Value Proposition: Control testing workpapers unify the internal audit approach: Control Definition → Design Test → Operating Test → Sampling → Evidence → Conclusion → Deficiency → Remediation → Re-test instead of disparate tests that do not explain “what was tested” or provide evidence.

In 20 Seconds: What Will You Get?

• Design Effectiveness Workpaper: Assessment of control design (Does it cover the risk? Is there segregation of duties?).
• Operating Effectiveness Workpaper: Testing of control operation with samples (Was it executed as described?).
• Sampling Plan: Identification of the test population, test period, sample size, and selection method.
• Sample Sheet: Sample log with reference for each sample (Doc no./Date/Owner/Result).
• Results & Exceptions Log: PASS/FAIL results + exception description + impact + escalation.
• Evidence Index: Linking each step/sample to the supporting attachment or report (path/file name).
• Deficiency & Remediation: Classification of the observation (Design/Operating) + remediation plan + re-testing.

CTA related to deliverables: Receive Workpapers + Sampling + Evidence to document control testing results consistently across all tasks.

Suitable For

• Internal Audit to standardize workpapers and reduce documentation quality discrepancies among auditors.
• Internal Control / Compliance to document periodic tests of key controls.
• External Audit Support to prepare an organized evidence file with traceable results.

Not Suitable For

• Those who want “test results” without actual execution (the templates document the test and do not replace execution).
• A company that does not maintain control evidence (no reports/no approvals/no logs) — will need to build evidence first.

Without Workpapers / With Workpapers (Quick Comparison)

Before Use: 5 Symptoms

• Control tests vary between auditors due to the absence of a standardized template.
• Samples are selected without documenting the test population or test period.
• PASS/FAIL results do not explain the impact or escalate clearly.
• Evidence exists but is not linked to test steps (difficult to review).
• Observations are repeated because there is no remediation tracker and re-testing.

Application Method (3 Steps)

Step 1: Define the Control and Link it to the Risk

• Control description + objective + frequency + owner + type of expected evidence.
• Determine the type of test: Design only, Operating, or both.

Step 2: Sampling Plan and Execution

• Identify the test population, period, sample size, and selection method.
• Execute the steps and record results for each sample (PASS/FAIL) with reference.

Step 3: Conclusion, Observations, and Remediation

• Write conclusion based on results and document exceptions.
• Open deficiency and prepare remediation plan, then re-test and close.

Product Components

1. Design Test Workpaper — Design assessment + SoD points.
2. Operating Test Workpaper — Operating test with samples.
3. Sampling Plan — Population/period/size/selection method.
4. Sample Register — Sample list + references + results.
5. Results & Exceptions Log — Exceptions + impact.
6. Evidence Index — Linking evidence.
7. Deficiency & Remediation — Remediation plan + re-testing.

Delivery Contents

• Workpapers (Design/Operating).
• Sampling + Sample register.
• Evidence index + logs.
• Deficiency/remediation + re-test.

After Application

• Operationally: Standardize documentation quality and reduce internal audit time on workpapers.
• Oversight: Test results are traceable from the control to the sample to the evidence to the conclusion.

FAQ

Does it cover the testing of design and operation of controls?

Yes. There is a Design effectiveness template and an Operating effectiveness template with sample templates.

Is it suitable for SOX testing?

It is suitable as a documentation and testing approach. Detailed SOX requirements (scoping) are adjusted according to your company’s framework.

Can it be used with RCM?

Yes, it is a direct complement to the RCM: each control in the RCM can be opened in a workpaper with a sample and evidence.

Does it require a specific ERP?

No. The important thing is to have evidence (reports/approvals/logs) supporting the operation of the control.

Ready to Document Control Testing Consistently?