sox-testing

Assists with SOX 404 testing of internal controls over financial reporting by generating sample selections, testing workpapers, and control-deficiency assessments. It is invoked with a control area and a testing period and is aimed at quarterly or annual testing cycles. Supported control areas include revenue recognition, procure-to-pay, payroll, financial close, treasury, fixed assets, inventory, ITGC, entity-level, and journal entries, as well as any specific control ID. An explicit disclaimer states it does not provide audit or legal advice and that all workpapers and assessments should be reviewed by qualified financial professionals before use.

The workflow first identifies the key controls for the area and presents a control matrix capturing control type (automated, manual, or IT-dependent manual), frequency, key or non-key status, risk, and the relevant CEAVOP assertions (Completeness, Existence/Occurrence, Accuracy, Valuation, Obligations/Rights, and Presentation/Disclosure). It then determines sample size from control frequency, scaling from a single instance for annual controls up to 25 to 60 for per-transaction controls, adjusted for risk level, prior-year results, and external-auditor reliance.

Samples are drawn using random, systematic, or targeted selection and presented with dates, references, amounts, and selection basis. A structured testing workpaper template is generated with the test objective, procedures, expected evidence, a results grid, an exceptions log, and a conclusion that classifies the control as effective, effective with exceptions, a deficiency, a significant deficiency, or a material weakness. Pre-built test-step templates are provided per control area, covering activities such as approval authorization, three-way match, and reconciliation review.