AI in auditing: what it should and should not do in control testing
Why every AI verdict in SOX testing needs a quoted line and page, and why AI should never sign off a test, even when it is sure.
BLOG
Practical SOX control testing guides for controls teams.
Each guide covers one job in the SOX year, from building the RCM to classifying a failed test. Start with the one that matches the work on your desk this week, or search every post below.
Six guides, in the order the SOX year needs them
01
New to SOX testing
SOX control testing 101
Seven steps from RCM row to signed-off test, with a worked bank reconciliation control description and a test-file checklist.
9 min readRead the guide 02 Planning the testing yearSOX sample sizes by control frequency
Look up how many samples a control needs for how often it runs, and how to round them.
7 min readRead the guide 03 Planning the testing yearInterim vs roll-forward testing
Where to put the interim cutoff for a December 31 year end, and how to size the roll-forward sample in proportion.
8 min readRead the guide 04 Testing a specific controlTesting the three-way match
A test template with seven attributes, the evidence to request per sample, and the exceptions testers find most often.
8 min readRead the guide 05 A test just failedDeficiency classification guide
Decide between a control deficiency, a significant deficiency and a material weakness, then plan remediation and the retest.
9 min readRead the guide 06 Bringing AI into testingAI in control testing
Which work AI should do and which conclusions a person must own, including confidence thresholds and escalation.
8 min readRead the guideAll posts, newest first
AI in audit
Agentic AI for SOX compliance: how AI agents are transforming control testing in 2027
What AI agents can take on in SOX control testing, the new risks they bring (actions, permissions, prompt injection), how to adopt them under control, and how far SOXLayer's own agents go.
Testing
SOX sampling guidance: how to choose the right sample size for control testing
Define a complete population, choose an audit sampling method, weigh the AS 2315 factors, handle a failed sample and document the rationale, with a monthly reconciliation worked through.
AI in audit
AI for SOX compliance: how artificial intelligence is changing SOX management
Where AI helps across a SOX program, from evidence review and control testing to the RCM and workpapers, the risks to manage, and how to roll it out one control at a time.
SOX basics
SOX compliance testing, without the headache: a one-page guide
The four-stage yearly SOX testing cycle, how controls are really tested, risk-based scoping, the best practices that cut audit pain, and where AI helps and where it does not.
Testing
SOX workpaper template and example for modern teams
The eight parts every SOX workpaper needs, a filled-in bank reconciliation workpaper with a pending March exception, seven steps to prepare one, and best practices for managing them.
Testing
SOX audit evidence: what counts and how to organize it
Six common evidence types, five checks that make evidence reliable, an eight-step way to organize it by control and period, and a worked journal entry approval example.
AI in audit
How to choose AI SOX testing software: a buyer's checklist
Eight things to check before you buy, from attribute-level testing and cited evidence to the audit trail, plus the vendor questions to ask and how to run a pilot that tells you something.
Testing
Rollforward testing for SOX controls: best practices
Eight steps from the interim workpaper to a full-year conclusion, a monthly bank reconciliation rolled forward from September to December, and the mistakes that leave a gap.
Testing
Test of design vs test of operating effectiveness explained
Which question each test answers, what evidence it needs, a monthly bank reconciliation tested both ways, and five mistakes that blur the two.
No posts match your search.