I drafted a general plan to present to my CFO and other executives.  Can you Polish this for me.  I want to keep the general theme and concepts given the specific environment however this is just not presentation ready.  Form new formal department to curate an environment of framework building, testing, and remediation to provide local assurance and proper maintains of controls designed to mitigate risk.
Director of Internal Audit 
•	Responsibilities: In charge of controlling the blurred line between the framework builders/enhancers of the ERM team and the testers of framework providing a local level of assurance to local management.
o	Duties
	Financial Risk
	ERM – Dashboard/monitoring
•	Risk individual/Senior - that could functionally report to Janine Goodwin in UK
	Financial Disclosure Committee
•	Complete memos and reporting on Quarterly Basis
o	Informal Duties
	ESG
•	Currently working with MaCara on how to obtain knowledge/potential resource
	Reporting all low risk issues/risk identified not for formal reporting. Typically discussed with Mark Clark, or heads of department pending my relationship.  This is an important peace to ensure we are address issues at the speed of Risk.
•	
Enterprise Risk Management 
•	BP Manager Responsibilities: Continued monitoring of risk.  Primarily focused on Financial Controls could be used for other areas of risk.  ERM shines the light on risk, builds a control framework to help eliminate the risk (Risk Response: Mitigate, Avoid, Transfer, Accept). ERM is responsible for maintaining framework after establishment (which means annual walkthroughs with updating of mapping and control wording/ownership)
•	IT Manager Responsibilities: Same as above for IT
•	In summary, if there is a whole this is the team the can plug it and find the permanent solution.  Weather the issue is identified internally or externally.
•	Staffing – Potential of two or more staff to help maintain all necessary duties above.

Testing Team
•	Responsible for testing/continual monitoring/continual auditing
•	Manager Responsibilities: Scoping of annual testing, documentation gathering, test methodology/frequency, formal findings to ERM team to address, and formal reporting to LOCAL AUDIT COMMITTEE.
•	Department Staffing

General Plan for ICT North America Testing
Step 1: Planning and Scoping (End of August?)
Define Scope for Each Entity:
- Categorize controls into financial cycles (e.g., revenue, expenditure, payroll, financial close).
- Focus on high-risk areas first.
- Review the risk assessment documents and identify key SOX controls relevant to each material entity.
- Focus on controls over financial reporting, including both automated and manual controls.

Determine Testing Methods:
- Inquiry: Interview staff responsible for executing the control.
- Observation: Observe the actual performance of the control.
- Inspection: Review supporting documentation.
- Reperformance: Independently execute the control process.
Step 2: Perform Testing (Start November??)
1. Initial Testing:
- Execute the testing plan for each control in each entity.
- Document findings with supporting evidence.
- Use a standardized testing template to ensure consistency.

Control Deficiency Assessment:
- Identify control deficiencies, classify them as significant deficiencies or material weaknesses.
- Discuss findings immediately with process owners.
Sample Size
Daily - 25-30 instances per quarter.
Weekly – 5-10 instances per quarter
Monthly – 2-3 instances per quarter (6-9 instances per year)
Quarterly – 1 instance per quarter
Annual – Single instance

Step 3: Evaluation and Documentation
1. Evaluate Results:
- Review potential issues with Process Owners and confirm/identify the true issue. “The first domino”
- Determine the impact of any deficiencies on financial reporting.

2. Remediation Plan:
- Work with process owners to develop and implement remediation plans for identified deficiencies.
- Perform follow-up testing on remediated controls as necessary.

3. Summarize Findings:
- Prepare a summary report of all findings, including control deficiencies, remediations, and areas of improvement.
- Present findings to management and the local audit committee.



Current State (Option One)
Based on current resources and current ask of external auditors they doing a full substantive audit.  We really only need to prove test of design (Test of One)

Entity	Control(s)
DTLR	21
Shoe Palace	15
FINL	38
ICT Owned	1

Obtain one polished example for all controls previously tested by Deloitte as they will only increase scope after last years control review given the limited approach/learning the business.

Current Stat (Option Two)

Formal Testing of controls.  This will need to be performed by BDO at DTLR and FINL; however given they have been facilitating all remediation at Shoe Palace; I would like the testing at Shoe Palace to be completed by the local ICT North American team.

This would include all controls DT testing last audit period, along with all Reconciliations (and a hand full of high risk items – gut check)

Personal Opinion Risk: This will put stress on departments during Holiday (typically a busier period; both work and personal). Along with then moving into year end close, followed by year end audit.  I believe Option One would be the minimum of what is necessary to ensure a smoother year end audit.  Formal testing as stated above will need to beginning in Q2 following the conclusion of the year end engagement with DT.






Future State
Honestly what does Hibbett have? What can we leverage before recreating the wheel?
3. Ongoing Monitoring:
- Establish a process for continuous monitoring of key controls.
- Update the risk assessment and control documentation as business processes and environments change.
Continues monitoring… all evidence is uploaded in one central repository that auditors have a monthly task to review and check the following
•	Was the control preformed
•	Was evidence provided
•	Was the evidence validated (with what method of testing?)