Priority 1
Financial Management & Internal Controls
Current signal: 10/20
Internal controls gaps create the highest downstream risk for questioned costs, findings, and rework.
Risk exposure: Internal controls deficiencies average $22K-$144K+ in questioned costs per finding. Material weaknesses trigger increased monitoring.
Next move: Start with documented control ownership, approvals, and evidence retention for the transactions you process most often.
- Undocumented internal controls are treated the same as no controls by auditors - the evidence of the control is the control.
- 2 CFR 200.303(e) explicitly requires reasonable cybersecurity measures for sensitive information and PII - this is now a tested compliance requirement.
