Turning a Marketing Blind Spot
into a Board-Ready Control Environment
A mid-market consumer goods company ran its first formal risk assessment of the marketing function; scoping risk, mapping controls, testing effectiveness, and closing gaps in a single quarter.
One of the largest budgets, never formally assessed.
Marketing controlled one of the largest discretionary budgets in the business; agency retainers, media buys, and a sprawling marketing tech stack; yet had never been subject to a formal risk assessment. Internal audit had limited visibility, and the CFO was concerned about four exposures the annual SOX and enterprise-risk cycles never reached: off-cycle agency invoices and purchase orders approved outside policy with vendor-invoice fraud risk; customer data flowing through campaign tools without clear consent tracking or a documented view of GDPR/CCPA obligations; advertising claims and promotions going live without consistent legal review; and third parties onboarded and granted system access with inconsistent contracts and no periodic access review.
A two-person team stood up the assessment in days, not months.
Torvia's AI interviewed process owners through guided workflows and drafted a risk register across the four focus areas, scoring each risk by likelihood and impact and surfacing 31 high or critical items. The platform mapped existing activities to a recommended control set aligned to COSO and the company's SOX framework, instantly flagging where a risk had no specific control. Torvia then generated test plans and sample selections, ingested supporting evidence; POs, consent logs, approval records; and evaluated design and operating effectiveness. For every gap and failed test, Torvia recommended a remediation, assigned an owner and due date, and tracked closure to completion.
Every gap closed with an owned, tested control.
“For the first time we can see marketing risk the way we see financial-reporting risk; scoped, tested, and monitored. Torvia gave a small team the reach of a full audit function.”
From blind spot to monitored control environment.
High and critical risks fell from 31 to 8 within a single quarter, with the remainder on a tracked remediation plan.
74% of key controls were operating effectively at retest, up from under half at first pass.
The CFO gained a complete evidence trail and a significantly enhanced view of marketing risk and control status.
Internal audit adopted the same Torvia workflow to extend risk assessments across other business units.
Partnering with the first and second lines within an organization is key to Internal Audit's future success. Empowering non-financial business units to perform risk assessments, build policies and controls, and perform self-testing is of significant organizational value.