Control Testing Workpaper Template (SOX ICFR, Design and Operating)

Control Testing Workpaper: [Control ID] [Control name]

Workpaper for testing one internal control over financial reporting (ICFR): control attributes, walkthrough of design and implementation, population and completeness of the information used, sample size rationale, test attributes and steps, results by sample, exceptions and root cause, conclusion, remediation retest, roll-forward, review sign-off and evidence index. Supports management's evaluation under Exchange Act Rule 13a-15(c) and Sarbanes-Oxley Act section 404(a), following SEC interpretive Release No. 33-8810 (as of 2026-10), and uses the GAO Green Book (GAO-25-107721, 2025 revision) terms for deficiencies in design, implementation and operating effectiveness. PCAOB AS 2201 is cited by number only. Sample sizes in this template are an example of practice, not a rule. Replace every [bracketed] value and every row marked Example. This is a document format, not legal, accounting or audit advice. Obtain the rules and standards for the normative text.

Document control

Approvals

Revision history

Contents

• 1. Control under test
• 2. Test objective and approach
• 3. Walkthrough: design and implementation
• 4. Population and information used
• 5. Sample size rationale
• 6. Test attributes and steps
• 7. Results by sample
• 8. Exceptions, extension and root cause
• 9. Conclusion
• 10. Remediation retest and roll-forward
• 11. Review notes and sign-off
• 12. Evidence index
• 13. Glossary and references
• Standard and licence note

1. Control under test

2. Test objective and approach

The objective is to obtain sufficient evidence that the control was designed to address the risk at the stated precision, that it was in place, and that it operated as designed throughout the period tested, performed by a person with the authority and competence to do it. Release 33-8810 links the amount of evidence to the ICFR risk of the control: the risk of the account (here, a significant balance with a presumed fraud risk in revenue) and the risk that the control fails (here, a judgement-based review that depends on a spreadsheet). Both are rated higher, so the plan uses re-performance of the review on the selected months, not only inspection of signatures.

Procedures used, from least to most persuasive, are inquiry of the control owner and preparer, observation of the control being performed, inspection of documents, and re-performance of the control by the tester. Use a combination: inquiry and observation in the walkthrough, inspection and re-performance in the operating effectiveness test.

Timing matters as much as the procedure. Testing at interim gives time to remediate, but the assessment speaks as of year end, so every interim test needs a roll-forward. Controls that operate only at year end, or that changed late in the year, must be tested when they operate. Record in this workpaper which period each sample represents, so that the annual assessment can show that the whole year, and in particular the last quarter, is covered.

3. Walkthrough: design and implementation

The walkthrough traces one transaction month through the control. It answers two questions from the Green Book evaluation model. Design: is the control capable of meeting its objective and addressing the risk if it operates as described? Implementation: does it exist and is it in use? A failure on either point is a deficiency in design or a deficiency in implementation, and operating effectiveness testing is then pointless until it is fixed.

Design conclusion (Example): the control as described in version 1 is designed to address RSK-OTC-004 at a precision of EUR 50k, below the scoping threshold of EUR 525k (group materiality EUR 700k). Implementation conclusion (Example): in place and operating in April 2026. Design note: version 1 does not require a written record of each investigation, which makes evidence of operation depend on the reviewer's notes. Raised with the control owner as an observation, not a deficiency, at the walkthrough date.

4. Population and information used

The population is the set of times the control should have operated in the testing period. For a monthly control it is the list of months; completeness comes from comparing the list of performed reviews with the close calendar, so that a missed month cannot be left out of the population. For a transaction-level control, extract the population from the system and reconcile its count and total to the general ledger or a system control total.

The control relies on IPE-002, the deferred revenue roll-forward. Test its completeness and accuracy for each selected month, because the reviewer's conclusion is only as good as the report.

5. Sample size rationale

Neither the SEC rules, Release 33-8810 nor PCAOB AS 2201 prescribe a sample size for management's testing. Release 33-8810 says that sufficiency of evidence depends on its quantity (such as sample size) and its quality: the nature of procedures, the period covered and the objectivity of the tester. The table below is an example of a firm methodology that scales sample size with control frequency and risk. It is not normative; adopt your own after agreeing it with the external auditor if you want them to use your work.

Application to CTL-REV-004 (Example): monthly, higher risk, so the methodology gives 3 for a full year. The interim period covers 9 of 12 months, so 2 are selected at interim and 1 at year end (December), for 3 across the year. Selection: random number generator seeded with the workpaper ID, applied to months 1 to 9, giving March and July. A haphazard pick of months the tester finds convenient is not random. December counts twice: as the year-end sample that completes the full-year sample of three, and as the third month of operation of the remediated version in section 10.

The deviation rate for a sample is the number of exceptions divided by the number of items tested.

For low-frequency controls (monthly or less), the methodology in this example treats any exception as a failure of the test. For high-volume controls, a pre-set number of tolerable exceptions may apply, with an extension of the sample if one exception occurs. Write the rule down before testing.

6. Test attributes and steps

Define one attribute per element of the control description. Each attribute is tested on each sample and recorded as pass, fail or not applicable with a reason. Re-performance means the tester repeats the review: rebuilds the expectation, identifies the movements above the threshold and checks that each was investigated and resolved.

Document each attribute so that another tester would reach the same answer. Write down the figures you looked at, the threshold you applied and the reference of the support you inspected. For a review control, keep a copy of the reviewer's evidence as it existed at the time of the review; a note added later, after the tester asked, is not evidence that the review happened at the stated precision.

7. Results by sample

All amounts in EUR thousand. Roll-forward check: opening plus billings less releases less adjustments equals closing.

Recomputation (Example): S1: 13,800 + 9,400 - 7,100 - 150 = 15,950. S2: 14,600 + 6,900 - 7,000 - 62 = 14,438. Both agree to the ERP trial balance.

S1 detail (Example): billings were EUR 1,900k above expectation because of annual renewals invoiced in March; the reviewer's note cites the renewal list and the tester agreed it to the billing register. Adjustments of EUR 150k (expectation EUR 15k) were traced to a credit for a service outage approved under CTL-REV-005; the note and approval were on file.

S2 detail (Example): adjustments of EUR 62k exceeded the EUR 50k absolute threshold for the adjustments line (the variance against the EUR 15k expectation, EUR 47k, was below EUR 50k, which is why the control states both legs). The roll-forward was signed on business day 5 but carried no explanation, and the reviewer could not show any follow-up made at the time. Recorded as exception EX-01.

8. Exceptions, extension and root cause

An exception means the control did not operate as designed on that occasion. Whether the underlying amount was right is a separate question: the severity of a deficiency depends on whether there is a reasonable possibility that the control fails to prevent or detect a misstatement, not on whether one happened. Evaluate both, record both, and pass the deficiency to the evaluation process.

The extension shows that the failure was isolated to the month the delegate performed the review, but under the methodology in section 5 a single exception in a monthly control means the test fails. The extension supports the root cause and the severity assessment; it does not turn the result into a pass.

9. Conclusion

Example: For the interim period the control did not operate effectively, because the July 2026 review omitted the investigation of a movement above the threshold. No misstatement resulted. The control was redesigned (version 2) from 2026-10-01 and is retested below.

10. Remediation retest and roll-forward

Management can conclude that a remediated control is effective at year end only if it has operated long enough to give sufficient evidence. Under the example methodology, a monthly control needs two months of operation before retest. Version 2 began on 2026-10-01, so the first two months are October and November 2026. Both were retested by 2026-12-15 (version 1.1 of this workpaper), which is the remediation conclusion. The December review is performed in the January close, so it is tested in January 2027 as the year-end roll-forward sample (version 1.2); it also completes the full-year sample of three under section 5.

Recomputation (Example): R1: 14,950 + 7,300 - 7,050 - 40 = 15,160. R2: 15,160 + 6,800 - 7,100 - 55 = 14,805. YE: 14,805 + 7,900 - 7,150 - 55 = 15,500, which agrees to the FY2026 deferred revenue balance in the annual assessment. The September closing balance of EUR 14,950k is the October opening balance. August and September 2026 were not sampled: they fall within the period already concluded as not effective for version 1, and the remediated version is tested from October.

Roll-forward conclusion (Example): version 2 of CTL-REV-004 operated effectively in October, November and December 2026. DEF-2026-003 is remediated as of 2026-12-31: the retest of October and November passed on 2026-12-15 and the December roll-forward sample passed on 2027-01-12. The annual assessment records the remediation, the closure of AGG-01 together with DEF-2026-001, and the change in the RCM (RCM-CHG-02).

11. Review notes and sign-off

The reviewer confirms that the population was complete, that the sample was selected as planned, that each attribute was tested on each sample with evidence attached, that exceptions were evaluated and that the conclusion follows from the results. Review notes and their clearance stay in the workpaper.

Choose a reviewer who did not perform the test and, for controls that the external auditor may use, someone at least as experienced as the tester. When the reviewer disagrees with a conclusion, record the disagreement and how it was resolved; do not overwrite the original assessment.

12. Evidence index

13. Glossary and references

References (obtain current versions):

• 17 CFR 240.13a-15(c) and 17 CFR 229.308, eCFR; Sarbanes-Oxley Act of 2002 section 404 (15 U.S.C. 7262).
• SEC Release Nos. 33-8810; 34-55929 (2007), section II.A.2 (evaluating evidence of operating effectiveness, ICFR risk, objectivity of testers).
• GAO, Standards for Internal Control in the Federal Government (GAO-25-107721, 2025), Section 3 (evaluating design, implementation and operating effectiveness; deficiencies).
• PCAOB AS 2201, number and title only.
• Related templates: Risk and Control Matrix (compliance/risk-control-matrix), ICFR Management Assessment (compliance/icfr-management-assessment), Control Deficiency Evaluation (compliance/control-deficiency-evaluation), Account Reconciliation (finance/account-reconciliation), PBC Request List (finance/pbc-request-list).

Standard and licence note

Based on US public law and US government works: the Sarbanes-Oxley Act of 2002, SEC rules in 17 CFR Parts 229 and 240, SEC Release No. 33-8810 and the GAO Green Book (GAO-25-107721), summarised in original wording. The sample size table is an illustrative practice methodology written for this template, not a requirement of any rule or standard. PCAOB AS 2201 and the COSO 2013 framework are cited by name or number only; no text, illustration or example from them is reproduced or paraphrased. This template is not affiliated with or endorsed by the SEC, GAO, COSO or the PCAOB. Corvid Commerce Group and all figures are fictional. This template is original text written for this collection. Check the current official versions of each rule, release and standard before use. Template licence: MIT.