, authorities and responsibilities
Advisacor controls that support it (7)
- AAC-P01 Company access check
- AAC-A06 Approver role
- AAC-A08 Turning on automatic coding needs a manager and two-factor
- AAC-A10 New QuickBooks account only by an account-setup person with two-factor
- AAC-A12 Turning on automatic posting or raising its limits needs a manager and two-factor
- AAC-C06 Company automation controls
- AAC-I12 Requisition approval chain and budget check
Principle 4Commitment to competent people
Stays with your company. No Advisacor control supports this principle; it is about your people, leadership and oversight.
Principle 5Accountability for internal control
Advisacor controls that support it (5)
- AAC-A05 Automatic posting cap and no AI posting in production
- AAC-A06 Approver role
- AAC-V02 Posting audit trail
- AAC-R04 Close checklist verifiers
- AAC-R05 Close calendar

2Risk assessment

Principle 6Clear objectives
Stays with your company. No Advisacor control supports this principle; it is about your people, leadership and oversight.
Principle 7Identifies and analyzes risks
Advisacor controls that support it (4)
- AAC-H05 Flux (period-over-period change)
- AAC-H06 Accounting rule engine
- AAC-H07 Payroll checks: changes explained, missed accrual, misposted payroll
- AAC-H08 Revenue and period cut-off findings
Principle 8Assesses fraud risk
Advisacor controls that support it (10)
- AAC-P03 Duplicate document and transaction check
- AAC-A03 Preparer cannot approve (segregation of duties)
- AAC-A04 Two-factor step-up for larger amounts
- AAC-A07 Second approver above the company's threshold
- AAC-A13 Invoices received by email always wait for a person
- AAC-I04 Bill duplicate detection
- AAC-I05 Bill anomaly detection
- AAC-I06 Vendor bank detail change
- AAC-I07 Quarantine gates
- AAC-I11 Three-way match of bills to purchase orders and receipts
Principle 9Identifies and analyzes significant change
Advisacor controls that support it (2)
- AAC-P04 Recurring entry auto-post hold
- AAC-D04 Change data capture

3Control activities

Principle 10Selects and develops control activities
Advisacor controls that support it (29)
- AAC-P02 Proposal fingerprint (hash)
- AAC-P03 Duplicate document and transaction check
- AAC-P04 Recurring entry auto-post hold
- AAC-P05 Automatic coding stops at exceptions
- AAC-A01 Approved review item required
- AAC-A02 Approval status checks
- AAC-A03 Preparer cannot approve (segregation of duties)
- AAC-A05 Automatic posting cap and no AI posting in production
- AAC-A07 Second approver above the company's threshold
- AAC-A09 Approve all is one full approval per bill
- AAC-A11 Automatic posting only within the company's standing authorization and limits
- AAC-A13 Invoices received by email always wait for a person
- AAC-C04 Posted entry matches the approved entry
- AAC-K01 Final posting authority
- AAC-K03 Cash-basis companies are not posted to
- AAC-K05 Entry check against QuickBooks (period, closing date, active accounts)
- AAC-V07 Corrections go through a new approved entry
- AAC-I02 Reading confidence review
- AAC-I03 Receipt matching to QuickBooks
- AAC-I04 Bill duplicate detection
- AAC-I06 Vendor bank detail change
- AAC-I07 Quarantine gates
- AAC-I08 GL mapping variance check
- AAC-I09 Uncategorized suggestions
- AAC-I11 Three-way match of bills to purchase orders and receipts
- AAC-I12 Requisition approval chain and budget check
- AAC-H02 Bank and card accounts reconciled
- AAC-R01 Reconciliation model (identified items, unexplained remainder)
- AAC-R06 Accrual proposals
Principle 11General controls over technology
Advisacor controls that support it (21)
- AAC-P01 Company access check
- AAC-P02 Proposal fingerprint (hash)
- AAC-P05 Automatic coding stops at exceptions
- AAC-A02 Approval status checks
- AAC-A04 Two-factor step-up for larger amounts
- AAC-A10 New QuickBooks account only by an account-setup person with two-factor
- AAC-C01 Debits equal credits (checked first)
- AAC-C03 Plan includes posting
- AAC-C04 Posted entry matches the approved entry
- AAC-C05 Approved posting workflows and posting kill switch
- AAC-K01 Final posting authority
- AAC-K02 One post per approval (idempotency)
- AAC-K04 QuickBooks write readiness
- AAC-K05 Entry check against QuickBooks (period, closing date, active accounts)
- AAC-K06 Balance re-checked on the exact QuickBooks request
- AAC-V03 Confirm in QuickBooks before any retry
- AAC-V06 QuickBooks request trace
- AAC-D01 QuickBooks company verified on connect
- AAC-D02 One accounting company per Advisacor company
- AAC-I01 Upload screening
- AAC-I10 Auto-fix eligibility with approved rules
Principle 12Policies and procedures
Advisacor controls that support it (11)
- AAC-A01 Approved review item required
- AAC-A08 Turning on automatic coding needs a manager and two-factor
- AAC-A11 Automatic posting only within the company's standing authorization and limits
- AAC-A12 Turning on automatic posting or raising its limits needs a manager and two-factor
- AAC-C02 Support required (evidence packet)
- AAC-C05 Approved posting workflows and posting kill switch
- AAC-C06 Company automation controls
- AAC-K01 Final posting authority
- AAC-K03 Cash-basis companies are not posted to
- AAC-V07 Corrections go through a new approved entry
- AAC-I10 Auto-fix eligibility with approved rules

4Information and communication

Principle 13Relevant, quality information
Advisacor controls that support it (21)
- AAC-C01 Debits equal credits (checked first)
- AAC-C02 Support required (evidence packet)
- AAC-V01 Read-back of the posted entry
- AAC-V02 Posting audit trail
- AAC-V05 Evidence packet finalized from QuickBooks
- AAC-V06 QuickBooks request trace
- AAC-D01 QuickBooks company verified on connect
- AAC-D03 Connection health
- AAC-D05 Statement control figures
- AAC-D06 Continuous tie-out to accounting reports
- AAC-D07 Withheld figures instead of guesses
- AAC-D08 Drill-down ties to the total
- AAC-D09 Weekly completeness check
- AAC-I02 Reading confidence review
- AAC-I03 Receipt matching to QuickBooks
- AAC-I08 GL mapping variance check
- AAC-I09 Uncategorized suggestions
- AAC-H01 Suspense and uncategorized balances
- AAC-H04 Balance sheet equation and bank-to-GL
- AAC-R06 Accrual proposals
- AAC-R07 AR and AP aging tie-outs
Principle 14Communicates internally
Advisacor controls that support it (3)
- AAC-V08 Automatic posts reported to the people who authorized them
- AAC-D07 Withheld figures instead of guesses
- AAC-R05 Close calendar
Principle 15Communicates externally
Stays with your company. No Advisacor control supports this principle; it is about your people, leadership and oversight.

5Monitoring activities

Principle 16Ongoing and separate evaluations
Advisacor controls that support it (22)
- AAC-V01 Read-back of the posted entry
- AAC-V02 Posting audit trail
- AAC-V04 Failure and balance incidents recorded
- AAC-V08 Automatic posts reported to the people who authorized them
- AAC-D03 Connection health
- AAC-D04 Change data capture
- AAC-D05 Statement control figures
- AAC-D06 Continuous tie-out to accounting reports
- AAC-D09 Weekly completeness check
- AAC-I05 Bill anomaly detection
- AAC-H01 Suspense and uncategorized balances
- AAC-H02 Bank and card accounts reconciled
- AAC-H03 Undeposited funds aging
- AAC-H04 Balance sheet equation and bank-to-GL
- AAC-H05 Flux (period-over-period change)
- AAC-H06 Accounting rule engine
- AAC-H07 Payroll checks: changes explained, missed accrual, misposted payroll
- AAC-H08 Revenue and period cut-off findings
- AAC-R02 Balance sheet tie-outs
- AAC-R03 Continuous close readiness
- AAC-R04 Close checklist verifiers
- AAC-R07 AR and AP aging tie-outs
Principle 17Evaluates and communicates deficiencies
Advisacor controls that support it (3)
- AAC-V04 Failure and balance incidents recorded
- AAC-R01 Reconciliation model (identified items, unexplained remainder)
- AAC-R03 Continuous close readiness

The control library

Every control in the library, grouped by where it runs. The first five groups are the path an entry takes to your books, ending at the final posting control. The rest check the data, documents and books around it.

Live Built into the product and running.
Early access Built, and turned on for companies in an early-access pilot.
Partly built Running, but not yet on every path it should cover.
Planned Designed, not built yet.

Prepare (5)

AAC-P01Company access check
Live
Risk covered: Someone works on, or posts to, a company they are not allowed to access.
Prevents
AAC-P02Proposal fingerprint (hash)
Live
Risk covered: The entry that posts differs from the one a person reviewed.
Prevents
AAC-P03Duplicate document and transaction check
Live
Risk covered: The same receipt or bill is entered twice.
Prevents
AAC-P04Recurring entry auto-post hold
Live
Risk covered: A recurring entry posts on its own when its terms no longer match.
Prevents
AAC-P05Automatic coding stops at exceptions
Live
Risk covered: Advisacor prepares a Bill on its own for a new, unusual or uncertain document that a person should code.
Prevents

Approve (13)

AAC-A01Approved review item required
Live
Risk covered: A journal entry is posted directly without an approval on record.
Prevents
AAC-A02Approval status checks
Live
Risk covered: An undecided, rejected, already-posted or other company's item is posted.
Prevents
AAC-A03Preparer cannot approve (segregation of duties)
Live
Risk covered: One person prepares and approves the same entry with no second check.
Prevents
AAC-A04Two-factor step-up for larger amounts
Live
Risk covered: A high-value entry is approved from a stolen or unattended session.
Prevents
AAC-A05Automatic posting cap and no AI posting in production
Live
Risk covered: Advisacor posts a large entry, or any entry in production, without a person.
Prevents
AAC-A06Approver role
Live
Risk covered: Someone without approval rights approves a write to the books.
Prevents
AAC-A07Second approver above the company's threshold
Live
Risk covered: A large entry is approved by only one person.
Prevents
AAC-A08Turning on automatic coding needs a manager and two-factor
Live
Risk covered: Someone without authority, or a stolen session, turns on automatic coding for a company.
Prevents
AAC-A09Approve all is one full approval per bill
Live
Risk covered: A batch approval skips the per-entry checks.
Prevents
AAC-A10New QuickBooks account only by an account-setup person with two-factor
Live
Risk covered: An account is added to the chart of accounts without authority.
Prevents
AAC-A11Automatic posting only within the company's standing authorization and limits
Live
Risk covered: Advisacor posts a Bill with nobody clicking that the company did not authorize, or beyond its per-bill or daily limits.
Prevents
AAC-A12Turning on automatic posting or raising its limits needs a manager and two-factor
Live
Risk covered: Someone without authority, or a stolen session, lets Advisacor post bills on its own or raises how much it may post.
Prevents
AAC-A13Invoices received by email always wait for a person
Live
Risk covered: An invoice someone emailed in (possibly forged or spoofed) is posted to QuickBooks with nobody looking at it.
Prevents

Before posting (6)

AAC-C01Debits equal credits (checked first)
Live
Risk covered: An unbalanced entry reaches the books.
Prevents
AAC-C02Support required (evidence packet)
Live
Risk covered: An entry posts without its supporting documents and approval record.
Prevents
AAC-C03Plan includes posting
Live
Risk covered: Posting runs for a plan that does not include it.
Prevents
AAC-C04Posted entry matches the approved entry
Live
Risk covered: An approval is reused to post a different entry.
Prevents
AAC-C05Approved posting workflows and posting kill switch
Live
Risk covered: An unapproved workflow posts, or posting continues during an incident.
Prevents
AAC-C06Company automation controls
Live
Risk covered: Advisacor posts for a company that chose not to allow it.
Prevents

Final posting control (6)

The last control before anything is written to QuickBooks. Every posting control before it feeds into it.

AAC-K01Final posting authority
Live
Risk covered: Anything reaches the GL or QuickBooks without passing every control above.
PreventsKey control
AAC-K02One post per approval (idempotency)
Live
Risk covered: A retry posts the same entry twice.
Prevents
AAC-K03Cash-basis companies are not posted to
Live
Risk covered: Accrual-style entries post into a cash-basis company's books.
Prevents
AAC-K04QuickBooks write readiness
Live
Risk covered: A write goes to a disconnected, unhealthy or inactive connection or subscription.
Prevents
AAC-K05Entry check against QuickBooks (period, closing date, active accounts)
Live
Risk covered: An entry posts into a locked or closed period, or to a missing or inactive account.
Prevents
AAC-K06Balance re-checked on the exact QuickBooks request
Live
Risk covered: The request built for QuickBooks does not balance even though the approved entry did.
Prevents

After posting (8)

AAC-V01Read-back of the posted entry
Live
Risk covered: QuickBooks recorded something different from what was approved.
Detects
AAC-V02Posting audit trail
Live
Risk covered: No record of who posted what, when and why.
Detects
AAC-V03Confirm in QuickBooks before any retry
Live
Risk covered: An unknown outcome is retried blindly and the bill or expense is created twice.
Prevents
AAC-V04Failure and balance incidents recorded
Live
Risk covered: A failed or unbalanced post goes unnoticed.
Detects
AAC-V05Evidence packet finalized from QuickBooks
Live
Risk covered: The support package does not reflect what QuickBooks actually recorded.
Detects
AAC-V06QuickBooks request trace
Live
Risk covered: A QuickBooks problem cannot be traced with Intuit support.
Detects
AAC-V07Corrections go through a new approved entry
Live
Risk covered: A posted entry is changed or reversed outside the approval path.
Prevents
AAC-V08Automatic posts reported to the people who authorized them
Live
Risk covered: A bill Advisacor posted on its own goes unnoticed, or cannot be traced to who authorized it.
Detects

Data from your accounting system (9)

AAC-D01QuickBooks company verified on connect
Live
Risk covered: Data is read from, or written to, the wrong QuickBooks company.
Prevents
AAC-D02One accounting company per Advisacor company
Live
Risk covered: One QuickBooks or Xero company is linked to two Advisacor companies.
Prevents
AAC-D03Connection health
Live
Risk covered: Figures are shown from a broken or stale connection.
Detects
AAC-D04Change data capture
Live
Risk covered: Changes made directly in QuickBooks are missed.
Detects
AAC-D05Statement control figures
Live
Risk covered: A served statement total does not tie to the accounting system's report.
Detects
AAC-D06Continuous tie-out to accounting reports
Live
Risk covered: A number shown to a customer drifts from the accounting system.
Detects
AAC-D07Withheld figures instead of guesses
Live
Risk covered: A figure that cannot be supported is shown anyway.
Prevents
AAC-D08Drill-down ties to the total
Live
Risk covered: The detail behind a figure does not add up to the figure.
Detects
AAC-D09Weekly completeness check
Live
Risk covered: A week of activity is missing from the synced data.
Detects

Documents and bills coming in (12)

Three-way matching and purchase approval chains are turned on for companies in the early-access pilot.

AAC-I01Upload screening
Live
Risk covered: A harmful or mislabelled file is stored or read.
Prevents
AAC-I02Reading confidence review
Live
Risk covered: A misread amount, date or vendor is used without a person checking it.
Detects
AAC-I03Receipt matching to QuickBooks
Live
Risk covered: A receipt is attached to the wrong transaction.
Detects
AAC-I04Bill duplicate detection
Live
Risk covered: A vendor bill is paid twice.
Detects
AAC-I05Bill anomaly detection
Live
Risk covered: Unusual bills (split thresholds, round numbers, price drift, off-hours) go unnoticed.
Detects
AAC-I06Vendor bank detail change
Live
Risk covered: Payment is redirected to a fraudster's bank account.
Detects
AAC-I07Quarantine gates
Live
Risk covered: A flagged bill is released without the required checks.
Prevents
AAC-I08GL mapping variance check
Live
Risk covered: A transaction is coded to an account that does not fit its history.
Detects
AAC-I09Uncategorized suggestions
Live
Risk covered: Uncategorized items stay parked or are coded without support.
Detects
AAC-I10Auto-fix eligibility with approved rules
Live
Risk covered: An approved rule changes a transaction it should not touch.
Prevents
AAC-I11Three-way match of bills to purchase orders and receipts
Early access
Risk covered: A bill is paid for more than was ordered, for goods not received, or against a closed purchase order.
Detects
AAC-I12Requisition approval chain and budget check
Early access
Risk covered: A purchase is approved by someone who is not the assigned approver, out of order, or over the account's budget.
Prevents

Books health (8)

AAC-H01Suspense and uncategorized balances
Live
Risk covered: Amounts sit in holding accounts at close.
Detects
AAC-H02Bank and card accounts reconciled
Live
Risk covered: Bank or card accounts are not reconciled through period end.
Detects
AAC-H03Undeposited funds aging
Live
Risk covered: Customer payments are never deposited or matched.
Detects
AAC-H04Balance sheet equation and bank-to-GL
Live
Risk covered: The balance sheet does not balance, or cash in the books does not match the bank.
Detects
AAC-H05Flux (period-over-period change)
Live
Risk covered: A large unexplained change between periods goes unreviewed.
Detects
AAC-H06Accounting rule engine
Live
Risk covered: Known accounting errors for the company's industry are missed.
Detects
AAC-H07Payroll checks: changes explained, missed accrual, misposted payroll
Live
Risk covered: Payroll cost changes go unexplained, a payroll accrual is missed at month end, or payroll is posted to the wrong account.
Detects
AAC-H08Revenue and period cut-off findings
Live
Risk covered: Revenue or bills land in the wrong period: service dates across period end, credit memos reversing last-days invoices, next-period bills that name the period month.
Detects

Reconciliation and close (7)

AAC-R01Reconciliation model (identified items, unexplained remainder)
Live
Risk covered: A reconciliation is marked done with an unexplained difference.
Detects
AAC-R02Balance sheet tie-outs
Live
Risk covered: Balance sheet accounts do not tie to the trial balance.
Detects
AAC-R03Continuous close readiness
Live
Risk covered: The period is closed while items are still open.
Detects
AAC-R04Close checklist verifiers
Live
Risk covered: A close checklist item is ticked without the work being done.
Detects
AAC-R05Close calendar
Live
Risk covered: Close deadlines are missed.
Detects
AAC-R06Accrual proposals
Live
Risk covered: Expenses received but not billed are left out of the period.
Detects
AAC-R07AR and AP aging tie-outs
Live
Risk covered: The aging reports do not tie to the receivable and payable balances.
Detects

What you can see

Every check leaves a record: the approval, who gave it and when, the supporting documents, and what QuickBooks recorded. These records are kept with each entry.

Evidence and approvals: what a reviewer sees

Each check leaves a record with the entry. A reviewer, whether that is your controller, your owner or your outside accountant, can see:

Who prepared it and who approved it
The approval, the person who gave it and when. The preparer can't approve their own entry; on a small team that allows it, a self-approval is labelled.
AAC-A03 · AAC-A06
Two-factor and second approvals
When an amount needs a two-factor confirmation, when it was confirmed and how. When your company has set a second-approver amount, both approvals.
AAC-A04 · AAC-A07
That the posted entry is the approved entry
A fingerprint is taken of the entry a person reviewed. If the entry changes after review, it is refused.
AAC-P02 · AAC-C04
The supporting documents
The support package is saved with the entry and completed from what QuickBooks recorded.
AAC-C02 · AAC-V05
What QuickBooks recorded
After posting, we read the entry back from QuickBooks and compare it with what was approved.
AAC-V01
The full history
Each posted, refused or failed attempt, with who and when. Failures are recorded so they can be followed up, and corrections go through a new approved entry.
AAC-V02 · AAC-V04 · AAC-V07

Illustration

Entry: Vendor bill, sample office supplier
Amount: $1,240.00
Prepared by: Bookkeeper
Approved by: Controller (a different person)
Debits equal credits: Passed
Supporting documents: Bill and approval saved
Final posting check: Passed, authorization recorded
Read back from QuickBooks: Matches the approved entry

Illustration: A sample record to show the layout. Not real data.

Control packs

Controls grouped by accounting process. Each pack shows what Advisacor checks, what your team does, and the records kept.

Cash application
Customer payments are deposited, applied and tied back to the bank and your receivables.
What Advisacor checks
- We flag customer payments left in undeposited funds.
- We check that cash in the books agrees to the bank and that bank accounts are reconciled.
- We tie your receivables aging to the ledger.
What your team does
- Apply each customer payment to the right invoice.
- Follow up short payments and payments you can't identify.
- Review the bank reconciliation each month.
Records kept
Undeposited funds and reconciliation findings, and the receivables tie-out.
Owner
Bookkeeper
Reviewer
Controller
Procure to pay
Bills are checked from purchase to payment.
What Advisacor checks
- We check for the same bill or receipt entered twice.
- Where three-way matching is turned on, we compare each bill with its purchase order and what was received.
- Where approval chains are turned on, each purchase is approved by its assigned approver, in order and within budget.
- The person who prepared an entry can't approve it. Larger amounts need a two-factor confirmation, and if your company has set a second-approver amount, a second person approves too.
- We flag changed vendor bank details, and flagged bills are held until the required checks are done.
- We flag unusual bills and coding that doesn't fit the vendor's history.
- We tie your payables aging to the ledger.
What your team does
- Approve purchases and bills before they are paid.
- Release vendor payments in your bank or bill-pay system.
- Confirm new vendor bank details by calling the vendor on a number you already have.
- Make vendor and bill changes through Advisacor. Changes made directly in your accounting system don't pass these checks.
Records kept
Duplicate, match, anomaly and bank change findings, each approval with who gave it and when, and the payables tie-out.
Owner
Accounts payable
Reviewer
Controller
Order to cash
Revenue lands in the right period and receivables tie to your books.
What Advisacor checks
- We look for revenue recorded in the wrong period, such as service dates across month end and credit memos that reverse last-days invoices.
- We tie your receivables aging to the ledger.
- We flag customer payments left in undeposited funds.
What your team does
- Invoice customers for all work delivered.
- Approve credit memos before they are issued.
- Follow up overdue accounts.
Records kept
Cut-off findings and the receivables tie-out.
Owner
Bookkeeper
Reviewer
Controller
Expenses and company cards
Receipts and card spending are checked before they reach your books.
What Advisacor checks
- Receipts are screened, unclear readings are flagged for a person, and each receipt is matched to the right transaction.
- The person who prepared an expense can't approve it, larger amounts need a two-factor confirmation, and expenses dated in a locked or closed period are refused.
- We check that card accounts are reconciled.
- We flag amounts left uncategorized and suggest accounts for a person to approve.
What your team does
- Send a receipt for each card purchase.
- Review each card statement monthly.
Records kept
The receipt with each expense, the approval with who gave it and when, and reconciliation findings.
Owner
Bookkeeper
Reviewer
Controller
Payroll to ledger
Payroll in your books is explained and checked each month.
What Advisacor checks
- We explain changes in payroll cost and look for missed payroll accruals and payroll posted to the wrong account.
- A payroll accrual reaches your books only after a person with approval rights approves it and it passes the final check.
What your team does
- Run payroll and approve the payroll register with your payroll provider.
- Review payroll liabilities paid each period.
Records kept
The monthly payroll explanation, findings, and the approval of each accrual.
Owner
Bookkeeper
Reviewer
Controller
Completeness
Nothing is left out of the period.
What Advisacor checks
- We look for revenue and bills recorded in the wrong period.
- We propose accruals for expenses received but not yet billed, for a person to approve.
- We run accounting rules that find known errors, such as accruals that never reverse.
- We rate each period's readiness to close and verify the close checklist against the books.
What your team does
- Tell us about goods or services received but not yet billed.
- Sign off the month-end close.
Records kept
Cut-off and rule findings, proposed accruals, and the close readiness rating.
Owner
Controller
Reviewer
Business owner
Data drift
Your data in Advisacor stays tied to your accounting system.
What Advisacor checks
- We confirm we're connected to the right company, and that each accounting company is linked only once.
- We watch the connection's health, pick up changes made directly in QuickBooks, and check each week for missing activity.
- We tie figures back to your accounting system's own reports. If a figure can't be supported, we show that it isn't available instead of guessing.
- We flag coding that doesn't fit an account's history and prices that drift from a vendor's usual prices.
What your team does
- Tell us before renaming, merging or deactivating accounts.
- Keep your accounting connection authorized.
Records kept
Connection health, tie-out results and drift findings.
Owner
Controller
Reviewer
Business owner

What's live and what's next

We label each part honestly. Nothing below is shown as live until it is built and running.

Live
Control library and the final posting control
The controls above, from preparing an entry to checking it after it is in QuickBooks.
Live
Control packs
Seven packs, one per accounting process, with what Advisacor checks and what your team does.
Live
Process maps
A standard map for each pack, inside Advisacor on the RA Pro plan, with duties to keep apart and COSO tags.
Planned
Your people and live status on the maps
Put your own people in the lanes and see duty conflicts, live status on each step from your synced data (never shown as passing without a run for the period), preparer and reviewer sign-off on reconciliation and close tasks, printable charts and a controls list, and Pulse answering questions about a step.
Early access · coming soon
Your own controls
Add your own checks to any step of a map. Each says what is done, whether it holds the item or only reminds, who does it and what proof is needed. A change needs a second person's approval, every version is kept, and a new version applies to new items only. Being built now; not available yet.
A check inside Advisacor can't stop someone acting directly in QuickBooks. Where QuickBooks' own audit log is available, we plan to flag those actions as exceptions on the map; we won't describe them as prevented.
Planned
Bring in your own flowcharts
Import flowcharts you already have (Visio, draw.io and BPMN files, or PDFs, documents and photos read with AI). A person confirms every step and arrow before anything is saved, and the map then shows where Advisacor keeps, adds to or fills a gap in your controls.
Planned
Firm view
For accounting firms: firm lanes on the maps, a view across the client companies you serve, and optional notifications when work is handed off between your team and the firm.

Questions

Is this SOX compliance or an audit opinion?

No. Audit Aware Controls shows the controls Advisacor runs and the records they leave. It doesn't certify compliance with any law or standard, and it isn't an opinion on whether your controls work. That judgment belongs to your auditor, who can use the records.

Where does the COSO mapping come from?

COSO publishes the five components and seventeen principles but no mapping of any product to them. The tags are Advisacor's own, reviewed against each control's risk and the code that enforces it.

What about changes made directly in QuickBooks?

Changes made directly in your accounting system don't pass Advisacor's checks. We pick up those changes when we sync, tie figures back to your accounting system's own reports, and flag what doesn't fit.

We're a small team and one person does several steps. What then?

Each process map names the pairs of duties to keep apart and gives a compensating control for when one person does both, usually a monthly review by the business owner, with a signed and dated record to keep.

What does "Early access" mean on a control?

The control is built and runs for companies in an early-access pilot, such as three-way matching of bills to purchase orders. It isn't turned on for every company yet.

Do the maps show whether my controls are working?

Not yet. Today's maps are standard templates with no status. Live status from your synced data is planned, and a step will never be shown as passing without a run for the period.

Where do I see the maps and packs?

Control packs are on this page and inside Advisacor. Process maps are inside Advisacor on the RA Pro plan.

Put these checks around your books

Advisacor is preparing for launch on QuickBooks Online. Join the early access list and we'll be in touch when access is available.

Request early access

Audit Aware Controls

The checks that protect your books

How it fits together

The control library

Control packs

Process maps

COSO 2013 tags

How an entry gets to your books

Prepared.

Approved by a person.

Checked before posting.

The final check.

Checked after posting.

Checks around your books

Your accounting data:

Documents and bills coming in:

Books health:

Reconciliation and close:

Process maps: see where each check sits

Procure to pay

Step by step

Purchase needed

Request the purchase

Approve the purchase

Receive the goods or services

Enter the vendor bill

Match the bill to the order and receipt

Check vendor bank details

Approve the bill

Release the vendor payment

Tie payables to the ledger

Bill paid and recorded

Duties to keep apart

The other six maps

Mapped to the COSO 2013 framework

1Control environment

2Risk assessment

3Control activities

4Information and communication

5Monitoring activities

The control library

Prepare (5)

Approve (13)

Before posting (6)

Final posting control (6)

After posting (8)

Data from your accounting system (9)

Documents and bills coming in (12)

Books health (8)

Reconciliation and close (7)

What you can see

Evidence and approvals: what a reviewer sees

Who prepared it and who approved it

Two-factor and second approvals

That the posted entry is the approved entry

The supporting documents

What QuickBooks recorded

The full history

Control packs

Cash application

What Advisacor checks

What your team does

Records kept

Procure to pay

What Advisacor checks

What your team does

Records kept

Order to cash

What Advisacor checks

What your team does

Records kept

Expenses and company cards

What Advisacor checks

What your team does

Records kept

Payroll to ledger

What Advisacor checks

What your team does

Records kept

Completeness