does a controller need a cpa