Use case
Internal Controls Testing
Who runs it
Who this review is for
Internal audit, compliance and finance teams gathering evidence that controls operated as designed, for an audit file or a regulator.
Requirements
Requirements you can run
You write each requirement in your own words. These are examples of the kind a reviewer runs.
- “Show evidence that the quarterly user access review was completed for Q3.”
- “Show approval by two signatories for payments over £10,000 in September.”
- “Show the September bank reconciliation, signed off by the reviewer.”
- “Show that leavers’ system access was removed within five working days.”
Documents it typically reads
- Access review records
- Approval logs and exports (CSV, XLSX)
- Reconciliations
- Meeting minutes
- Policies and procedures
- Ticket and change exports
How it runs
From upload to decision
Step 1
Upload the evidence for the period
Exports, logs, signed reconciliations and minutes for the controls under test.
Step 2
Write each control test as a requirement
One requirement per control and period, in the words of your test.
Step 3
Run it
Each test gets the passage or rows that evidence it, with the file cited, or a plain statement that no evidence was located.
Step 4
A named reviewer decides
Each finding is confirmed, rejected or marked for follow-up by a person. The decision is attributed and logged, and the run exports as DOCX, XLSX, CSV or JSON with every finding, its sources and the decision.
Key to findings
- …certificate valid until 2 March 2028…
- Evidence located
- A passage DataStruct could support against the requirement, shown with its file, page and section, or its sheet and rows.
- …annual review completed…
- Cited, not confirmed
- A source the answer relied on that DataStruct could not confirm as support. Listed first, so the reviewer opens it first.
- Related material
- Returned by the search and not used as evidence. Kept apart so it never reads as proof.
- [ no supporting passage ]
- No supporting evidence located
- Nothing in the set supports the requirement. The finding says so and names what is missing.
Only a named person can confirm, reject or mark a finding for follow-up. The decision is attributed and logged. Green is theirs alone: no system state is ever shown in green.
The boundary
What it does not do
- It does not test the control or select a sample. It locates documented evidence in what you upload; a person concludes on the control.
- It does not reperform calculations or reconciliations.
- Evidence that was never documented, or not uploaded, cannot be located.
Questions
Common questions
Can it read spreadsheet exports?
Yes. XLSX and CSV files are read sheet by sheet, and findings cite the sheet and row range.
Does it replace audit sampling?
No. Sampling and the conclusion on the control stay with the auditor. DataStruct finds and cites the evidence for the items you test.
Guides
Further reading
- What counts as audit evidence? A practical guide“We do that” is not evidence. What auditors accept, why some evidence carries more weight than other evidence, and how to organise records so that every claim traces back to a document, a page and a date.
- AI for compliance document review: 8 questions to askBefore an AI tool reviews certificates, policies or contracts for compliance, ask how it cites sources, what it does when evidence is missing, who decides, and what happens to your documents. Here are the eight questions, with our own answers.
More use cases
Other reviews teams start with
- Supplier compliance reviewA supplier’s certificates, policies and questionnaires against your requirements.
- Requirement TraceabilityTrace each requirement in a specification, statement of work or contract to the document that addresses it, with the page or row cited, and with the…
- Claim and evidence checksCheck that the statements in a report, disclosure or customer document are backed by your own source documents. Each claim gets the passage that…
- Tender EvaluationCheck every bid against the same published criteria. Each criterion gets the passage in the bid that answers it, cited to its page, so evaluators…
- M&A Due DiligenceReview a data room against your due diligence checklist. Each item gets the passage that answers it, cited to its document and page, or a plain…