Skip to Content
  1. Home
  2. Systems
  3. Governance, risk and compliance

Controls that leave evidence in the system

We review risks, controls and permissions, and how your systems can enforce them, before proposing any GRC tool.

Take the assessment (9 min)

34 questions, result at the end, free of charge.

5 dimensionsLevel, gaps and first step when you finish

GRC system: definition and use

GRC stands for governance, risk and compliance. A GRC system documents risks, controls, audits and regulatory obligations, and proves that controls work.

Much of internal control lives in the ERP: permissions, approvals, lock dates and audit trail. A GRC platform organises the rest when volume calls for it.

Signs your internal control needs a review

  • An audit asks for evidence of controls nobody kept
  • Some users have more permissions than they need
  • Accounting records are deleted instead of reversed
  • There is no risk matrix and no owner per risk
  • Segregation of duties is not defined
  • The system audit trail is not switched on

Who it is for and when it does not fit

A good fit for

  • Companies audited every year by an outside firm
  • Regulated sectors: finance, health, mining, energy
  • Boards asking for a risk matrix with owners
  • Companies whose ERP users have more permissions than needed

Not a fit when

  • Processes are not documented yet: work starts with processes and basic internal control
  • The only need is the ERP audit trail: it is switched on without buying another system
  • You seek a full ISO certification: that is for a consultant in that standard

Cost of rebuilding evidence for every audit

Searching emails for approvals and building samples by hand takes weeks at every audit. Work out the cost with your own figures.

Example: an internal auditor and an analyst at S/ 45 an hour. Replace the values with yours.

Hours a month35 h
Cost a monthS/ 1,559
Cost a yearS/ 18,706

The estimate shows what the manual task costs today. It is not a savings promise.

Risks, controls and evidence

A GRC system records each risk with its owner, the controls that mitigate it, the periodic test of each control and the evidence behind it. Regulatory obligations carry a date and an owner.

In the ERP, evidence is produced automatically: Odoo 20 keeps in the Audit Trail who changed each entry, when and the previous value. That trail is one of the GRC sources.

Control cycle

  1. Risk identified
  2. Control assigned
  3. Test with evidence
  4. Finding closed
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit Trail list with date, author, document and old and new value of each change
Odoo 20 Audit TrailReal screenshot of standard Odoo 20, demo instance with test data.
DMG-RT method

The method applied to internal control and risk management

Diego Muñoz leads every assessment: process and data first, then the tool, in short phases you approve.

  1. Risks and critical processes

    With management we identify the risks that matter most and the processes where they occur: purchasing, payments, accounting, access.

  2. Controls and evidence

    We write the control matrix and check which ones the ERP already provides (permissions, approvals, locks) and which are missing.

  3. Sample testing

    We test a sample of controls against real records and note which evidence comes from the system.

  4. Roadmap and tool

    We propose what to adjust in the systems and whether a GRC platform makes sense. If one is chosen, its vendor implements it.

See the full method

Open lever-arch file with documents and dividers

Deliverables

  • Risk and control matrix with owners
  • Segregation-of-duties matrix checked against real permissions
  • Results of testing a sample of controls
  • Roadmap of system adjustments and a decision on a GRC platform

Prerequisites and outputs

Prerequisites

  • Process map with an owner per process
  • List of applicable regulatory obligations
  • Current roles and permissions in each system
  • Findings from previous audits

Outputs: matrices, obligations calendar and evidence

  • Risk and control matrix with owners
  • Segregation-of-duties matrix by role
  • Obligations calendar with owners
  • Evidence of each control test ready for the auditor
Online assessment

Assessment dimensions

This analysis reviews the risk matrix, the control matrix and its evidence, tests and findings, access and segregation of duties, and regulatory and contractual obligations. The questions describe how internal control is documented and tested today, and how much of it the systems enforce.

What you receive

When you finish you receive a level per dimension of your internal control and the gaps ordered by priority. Each gap states whether it is solved with ERP permissions and configuration or with a procedure, and the first verifiable action.

17 scored questions and 12 context questions (type of operation, size, current system). Context questions are not scored: they let us read the result against similar operations.

Take the assessment (9 min)
  1. Risk matrix and ownersIt looks at whether each risk has an owner, inherent and residual assessment with fixed criteria, and whether incidents and third parties feed that assessment.
  2. Control matrix and evidenceIt looks at whether there is a single list of controls with frequency and owner, and whether each control states which system it runs in and where its evidence comes from.
  3. Control testing and findingsIt looks at whether controls are tested against a plan, whether each failure leads to a dated action and whether audit findings are tracked to closure.
  4. Access and segregation of dutiesIt looks at whether permissions are reviewed each period, whether terminations remove access the same day and whether whoever records, approves and pays are different people.
  5. Regulatory and contractual obligationsIt looks at whether obligations to SUNAT, SUNAFIL, regulators and clients are in a single list with owner, advance notice and evidence, and whether staff know the policies.

Market options

We do not implement GRC platforms. We review which controls your ERP can enforce and, if a platform is needed, help you choose it.

ERP coverage

What the ERP covers: role-based permissions, approvals by amount, lock dates and audit trail. In Odoo this is configured without a separate tool.

Odoo 20 technical modules

  • account
  • approvals
  • documents

Other options

GRC and internal audit platforms for risk matrices, control testing, findings and obligations, used mainly by large or regulated companies.

  • ServiceNow GRC
  • Archer (RSA)
  • MetricStream
  • AuditBoard
  • SAP GRC
  • Diligent HighBond

GRC platforms used by internal audit; in no order of preference.

Selection criteria

  • Risk and control matrix the team maintains without a consultant
  • Evidence linked to the ERP record
  • Obligation reminders with owner and date
  • Audit committee report without rebuilding it by hand

Limits of the standard product

  • GRC platform implementation

    How it is handled

    We do not do it: the vendor does, with our prior assessment

  • ERP audit trail not enabled

    How it is handled

    It is enabled in Settings; it records from then on, not backwards

  • Controls in systems with no change log

    How it is handled

    They are documented with dated manual evidence until migration

Peruvian localisation

  • Law 30424 and crime-prevention model
  • Personal data protection law 29733
  • SBS or SMV rules for supervised companies

Assessment, selection and integration

01

Internal control assessment

Risks, control matrix, segregation of duties and sample testing.

02

Controls in the ERP

Role-based permissions, approvals, lock dates and audit trail in the ERP you already use.

03

GRC platform selection

Comparison of options against your controls and volume, if a platform is justified.

04

Vendor coordination

We support the chosen vendor’s implementation with the control matrix in hand.

Diego Muñoz, process and technology consultant
Scope, in Diego’s words

I assess your internal control and how your systems enforce it: permissions, segregation of duties, audit trail and lock dates in the ERP. If you need a GRC platform, I help you choose it and coordinate with the vendor; I do not implement it.

Systems that connect with internal control and risk management

GRC draws evidence from accounting and the books, access data from the user directory and documents from the document manager. The links lead to each system’s assessment.

Governance, risk and compliance

Before you start

Paper spreadsheet with handwritten corrections

Many mid-sized companies do not. A well-built matrix and controls configured in the ERP cover the essentials. The assessment shows when a platform is justified.

We do not issue audit opinions. We review control design and how systems enforce it, so you reach the audit in order.

No. We help you choose it and coordinate with the vendor. What we do configure are the controls inside Odoo.

The online assessment and the 30-minute review are free. Later work is quoted by phase.

Only Diego Muñoz, to prepare the review. They are not shared with third parties.

Start with the online assessment

At the end you see your level and where to start. If you like, we review it in a 30-minute video call with Diego Muñoz.

Take the assessment (9 min)Message on WhatsAppBook 30 minutes

WhatsApp +51 919 488 260 · damunoz@dmunozgroup.com