SOX Control Testing

ScreenSarbanes-Oxley (SOX)·step 1

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

• Control under test (required)

  controlId

  Enter control under test.

• Control frequency (required)

  controlFrequency

  Enter control frequency.

• Scope version in force at the test date (required)

  scopeVersionId

  A later scope change never rewrites the basis on which past testing was performed.

ScreenSarbanes-Oxley (SOX)·step 2

Complete the Coverage fields. Each value is validated against the schema before the next step unlocks.

• Population size (required)

  populationSize

  Enter population size.

• Items tested (required)

  itemsTested

  Enter items tested.

• What the population consists of (required)

  populationDefinition

  Without this, the two numbers describe nothing and coverage cannot be challenged.

• Testing approach (required)

  testingApproach

  Enter testing approach.

ScreenSarbanes-Oxley (SOX)·step 3

Complete the Sampling fields. Each value is validated against the schema before the next step unlocks.

• Selection methodoptional

  sampleSelectionMethod

  Enter selection method.

• Why the sample supports a conclusion about the remainderoptional

  sampleRationale

  A sample without rationale is recorded as unsupported, not as a smaller test.

ScreenSarbanes-Oxley (SOX)·step 4

Complete the Operating fields. Each value is validated against the schema before the next step unlocks.

• Mechanism operating fromoptional

  operatingPeriodStart

  Enter mechanism operating from.

• Mechanism operating tooptional

  operatingPeriodEnd

  Enter mechanism operating to.

• Monitoring lapsed fromoptional

  monitoringLapseFrom

  Enter monitoring lapsed from.

• Monitoring resumed onoptional

  monitoringLapseTo

  Enter monitoring resumed on.

ScreenSarbanes-Oxley (SOX)·step 5

Complete the Evidence fields. Each value is validated against the schema before the next step unlocks.

• Evidence collected onoptional

  evidenceCollectedOn

  Enter evidence collected on.

• Period end (required)

  periodEnd

  Staleness is computed against this. Q1 evidence does not support a December conclusion on its own.

• Evidence artefacts (required)

  evidenceRefs

  Enter evidence artefacts.

• Roll-forward performed onoptional

  rollForwardPerformedOn

  Roll-forward is itself recorded work, not an assumption.

ScreenSarbanes-Oxley (SOX)·step 6

Complete the Exceptions fields. Each value is validated against the schema before the next step unlocks.

• Deviations found (required)

  deviationsFound

  A count, recorded before it is interpreted. Whether it constitutes a control failure is decided under

• What was observedoptional

  deviationDescription

  Enter what was observed.

ScreenSarbanes-Oxley (SOX)·step 7

Complete the Automation fields. Each value is validated against the schema before the next step unlocks.

• Result comes from an automated or continuous mechanismoptional

  isAutomatedTest

  Enter result comes from an automated or continuous mechanism.

ScreenSarbanes-Oxley (SOX)·step 8

Complete the Audit fields. Each value is validated against the schema before the next step unlocks.

• Decided by (required)

  decidedBy

  Which layer produced this conclusion. Only the deterministic engine or a human may decide a control outcome.

• Rule version (required)

  ruleVersion

  Version of the rule that produced the conclusion. Without it the conclusion cannot be reproduced after the rule changes.

• Rule packageoptional

  rulePackage

  Rego package or module identifier the rule lives in.

• Inputsoptional

  conclusionInputs

  The facts the rule read. A conclusion without its inputs cannot be re-derived or challenged.

• Reason (required)

  conclusionReason

  Human-reviewable explanation of the outcome. This is the explainability an auditor asks for.

• Evaluated at (ns)optional

  evaluatedAtNs

  Nanosecond evaluation stamp, matching the engine freshness input.

• Human reviewed atoptional

  humanReviewedAt

  When a human confirmed the conclusion, where review was required.

• Human reviewed byoptional

  humanReviewedBy

  Enter human reviewed by.