SOX 404 Audit Support

Support SOX 404 compliance activities: control testing methodology, sample selection, deficiency classification, workpaper documentation, and walkthrough preparation.

Workflow

Step 1: Identify the Control and Testing Approach

Gather control details:

• Control ID: The identifier from the controls matrix (e.g., REV-01, P2P-03).
• Control description: What the control does, who performs it, and how frequently.
• Control type: Preventive vs. detective; manual vs. automated (ITGC).
• Assertion: Which financial statement assertion it addresses (existence, completeness, valuation, rights, presentation).
• Frequency: Transaction-level, daily, weekly, monthly, quarterly, annual.

Determine testing approach:

• Inquiry: Interview control owner about how they perform the control.
• Observation: Watch the control being performed in real time.
• Inspection: Examine documentation or system evidence of the control operating.
• Reperformance: Independently re-execute the control to verify the result.

Step 2: Select the Sample

Apply PCAOB-aligned sample sizes based on control frequency:

Selection method:

• Random: Use a random number generator against the population; document the seed.
• Haphazard: Select items without a pattern but not truly random (acceptable for smaller populations).
• Systematic: Every Nth item (appropriate for homogeneous populations).
• Stratified: Divide population by risk characteristics; over-sample high-risk strata.

Step 3: Execute Testing and Document Results

For each sample item, document:

• Item identifier: Transaction ID, document number, or date.
• Control evidence: What evidence was examined (e.g., approval signature, system log, reconciliation file).
• Expected result: What a properly operating control should produce.
• Actual result: What was observed.
• Pass/Fail: Whether the control operated effectively for this item.
• Exception detail: If fail, describe the nature of the deviation.

Step 4: Evaluate and Classify Deficiencies

If exceptions are found, classify the deficiency:

• Deficiency: A control does not operate as designed but the risk of material misstatement is remote.
• Significant Deficiency: A deficiency or combination of deficiencies such that there is a reasonable possibility of a more-than-inconsequential misstatement.
• Material Weakness: A deficiency or combination such that there is a reasonable possibility of a material misstatement not being prevented or detected on a timely basis.

Consider: severity, pervasiveness, likelihood of misstatement, compensating controls, and whether the issue is systemic or isolated.

Step 5: Document the Workpaper

Produce a complete, reviewer-ready workpaper.

Output Format

## SOX Control Testing Workpaper

**Control ID**: [ID] | **Control Owner**: [Name]
**Description**: [What the control does]
**Assertion(s)**: Existence / Completeness / Valuation / Rights / Presentation
**Frequency**: [Monthly/Weekly/etc.] | **Type**: Manual / Automated
**Testing period**: [YYYY-QN]

### Test Objective
Determine whether [control description] operated effectively during the testing period.

### Population and Sample
- **Population**: [Description and count]
- **Sample size**: [N] items
- **Selection method**: [Random/Haphazard/Systematic]

### Testing Procedures
1. [Procedure 1 - e.g., inspect approval documentation]
2. [Procedure 2 - e.g., reperform the reconciliation]

### Results
| # | Item ID     | Date       | Evidence Examined        | Result | Notes       |
|---|-------------|------------|--------------------------|--------|-------------|
| 1 | INV-10234   | 2026-01-15 | Approval email attached  | Pass   |             |
| 2 | INV-10456   | 2026-02-03 | No approval on file      | Fail   | See exception|

### Exceptions
**Exception 1**: Invoice INV-10456 lacked documented approval...
**Root cause**: [Description]
**Compensating control**: [If any]

### Conclusion
- **Exceptions**: [N] out of [Sample size]
- **Deficiency classification**: None / Deficiency / Significant Deficiency / Material Weakness
- **Conclusion**: The control [operated / did not operate] effectively during [period].

### Prepared by / Reviewed by
- Prepared: [Name] | [Date]
- Reviewed: [Name] | [Date]

Examples

User: "Generate a sample selection for our monthly bank reconciliation control" Action: Identify the population (12 months), select 2-3 sample items using random selection, document the methodology.

User: "We found 2 exceptions out of 25 samples on revenue approval. How do we classify this?" Action: Evaluate the exception rate (8%), assess severity, check for compensating controls, and classify the deficiency with supporting rationale.

User: "Prep me for the external auditor walkthrough on our P2P controls" Action: Generate a walkthrough guide covering control description, process flow, evidence locations, and anticipated auditor questions.

Best Practices

• Always document the population source and how completeness of the population was verified.
• Include screenshots or references to source evidence; a workpaper should be self-contained.
• Clearly separate facts (what was observed) from conclusions (what it means).
• When classifying deficiencies, always document the rationale, including why a higher classification was not selected.
• Track remediation timelines for any identified deficiencies.
• Cross-reference related controls; a deficiency in one control may be mitigated by another.
• Use consistent workpaper formatting across all controls to facilitate review.