Rollforward testing for SOX controls: best practices

Rollforward testing for SOX controls is the extra evidence you gather after interim testing to show a control kept operating effectively through year end. It covers the months interim testing did not reach, checks what changed since the interim test, and ends in a documented conclusion for the full period.

SOX testing often starts well before the fiscal year closes. Internal audit and SOX teams test controls during an interim period, then perform rollforward procedures to cover the rest. Done well, rollforward testing connects the interim results to the year-end assessment. Done badly, it is a September conclusion with a December date on it.

What is rollforward testing for SOX controls?

Rollforward testing for SOX controls is the process of obtaining additional evidence after interim testing to assess whether a control continued to operate effectively through the end of the reporting period.

Say a company tests a monthly account reconciliation control from January through September. The team then performs rollforward procedures for October, November and December.

The point is not to repeat the earlier test. It is to get sufficient evidence for the period interim testing did not cover. You will also see it called SOX roll-forward testing, rollforward procedures or year-end control testing.

The exact procedures depend on the control, the interim results, the length of the remaining period and your testing methodology.

Why rollforward testing matters for SOX controls

Interim testing takes work off the year-end calendar. It does not, on its own, show a control operated effectively for the whole year. A control that passed in September has not signed anything promising to keep passing in December.

A control can change after interim testing. A new employee takes over the process. The system is updated. Or the control is simply not performed consistently in the remaining months. Rollforward testing is where those changes get noticed and evidenced.

It supports:

• Year-end SOX control testing
• An operating effectiveness conclusion for the full reporting period
• Follow-up on control changes or exceptions found at interim
• Organized audit evidence and workpaper documentation
• Finding issues early enough to deal with them before year-end reporting

Rollforward procedures should be designed for the specific control. Passing them is evidence, not a guarantee that the control was effective.

Interim testing vs rollforward testing

The two rounds answer different questions.

The periods here are illustrative. Define your own interim cutoff and rollforward period. Interim vs roll-forward testing covers how to set the cutoff and plan the two rounds across the SOX year.

When SOX teams perform rollforward testing

Rollforward testing comes up whenever a control was tested before year end and the team needs evidence for the rest of the period. It usually applies when:

• A recurring control was tested during interim testing
• The control kept running after the interim cutoff
• The control, system or people changed and the change needs assessing
• Interim testing found matters that need follow-up
• Your SOX testing methodology calls for additional year-end procedures

If the control's design or operation changed significantly, extending the interim conclusion is not enough. The changed control may need its own assessment, starting with its test of design.

How to perform rollforward testing for SOX controls in eight steps

A fixed sequence keeps rollforward work consistent from control to control.

1. Confirm the interim testing results

Start with the interim workpaper. Confirm:

• Which control was tested
• What period was covered
• What procedures were performed and what evidence was reviewed
• Whether exceptions were found
• Whether the conclusion still holds

If interim testing found a deviation, decide how it shapes the rollforward approach. Do not assume the issue was fixed without evidence that it was.

2. Define the rollforward period

Document the period interim testing did not cover. If interim testing ended on September 30, the rollforward period may run from October 1 through December 31.

Put the cutoff in the test plan and the workpaper, so a reviewer can see exactly which control instances are in scope. "Q4-ish" is not a cutoff.

3. Assess changes since interim testing

Ask what changed after the interim test. Relevant changes include:

• A new control owner or reviewer
• New or updated systems
• Changed approval limits
• Revised procedures
• Changes in transaction volume or business processes
• New risks that affect the control

A change does not mean the control failed. Assess whether it affects the control's design, its operation or the interim conclusion, and write down what you decided.

4. Obtain evidence for the remaining period

Collect evidence of how the control operated after the interim cutoff: reconciliations, approvals, system logs, review records, reports or supporting documents, depending on the control.

Check that the evidence belongs to the right control, period and population, and that it is complete and reliable enough for the testing objective.

5. Decide the additional testing required

Decide which procedures cover the remaining period. That may mean testing selected control instances, reviewing changes, or other procedures your methodology defines. Scope depends on:

• Control frequency
• Length of the rollforward period
• Interim test results
• Changes to the control or process
• Risk and testing requirements

There is no single rollforward sample size for every SOX control. Follow your approved sampling methodology and your auditor's minimums. For a worked example of sizing a gap-period sample, see how to size roll-forward samples, and for frequency-based ranges, SOX sample sizes by control frequency.

6. Test the control instances

For each selected instance, compare the evidence with the control requirements. For a monthly reconciliation, the tester might check:

• The correct account and reporting month
• Evidence of review by an authorized person
• Timing of the review and approval
• Investigation of significant reconciling items
• Evidence that required follow-up happened

Record any potential deviation and investigate it before concluding.

7. Evaluate exceptions and changes

If you find a missing approval, a late review or another potential deviation, find out what happened. Decide whether it is a confirmed control deviation, whether it affects the interim conclusion, and whether it needs escalation or remediation.

A potential exception is not a confirmed deficiency until it has been evaluated against the control requirements and the facts. The deficiency classification guide covers what happens once it is confirmed.

8. Document the rollforward conclusion

The workpaper should explain how the team got evidence for the remaining period. Include:

• The interim testing period and conclusion
• The rollforward period
• Procedures performed and evidence reviewed
• Changes assessed
• Exceptions and how they were resolved
• The final conclusion and reviewer approval

Another qualified reviewer should be able to follow the work without anyone explaining it to them in a meeting.

Worked example: rollforward testing of a monthly bank reconciliation

A company has a monthly bank reconciliation control. A finance manager reviews the reconciliation and investigates significant differences. The SOX team tests January through September at interim, and the control operates as expected. The team then plans rollforward testing for October through December. (This example is illustrative.)

1. Confirm interim. The tester reads the interim workpaper and its conclusion.
2. Check for changes. The tester asks whether the reconciliation process, reviewer or system changed after September.
3. Get the evidence. The team obtains the October, November and December reconciliations and the related review evidence.
4. Test each month. The tester checks that each reconciliation was reviewed by the authorized manager, completed on time, and backed by evidence of investigation where required.
5. Investigate the gap. November shows no visible approval. The tester checks whether the approval was recorded somewhere else, documents what they found, and decides whether the control requirement was met.
6. Review and conclude. The reviewer evaluates the rollforward results alongside the interim work and approves the full-year conclusion.

The rollforward test extends the evidence period. It does not assume the control kept operating because it passed interim testing.

Rollforward testing best practices

• Plan the year-end work early. Set the interim cutoff, expected evidence, rollforward period and review responsibilities before year end. It cuts last-minute evidence requests
• Let interim results guide the approach. Prior results and exceptions should shape the nature and extent of the rollforward procedures
• Focus on changes. An unchanged control may need a different approach from one with a new owner, system or procedure. Document the assessment
• Keep evidence connected to the control. Organize it by control, period and tested instance, so review and follow-up are quick
• Apply the approved methodology. No generic sample size or procedure without weighing the control's frequency, risk and testing requirements
• Investigate potential exceptions. Decide whether an apparent deviation is a control failure, missing evidence or something else, and record why
• Keep the workpaper readable. A reviewer should see the interim coverage, rollforward procedures, evidence, exceptions and conclusion in one place
• Finish review before the reporting deadline. Leave time for evidence follow-up, exception evaluation, remediation discussions and sign-off

Common rollforward testing mistakes

Assuming interim results cover the full year

Interim testing supports the period tested. The remaining period needs its own procedures when your testing approach requires them.

Skipping the change assessment

Changes in people, systems or procedures can make the interim conclusion irrelevant. Ask, and write down the answer.

Collecting evidence without checking it

A file can exist and still not show the control operated as required. Check the evidence against the control criteria.

Leaving the rollforward cutoff vague

If the period is not documented, reviewers cannot tell which control instances were covered.

Ignoring interim exceptions

Earlier deviations should shape how the additional testing is planned and evaluated.

Documenting only the final result

A conclusion without the procedures and evidence behind it is hard to review. The workpaper should show how the conclusion was reached.

How SOXLayer supports rollforward testing

SOXLayer is SOX control testing software for planning, performing, reviewing and evidencing control tests. For rollforward work specifically:

• Suggested interim and rollforward plans: enter the fiscal year end and deadlines, and SOXLayer suggests both plans. Nothing is created until someone on your team accepts it
• Planning filled in: sample sizes, due dates and preparers are filled in when you add controls to a plan, on a working calendar with holidays
• Evidence tied to samples: evidence is matched to each sample, and a population upload is totalled and SHA-256 fingerprinted
• AI first pass with citations: the AI proposes Pass, Fail, Insufficient or N/A per attribute, with a confidence score and the exact quote and page it relied on
• Exceptions to deficiencies: exceptions raise deficiencies automatically, and every decision lands in a hash-chained audit trail

AI never submits, reviews or approves a test. With auto-fill on, it can record a result it is at least 90% sure of, with a verified citation, while the test is still being prepared. Anything flagged, disputed or Insufficient waits for a person, and admins can switch auto-fill off so every result waits. Roll-forward testing is included in the Professional plan ($799 a month) and Enterprise; pricing has the details.

Common questions about rollforward testing for SOX controls

What is rollforward testing in SOX?

Rollforward testing obtains additional evidence after interim testing to assess whether a control continued to operate effectively through the rest of the reporting period.

Why is rollforward testing performed?

It covers the period interim testing did not reach, and it makes the team consider changes or exceptions that could affect the year-end conclusion.

Is rollforward testing the same as retesting?

Not exactly. Rollforward testing extends evidence from the interim period to the reporting date. Retesting can mean testing a control again for other reasons, such as after a deviation or remediation.

How many samples are needed for rollforward testing?

There is no universal number. It depends on control frequency, the length of the period covered, prior results, risk and your testing methodology. Your auditor's minimums win.

Does passing interim testing mean the control passed for the full year?

No. Interim testing supports the period tested. The remaining period needs appropriate additional procedures before you reach a full-year conclusion.

What evidence is needed for rollforward testing?

It depends on the control. Typical evidence includes approval records, reconciliations, system logs, review documentation, transaction records and evidence of follow-up.

What if the control changed after interim testing?

Assess whether the change affects the control's design or operation. Depending on the change, you may need additional testing or a fresh assessment of the changed control.

Sources and further reading

The standards and guidance behind this article. Your external auditor's methodology and your company's own policy still set the requirements for your program.

• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting: includes what the auditor considers when extending interim test results to the remaining period
• SEC Release No. 33-8810, Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting: guidance for management's own evaluation of ICFR
• Interim vs roll-forward testing: how to plan the SOX year: setting the cutoff and sizing the gap-period sample

Interim testing tells you how the control behaved in September. Rollforward testing tells you whether December got the same control.

Back to top

Furqan Abaid

Furqan Abaid builds SOXLayer, AI-assisted SOX control testing software, and writes about how SOX programs scope, test, review and document their controls.

Read these next

Testing

Test of design vs test of operating effectiveness explained

Which question each test answers, what evidence it needs, a monthly bank reconciliation tested both ways, and five mistakes that blur the two.

Furqan Abaid·October 22, 2026·8 min read

Testing

Three-way match in accounts payable: how to test the control

Seven attributes, five documents per sample and four exceptions to check, plus an illustrative worked sample with a 4-unit quantity variance.

Furqan Abaid·September 2, 2026·9 min read