CO-SOURCED CONTROL TESTING
Find insights that weren't in your sample.
Sample sizes were always a budget constraint, not a methodology. Where the evidence is system-extractable, we test the full population — every item, not twenty-five of four thousand — and a qualified auditor signs every conclusion. You get the exceptions a sample would have missed, and the patterns it could never show.
WHAT WE TEST
IT general controls, end to end.
Access management
Provisioning, de-provisioning, periodic access reviews, privileged access. Population completeness documented, sampling methodology stated.
Change management
Change authorization, testing evidence, segregation of duties between development and production, emergency change handling.
SDLC
Development standards, approval gates, and the evidence trail from requirement to release.
Backup, recovery and job scheduling
Backup execution and restoration testing, batch job monitoring, failure handling and escalation.
HOW IT WORKS
Detect. Decide. Document.
01
Detect
The model ingests the control population, evidence, and system output — and flags exceptions, gaps, and population completeness issues at full-population scale rather than sample scale.
02
Decide
A qualified auditor reviews every flagged item and every conclusion. The judgment call is human, always, and the workpaper records who made it and why.
03
Document
Each test produces a complete trail: inputs, model version and configuration, outputs, reviewer identity, and rationale. Reproducible, and built to be handed to your external auditor.
BUILT FOR RELIANCE
Designed for the AS 2605 conversation.
Before an external auditor relies on internal audit's work, they assess competence and objectivity — and when AI is in the testing process, they assess that too. Most AI-assisted testing fails this conversation because nobody documented it for the conversation.
Every engagement produces, as standard: prompts and inputs captured per test, model and configuration versions recorded, documented evidence of human review, stated sampling methodology and population completeness, and an explicit line between what was AI-assisted and what was human-determined.
The PCAOB has not yet issued an AI-specific auditing standard. Until it does, the defensible position is documentation your auditor can follow without taking anything on faith.
HOW WE PRICE
Scoped first. Then fixed.
Control testing is scoped by a design assessment, then priced per engagement and agreed before we start. Controls aren't comparable units — one is a single straightforward check, another spans thousands of assets — so a per-control rate would either underprice the heavy ones or price us out of the light ones. You get budget certainty; we get the upside of doing it efficiently. Hourly billing would charge you for our learning curve and penalize us for our tooling — so we don't use it.
Annual co-source retainers are available with a committed scope and priority scheduling through peak season.
INDEPENDENCE
We don't audit our own work.
Banneker also builds automations. Where we have built a process for a client, we do not test the controls over that process — the independence requirement in the Global Internal Audit Standards is not a formality, and we scope around it in writing before an engagement begins.
If you want both, we will tell you which domains we can test and which we can't.
WHO IT'S FOR
Internal audit functions carrying a SOX or FDICIA obligation with more risk coverage than headcount — mid-size banks and credit unions, broker-dealers, and fintechs approaching first-year SOX readiness. Led by an auditor with over a decade in internal audit and security governance (CISA · CISM · CISSP · PMP).