AR / cash application · Order-to-Cash
Controls
SOX 404 · ICFR · COSO 2013 control framework overlay
Framework Coverage
COSO 2013AI Ready
100%
0 covered1 partial0 gap
ICFRAI Ready
100%
0 covered3 partial0 gap
SOX 404AI Ready
100%
0 covered1 partial0 gap
Control Mappings
Partial5 controls
SOX-O2C-002SOX 404
Cash application audit trail
audit_trail
Audit trail exists at transaction level but not at decision level — cannot reconstruct why a manual match was made.
ICFR-X-002ICFR
Exception escalation governance
exception_governance
Escalation relies on collector judgement; no defined threshold triggers a formal review.
ICFR-X-003ICFR
Control owners are assigned and accountable
ownership_accountability
Key-person dependency risk — process knowledge is not distributed or documented.
COSO-CA-002COSO 2013
Evidence that controls were executed
evidence_retention
Evidence is incomplete for decisions made outside the standard matching rules.
ICFR-X-001ICFR
Controls are documented and operating
monitoring
Control documentation is informal; no periodic review of whether controls are operating as designed.
SOX 404
Cash application decision rationale not retainedhighaudit_trail
Manual cash matches are made by collectors but decision rationale is not recorded. The audit trail exists at transaction level but not at decision level.
ACTIONRequire collectors to record match rationale in the system at the point of manual application.
ICFR
Key-person dependency in cash applicationmediumownership_accountability
Cash application knowledge is concentrated in individual collectors. No deputy coverage or process documentation exists to support continuity.
ACTIONDocument the cash application process and designate trained deputies for all critical application decisions.
COSO 2013
Partial evidence for exception matching decisionsmediumevidence_retention
System logs exist but rationale for decisions made outside standard matching rules is undocumented, limiting audit testability.
ACTIONExtend evidence capture to include rationale for all manual matches and exception decisions.