Dear colleagues: I am the Controller of a private company with about 400 employees. I recently joined—the previous Controller was promoted to CFO after the old CFO retired. Both of them had been with the company for over 25 years.

We currently have almost no internal controls, and I want to start an assessment to identify weaknesses and gradually build real control mechanisms. The first step is the accounting system. Does anyone in the community have a standard checklist of questions that can be used to ask our IT staff? I am mainly concerned about issues such as who has what access rights and what documentation we have.

Thank you in advance for your guidance!