Controls Lead Programme Β· TIB Systems Training
CL
Controls Lead Programme Β· 24 Weeks

Controls
Lead
Programme

The only commercially available programme that trains you to lead a complete 30-day SAP controls engagement from Day One β€” scope, plan, direct an SCC team, write the management letter, and close with the client. 24 weeks. All 14 domains. TIB-CERT-CL.

24
Weeks to TIB-CERT-CL
140
Procedures Β· All 14 Domains
17
Ironbridge Deliverables
Β£1,200
Engagement Lead Day Rate
What Changes from SCC

You Stop Executing.
You Start Leading.

The SCC programme makes you independently deployable on procedures. The Controls Lead programme makes you the person who sets the scope, directs the SCC team, produces the management letter, and closes the engagement with the client.

The 7 additional domains are not just more procedures. They represent the full scope of a modern SAP controls engagement β€” cloud infrastructure, identity governance, privacy, SOX financial controls, non-SAP applications, interface security, and audit methodology itself.

The Ironbridge simulation changes too. In the SCC programme, the instructor plays the Controls Lead. In the CL programme, you are the Controls Lead. All 17 deliverables. Including the management letter and the close-out with Marcus Holt.

What CL Adds to SCC
+
7 New Domains (B, H, I, K, L, M, N)
ITGC, Cloud Infrastructure, Non-SAP Applications, Privacy, SOX Financial Controls, Audit Methodology, Engagement Readiness β€” 70 additional procedures
+
23-Finding Aggregation Exercise
Week 10 milestone: aggregate findings across all domains. Identify Significant Deficiency patterns. Decide what escalates to the management letter and what stays at finding level.
+
PBC Design and Management
Build the Pre-Engagement Checklist from scratch. Manage outstanding items. Write escalation emails when items are late. Document the client's response.
+
RACI Construction
Map stakeholders, assign responsibilities, identify who needs access to what system, who attends which walkthrough.
+
Management Letter Production
Full management letter β€” QA-reviewed. Client close-out simulation. Marcus Holt challenges your highest-severity finding in a Teams call. You have 30 seconds.
+
All 17 Ironbridge Deliverables
As Controls Lead, not as SCC. RACI, PBC tracker, kickoff agenda, walkthrough notes, findings tracker, preliminary issuance, management responses, management letter, close-out pack.
SCC vs Controls Lead

The Difference Is Leadership

Capability SCC Graduate Controls Lead Graduate
Domains covered7 (A, C, D, E, F, G, J)All 14 (A–N)
Procedure execution70 procedures independently140 procedures + review of SCC's work
Engagement roleExecutes under Controls Lead directionLeads the engagement independently
PBC managementFollows the PBC trackerDesigns, sends, and manages the PBC
Finding aggregationRates individual findingsAggregates across domains. Identifies SD patterns.
Management letterContributes finding write-upsProduces the full management letter. QA-reviewed.
Client close-outAttendsLeads. Defends every finding rating.
Ironbridge simulation roleSCCControls Lead β€” all 17 deliverables
Day rate (UK market)Β£550–£750/dayΒ£850–£1,200/day
CertificationTIB-CERT-SCCTIB-CERT-CL (80% written pass required)
Domain Coverage

All 14 Domains.
No Blind Spots.

A
Access Control
B
ITGC / Change
C
GRC Platform
D
RFC Security
E
Infrastructure
F
Fiori / Web
G
BTP / Cloud Platform
H
Cloud Infrastructure
I
Non-SAP Applications
J
Identity Governance
K
Privacy / GDPR
L
SOX Financial Controls
M
Audit Methodology
N
Engagement Readiness
SCC + Controls Lead domains (7)
Controls Lead additional domains (7)
Management Layer

What "Lead Level" Means
in Practice

πŸ“‹
PBC Design and Management
Build the pre-engagement checklist from scratch. Send it. Track outstanding items. Write the escalation email when Day 3 passes and the user access extract still has not arrived. Document the client's response.
πŸ—Ί
RACI and Stakeholder Mapping
Map every system owner, every workstream lead, every client stakeholder. Decide who attends which walkthrough. Build the responsibility matrix before fieldwork starts β€” not after the first missed session.
πŸ“Š
23-Finding Aggregation
Week 10 capstone: aggregate findings across all 14 domains. Identify Significant Deficiency patterns. Decide what escalates to management letter level and what stays as an operational finding.
πŸ“
Management Letter Production
Write the full management letter β€” executive summary, finding narrative, management responses, remediation timeline. Submit it. It comes back with QA comments. Rewrite. The standard: a partner can sign it without editing.
πŸ”΄
EOD Email Discipline
End-of-day emails. Daily sync structure. Escalation protocol for access delays, aggressive client behaviour, and findings that need to reach the Audit Lead before the next morning.
🀝
Close-Out Leadership
Lead the close-out meeting. Present findings. When Marcus Holt challenges your SAP_ALL severity rating in front of three witnesses β€” you respond. With evidence. In 30 seconds.
Weeks 17–24 Β· Ironbridge Simulation

You Are the
Controls Lead.

In the SCC programme, the instructor plays the Controls Lead. In the CL programme, you are the Controls Lead. You direct the SCC team. You manage the client relationship. You produce every deliverable. All 17.

All 17 Deliverables
RACI Matrix
PBC Tracker
Kickoff Agenda
Gap Analysis Memo
Walkthrough Notes Γ—5
Daily Sync Reports Γ—30
Findings Tracker
Preliminary Issuance
Management Responses
Management Letter
Close-Out Pack
Critical Judgment Moment: Day 11

SAP_ALL confirmed on a dialog user in production at Ironbridge. Last logon: this morning. The GRC Administrator confirmed it verbally in the walkthrough. The client's IT Director is not available until tomorrow.

Do you call the Audit Lead now or include it in the daily sync?

The SCC programme tells you the answer. The CL programme puts you in the room and makes you decide β€” with the timer running.

Critical Judgment Moment: Day 19

Close-out meeting. You present SAP_ALL as a CRITICAL finding. Marcus Holt, IT Director: "That account is used by our BASIS consultant during upgrades. It is under control. I am disputing that severity."

You have the Competency Passport. You have the workpaper. You have 30 seconds. What do you say?

The Career Trajectory

Four Stages.
One Clear Direction.

Week 16
SCC Graduation
Senior Controls Consultant β€” independently deployable
Β£550–£750/day
Big 4 sub-contract equivalent
Months 3–6 post-graduation
First 3 Engagements
Building live engagement track record under TIB supervision framework
Market rate
SCC positioning
Week 24 (or SCC + Upgrade)
CL Graduation
Controls Lead β€” independently deployable as engagement lead
Β£850–£1,200/day
Engagement lead rate
18–24 months post-CL
Independent Practice
Deliver directly to clients under own brand or TIB network sub-contract
Premium rate
Independent billing
Enrolment

Controls Lead Programme

Cohort Track β€” Recommended
$2,800
One-time Β· or $249/month Γ— 12 Β· UK: Β£2,300 / Β£210Γ—12
Full 24-week CL programme
Weekly 60-minute live sessions
All 140 procedures, all 14 domains
Peer review β€” CCCE rubric
23-finding aggregation exercise
PBC design and management training
Full management letter production
QA review (max 2 submissions)
Ironbridge simulation β€” CL role
All 17 engagement deliverables
Written certification β€” 80% pass
TIB-CERT-CL + Competency Passport
Enrol in Controls Lead β†’

The Only Programme Where You Lead Before You Lead.

In the Ironbridge simulation, you are the Controls Lead. You direct the SCC team. You produce the management letter. You close the engagement with Marcus Holt. Then, in your first real engagement, you do it again β€” with a Competency Passport that proves you have done it before.

$2,800
One-time Β· or $249/month Γ— 12
Enrol Now β†’