NI 52-109 · SOX 404 · COSO 2013
OSA — short for One Stop Accountability — is a single system of record for your entire internal controls program. It automates the identification, mitigation, and evaluation of financial reporting risks — risk assessment, control testing, gap remediation, management reporting, and process owner certifications — mapped directly to your financial statements and built on the COSO 2013 risk management framework, so organizations can optimize the efficiency of their financial reporting processes and meet NI 52-109 (Canada) and SOX 404 (U.S.) requirements without the manual, spreadsheet-driven labor most teams rely on today.
Why OSA
Within the competitive landscape of compliance software, OSA aims to deliver the highest quality service at the lowest price. High quality — built on significant experience and a historically consistent record of positive outcomes for clients' internal controls systems. Low cost — competitively priced subscription fees, made possible by the deliberately small size of the OSA service organization. Built for growing and newly public issuers who don't need (or want to pay for) Fortune-500-scale GRC software.
Product Overview
Executives certify with comfort that the evaluation is designed to comply with the five components and 17 principles of the COSO 2013 Framework.
Risk assessments, controls, test evidence, and remediation are collected in a single system — not scattered on the network, across spreadsheets and inboxes.
Process owners certify on the effectiveness of controls and remediation efforts to close gaps. Certification review comments and change indicators are captured in workflows to ensure documentation is up to date and relevant.
Automation replaces manual coordination and communication across process owners, testers, and reviewers. Automated dashboard reporting provides real-time evaluation status visibility to management and stakeholders.
Versioning provides an evidence trail of all changes; sign-offs are timestamped and traceable for internal and external audit. Attach policies and test sheets for complete analysis.
The certification process highlights the cause-and-effect relationship between risk and controls, presented in basic terms to process and control owners to ensure internal control accountabilities are understood and stewarded effectively.
Cloud SaaS on the AWS platform with no integrations to your existing systems. AWS data is encrypted, and processes are compliant with SOC 1/2/3 and ISO 27001 certified infrastructure requirements.
Clients can choose to have the evaluation performed by OSA's experienced external consultants, or we can train your internal resources to perform the evaluation in-house.
An AI Agent is being developed for the next version of the OSA application, with caution in mind to ensure sufficient human judgement is involved in reaching appropriate conclusions about the effectiveness of internal controls. The current pace of AI agent introduction can seem overwhelming, so OSA's development is careful to ensure utility and benefit is derived rationally, rather than overwhelming the user with misaligned AI capabilities. OSA is built and maintained by a licensed CPA with two decades of practical experience — not just an algorithm.
Key Features & Benefits
Each system capability is strategically designed so the evaluation delivers a user-friendly experience while ensuring the application content is relevant to optimizing organizational processes and meeting regulatory compliance requirements.
Use the arrows or the numbers below to browse
Every process and control activity is fully referenced to the financial statement line item it supports.
BenefitEnsure the evaluation completely addresses all material financial statement line items and nothing is omitted. Reduce compliance costs by focusing audit scope on only relevant processes that pose a calculated risk of financial misstatement.
The defining feature of OSA is a comprehensive risk assessment process to ensure the evaluation is aligned with process owners' responsibilities and priorities. Every control is documented based on a specified objective, as required by COSO. Process and control multi-level risk rankings are calculated based on measured impact and likelihood. A detailed, specific fraud risk assessment ensures adequate controls exist to mitigate loss and financial misstatement.
BenefitEvaluation is performed with clear focus and resource attention to high-risk areas with impactful results toward optimizing business processes and mitigating preventable risks. Every testing action is based on a defined risk assessment.
Testing procedures, milestones, automated updates for percentage of completion based on sample size populations, auditor conclusions, planning timelines & resource allocations available in real-time.
BenefitQuantified, measurable testing, analysis, and results — packaged for management and audit committee reporting that shows direct compliance with COSO risk management requirements.
To ensure full accountability for gap correction — every identified deficiency is logged, assigned, and tracked through remediation with a full workflow history.
BenefitTimely gap remediation and control owner accountability with emphasis on risk mitigation, meeting assigned deadlines and prevention of financial loss and misstatement.
Live dashboards with 22 KPIs across five categories — measuring evaluation status, aggregating testing progress, gaps. Analyze the underlying reporting data by clicking on graph components and transitioning to data details.
BenefitReal-time visibility for the audit committee and management, enabling prompt decision making. No delays or inefficient duplication of meetings for manual project status report compilation.
Process owner certification workflows are designed for ease of use, understanding, and risk mitigation for process owners who are not accountants. Clarity of understanding of risk management helps reduce the risk of financial misstatement by consolidating the foundation of internal controls responsibilities into a user-friendly experience.
BenefitEnhanced accountability of process owner oversight to ensure the operating effectiveness of internal controls. Timely resolution of gaps due to a clear understanding of the negative impact of unmitigated risks.
Automated compilation of changes in process, technology, personnel, policy, etc., to determine high-risk focus areas and an action plan to mitigate new risks.
BenefitIdentified changes are highlighted for re-active plans to implement preventative measures and mitigate potential risk of financial loss and misstatement. Versioning is enforced on all relevant data elements to maintain audit logs of all changes.
Build the annual ICFR testing calendar, assign reviewers, and track milestones against filing deadlines.
BenefitRelevant data for concise decision making to allocate resources to perform the evaluation within timelines required by external auditors, management, and audit committees.
Enforced role-based user access permissions ensure privacy of your entity data. Views and roles for non-accountants are simplified for a productive and transparent user experience.
BenefitDesigned to meet industry cybersecurity risk mitigation requirements to secure your internal controls data and user information and reduce the likelihood of a cybersecurity breach.
Request a Demo
Tell us about your organization and your ICFR requirements — we'll follow up to schedule an introductory meeting to discuss how OSA can optimize your internal controls.
Your email client should now have a pre-filled message with your demo request. Send it over and we'll be in touch to schedule a demo.
Qualifications, Experience & Security
OSA's Founder is a Chartered Professional Accountant (CPA) with 20 years of experience in financial reporting, internal audit, and internal control over financial reporting. Since 2013, they have advised and serviced more than 20 organizations on SOX 404 and NI 52-109 compliance programs — work that directly informed the "one stop" philosophy behind the OSA platform's design.
We value a strong cybersecurity posture, and as a service provider we are working to assure you that OSA's IT governance controls — including user access and change management — are aligned with industry security standards. OSA is currently undergoing a SOC 2 examination to formally validate the platform's controls.
Resources
A starting set of resources — to be expanded with product-specific guides and client case studies over time.
COSO is a joint initiative of five private-sector professional associations, each represented on its board. OSA's control structure is built around the framework these organizations jointly govern.
Source: coso.org/governance
Control Environment
Risk Assessment
Control Activities
Information & Communication
Monitoring Activities
A guided video tour of risk assessment, testing, remediation, and certification inside OSA.
Product brief and an ICFR readiness checklist for teams preparing their first SOX 404 or NI 52-109 cycle.
Placeholder formats below — to be replaced with named engagements as client consent and the SOC 2 report are finalized.
Before OSA, this client's core evaluation of internal control over financial reporting lived across 150 separate files scattered on the corporate network — 105 process documents (risk assessment, control activities, and a flowchart for each of 35 processes) plus roughly 45 administrative documents for reporting calculations, certifications, policies, and gap remediations, all under annual management.
After adopting OSA, all of that content is cohesively unified inside one SaaS web application, readily accessible to users and decision makers. The quality of the content is significantly higher because it is inter-relational — rather than scattered across Word, Excel, and PDF documents on the network, each risk, control, and process is directly connected to the others inside a single system.
The direct, COSO-driven benefit of moving from 150 documents to a single application is that process owners can far more clearly see and understand the risk and impact of their work on the control activities that mitigate risk and prevent financial misstatement — resulting in a more purposeful quarterly process owner certification on effectiveness.
Contact
Reach out directly and a member of the team will respond.
Email Us →