Finance procedures that people follow, with controls the auditor can test.

The procedures manual governs the processes and controls that produce the numbers; the accounting policy manual governs how the numbers are recognised, measured and presented under IFRS. Each procedure references the relevant accounting policy where a judgement arises, for example the fixed asset procedure references the capitalisation and useful-life policy, and the revenue procedure references the IFRS 15 policy. Keeping them separate lets each document be owned and updated on its own cycle, procedures by the finance operations lead and policies by the financial reporting lead, while the cross-references keep them consistent.

Not fully, and the manual should not pretend otherwise. Where one person necessarily performs incompatible tasks, such as raising and approving payments in a five-person team, the manual identifies the conflict and puts a compensating control in place: an independent review of the payment run by a manager or board member, bank mandates requiring dual authorisation, monthly review of vendor master changes, and system logs reviewed by someone outside the process. The risk and control matrix records each conflict and its compensating control, which is exactly what an internal auditor or a bank's due diligence will ask to see.

A procedure that the system does not enforce will be bypassed under pressure, so we design the procedures and the ERP configuration together. The delegation of authority matrix is translated into workflow approval rules, the segregation-of-duties design into user roles and permissions, and the procedures into the sequence of transactions the system supports. Where the ERP cannot enforce a control, the manual specifies the manual control and its evidence. For clients implementing a new ERP, the manual is written during the design phase so that the configuration follows it rather than the other way round.

For Saudi listed companies, the Capital Market Authority's corporate governance regulations require the board to approve internal control policies and to review the effectiveness of the internal control system, which presupposes documented policies and procedures with clear authorities. Bahrain's corporate governance code and the requirements of the Central Bank of Bahrain for licensed entities impose comparable obligations. Government entities are subject to the requirements of their audit bureaus and financial regulations. The manual is built to satisfy the requirement that applies, and it gives internal audit and the audit committee the documented basis for their annual assessment of controls.

The scope depends on the number of cycles, entities and systems and on the state of the existing documentation, so the timeline is agreed after the diagnostic rather than in advance. A full manual for a mid-sized group typically covers eight to ten cycles, forty to eighty procedures and a delegation of authority matrix of a few hundred lines. The level of detail is set so that a new employee in the role can perform the procedure from the manual with normal supervision. More detail than that is not read, and less does not control anything.

Each procedure has a named owner, usually the head of the relevant function, and the manual as a whole is owned by the chief financial officer with an annual review approved by the audit committee or the board. Changes during the year, such as a new approval limit or a system upgrade, follow a change procedure included in the manual, and the version history is retained. We provide the templates and the review checklist, and we can perform the annual review, which is often combined with the accounting policy manual update.