Interim vs roll-forward testing: how to plan the SOX year

Most SOX programs do not test controls once a year in a single push. They test in two passes: an interim round that covers most of the fiscal year, and a shorter roll forward that covers the remaining weeks through year end. Teams that plan around this split spread the workload, get findings in front of management while there is still time to remediate, and give the external auditor what they expect to see in an interim file. Teams that skip the split end up trying to test twelve months of controls in the six weeks after year end close, which is when everyone, including the auditor, has the least time to spare.

This post walks through why interim testing exists, how the interim cutoff is usually set, what the roll forward period actually needs to cover, and how sample sizes and testing approach commonly scale down for that shorter period. It closes with practical guidance on sequencing a year of testing so the plan holds up under real scheduling pressure.

Why test interim instead of waiting for year end

Waiting until after fiscal year end to start testing has three predictable problems. First, it compresses a full year of testing into a few weeks that also contain year end close, financial statement prep, and the external audit kickoff. Second, it leaves no runway to fix anything: a control found deficient in week one of the audit has nowhere to go. Third, it clusters preparer requests all at once, which is exactly when finance and IT owners are least available to pull evidence.

Interim testing solves this by starting the testing cycle months before year end, typically once controls have operated enough times in the new fiscal year to produce a representative sample. A deficiency found in August gives the control owner time to fix the control, and gives the team time to test the fix, well before the year end conversation with the auditor even starts.

Setting the interim cutoff

The interim cutoff is the date through which interim testing covers control operation. It is set by counting back from the fiscal year end, commonly by one to three months, though the exact gap depends on the program's testing capacity, the auditor's reliance timeline, and how many controls need to be covered in the interim round.

A calendar year company with a December 31 year end might set an interim cutoff of October 31 or November 30. That gives the team ten or eleven months of the population to sample from, and leaves a one or two month roll forward period to cover separately. A company with a June 30 year end would count back the same way from its own fiscal close date.

The cutoff should be set early in the year, not discovered in October, because it determines when interim testing has to start, how many testing weeks are available before the cutoff, and when the roll forward evidence request needs to go out. In SOXLayer, once the fiscal year end and testing deadlines are set for the year, it suggests an interim cutoff and a roll forward window as part of the year's test plan, though the plan itself is only created when the team accepts it: one click creates the plan, nothing is auto-created without that step.

What roll forward testing covers

Roll forward testing covers the gap between the interim cutoff and the fiscal year end, the period interim testing did not reach. For a control with a November 30 interim cutoff and a December 31 year end, roll forward covers December.

The purpose of roll forward is narrow: confirm the control kept operating consistently through year end. It is not a second full test of the whole year. It answers two questions: did the control operate in the gap period the same way it operated during interim, and did anything change about the control, the process, or the people running it between the interim cutoff and year end. If nothing changed and the control operated as expected, roll forward can be light. If something changed, roll forward needs to look closer at that change specifically.

Sizing roll forward samples

Because roll forward only covers a fraction of the year, its sample size is commonly sized down proportionally to the share of the year it represents, rather than using the same sample size as the full annual population. A control tested against a full year sample of 25 items, where the roll forward period is one month out of twelve, would typically draw a roll forward sample sized to roughly one twelfth of the annual population, rounded to a sensible whole number, rather than another 25.

The table below shows a worked example for a monthly control with an annual sample of 25 and a one month roll forward period.

Programs vary in how they round and where they set a practical floor, since a control rarely gets a roll forward sample of zero even if the proportional math rounds down to it. The principle that carries across programs is the same: the roll forward sample reflects the length of the gap period, not the full year.

Walkthrough or reduced test instead of a full retest

Depending on the control's risk rating and whether anything changed in the gap period, roll forward does not always mean pulling a proportional sample and retesting it the same way interim testing did. Common alternatives include:

• A walkthrough of the control's operation in the gap period, confirming the process ran as designed without pulling a full evidence sample.
• A reduced sample focused on confirming continuity, rather than a full retest of every attribute checked at interim.
• A full roll forward retest, reserved for higher risk controls or for any control where the process, system, or personnel changed between the interim cutoff and year end.

The deciding factor is change. A control that ran through year end with the same owner, same system, and no process changes is a good candidate for a lighter roll forward. A control where the preparer changed roles, the system was upgraded, or a prior interim test raised any exceptions should get a fuller look, regardless of how short the gap period is.

Sequencing controls across the year

A workable year plan spreads controls across testing windows instead of bunching them near the interim cutoff or year end. A few practical patterns help:

• Group controls by frequency first. Annual controls can often only be tested once their single occurrence has happened, while monthly and quarterly controls have more flexibility in when interim testing can start.
• Stagger due dates across preparers so the same control owner is not asked for five different controls' evidence in the same week.
• Build in a buffer between the interim cutoff and the interim testing deadline, so a slow evidence request or a reviewer's questions do not push the whole round past the cutoff date the auditor is expecting.
• Plan the roll forward request separately from interim, with its own shorter deadline, rather than assuming it will get done as a follow up to interim work.

Adding controls to a plan in SOXLayer fills in sample sizes, due dates, and preparers automatically based on the control's attributes and the working calendar, which removes a chunk of the manual scheduling work but does not remove the need to look at the resulting spread and check it does not cluster everything into the same two weeks.

Avoiding the year end crunch

Year end crunch usually has the same root cause: too much interim work left undone by the time the interim cutoff arrives, which then gets absorbed into the roll forward and year end schedule instead of staying in its own lane. Watching a few things through the year helps avoid it.

• Track interim completion against the interim cutoff, not against year end. A round that is behind in September is a September problem, not a December one, and it is much easier to fix in September.
• Respect the working calendar. A plan built on calendar days can look fine until a preparer's local holidays or a plant shutdown week quietly eats the buffer that was supposed to absorb delays. A working calendar with company working days and per entity holiday overrides keeps due dates realistic across locations instead of assuming every entity works the same schedule.
• Keep roll forward scoped to the gap period. The moment roll forward testing starts pulling in items that belong to the interim population, the proportional sizing logic breaks down and the roll forward round balloons back toward a second full test.

Coordinating with the external auditor

External auditors run their own interim and roll forward testing, and they typically want to see the internal program's interim cutoff, sample sizes, and roll forward approach early enough to plan their own reliance testing around it. A few coordination points are worth confirming directly with the audit team rather than assuming:

• Whether the auditor expects the same interim cutoff date the internal team is using, or a different one for their own reliance testing.
• Whether the auditor has a minimum roll forward sample size or approach they expect for higher risk controls, separate from the internal program's own sizing convention.
• Whether any changes identified during the internal team's own roll forward inquiry (system changes, process changes, personnel changes) need to be communicated to the audit team as they come up, rather than only at the year end status update.

Getting these expectations in writing early in the year, rather than discovering a mismatch during fieldwork, avoids a scramble to redo roll forward work under a different sample size or scope than what was originally planned.

SOXLayer Team

Product