opencode-knowledge-work 0.0.0-stage → 0.1.0

package/content/finance/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/content/finance/README.md

@@ -0,0 +1,92 @@
+# Finance & Accounting Plugin
+
+A finance and accounting plugin primarily designed for [Cowork](https://claude.com/product/cowork), Anthropic's agentic desktop application — though it also works in Claude Code. Supports month-end close, journal entry preparation, account reconciliation, financial statement generation, variance analysis, and SOX audit support.
+
+> **Important**: This plugin assists with finance and accounting workflows but does not provide financial, tax, or audit advice. All outputs should be reviewed by qualified financial professionals before use in financial reporting, regulatory filings, or audit documentation.
+
+## Installation
+
+```bash
+claude plugin marketplace add anthropics/knowledge-work-plugins
+claude plugin install finance@knowledge-work-plugins
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `/journal-entry` | Journal entry preparation — generate accruals, fixed asset entries, prepaids, payroll, and revenue entries with proper debits/credits and supporting detail |
+| `/reconciliation` | Account reconciliation — compare GL balances to subledger, bank, or third-party balances and identify reconciling items |
+| `/income-statement` | Income statement generation — produce P&L with period-over-period comparison and variance analysis |
+| `/variance-analysis` | Variance/flux analysis — decompose variances into drivers with narrative explanations and waterfall analysis |
+| `/sox-testing` | SOX compliance testing — generate sample selections, testing workpapers, and control assessments |
+
+## Skills
+
+| Skill | Description |
+|-------|-------------|
+| `journal-entry-prep` | JE preparation best practices, standard accrual types, supporting documentation requirements, and review workflows |
+| `reconciliation` | Reconciliation methodology for GL-to-subledger, bank recs, and intercompany, with reconciling item categorization and aging |
+| `financial-statements` | Income statement, balance sheet, and cash flow statement formats with GAAP presentation and flux analysis methodology |
+| `variance-analysis` | Variance decomposition techniques (price/volume, rate/mix), materiality thresholds, narrative generation, and waterfall charts |
+| `close-management` | Month-end close checklist, task sequencing, dependencies, status tracking, and common close activities by day |
+| `audit-support` | SOX 404 control testing methodology, sample selection, documentation standards, and deficiency classification |
+
+## Example Workflows
+
+### Month-End Close
+
+1. Run `/journal-entry ap-accrual 2024-12` to generate AP accrual entries
+2. Run `/journal-entry prepaid 2024-12` to amortize prepaid expenses
+3. Run `/journal-entry fixed-assets 2024-12` to book depreciation
+4. Run `/reconciliation cash 2024-12` to reconcile bank accounts
+5. Run `/reconciliation accounts-receivable 2024-12` to reconcile AR subledger
+6. Run `/income-statement monthly 2024-12` to generate the P&L with flux analysis
+
+### Variance Analysis
+
+1. Run `/variance-analysis revenue 2024-Q4 vs 2024-Q3` to analyze revenue variances
+2. Run `/variance-analysis opex 2024-12 vs budget` to investigate operating expense variances
+3. Review the waterfall analysis and provide context on unexplained variances
+
+### SOX Testing
+
+1. Run `/sox-testing revenue-recognition 2024-Q4` to generate revenue control testing workpapers
+2. Run `/sox-testing procure-to-pay 2024-Q4` to test procurement controls
+3. Review sample selections and document test results
+
+## MCP Integration
+
+> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](CONNECTORS.md).
+
+This plugin works best when connected to your financial data sources via MCP servers. Add the relevant servers to your `.mcp.json`:
+
+### ERP / Accounting System
+
+Connect your ERP (e.g., NetSuite, SAP) MCP server to pull trial balances, subledger data, and journal entries automatically.
+
+### Data Warehouse
+
+Connect your data warehouse (e.g., Snowflake, BigQuery) MCP server to query financial data, run variance analysis, and pull historical comparisons.
+
+### Spreadsheets
+
+Connect spreadsheet tools (e.g., Google Sheets, Excel) for workpaper generation, reconciliation templates, and financial model updates.
+
+### Analytics / BI
+
+Connect your BI platform (e.g., Tableau, Looker) to pull dashboards, KPIs, and trend data for variance explanations.
+
+> **Note:** Connect your ERP and data warehouse MCP servers to pull financial data automatically. Without these, you can paste data or upload files for analysis.
+
+## Configuration
+
+Add your data source MCP servers to the `mcpServers` section of `.mcp.json` in this plugin directory. The `recommendedCategories` field lists the types of integrations that enhance this plugin's capabilities:
+
+- `erp-accounting` — ERP or accounting system for GL, subledger, and JE data
+- `data-warehouse` — Data warehouse for financial queries and historical data
+- `spreadsheets` — Spreadsheet tools for workpaper generation
+- `analytics-bi` — BI tools for dashboards and KPI data
+- `documents` — Document storage for policies, memos, and support
+- `email` — Email for sending reports and requesting approvals
+- `chat` — Team communication for close status updates and questions

package/content/finance/skills/finance-audit-support/SKILL.md

@@ -0,0 +1,374 @@
+---
+name: audit-support
+description: Support SOX 404 compliance with control testing methodology, sample selection, and documentation standards. Use when generating testing workpapers, selecting audit samples, classifying control deficiencies, or preparing for internal or external audits.
+user-invocable: false
+---
+
+# Audit Support
+
+**Important**: This skill assists with SOX compliance workflows but does not provide audit or legal advice. All testing workpapers and assessments should be reviewed by qualified financial professionals. While "significance" and "materiality" are context-specific concepts that are ultimately assessed by auditors, this skill is intended to assist professionals in the creation and evaluation of effective internal controls and documentation for audits.
+
+SOX 404 control testing methodology, sample selection approaches, testing documentation standards, control deficiency classification, and common control types.
+
+## SOX 404 Control Testing Methodology
+
+### Overview
+
+SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR). This involves:
+
+1. **Scoping:** Identify significant accounts and relevant assertions
+2. **Risk assessment:** Evaluate the risk of material misstatement for each significant account
+3. **Control identification:** Document the controls that address each risk
+4. **Testing:** Test the design and operating effectiveness of key controls
+5. **Evaluation:** Assess whether any deficiencies exist and their severity
+6. **Reporting:** Document the assessment and any material weaknesses
+
+### Scoping Significant Accounts
+
+An account is significant if there is more than a remote likelihood that it could contain a misstatement that is material (individually or in aggregate).
+
+**Quantitative factors:**
+- Account balance exceeds materiality threshold (typically 3-5% of a key benchmark)
+- Transaction volume is high, increasing the risk of error
+- Account is subject to significant estimates or judgment
+
+**Qualitative factors:**
+- Account involves complex accounting (revenue recognition, derivatives, pensions)
+- Account is susceptible to fraud (cash, revenue, related-party transactions)
+- Account has had prior misstatements or audit adjustments
+- Account involves significant management judgment or estimates
+- New account or significantly changed process
+
+### Relevant Assertions by Account Type
+
+| Account Type | Key Assertions |
+|-------------|---------------|
+| Revenue | Occurrence, Completeness, Accuracy, Cut-off |
+| Accounts Receivable | Existence, Valuation (allowance), Rights |
+| Inventory | Existence, Valuation, Completeness |
+| Fixed Assets | Existence, Valuation, Completeness, Rights |
+| Accounts Payable | Completeness, Accuracy, Existence |
+| Accrued Liabilities | Completeness, Valuation, Accuracy |
+| Equity | Completeness, Accuracy, Presentation |
+| Financial Close/Reporting | Presentation, Accuracy, Completeness |
+
+### Design Effectiveness vs Operating Effectiveness
+
+**Design effectiveness:** Is the control properly designed to prevent or detect a material misstatement in the relevant assertion?
+- Evaluated through walkthroughs (trace a transaction end-to-end through the process)
+- Confirm the control is placed at the right point in the process
+- Confirm the control addresses the identified risk
+- Performed at least annually, or when processes change
+
+**Operating effectiveness:** Did the control actually operate as designed throughout the testing period?
+- Evaluated through testing (inspection, observation, re-performance, inquiry)
+- Requires sufficient sample sizes to support a conclusion
+- Must cover the full period of reliance
+
+## Sample Selection Approaches
+
+### Random Selection
+
+**When to use:** Default method for transaction-level controls with large populations.
+
+**Method:**
+1. Define the population (all transactions subject to the control during the period)
+2. Number each item in the population sequentially
+3. Use a random number generator to select sample items
+4. Ensure no bias in selection (all items have equal probability)
+
+**Advantages:** Statistically valid, defensible, no selection bias
+**Disadvantages:** May miss high-risk items, requires complete population listing
+
+### Targeted (Judgmental) Selection
+
+**When to use:** Supplement to random selection for risk-based testing; primary method when population is small or highly varied.
+
+**Method:**
+1. Identify items with specific risk characteristics:
+   - High dollar amount (above a defined threshold)
+   - Unusual or non-standard transactions
+   - Period-end transactions (cut-off risk)
+   - Related-party transactions
+   - Manual or override transactions
+   - New vendor/customer transactions
+2. Select items matching risk criteria
+3. Document rationale for each targeted selection
+
+**Advantages:** Focuses on highest-risk items, efficient use of testing effort
+**Disadvantages:** Not statistically representative, may over-represent certain risks
+
+### Haphazard Selection
+
+**When to use:** When random selection is impractical (no sequential population listing) and population is relatively homogeneous.
+
+**Method:**
+1. Select items without any specific pattern or bias
+2. Ensure selections are spread across the full population period
+3. Avoid unconscious bias (don't always pick items at the top, round numbers, etc.)
+
+**Advantages:** Simple, no technology required
+**Disadvantages:** Not statistically valid, susceptible to unconscious bias
+
+### Systematic Selection
+
+**When to use:** When population is sequential and you want even coverage across the period.
+
+**Method:**
+1. Calculate the sampling interval: Population size / Sample size
+2. Select a random starting point within the first interval
+3. Select every Nth item from the starting point
+
+**Example:** Population of 1,000, sample of 25 → interval of 40. Random start: item 17. Select items 17, 57, 97, 137, ...
+
+**Advantages:** Even coverage across population, simple to execute
+**Disadvantages:** Periodic patterns in the population could bias results
+
+### Sample Size Guidance
+
+| Control Frequency | Expected Population | Low Risk Sample | Moderate Risk Sample | High Risk Sample |
+|------------------|--------------------|-----------------|--------------------|-----------------|
+| Annual | 1 | 1 | 1 | 1 |
+| Quarterly | 4 | 2 | 2 | 3 |
+| Monthly | 12 | 2 | 3 | 4 |
+| Weekly | 52 | 5 | 8 | 15 |
+| Daily | ~250 | 20 | 30 | 40 |
+| Per-transaction (small pop.) | < 250 | 20 | 30 | 40 |
+| Per-transaction (large pop.) | 250+ | 25 | 40 | 60 |
+
+**Factors increasing sample size:**
+- Higher inherent risk in the account/process
+- Control is the sole control addressing a significant risk (no redundancy)
+- Prior period control deficiency identified
+- New control (not tested in prior periods)
+- External auditor reliance on management testing
+
+## Testing Documentation Standards
+
+### Workpaper Requirements
+
+Every control test should be documented with:
+
+1. **Control identification:**
+   - Control number/ID
+   - Control description (what is done, by whom, how often)
+   - Control type (manual, automated, IT-dependent manual)
+   - Control frequency
+   - Risk and assertion addressed
+
+2. **Test design:**
+   - Test objective (what you are trying to determine)
+   - Test procedures (step-by-step instructions)
+   - Expected evidence (what you expect to see if the control is effective)
+   - Sample selection methodology and rationale
+
+3. **Test execution:**
+   - Population description and size
+   - Sample selection details (method, items selected)
+   - Results for each sample item (pass/fail with specific evidence examined)
+   - Exceptions noted with full description
+
+4. **Conclusion:**
+   - Overall assessment (effective / deficiency / significant deficiency / material weakness)
+   - Basis for conclusion
+   - Impact assessment for any exceptions
+   - Compensating controls considered (if applicable)
+
+5. **Sign-off:**
+   - Tester name and date
+   - Reviewer name and date
+
+### Evidence Standards
+
+**Sufficient evidence includes:**
+- Screenshots showing system-enforced controls
+- Signed/initialed approval documents
+- Email approvals with identifiable approver and date
+- System audit logs showing who performed the action and when
+- Re-performed calculations with matching results
+- Observation notes (with date, location, observer)
+
+**Insufficient evidence:**
+- Verbal confirmations alone (must be corroborated)
+- Undated documents
+- Evidence without identifiable performer/approver
+- Generic system reports without date/time stamps
+- "Per discussion with [name]" without corroborating documentation
+
+### Working Paper Organization
+
+Organize testing files by control area:
+
+```
+SOX Testing/
+├── [Year]/
+│   ├── Scoping and Risk Assessment/
+│   ├── Revenue Cycle/
+│   │   ├── Control Matrix
+│   │   ├── Walkthrough Documentation
+│   │   ├── Test Workpapers (one per control)
+│   │   └── Supporting Evidence
+│   ├── Procure to Pay/
+│   ├── Payroll/
+│   ├── Financial Close/
+│   ├── Treasury/
+│   ├── Fixed Assets/
+│   ├── IT General Controls/
+│   ├── Entity Level Controls/
+│   └── Summary and Conclusions/
+│       ├── Deficiency Evaluation
+│       └── Management Assessment
+```
+
+## Control Deficiency Classification
+
+### Deficiency
+
+A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.
+
+**Evaluation factors:**
+- What is the likelihood that the control failure could result in a misstatement?
+- What is the magnitude of the potential misstatement?
+- Is there a compensating control that mitigates the deficiency?
+
+### Significant Deficiency
+
+A deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by those charged with governance.
+
+**Indicators:**
+- The deficiency could result in a misstatement that is more than inconsequential but less than material
+- There is more than a remote (but less than reasonably possible) likelihood of a material misstatement
+- The control is a key control and the deficiency is not fully mitigated by compensating controls
+- Combination of individually minor deficiencies that together represent a significant concern
+
+### Material Weakness
+
+A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis.
+
+**Indicators:**
+- Identification of fraud by senior management (any magnitude)
+- Restatement of previously issued financial statements to correct a material error
+- Identification by the auditor of a material misstatement that would not have been detected by the company's controls
+- Ineffective oversight of financial reporting by the audit committee
+- Deficiency in a pervasive control (entity-level, IT general control) affecting multiple processes
+
+### Deficiency Aggregation
+
+Individual deficiencies that are not significant individually may be significant in combination:
+
+1. Identify all deficiencies in the same process or affecting the same assertion
+2. Evaluate whether the combined effect could result in a material misstatement
+3. Consider whether deficiencies in compensating controls exacerbate other deficiencies
+4. Document the aggregation analysis and conclusion
+
+### Remediation
+
+For each identified deficiency:
+
+1. **Root cause analysis:** Why did the control fail? (design gap, execution failure, staffing, training, system issue)
+2. **Remediation plan:** Specific actions to fix the control (redesign, additional training, system enhancement, added review)
+3. **Timeline:** Target date for remediation completion
+4. **Owner:** Person responsible for implementing the remediation
+5. **Validation:** How and when the remediated control will be re-tested to confirm effectiveness
+
+## Common Control Types
+
+### IT General Controls (ITGCs)
+
+Controls over the IT environment that support the reliable functioning of application controls and automated processes.
+
+**Access Controls:**
+- User access provisioning (new access requests require approval)
+- User access de-provisioning (terminated users removed timely)
+- Privileged access management (admin/superuser access restricted and monitored)
+- Periodic access reviews (user access recertified on a defined schedule)
+- Password policies (complexity, rotation, lockout)
+- Segregation of duties enforcement (conflicting access prevented)
+
+**Change Management:**
+- Change requests documented and approved before implementation
+- Changes tested in a non-production environment before promotion
+- Separation of development and production environments
+- Emergency change procedures (documented, approved post-implementation)
+- Change review and post-implementation validation
+
+**IT Operations:**
+- Batch job monitoring and exception handling
+- Backup and recovery procedures (regular backups, tested restores)
+- System availability and performance monitoring
+- Incident management and escalation procedures
+- Disaster recovery planning and testing
+
+### Manual Controls
+
+Controls performed by people using judgment, typically involving review and approval.
+
+**Examples:**
+- Management review of financial statements and key metrics
+- Supervisory approval of journal entries above a threshold
+- Three-way match verification (PO, receipt, invoice)
+- Account reconciliation preparation and review
+- Physical inventory observation and count
+- Vendor master data change approval
+- Customer credit approval
+
+**Key attributes to test:**
+- Was the control performed by the right person (proper authority)?
+- Was it performed timely (within the required timeframe)?
+- Is there evidence of the review (signature, initials, email, system log)?
+- Did the reviewer have sufficient information to perform an effective review?
+- Were exceptions identified and appropriately addressed?
+
+### Automated Controls
+
+Controls enforced by IT systems without human intervention.
+
+**Examples:**
+- System-enforced approval workflows (cannot proceed without required approvals)
+- Three-way match automation (system blocks payment if PO/receipt/invoice don't match)
+- Duplicate payment detection (system flags or blocks duplicate invoices)
+- Credit limit enforcement (system prevents orders exceeding credit limit)
+- Automated calculations (depreciation, amortization, interest, tax)
+- System-enforced segregation of duties (conflicting roles prevented)
+- Input validation controls (required fields, format checks, range checks)
+- Automated reconciliation matching
+
+**Testing approach:**
+- Test design: Confirm the system configuration enforces the control as intended
+- Test operating effectiveness: For automated controls, if the system configuration has not changed, one test of the control is typically sufficient for the period (supplemented by ITGC testing of change management)
+- Verify change management ITGCs are effective (if system changed, re-test the control)
+
+### IT-Dependent Manual Controls
+
+Manual controls that rely on the completeness and accuracy of system-generated information.
+
+**Examples:**
+- Management review of a system-generated exception report
+- Supervisor review of a system-generated aging report to assess reserves
+- Reconciliation using system-generated trial balance data
+- Approval of transactions identified by a system-generated workflow
+
+**Testing approach:**
+- Test the manual control (review, approval, follow-up on exceptions)
+- AND test the completeness and accuracy of the underlying report/data (IPE — Information Produced by the Entity)
+- IPE testing confirms the data the reviewer relied on was complete and accurate
+
+### Entity-Level Controls
+
+Broad controls that operate at the organizational level and affect multiple processes.
+
+**Examples:**
+- Tone at the top / code of conduct
+- Risk assessment process
+- Audit committee oversight of financial reporting
+- Internal audit function and activities
+- Fraud risk assessment and anti-fraud programs
+- Whistleblower/ethics hotline
+- Management monitoring of control effectiveness
+- Financial reporting competence (staffing, training, qualifications)
+- Period-end financial reporting process (close procedures, GAAP compliance reviews)
+
+**Significance:**
+- Entity-level controls can mitigate but typically cannot replace process-level controls
+- Ineffective entity-level controls (especially audit committee oversight and tone at the top) are strong indicators of a material weakness
+- Effective entity-level controls may reduce the extent of testing needed for process-level controls