# Control Testing Workpaper: [Control ID] [Control name]

> Workpaper for testing one internal control over financial reporting
> (ICFR): control attributes, walkthrough of design and implementation,
> population and completeness of the information used, sample size
> rationale, test attributes and steps, results by sample, exceptions
> and root cause, conclusion, remediation retest, roll-forward, review
> sign-off and evidence index. Supports management's evaluation under
> Exchange Act Rule 13a-15(c) and Sarbanes-Oxley Act section 404(a),
> following SEC interpretive Release No. 33-8810 (as of 2026-10), and
> uses the GAO Green Book (GAO-25-107721, 2025 revision) terms for
> deficiencies in design, implementation and operating effectiveness.
> PCAOB AS 2201 is cited by number only. Sample sizes in this template
> are an example of practice, not a rule. Replace every `[bracketed]`
> value and every row marked *Example*. This is a document format, not
> legal, accounting or audit advice. Obtain the rules and standards for
> the normative text.

<!--
Guidance: How to use this template
- Purpose: one workpaper per key control per testing cycle, complete
  enough that an experienced reviewer who did not do the work (the
  external auditor or internal audit) can see what was tested, how, on
  what evidence and why the conclusion follows.
- Fill section 1 from the Risk and Control Matrix
  (`compliance/risk-control-matrix`) and do not change the description
  here; if the walkthrough shows the description is wrong, update the
  RCM first and record the change.
- Plan sections 4 to 6 before you look at any sample. Decide the
  population, sample size and pass criteria in advance so that the
  result cannot shape the test.
- The worked example is fictional: Corvid Commerce Group plc (IFRS
  reporter, EUR, calendar year, listed in London with ADSs in New York,
  SEC foreign private issuer filing Form 20-F), treated as an
  accelerated filer for this example. The control is
  CTL-REV-004, the monthly group deferred revenue roll-forward review,
  tested at interim with one exception that became deficiency
  DEF-2026-003. Together with DEF-2026-001 (the US deferral journal
  review, same balance, same month) it forms the significant deficiency
  AGG-01 evaluated in `compliance/control-deficiency-evaluation`.
- Common pitfall: testing that the reviewer signed, rather than that
  the review was done at the stated precision. A signature shows the
  control happened, not that it worked.
-->

## Document control

<!-- Guidance: Each workpaper has its own ID, preparer and reviewer. Never edit a reviewed workpaper; add a new version for retests and roll-forward. -->

| Field | Value |
|---|---|
| Workpaper ID | [TW-YYYY-PROC-NNN] (*Example:* TW-2026-REV-004) |
| Control ID and name | [CTL-ID] (*Example:* CTL-REV-004 Deferred revenue roll-forward review) |
| RCM reference and version | [RCM-YYYY v1.x] (*Example:* RCM-2026 v1.0 for January to September, v1.1 from 2026-10-01) |
| Fiscal year and testing period | [YYYY], [period] (*Example:* FY2026, interim 2026-01-01 to 2026-09-30) |
| Test type | [Design and implementation / Operating effectiveness / Remediation retest / Roll-forward] |
| Tester | [@name, team] (*Example:* internal audit) |
| Reviewer | [@name] |
| Version | [1.0] |
| Status | [In progress / Prepared / Reviewed / Closed] |
| Owner | [@head-of-internal-audit] |
| Approvers/reviewers | [@head-of-internal-control] |
| Last updated | YYYY-MM-DD |
| Classification | Confidential; shared with the external auditor |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Tester (preparer) | [@name] | [Prepared] | YYYY-MM-DD |
| Reviewer | [@name] | [Reviewed / Returned with notes] | YYYY-MM-DD |
| Control owner (results acknowledged) | [@name] | [Acknowledged] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Interim test, 2 samples, 1 exception, extended to 3 more months |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Remediation retest, October and November 2026 |
| 1.2 | YYYY-MM-DD | [@name] | *Example:* Year-end roll-forward, December 2026 sample tested in January 2027 |
| 1.3 | 2026-10-25 | [@name] | Updated to the FY2026 deficiency register (DEF-2026-003, AGG-01), version 2 date 2026-10-01 and an explicit threshold basis |

## Contents

- [1. Control under test](#1-control-under-test)
- [2. Test objective and approach](#2-test-objective-and-approach)
- [3. Walkthrough: design and implementation](#3-walkthrough-design-and-implementation)
- [4. Population and information used](#4-population-and-information-used)
- [5. Sample size rationale](#5-sample-size-rationale)
- [6. Test attributes and steps](#6-test-attributes-and-steps)
- [7. Results by sample](#7-results-by-sample)
- [8. Exceptions, extension and root cause](#8-exceptions-extension-and-root-cause)
- [9. Conclusion](#9-conclusion)
- [10. Remediation retest and roll-forward](#10-remediation-retest-and-roll-forward)
- [11. Review notes and sign-off](#11-review-notes-and-sign-off)
- [12. Evidence index](#12-evidence-index)
- [13. Glossary and references](#13-glossary-and-references)
- [Standard and licence note](#standard-and-licence-note)

## 1. Control under test

<!-- Guidance: Copy the control attributes from the RCM. Questions: Which risk and assertions does the control address? What is its precision? On what information and systems does it depend? Pitfall: a description too vague to say what a failure looks like. -->

| Attribute | Value |
|---|---|
| Control ID *(Example)* | CTL-REV-004 |
| Process *(Example)* | OTC, order-to-cash, subscriptions |
| Risk addressed *(Example)* | RSK-OTC-004: deferred revenue balance misstated through unusual credits, cancellations or manual adjustments |
| Assertions *(Example)* | Valuation or allocation (V), completeness (C) |
| Significant account *(Example)* | Deferred revenue (contract liabilities), EUR 15,500k at FY2026 year end |
| Description, version 1 (to 2026-09-30) *(Example)* | Head of revenue accounting reviews the monthly group deferred revenue roll-forward (opening, billings, releases, adjustments, closing), investigates every line whose actual movement differs from expectation by more than EUR 50k and any adjustments line above EUR 50k in absolute value, and signs within 5 business days of month end |
| Description, version 2 (from 2026-10-01) *(Example)* | As version 1, plus a written explanation, corroborating evidence and outcome for every line above the threshold, recorded on the roll-forward before sign-off |
| Key or non-key | Key |
| Type and nature | Detective; IT-dependent manual |
| Frequency | Monthly |
| Owner | Head of revenue accounting |
| Information used (IPE) | IPE-002 deferred revenue roll-forward (billing platform export plus spreadsheet) |
| ITGC dependency | Billing platform (SOC 1 Type 2, SO-001); ERP |
| Fraud flag | Yes (revenue recognition) |
| Green Book principle | 10 Design control activities; 16 Monitoring activities |

## 2. Test objective and approach

<!-- Guidance: State what the test must show and which procedures give the evidence. Release 33-8810 asks that the nature, timing and extent of testing follow the assessed ICFR risk. Pitfall: inquiry alone; it never gives enough evidence of operating effectiveness for a key control. -->

The objective is to obtain sufficient evidence that the control was
designed to address the risk at the stated precision, that it was in
place, and that it operated as designed throughout the period tested,
performed by a person with the authority and competence to do it.
Release 33-8810 links the amount of evidence to the ICFR risk of the
control: the risk of the account (here, a significant balance with a
presumed fraud risk in revenue) and the risk that the control fails
(here, a judgement-based review that depends on a spreadsheet). Both
are rated higher, so the plan uses re-performance of the review on the
selected months, not only inspection of signatures.

| Planning factor | Assessment *(Example)* | Effect on the test |
|---|---|---|
| Risk of material misstatement in the account | Higher: significant balance, revenue fraud presumption | More evidence; re-performance |
| Complexity and judgement in the control | Medium: thresholds set, but explanation needs judgement | Inspect the quality of explanations, not only their existence |
| Reliance on IPE | Yes, IPE-002 includes a user spreadsheet | Test IPE completeness and accuracy each sample |
| Changes in the period | Yes, version 2 from 2026-10-01 | Test each version for the period it operated |
| Prior-year results | No exceptions in FY2025 | No reduction taken because the risk rating is higher |
| Tester objectivity | Internal audit, reports to the audit committee | Results available for use by the external auditor under PCAOB AS 2201 |

Procedures used, from least to most persuasive, are inquiry of the
control owner and preparer, observation of the control being performed,
inspection of documents, and re-performance of the control by the
tester. Use a combination: inquiry and observation in the walkthrough,
inspection and re-performance in the operating effectiveness test.

Timing matters as much as the procedure. Testing at interim gives time
to remediate, but the assessment speaks as of year end, so every
interim test needs a roll-forward. Controls that operate only at year
end, or that changed late in the year, must be tested when they
operate. Record in this workpaper which period each sample represents,
so that the annual assessment can show that the whole year, and in
particular the last quarter, is covered.

## 3. Walkthrough: design and implementation

<!-- Guidance: Follow one instance of the control from start to end, using the real documents. Questions: Would the control, performed as described, detect a material misstatement in time? Was it actually in place? Pitfall: walkthrough done by reading the narrative instead of tracing an actual month. -->

The walkthrough traces one transaction month through the control. It
answers two questions from the Green Book evaluation model. Design:
is the control capable of meeting its objective and addressing the
risk if it operates as described? Implementation: does it exist and is
it in use? A failure on either point is a deficiency in design or a
deficiency in implementation, and operating effectiveness testing is
then pointless until it is fixed.

| Step | Procedure | Evidence | Result *(Example)* |
|---|---|---|---|
| WT-1 | Inquiry of the head of revenue accounting about how the review is performed, thresholds and follow-up | Interview notes, 2026-05-12 | Description in RCM confirmed |
| WT-2 | Observe the April 2026 review being performed | Screen share notes, 2026-05-07 | Reviewer compared each line to expectation built from billing forecast |
| WT-3 | Inspect the April 2026 roll-forward and sign-off | Roll-forward file, sign-off timestamp 2026-05-07 | Signed on business day 5 |
| WT-4 | Trace one investigated movement to its support | Contract amendment for a customer upgrade, EUR 140k | Explanation corroborated |
| WT-5 | Assess precision: would a movement just above EUR 50k be noticed? | Threshold applied per line, expectation documented | Yes |
| WT-6 | Confirm the reviewer's authority and competence | Delegation of authority matrix, job description | Appropriate |

Design conclusion *(Example)*: the control as described in version 1 is
designed to address RSK-OTC-004 at a precision of EUR 50k, below the
scoping threshold of EUR 525k (group materiality EUR 700k). Implementation conclusion *(Example)*:
in place and operating in April 2026. Design note: version 1 does not
require a written record of each investigation, which makes evidence of
operation depend on the reviewer's notes. Raised with the control owner
as an observation, not a deficiency, at the walkthrough date.

## 4. Population and information used

<!-- Guidance: Define the population of control occurrences and prove it is complete, then test the reports the control uses. Pitfall: sampling from a population supplied by the control owner without checking it against an independent source. -->

The population is the set of times the control should have operated
in the testing period. For a monthly control it is the list of months;
completeness comes from comparing the list of performed reviews with
the close calendar, so that a missed month cannot be left out of the
population. For a transaction-level control, extract the population
from the system and reconcile its count and total to the general ledger
or a system control total.

| Item | Value *(Example)* |
|---|---|
| Population definition | Monthly deferred revenue roll-forward reviews, January to September 2026 |
| Population size | 9 |
| Source | Close folder index for each month; close calendar (`finance/month-end-close-checklist`) |
| Completeness procedure | Compared the 9 calendar close cycles with the 9 roll-forward files and sign-offs found; no missing month |
| Population exclusions | None |

The control relies on IPE-002, the deferred revenue roll-forward. Test
its completeness and accuracy for each selected month, because the
reviewer's conclusion is only as good as the report.

| IPE test | Procedure | Result *(Example)* |
|---|---|---|
| IPE-T1 Opening balance | Agree opening balance to prior month closing balance in the ERP | Agreed for all samples |
| IPE-T2 Billings | Agree billings to the billing platform invoice register total for the month | Agreed |
| IPE-T3 Releases | Agree releases to the revenue journal posted from the sub-ledger | Agreed |
| IPE-T4 Closing balance | Agree closing balance to the ERP trial balance | Agreed |
| IPE-T5 Spreadsheet integrity | Inspect formula cells for hard-coded values; confirm version from locked template | No overrides found |
| IPE-T6 Source report reliability | Billing platform report logic covered by SOC 1 Type 2 (SO-001); CUEC-BIL-02 mapped | Reliance supported |

## 5. Sample size rationale

<!-- Guidance: Use the company's sampling methodology and say which row applies and why. The table is an example methodology; replace it with your own. Pitfall: presenting an industry rule of thumb as a requirement. -->

Neither the SEC rules, Release 33-8810 nor PCAOB AS 2201 prescribe a
sample size for management's testing. Release 33-8810 says that
sufficiency of evidence depends on its quantity (such as sample size)
and its quality: the nature of procedures, the period covered and the
objectivity of the tester. The table below is an example of a firm
methodology that scales sample size with control frequency and risk.
It is not normative; adopt your own after agreeing it with the
external auditor if you want them to use your work.

| Control frequency | Typical occurrences a year | Sample, lower risk *(Example)* | Sample, higher risk *(Example)* | Minimum operation before retest of a remediated control *(Example)* |
|---|---|---|---|---|
| Annual | 1 | 1 | 1 | Next occurrence |
| Quarterly | 4 | 2 | 2 | 2 quarters |
| Monthly | 12 | 2 | 3 | 2 months |
| Weekly | 52 | 5 | 10 | 5 weeks |
| Daily | about 250 | 20 | 30 | 20 days |
| Recurring (many times a day) | over 250 | 25 | 40 | 25 occurrences over at least 30 days |
| Automated, with effective ITGCs | Not applicable | 1 instance per relevant configuration | 1 instance per relevant configuration | 1 instance after the change |

Application to CTL-REV-004 *(Example)*: monthly, higher risk, so the
methodology gives 3 for a full year. The interim period covers 9 of 12
months, so 2 are selected at interim and 1 at year end (December), for
3 across the year. Selection: random number generator seeded with the
workpaper ID, applied to months 1 to 9, giving March and July. A
haphazard pick of months the tester finds convenient is not random.
December counts twice: as the year-end sample that completes the
full-year sample of three, and as the third month of operation of the
remediated version in section 10.

The deviation rate for a sample is the number of exceptions divided by
the number of items tested.

$$
\text{Deviation rate} = \frac{\text{exceptions}}{\text{items tested}}
$$

For low-frequency controls (monthly or less), the methodology in this
example treats any exception as a failure of the test. For high-volume
controls, a pre-set number of tolerable exceptions may apply, with an
extension of the sample if one exception occurs. Write the rule down
before testing.

## 6. Test attributes and steps

<!-- Guidance: List the attributes each sample must meet, each one observable and pass or fail. Questions: Does the attribute test precision and follow-up, not only sign-off? Pitfall: attributes copied from another control without adjusting to its description. -->

Define one attribute per element of the control description. Each
attribute is tested on each sample and recorded as pass, fail or not
applicable with a reason. Re-performance means the tester repeats the
review: rebuilds the expectation, identifies the movements above the
threshold and checks that each was investigated and resolved.

Document each attribute so that another tester would reach the same
answer. Write down the figures you looked at, the threshold you applied
and the reference of the support you inspected. For a review control,
keep a copy of the reviewer's evidence as it existed at the time of the
review; a note added later, after the tester asked, is not evidence
that the review happened at the stated precision.

| Attribute | What the tester checks | Procedure |
|---|---|---|
| A1 Completeness of roll-forward | All components present (opening, billings, releases, adjustments, closing) and the roll-forward foots and cross-foots | Inspect, recompute |
| A2 Information reliable | IPE tests IPE-T1 to IPE-T5 passed for the month | Inspect, agree |
| A3 Authorised reviewer | Reviewer is the head of revenue accounting or the named delegate, and is not the preparer | Inspect sign-off, compare with delegation list |
| A4 Timeliness | Sign-off within 5 business days of month end | Inspect timestamp, compare with close calendar |
| A5 Precision and investigation | Every line whose movement differs from expectation by more than EUR 50k, and any adjustments line above EUR 50k in absolute value, identified, investigated and explained, with the explanation corroborated by support | Re-perform; inspect support |
| A6 Follow-up | Errors found by the review corrected by journal in the same or next close | Inspect journal and approval |
| A7 Evidence retained | Signed roll-forward and support stored in the close folder | Inspect |

## 7. Results by sample

<!-- Guidance: One row per sample, one column per attribute, with the key figures that let a reviewer re-perform. Pitfall: "No exceptions noted" with no figures; the reviewer cannot tell what was looked at. -->

All amounts in EUR thousand. Roll-forward check: opening plus billings
less releases less adjustments equals closing.

| Sample | Opening | Billings | Releases | Adjustments | Closing | Movements above threshold | A1 | A2 | A3 | A4 | A5 | A6 | A7 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| S1 March 2026 *(Example)* | 13,800 | 9,400 | (7,100) | (150) | 15,950 | 2 (billings, adjustments) | Pass | Pass | Pass | Pass, day 4 | Pass | n/a, no errors | Pass |
| S2 July 2026 *(Example)* | 14,600 | 6,900 | (7,000) | (62) | 14,438 | 1 (adjustments) | Pass | Pass | Pass | Pass, day 5 | Fail | n/a | Pass |

Recomputation *(Example)*: S1: 13,800 + 9,400 - 7,100 - 150 = 15,950.
S2: 14,600 + 6,900 - 7,000 - 62 = 14,438. Both agree to the ERP trial
balance.

S1 detail *(Example)*: billings were EUR 1,900k above expectation
because of annual renewals invoiced in March; the reviewer's note
cites the renewal list and the tester agreed it to the billing
register. Adjustments of EUR 150k (expectation EUR 15k) were traced to
a credit for a service outage approved under CTL-REV-005; the note and
approval were on file.

S2 detail *(Example)*: adjustments of EUR 62k exceeded the EUR 50k
absolute threshold for the adjustments line (the variance against the
EUR 15k expectation, EUR 47k, was below EUR 50k, which is why the
control states both legs). The roll-forward was signed on
business day 5 but carried no explanation, and the reviewer could not
show any follow-up made at the time. Recorded as exception EX-01.

## 8. Exceptions, extension and root cause

<!-- Guidance: For each exception, record facts, whether it shows a control failure, any extended testing, the root cause and the effect on the financial statements. Pitfall: explaining away an exception after the fact ("the amount turned out to be correct") instead of evaluating the control. -->

An exception means the control did not operate as designed on that
occasion. Whether the underlying amount was right is a separate
question: the severity of a deficiency depends on whether there is a
reasonable possibility that the control fails to prevent or detect a
misstatement, not on whether one happened. Evaluate both, record both,
and pass the deficiency to the evaluation process.

| Field | EX-01 *(Example)* |
|---|---|
| Sample and attribute | S2 July 2026, A5 Precision and investigation |
| Facts | Adjustments line of EUR 62k exceeded the EUR 50k absolute threshold; no investigation or explanation documented at the time of review |
| Control failure | Yes: an element of the control description was not performed |
| Extension | Extended to the three months before the exception, April, May and June 2026 (3 additional samples); no exceptions in A1 to A7 |
| Substantive check | Tester traced the EUR 62k to 4 customer cancellations with signed termination notices; the amounts were correctly recorded; no misstatement found |
| Root cause | Reviewer on leave in the week after month end; delegate signed without the investigation step, and version 1 of the control did not require a written record that would have shown the gap |
| Deviation rate | 1 of 5 months tested = 20% |
| Deficiency raised | DEF-2026-003 on 2026-09-25, evaluated in `compliance/control-deficiency-evaluation` (CDE-2026) |
| Classification (from evaluation) | Control deficiency on its own. Aggregated with DEF-2026-001 (US deferral journal review CTL-REV-007, not performed in March and July) into AGG-01, a significant deficiency, because in July 2026 both review layers over deferred revenue failed; reported to the audit committee on 2026-10-14 |

$$
\text{Deviation rate} = \frac{1}{5} = 20\%
$$

The extension shows that the failure was isolated to the month the
delegate performed the review, but under the methodology in section 5 a
single exception in a monthly control means the test fails. The
extension supports the root cause and the severity assessment; it does
not turn the result into a pass.

## 9. Conclusion

<!-- Guidance: Conclude separately on design, implementation and operating effectiveness for the period tested. Pitfall: a single word "effective" that hides an exception or a period not covered. -->

| Aspect | Conclusion *(Example)* | Basis |
|---|---|---|
| Design | Effective, with an observation that version 1 lacked a written investigation step | Walkthrough WT-1 to WT-6 |
| Implementation | Effective | April 2026 walkthrough |
| Operating effectiveness, 2026-01-01 to 2026-09-30 (version 1) | Not effective | EX-01 in July 2026 |
| Deficiency | DEF-2026-003, control deficiency; part of significant deficiency AGG-01 | CDE-2026 |
| Effect on the annual assessment | Remediate and retest before year end (section 10) | `compliance/icfr-management-assessment` section 9 |

*Example:* For the interim period the control did not operate
effectively, because the July 2026 review omitted the investigation of
a movement above the threshold. No misstatement resulted. The control
was redesigned (version 2) from 2026-10-01 and is retested below.

## 10. Remediation retest and roll-forward

<!-- Guidance: Test the remediated control after it has operated for the minimum period in your methodology, then roll forward to year end. Pitfall: retesting the first month after the fix, which proves little about sustained operation. -->

Management can conclude that a remediated control is effective at year
end only if it has operated long enough to give sufficient evidence.
Under the example methodology, a monthly control needs two months of
operation before retest. Version 2 began on 2026-10-01, so the first
two months are October and November 2026. Both were retested by
2026-12-15 (version 1.1 of this workpaper), which is the remediation
conclusion. The December review is performed in the January close, so
it is tested in January 2027 as the year-end roll-forward sample
(version 1.2); it also completes the full-year sample of three under
section 5.

| Sample | Opening | Billings | Releases | Adjustments | Closing | A1 to A4, A6, A7 | A5 (version 2) | Result |
|---|---|---|---|---|---|---|---|---|
| R1 October 2026 *(Example)* | 14,950 | 7,300 | (7,050) | (40) | 15,160 | Pass | Pass: 1 movement above threshold (billings), written explanation and support | Pass |
| R2 November 2026 *(Example)* | 15,160 | 6,800 | (7,100) | (55) | 14,805 | Pass | Pass: adjustments EUR 55k explained with cancellation notices | Pass |
| YE December 2026 *(Example)*, tested 2027-01-12 | 14,805 | 7,900 | (7,150) | (55) | 15,500 | Pass | Pass: 2 lines above threshold, billings above expectation (renewal list attached) and adjustments EUR 55k (cancellation notices) | Pass |

Recomputation *(Example)*: R1: 14,950 + 7,300 - 7,050 - 40 = 15,160.
R2: 15,160 + 6,800 - 7,100 - 55 = 14,805. YE: 14,805 + 7,900 - 7,150 - 55
= 15,500, which agrees to the FY2026 deferred revenue balance in the
annual assessment. The September closing balance of EUR 14,950k is the
October opening balance. August and September 2026 were not sampled:
they fall within the period already concluded as not effective for
version 1, and the remediated version is tested from October.

Roll-forward conclusion *(Example)*: version 2 of CTL-REV-004 operated
effectively in October, November and December 2026. DEF-2026-003 is
remediated as of 2026-12-31: the retest of October and November passed
on 2026-12-15 and the December roll-forward sample passed on
2027-01-12. The annual assessment
records the remediation, the closure of AGG-01 together with
DEF-2026-001, and the change in the RCM (RCM-CHG-02).

## 11. Review notes and sign-off

<!-- Guidance: The reviewer checks the work, raises notes and clears them before sign-off. Keep the notes; they show the review was real. Pitfall: reviewer sign-off on the same day as preparation without any notes on a test with an exception. -->

The reviewer confirms that the population was complete, that the
sample was selected as planned, that each attribute was tested on each
sample with evidence attached, that exceptions were evaluated and that
the conclusion follows from the results. Review notes and their
clearance stay in the workpaper.

Choose a reviewer who did not perform the test and, for controls that
the external auditor may use, someone at least as experienced as the
tester. When the reviewer disagrees with a conclusion, record the
disagreement and how it was resolved; do not overwrite the original
assessment.

| Note ID | Reviewer note | Response | Cleared |
|---|---|---|---|
| RN-01 *(Example)* | Show how the expectation for adjustments (EUR 15k) was derived | Added: average of January to June adjustments excluding the March outage credit | Yes, YYYY-MM-DD |
| RN-02 *(Example)* | Confirm the delegate in July was authorised | Delegation list shows the deputy revenue controller as delegate; authority not the issue, the step was missed | Yes, YYYY-MM-DD |
| RN-03 *(Example)* | Link the deficiency evaluation reference and the aggregation | CDE-2026, DEF-2026-003 and AGG-01 added in section 8 | Yes, YYYY-MM-DD |

| Sign-off | Name | Date |
|---|---|---|
| Prepared by | [@tester] | YYYY-MM-DD |
| Reviewed by | [@reviewer] | YYYY-MM-DD |
| Control owner acknowledgement | [@control-owner] | YYYY-MM-DD |

## 12. Evidence index

<!-- Guidance: List every document relied on with a stable reference, so the auditor can reperform. Pitfall: links to personal drives or chat messages that expire. -->

| Evidence ID | Description | Location | Used for |
|---|---|---|---|
| EV-01 *(Example)* | Walkthrough notes and April 2026 roll-forward | ICFR repository / FY2026 / 03 / TW-2026-REV-004 / WT | Section 3 |
| EV-02 *(Example)* | Close calendar and roll-forward index, January to September | Same folder / POP | Section 4 |
| EV-03 *(Example)* | Random selection output with seed | Same folder / SEL | Section 5 |
| EV-04 *(Example)* | Signed roll-forwards and support, March and July | Same folder / S1, S2 | Section 7 |
| EV-05 *(Example)* | Extension samples April to June | Same folder / EXT | Section 8 |
| EV-06 *(Example)* | Termination notices for the EUR 62k adjustments | Same folder / EX-01 | Section 8 |
| EV-07 *(Example)* | Retest samples October, November, December | Same folder / RT | Section 10 |
| EV-08 *(Example)* | SOC 1 Type 2 report and bridge letter, billing platform | ICFR repository / FY2026 / 06 / SO-001 | Section 4 |

## 13. Glossary and references

<!-- Guidance: Define terms in your own words and list the rule versions used. -->

| Term | Meaning in this document |
|---|---|
| Test of design | Procedure to judge whether a control, operating as described, would address the risk |
| Implementation | Evidence that the control exists and is in use |
| Operating effectiveness | Evidence that the control operated as designed, consistently, over the period, by a competent person with authority |
| Re-performance | The tester repeats the control independently and compares results |
| Population | All occurrences of the control in the testing period |
| Deviation rate | Exceptions divided by items tested |
| Roll-forward | Procedures that extend interim conclusions to year end |
| IPE | Information produced by the entity and used in a control |

References (obtain current versions):

- 17 CFR 240.13a-15(c) and 17 CFR 229.308, eCFR; Sarbanes-Oxley Act of 2002 section 404 (15 U.S.C. 7262).
- SEC Release Nos. 33-8810; 34-55929 (2007), section II.A.2 (evaluating evidence of operating effectiveness, ICFR risk, objectivity of testers).
- GAO, Standards for Internal Control in the Federal Government (GAO-25-107721, 2025), Section 3 (evaluating design, implementation and operating effectiveness; deficiencies).
- PCAOB AS 2201, number and title only.
- Related templates: Risk and Control Matrix (`compliance/risk-control-matrix`), ICFR Management Assessment (`compliance/icfr-management-assessment`), Control Deficiency Evaluation (`compliance/control-deficiency-evaluation`), Account Reconciliation (`finance/account-reconciliation`), PBC Request List (`finance/pbc-request-list`).

## Standard and licence note

Based on US public law and US government works: the Sarbanes-Oxley Act
of 2002, SEC rules in 17 CFR Parts 229 and 240, SEC Release No. 33-8810
and the GAO Green Book (GAO-25-107721), summarised in original wording.
The sample size table is an illustrative practice methodology written
for this template, not a requirement of any rule or standard. PCAOB AS
2201 and the COSO 2013 framework are cited by name or number only; no
text, illustration or example from them is reproduced or paraphrased.
This template is not affiliated with or endorsed by the SEC, GAO, COSO
or the PCAOB. Corvid Commerce Group and all figures are fictional. This
template is original text written for this collection. Check the
current official versions of each rule, release and standard before
use. Template licence: MIT.