Workpaper Requirements (+2)

Workpaper Requirements

Every control test should be documented with:

1. Control identification:

   • Control number/ID
   • Control description (what is done, by whom, how often)
   • Control type (manual, automated, IT-dependent manual)
   • Control frequency
   • Risk and assertion addressed

2. Test design:

   • Test objective (what you are trying to determine)
   • Test procedures (step-by-step instructions)
   • Expected evidence (what you expect to see if the control is effective)
   • Sample selection methodology and rationale

3. Test execution:

   • Population description and size
   • Sample selection details (method, items selected)
   • Results for each sample item (pass/fail with specific evidence examined)
   • Exceptions noted with full description

4. Conclusion:

   • Overall assessment (effective / deficiency / significant deficiency / material weakness)
   • Basis for conclusion
   • Impact assessment for any exceptions
   • Compensating controls considered (if applicable)

5. Sign-off:

   • Tester name and date
   • Reviewer name and date

Evidence Standards

Sufficient evidence includes:

• Screenshots showing system-enforced controls
• Signed/initialed approval documents
• Email approvals with identifiable approver and date
• System audit logs showing who performed the action and when
• Re-performed calculations with matching results
• Observation notes (with date, location, observer)

Insufficient evidence:

• Verbal confirmations alone (must be corroborated)
• Undated documents
• Evidence without identifiable performer/approver
• Generic system reports without date/time stamps
• "Per discussion with [name]" without corroborating documentation

Working Paper Organization

Organize testing files by control area:

SOX Testing/
├── [Year]/
│   ├── Scoping and Risk Assessment/
│   ├── Revenue Cycle/
│   │   ├── Control Matrix
│   │   ├── Walkthrough Documentation
│   │   ├── Test Workpapers (one per control)
│   │   └── Supporting Evidence
│   ├── Procure to Pay/
│   ├── Payroll/
│   ├── Financial Close/
│   ├── Treasury/
│   ├── Fixed Assets/
│   ├── IT General Controls/
│   ├── Entity Level Controls/
│   └── Summary and Conclusions/
│       ├── Deficiency Evaluation
│       └── Management Assessment