Last reviewed: September 2026
No Credit Card Required
This free SOX control testing checklist runs one test cycle for a US-listed company: a quarterly round of management testing, an interim cycle, or the year-end roll-forward. Built for SOX leads, internal audit and co-source testers, it takes each key control from walkthrough and test of design through sampling, operating effectiveness testing, severity rating and retest. Every cycle ends with a reviewed test file, a deficiency log and a hand-off pack your external auditor can re-perform.
The annual SOX programme decides which controls are in scope. This checklist starts after that decision and produces evidence about each control due this cycle. If you need the programme itself (scoping, filer status, 302 certifications and the 404(a) report), use the SOX 404 Compliance Checklist.
The vocabulary comes from PCAOB AS 2201, adopted in 2007 as Auditing Standard No. 5. It governs the external auditor, not management. SEC Rule 13a-15(c) accepts many ways of evaluating internal control, with the SEC’s 2007 interpretive guidance as one route that satisfies it. Most testing teams still work to the auditor’s standard, because the auditor can use management’s testing only when it meets the auditor’s bar for competence and objectivity (AS 2201.16–.19). AS 2201 also separates two kinds of failure. A design deficiency means the control is missing, or would not meet its objective even if performed perfectly. An operating deficiency means a well-designed control was not performed as designed, or was performed by someone without the authority or competence to do it.
Method: a walkthrough of one transaction, with inquiry, observation and inspection (AS 2201.42–.43).
Evidence: the control objective, the assertion covered, the precision of any review and the data it relies on.
If it fails: stop. Sampling a badly designed control proves nothing.
Method: inspection or re-performance of a sample across the period; inquiry alone is never enough (AS 2201.50).
Evidence: the population, the selection method, results per sample and the reviewer’s sign-off.
If it fails: investigate, then extend, compensate or conclude it is ineffective.
AS 2201.63–.64 rates a deficiency by two things: whether there is a reasonable possibility the controls will fail to prevent or detect a misstatement, and how large that misstatement could be. Whether a misstatement actually occurred does not decide it. A clean reconciliation this quarter does not make a missed review a minor finding.
Five phases run every cycle. Phases 5 and 6 appear only when testing finds exceptions or earlier deficiencies still need a retest. Paragraph references are to PCAOB AS 2201.
The first task records the cycle type and whether deficiencies from earlier cycles are still open. Those answers switch on the roll-forward task in Phase 4 and the retest phase.
The roll-forward task appears only in the year-end cycle. The last task asks whether any exceptions were found, which decides whether Phase 5 appears.
Shown only when Phase 4 records at least one exception.
Shown when this cycle found exceptions, or when Phase 1 recorded deficiencies from earlier cycles that still need a retest.
Assign the review tasks to someone who did not perform the testing.
No rule sets SOX sample sizes. AS 2201 says only that evidence should increase with the risk of the control (.46), that a control does not have to operate without any deviation to be effective (.48), and that testing closer to the year end gives more evidence (.52). The sizes in common use are audit firm practice guidance. The table shows one published example: the illustrative minimums for manual controls in KPMG’s 2004 guide to management’s Section 404 assessment, written under the predecessor standard, which KPMG said management should not simply adopt. Agree your own methodology with your auditor, and treat the table as a starting point, not legal advice.
| Control frequency | Occurrences a year | Example minimum sample (KPMG, 2004) | What testers get wrong |
|---|---|---|---|
| Annual | 1 | 1 | Testing it before it has run for the current year |
| Quarterly | 4 | 2–3 | Leaving out the fourth-quarter occurrence at year end |
| Monthly | 12 | 2–4 | Treating the review sign-off as the test |
| Weekly | About 52 | 5–10 | Picking weeks from one quarter only |
| Daily | About 250 working days | 15–30 | Not proving the population is complete |
| Recurring manual (many times a day) | Hundreds or thousands | 30–60 | Selecting items by hand rather than at random |
| Automated | Continuous | One test of each configuration, when IT general controls are effective | Assuming nothing changed without checking change logs |
Practice varies more for frequent controls. A 2015 American Accounting Association study of sampling policies at the Big Four and two other international firms found planning inputs that give 22 to 59 items, usually planning for zero deviations. After a deviation, some firms double the sample while others turn to compensating controls or more substantive testing.
Two SEC proposals from May 2026 could change the rhythm of this work. One would let companies file a semiannual report instead of quarterly 10-Qs, with certifications twice a year. The other would limit the auditor’s 404(b) attestation to large accelerated filers with at least $2 billion of public float. At the time of review both were proposals, not final rules, and neither would remove management’s own annual assessment, so plan testing against the current rules.
A recurring schedule opens the cycle each quarter, and dynamic due dates count evidence requests and fieldwork back from the date the auditor expects the files. A late request shows up weeks before year end.
Conditional logic reads the exceptions answer at the end of Phase 4. Record an exception and the evaluation and retest phases appear with owners and due dates. Enforced step order keeps the design conclusion ahead of sampling, and a table inside the task holds each sample’s result.
Populations, selections and evidence sit on the task they support. The reviewer’s sign-off runs as an approval, the activity trail records who did what and when, and template versioning shows which test steps applied in each quarter.
CheckFlow is not a GRC platform or an audit firm, and it does not give an opinion on your controls. It runs the testing work, evidence and sign-offs your team and auditor rely on. Our guide to financial services workflow automation places quarterly SOX testing among the other recurring compliance reviews a regulated firm runs, and the SOX 404 Compliance Checklist collects each cycle’s results into management’s annual assessment.
Access conflicts in finance systems often cause design deficiencies. The Segregation of Duties Review Checklist finds and resolves them before your testers do.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
There is no regulatory number. Sample sizes come from your testing methodology and should rise with the risk of the control. Published audit firm examples, such as KPMG’s 2004 guidance, suggest one sample for an annual control, two or three for a quarterly control, two to four for a monthly one and larger samples for daily or more frequent controls. Where your auditor plans to use your testing, agree the sizes with them before fieldwork.
A walkthrough follows one transaction from initiation to the ledger to understand the process and judge whether each control is designed to catch a misstatement. A test of operating effectiveness checks a sample of occurrences across the period to show the control actually worked each time. Depending on the risk of the control, AS 2201 says a walkthrough might also give enough evidence of operation, but most key controls need a sample.
Yes, to a degree the auditor decides. Under AS 2201.16–.19 the auditor may use work by internal audit, other company staff or third parties, after assessing their competence and objectivity. The higher the risk of the control, the more the auditor must test it directly. Testers who report to the people running the controls are less objective, which is why the checklist assigns independent testers in Phase 1.
Find out why it happened, then choose a response: extend the sample if you believe it was isolated, test a compensating control that is precise enough to catch a material misstatement, or conclude the control is ineffective. Each deficiency is then rated, alone and with related findings. A single exception does not automatically make a control ineffective, because AS 2201 accepts that controls can operate with some deviation.
Long enough to produce the number of occurrences your methodology needs for that frequency. A quarterly control fixed in the third quarter may give only one occurrence before the year end, which is why remediation deadlines should sit well before it. AS 2201.53 lets the auditor test the new control instead of the one it replaced, if it has operated long enough to be tested.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
