Six shields review the finance function item by item: who holds which right, payment fraud, document permissions, access behaviour, ledger resilience and internet exposure. Output: a risk register plus checkbox remediation tasks. Zero agent, cloud only, fully automated. Every remediation action is executed by your own IT - we never touch your finance systems.
Prefer to talk? +86 138 0125 2139 (Mon-Sat 9:00-21:00 UTC+8)
An internal-control review is not an audit. Saying so up front is the only way this product stays honest.
Every finding is tagged with a code (S1-1 to S6-4) that appears identically in the free self-check and in the delivered report. No drift between what you are told for free and what the paid report concludes.
Five-right segregation, shared logins, departed staff, second factor, password strength labels, unusual logins, one person holding several finance accounts.
Bank-detail change verification, impersonated executive or supplier, high-risk attachments, urgency plus bypass wording, payments above threshold without approval.
Core finance files readable by everyone, stored in personal channels, sent outside without masking, write access held by non-finance roles.
Bulk export, out-of-hours access, unusual location, repeated password failures, and whether logs are retained long enough to be useful.
Three copies, offline isolation, encrypted cloud backup, freshness, restore drills, uncontrolled removable media.
Finance or OA panels reachable from the internet without a second factor, high-risk ports, no login rate limit, weak passwords on exposed entries.
A check that only catches bad input is half-tested. The drill suite runs four categories times six rounds, and every category includes a clean-sample round that must produce zero findings.
Currently passing: 24 of 24 rounds, 38 of 38 expected detections, 0 false positives on clean samples. Categories: payment fraud, permission leaks, access anomalies, resilience gaps. A security tool that flags everything is as useless as one that flags nothing, so false positives are scored as failures, not as noise.
Fully automated delivery: no implementation, no human consulting, no one-to-one debugging. That is why the price is where it is.
| Tier | Employees | Monthly (CNY) | Included |
|---|---|---|---|
| F | 1-99 | 199 | All six shields, risk register, remediation tasks, 24-drill report |
| E | 100-499 | 299 | Everything in F plus monthly re-checks |
| D | 500-999 | 399 | Everything in E plus quarterly deep review |
Prices are set and billed in CNY. Payment by WeChat Pay, Alipay, PayPal, or bank wire (USD accepted for international wires). Priced by headcount only, not by number of devices. Healthcare and financial-industry engagements are declined and refunded in full.
No. An audit produces an opinion and requires vouchers, interviews and sampling by a licensed firm. This is an internal-control review: it tells you which control points are missing and what to do, with evidence requirements.
Never. We do not connect to banking systems, do not hold tokens and do not move funds. We review exported lists, configuration screenshots and logs.
Because it is the single largest per-incident loss in the whole checklist, and the money is almost never recovered. It is the one rule we set as non-negotiable: two independent channels, using the number already on file, plus written confirmation from both sides.
Yes. Separate product, separate package, separate price, separate delivery. You can buy either one without the other.
Then true five-way segregation is impossible and we will say so. The minimum we insist on is that payment and booking are not done by the same person, plus written approval above a threshold and a monthly reconciliation by someone outside the payment flow.
This is an internal-control review service. It is not an audit, does not produce an audit opinion and is not legal advice.