Skip to content
TrustMosaic

GRC core

MeshControl

Risk and control matrix, owner self-assessment and design and effectiveness testing, with the evidence in one place.

If your controls still work like this

  • A control matrix in a spreadsheet no one updates?Processes change, controls change, and the matrix still describes how things were two years ago.
  • Tests redone from scratch every year?Sample, test script and conclusion sit in loose files, and the next cycle starts with no history.
  • Control owner evidence arriving by email?No one knows whether the file is from the right period or who approved it.
  • Deficiencies with no rating and no plan?The failure shows up in the report, but has no owner, deadline or link to the risk it left uncovered.

What MeshControl does

  • Risk and control matrix

    Controls linked to the processes and risks they mitigate, with type, frequency, owner and expected evidence.

  • Owner self-assessment

    Periodic campaigns in which each owner states whether the control operated and attaches the evidence.

  • Design and effectiveness testing

    Test script, sample, exceptions and conclusion recorded on the control itself.

  • Deficiency rating

    Deficiency, significant deficiency or material weakness, with an action plan and a link to the risk.

  • IT controls

    IT general controls and automated controls tested together with MeshTechAudit.

  • Reuse by internal audit

    Second-line testing is available to internal audit, with the same evidence.

Effectiveness test

The test lives on the control, with sample and conclusion.

The tester records the script, the sample and every exception. The conclusion updates the control and the linked risk, and the next cycle starts from the last test.

Self-assessment

Whoever runs the control answers for it.

Each owner receives only their controls, states whether they operated in the period and attaches the evidence. What hasn't been answered shows up before the deadline.

Illustrative screens with fictitious data.

A structure auditors recognize

Matrix and deficiency rating aligned with COSO 2013 and SOX 404 practices, with IT controls following COBIT.

The AI suggests, the tester decides

Mesh Intelligence suggests controls for uncovered risks and drafts the test script from previous tests. Nothing changes in the matrix without approval.

Fits with

  • MeshRiskA living risk matrix, linked to the controls that mitigate each risk and the findings that challenge it.
  • MeshTechAuditIT audit and ITGC: access, change, operations and system continuity.
  • MeshComplyEach regulator's obligations mapped and combined. Where two rules overlap, the sum of their requirements applies.
  • MeshPulseContinuous auditing and monitoring: rules over the full population of transactions, with exceptions becoming findings.
  • MeshInterviewInterviews and walkthroughs transcribed and organized. From them, Mesh Intelligence proposes controls, risks, flows and findings to the other modules, and the auditor decides what goes in. Forensic interviews are isolated from the start.

Questions from control owners

Can I import the matrix I already have?

Yes. Your current matrix comes in via spreadsheet using a template provided at onboarding, and links to risks and processes are checked before they take effect.

Do control owners need a license?

No. Anyone who only answers self-assessments and sends evidence joins as a respondent, at no user cost.

Does it work for SOX?

Yes. Deficiency rating and design and effectiveness testing follow the structure used in SOX 404.

See MeshControl with a case from your industry

The demo is led by the founder, who has seven years of internal and external audit experience.

Modules are licensed separately. The platform comes with all of them.