SOX Testing Workpaper
SOX sample selections, testing workpapers, and internal control assessments
SOX testing season means weeks of manual sample selections, workpaper documentation, and control testing — repeated identically every quarter. This playbook automates SOX sample selections, generates standardized testing workpapers, and produces internal control assessment documentation.
Who it's for: internal auditors performing quarterly SOX compliance testing across multiple controls, external audit staff preparing sample selections and test workpapers for SOX engagements, SOX compliance managers standardizing testing documentation across their audit team, controllers ensuring internal controls are properly documented and tested, risk and compliance officers overseeing SOX 404 testing programs
Example
"Generate SOX testing workpapers for our revenue recognition controls" → SOX pipeline: statistical sample selection from transaction population with proper documentation, testing workpaper template generation with control objectives and test procedures, test result recording with pass/fail criteria, exception documentation with remediation tracking, and management assertion summary ready for auditor review
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
npx ccplaybooks add sox-testing-workpaper# SOX Testing Workpaper
**Important**: This workflow assists with SOX compliance processes but does not provide audit or legal advice. All testing workpapers and assessments should be reviewed by qualified financial professionals before use in audit documentation.
Generate sample selections, create testing workpapers, document control assessments, and provide testing templates for SOX 404 internal controls over financial reporting.
## Usage
```
sox-testing <control-area> <period>
```
Get new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
This playbook helps you plan and execute SOX 404 testing for internal controls over financial reporting. It generates control matrices, calculates sample sizes based on control frequency and risk, creates sample selections, produces testing workpaper templates with pre-populated test steps, and provides a deficiency evaluation framework.
Important: This workflow assists with SOX compliance processes but does not provide audit or legal advice. All testing workpapers and assessments should be reviewed by qualified financial professionals before use in audit documentation.
Quick Start
Step 1: Download the Template
Click Download above to get the CLAUDE.md file.
Step 2: Set Up Your Project
Create a project folder and place the template inside:
mkdir -p ~/Documents/SOXTesting
mv ~/Downloads/sox-testing-workpaper.md ~/Documents/SOXTesting/CLAUDE.md
Step 3: Start Working
cd ~/Documents/SOXTesting
claude
Say: "Generate a testing workpaper for revenue recognition controls for Q4 2024"
Supported Control Areas
revenue-recognition-- Revenue cycle controls (order-to-cash)procure-to-pay/p2p-- Procurement and AP controlspayroll-- Payroll processing and compensation controlsfinancial-close-- Period-end close and reporting controlstreasury-- Cash management and treasury controlsfixed-assets-- Capital asset lifecycle controlsinventory-- Inventory valuation and management controlsitgc-- IT general controls (access, change management, operations)entity-level-- Entity-level and monitoring controlsjournal-entries-- Journal entry processing controls
Sample Size Guidelines
| Control Frequency | Population (approx.) | Recommended Sample |
|---|---|---|
| Annual | 1 | 1 |
| Quarterly | 4 | 2 |
| Monthly | 12 | 2-4 |
| Weekly | 52 | 5-15 |
| Daily | ~250 | 20-40 |
| Per-transaction | Varies | 25-60 |
Samples are adjusted for risk level, prior year results, and auditor reliance.
Assertions (CEAVOP)
- Completeness -- All transactions are recorded
- Existence/Occurrence -- Transactions actually occurred
- Accuracy -- Amounts are correctly recorded
- Valuation -- Assets/liabilities are properly valued
- Obligations/Rights -- Entity has rights to assets, obligations for liabilities
- Presentation/Disclosure -- Properly classified and disclosed
Deficiency Classification
| Level | Definition |
|---|---|
| Deficiency | Control does not prevent or detect misstatements on a timely basis |
| Significant Deficiency | Important enough to merit attention by oversight bodies |
| Material Weakness | Reasonable possibility of material misstatement not prevented/detected |
Example Prompts
"Generate a testing workpaper for revenue recognition controls for Q4 2024"
"Pull a sample of 25 items for the three-way match P2P control"
"Create an ITGC access review testing template for 2024"
"Evaluate this exception -- is it a deficiency or significant deficiency?"
"Build the control matrix for financial close controls"