A Technical Note for CEOs and CFOs
by Otto Acuña N. MBA, CMC, CSSBB 🇨🇷 🇪🇪 – EXYGE Consulting | June 2025
In a business environment characterized by increasingly automated operations, accelerated digital transformation, and multiple and converging risks (regulatory, operational, technological, climate, and reputational), organizations require not only operational efficiency, but also structural resilience and intelligent control.
In this context, the role of the Comptroller’s Office has emerged as a fundamental strategic component within the Three Lines of Defense model for integrated risk management (Institute of Internal Auditors, IIA), a term familiar to those who work in the financial services sector, but of relative recent application in other industries such as manufacturing, food, services, logistics and others.
From Executor to Control Architect: Evolution of the Comptroller’s Role
Historically, a little less than a century ago, the comptroller emerged as a central figure in financial management, consolidating operational functions, from accounting to treasury. As organizations grew and specialized, many of these responsibilities were transferred to specific operational areas. Consequently, the comptroller evolved into a role more focused on the design, supervision and integrity of the financial and risk control system.
Currently, the controller is not a replacement for the CFO: both positions can coexist and the controller fulfills an independent function, focused on monitoring, technical advice, objective interpretation of financial information and ensuring regulatory and procedural compliance. This paradigm shift has made it possible to professionalize the function and avoid conflicts of interest, reinforcing accountability from an objective perspective. In the highly regulated financial services industry, there is the specialized position of the Risk Manager, but the Comptroller, for industries other than banking, brings together not only the role of managing risks, but also a more proactive, agile and flexible area that is part of the operating model that ensures operational excellence and resilience, contributing to the smooth running of the organization’s key operations.
The second line of defense: role, limits and responsibilities
The Three Lines of Defense model, originally defined by the IIA in 2013 and updated in 2020 to reflect a more proactive and collaborative role between the 3 lines, sets out a clear architecture of responsibilities to ensure organisational governance:
First Line: corresponds to the operating units (such as SSC – shared services center, accounting, treasury and business units), which execute the day-to-day processes and controls.
Second Line: includes supervisory functions such as the Comptroller’s Office, Risk Management and Compliance, which define regulatory frameworks, monitor compliance and advise the operation without executing the processes (without approvals or operational tasks that are part of the 1st line).
Third Line: includes internal and external audits, as well as regulatory entities, which provide independent assurance to the Board of Directors and the Audit Committee.
The modern Comptroller’s Office acts in this second line, and its key role is to monitor, strengthen and promote compliance with the internal control framework and risk management standards. To do this, it adopts a non-invasive and collaborative approach with the operation, leveraged on analytical tools, report automation, dashboards and a systematic interpretation of risks based on international standards such as ISO 31000.
Delimitation of responsibilities
An effective modern comptroller’s office:
- Designs policies, establishes procedures, and works together with operational areas to optimize workflows and improve operational resilience and minimally invasive controls.
- It advises the operation, but does not execute operational tasks (such as reconciliations or payment approvals).
- Regularly reviews compliance and issues constructive observations.
- Reports to the CEO or CFO according to the company’s organizational model, forming a key element of the operation’s continuous improvement cycle. It constitutes a “first layer of proactive review” from within the operation and differs from external audit, as it is entirely external to the operation and reports directly to the Board of Directors and the Audit Committee.
The strategic value of the modern Comptroller’s Office
In an increasingly digital and automated operating environment, modern comptrollership brings value to the organization in several ways:
Alignment with global frameworks and proven methodologies
The comptroller’s office is based on models such as:
- COSO: to structure internal control.
- ISO 31000: to establish a proactive approach to risk management.
- EFQM and APQC: to promote operational excellence and compare financial performance with industry benchmarks.
Continuous improvement and operational governance agent
The Comptroller’s Office is no longer just an inspector. It is also a:
- Provider of self-control tools (dashboards, KPIs).
- Facilitator of redesign of internal control management processes.
- Trainer of technical capacities in the operation on issues of internal control, risks and operational effectiveness.
Guarantor of the risk-based approach
Apply tools such as:
- Root cause analysis: to explain findings and recommend sustainable solutions.
- FMEA (Failure Mode and Effects Analysis): to identify and prioritize failure modes in critical processes.
Pillar of transparency and accountability
By being separated from the operation but at the same time being part of Finance, the Comptroller’s Office becomes a reliable filter of the quality of financial information, the accuracy of operational indicators, reducing the risk of material errors and improving the organizational reputation before third parties.
The EXYGE approach: Controllership as an enabler of operational excellence
At EXYGE.COM we support business groups and organizations with SSCs to redesign and strengthen their comptroller function under five key pillars:
- Design of structures by lines of defense, avoiding overlap and conflicts of interest.
- Mapping of critical financial and operational risks, aligned with ISO 31000.
- Instrumentation of key control indicators (KPIs) and automated monitoring.
- Continuous accompaniment , training and transferring skills to finance and comptroller personnel.
- Organizational review and definition of critical processes for the financial and comptroller areas.
Final Words: A Critical Function for Resilience and Sustainability
In a world of permacrisis and digital transformation, the modern Comptroller’s Office can no longer be confused with the CFO or with merely accounting functions. It is a strategic, independent actor, aimed at preventing, advising, optimizing and strengthening the financial and operational resilience of the organization.
CEOs and CFOs who understand this new approach are better positioned to face complex regulatory or operational environments, with demands for transparency and increasing expectations from the different actors in the ecosystem.
How can we help you?
At EXYGE, we have been helping public and private organizations transform with structure, speed, and purpose for more than 15 years. We invite you to explore how we can accompany you in modernizing your finance operations and strengthening your resilience through a direct conversation with our experts.
📩 contact@exyge.com
🌐 www.exyge.com
📞 Request a meeting: https://exyge.link/solicite_VC
