Ask what a controller's monthly review actually covers

If an outsourced controller proposal promises monthly review, ask which records are reviewed, what procedures are performed and what evidence you receive. The word review can describe a manager checking selected work or a formal professional engagement with a particular level of assurance. Those meanings should be clear before the company relies on the result.

AICPA & CIMA distinguishes compilations, reviews and audits as different professional services with different assurance. An operational controller's monthly check should not be presented as one of those formal services unless the engagement actually provides it. Ask the provider to identify the nature and limits of the work in writing.

Start with the accounting risks and deadlines that matter to your company. A controller may need to review cash reconciliations in full, inspect selected expense entries and examine unusual contracts separately. The scope can vary, but the company should understand the coverage it is purchasing.

A reconciliation explains a balance by connecting the ledger to supporting records and identifying differences. Reviewing selected transactions answers a narrower question about those records. Ask whether the provider prepares or reviews the full reconciliation, or merely inspects a few entries from the account.

For example, checking five bank transactions does not by itself explain the bank account's closing balance. A complete bank reconciliation also needs the statement balance, ledger balance and identified reconciling items. The controller's review should describe which of those elements it examines and what happens to unresolved differences.

The IRS identifies supporting documents as evidence behind business records. In a controller engagement, ask how the reviewer reaches that evidence. A checkmark beside an account is difficult to evaluate if the company cannot tell which schedule, statement or document the reviewer considered.

When a provider uses selected checks, ask what drives the selection. It might focus on large amounts, unusual accounts, new suppliers or changes from prior periods. Each approach addresses different risks. A fixed number of randomly chosen items should not be assumed to provide the same coverage as a targeted review.

Do not prescribe a statistical method unless the engagement calls for one and the professional agrees it is appropriate. The buyer's practical question is what conclusion the provider can support from the work performed. Ask it to explain the limitation without turning an operational check into an implied audit opinion.

Request an example of how an exception changes the work. If one selected transaction has missing support, does the reviewer investigate related items, ask the preparer to correct the population or record the matter for management? A scope that never responds to findings can miss the reason for reviewing in the first place.

Ask how the provider confirms that the population supplied for review is complete. Selecting entries from a report that omits a bank account leaves that account outside the check regardless of how carefully the selected entries are examined. The coverage record should identify the source population and any known exclusions.

List the material account groups and recurring schedules, then describe the preparation and review procedure for each. Include the person responsible and the expected evidence. This map can reveal an account that everyone assumed another team was reviewing.

In an illustrative month, the provider reviews every bank reconciliation, checks all new debt entries against agreements and selects expense items above an agreed threshold. Write those procedures separately. The company can then see that complete bank coverage does not imply complete inspection of every expense transaction.

Add event-driven work, such as a new lease or an unusual customer agreement. Those events may require a separate technical review outside the recurring close. Decide how they are identified and priced so a monthly fee does not conceal an unassigned policy question.

Ask the controller to record the issue, affected amount or population, required action and owner. Distinguish a proposed correction from an approved entry and a resolved item from one carried forward. The record should show what management is being asked to decide.

For a hypothetical $2,700 unexplained difference, the reviewer might identify $2,200 as a documented timing item and leave $500 for investigation. The schedule should preserve both parts. Marking the account reviewed should not erase the remaining $500 or imply the entire difference has been explained.

Agree how overdue exceptions affect report delivery. Some may permit a clearly described preliminary report; others may prevent a reliable conclusion. The responsible professional should explain the significance and the company should retain the decision about how the report will be used.

Request a completed example with confidential information removed. Look for the schedule version, reviewer, date, findings and resolution. A signature alone may show that someone performed a step without explaining what they examined or concluded.

Ask how the reviewer challenges the preparer's work and whether the same person can prepare and approve the same item. A small team may use a practical alternative review arrangement, but the limitation should be visible. The appropriate structure depends on the engagement and the company's needs.

Also check the timing. A review performed weeks after management used the report provides different protection from one completed before issuance. Compare the actual delivery sequence with the deadline in the proposal and identify any period when the company is using unreviewed information.

A scope designed for one entity with routine expenses may need revision after inventory, financing or another sales channel is added. Ask the controller to identify the events that require a coverage review. The company should notify the provider when those events occur.

Keep the coverage map with the engagement and use it in periodic service discussions. Compare the agreed procedures with completed evidence and recurring exceptions. If the same issue returns every month, investigate the source process rather than merely adding another review note.

When a lender or investor requests a formal report, show the actual controller engagement to the appropriate professional. Do not relabel the monthly review packet to satisfy the request. Confirm the required service and arrange it under a scope that supports the intended use.