SOX workpaper template and example for modern teams

A SOX workpaper template is a fixed structure for recording a control test: the control and its risk, the period and sample, the procedures, the evidence, the results, any exceptions, the conclusion and who signed it off. Use the same template every time, and any qualified reviewer can follow any test without asking the tester what happened.

SOX control testing takes more than collecting documents and checking boxes. Teams have to show what they tested, which evidence they reviewed and why they reached a particular conclusion. For modern SOX teams the goal is simple: workpapers that are accurate, easy to review and backed by reliable evidence. This guide covers what a SOX workpaper should include, gives a practical example, and shares best practices for managing workpapers.

What is a SOX workpaper?

A SOX workpaper is a document or electronic record that supports the testing of internal controls over financial reporting. It records the testing performed and the evidence that supports the conclusion.

For a monthly bank reconciliation control, the workpaper records the control requirements, the selected samples, the approval evidence, the testing results and any exceptions identified. Another qualified reviewer should be able to read it and understand what was tested and how the conclusion was reached.

Why SOX workpapers are important

Workpapers keep a clear record of control testing and make it consistent across controls, testers and reporting periods. Well-prepared workpapers help teams:

• Document control testing procedures
• Connect evidence to specific testing attributes
• Record and investigate potential exceptions
• Support reviewer approval
• Prepare for internal and external audit review
• Keep traceability between evidence and conclusions

Poor documentation causes review delays even when the control is operating correctly. The evidence and reasoning have to be clear enough to carry the conclusion on their own.

What a SOX workpaper template should include

A useful SOX workpaper template covers the main stages of control testing in eight parts.

1. 1

   Control information

   The control ID, name, owner, process, frequency and the relevant financial reporting risk, with a clear description of who performs the control, what they do and when.

2. 2

   Control objective and risk

   What the control is meant to achieve and which risk it addresses. A journal entry approval control, for example, addresses the risk of unauthorized or inaccurate entries affecting financial reporting. This helps the tester choose procedures that match the control's purpose.

3. 3

   Testing period and scope

   The period covered by the test, plus the population and sample selection approach where they apply. Reviewers can then see which control instances were included.

4. 4

   Testing procedures

   The steps the tester performed, tied directly to the control requirements. For a bank reconciliation control: check the account and period, verify reviewer approval, confirm the timing of the review, and examine follow-up on significant differences.

5. 5

   Evidence reviewed

   The records used in the test: reconciliations, approval logs, system reports, invoices, transaction records and supporting schedules. Link each item to its sample or testing attribute, with file names, source references, page numbers or record IDs where appropriate. SOX audit evidence covers what counts and how to organize it.

6. 6

   Test results

   The outcome for each tested item or attribute, with a short explanation of what the evidence showed. Do not rely on unexplained labels: a column of bare "Pass" entries is a workpaper that has given up on its reviewer.

   If information is missing or unclear, document the limitation and investigate it before reaching a conclusion.

7. 7

   Exceptions and findings

   Potential deviations from the control requirements: the issue, the supporting evidence, the investigation performed and the final assessment. A missing document does not automatically prove the control failed. The tester evaluates the facts and decides whether the control requirement was met.

8. 8

   Conclusion and sign-off

   A summary of the results and the basis for the conclusion, plus the preparer, preparation date, reviewer, review date and approval status. Record review comments and changes according to your methodology.

SOX workpaper template: a practical example

A company requires its finance manager to review the monthly bank reconciliations, so that bank balances are reconciled and significant differences are investigated. Here is how the workpaper for that control could be organized. The control details and results are fictional.

To see a finished one, page through this sample SOX workpaper: a complete 24-page working paper for a monthly bank reconciliation review, with five samples, every result cited to the page it came from, and the reviewer and approver sign-offs. It is also available as a PDF and an Excel workbook.

Section 1: control details

Section 2: testing procedures

The tester reviews selected monthly bank reconciliations. For each one, the tester checks that it relates to the correct account and month, that an authorized manager reviewed it, and that approval happened within the required timeframe. The tester also examines the evidence of investigation for significant reconciling items.

Section 3: sample results

These results are illustrative, not an actual audit conclusion. March stays under investigation: the tester checks whether approval was recorded in another approved system or document before deciding the final result.

Section 4: exception documentation

• Issue: approval evidence was not found in the initial March evidence package
• Required action: review the approved workflow system and ask the control owner to clarify
• Status: pending investigation
• Final assessment: record the conclusion after reviewing the additional evidence and applying the testing methodology

Section 5: workpaper conclusion

The conclusion summarizes the procedures performed, the evidence reviewed and the results of any investigation. If the evidence shows the selected control instances met the requirements, the tester explains why. If a deviation is confirmed, the workpaper documents it and follows the process for evaluating and escalating the finding; the deficiency classification guide covers that evaluation.

The final conclusion should not be approved while a material testing question is unresolved.

How to create a SOX workpaper step by step

A consistent process produces accurate workpapers and fewer avoidable review comments.

1. 1

   Start with the risk and control matrix

   Use the RCM to identify the control, its objective, the associated risk and the relevant testing attributes, so the workpaper supports the control actually being evaluated.

2. 2

   Define the testing approach

   Set the testing period, population, sample selection method and required procedures. Follow your approved methodology and consider the control's frequency, risk and requirements; SOX sample sizes by control frequency has illustrative ranges.

3. 3

   Collect and organize evidence

   Request evidence from approved sources and organize it by control, period, sample and evidence type. Confirm the records relate to the selected control instances.

4. 4

   Perform the test

   Compare each selected item with the control requirements and record what you checked and what the evidence showed. If an attribute cannot be evaluated because evidence is missing, document the limitation and follow up.

5. 5

   Investigate potential exceptions

   Review apparent deviations, get additional evidence where needed, document the investigation, and keep unresolved issues apart from confirmed findings.

6. 6

   Document the conclusion

   Explain how the evidence supports the result: the work performed and the reasoning behind the outcome. "Control is fine" is not a conclusion; it is a mood.

7. 7

   Complete review and sign-off

   Submit the workpaper for review, address the comments, update the documentation where needed, and retain the final approval according to your procedures.

Best practices for SOX workpaper management

• Keep the format consistent. Use a standard SOX workpaper template across similar controls, so reviewers find what matters quickly
• Link evidence to testing attributes. Never store evidence without saying what it is for. Connect each document to the requirement or sample it supports
• Use clear file names. Include the control ID, period, sample and document type. A file called rec_final_v3_FINAL.xlsx tells the reviewer only that someone, at some point, felt very sure
• Document exceptions promptly. Record potential issues when you find them, and track the investigation, evidence and final assessment
• Keep review responsibilities clear. Define who prepares the workpaper, who reviews it and who approves the final conclusion
• Review templates regularly. Control owners, systems and procedures change. Update the template when the control or the methodology does

Common SOX workpaper mistakes

Conclusions without evidence

A conclusion is hard to validate if the workpaper does not identify the evidence behind it.

Generic testing procedures

Different controls address different risks. Procedures should reflect the actual control requirements, not repeat generic wording.

Unclear evidence references

A reviewer should find the relevant source without a search party through unrelated documents.

Unresolved exceptions

Investigate and document potential deviations before the final conclusion is approved.

Outdated control information

An old control description may no longer match the current process. Confirm the details before testing starts.

How SOXLayer supports modern workpaper management

SOXLayer is an AI-assisted SOX control testing workspace for internal audit, SOX and internal controls teams. Its test workflow follows the same parts as the template above:

• Control and risk: versioned controls with full design attributes in a multi-entity RCM, with risks mapped to controls
• Procedures: reusable, versioned test templates whose attributes carry their own pass and fail criteria
• Scope and samples: a population upload is totalled and SHA-256 fingerprinted before samples are drawn
• Evidence and results: evidence is matched to each sample, and the AI proposes Pass, Fail, Insufficient or N/A per attribute with a confidence score and the exact quote and page it relied on
• Exceptions: exceptions raise deficiencies automatically, tracked through to remediation
• Conclusion and sign-off: the AI can draft the test conclusion; a preparer submits, then a reviewer and approver sign off, with live segregation-of-duties warnings, and approved tests are locked
• History: every decision lands in a hash-chained audit trail

AI never submits, reviews or approves a test. With auto-fill on, it can record a result it is at least 90% sure of, with a verified citation, while the test is still being prepared. Anything flagged, disputed or Insufficient waits for a person, and admins can switch auto-fill off so every result waits. Until the test is submitted, a person can still edit or override any result, auto-filled ones included. If you are evaluating SOX workpaper software, the question is whether it fits your testing methodology and documentation requirements; a pilot on one control answers it faster than a demo. The sample workpaper shows what that pilot produces.

Common questions about SOX workpaper templates

What is a SOX workpaper template?

A structured format for documenting control details, testing procedures, evidence, results, exceptions, the conclusion and reviewer sign-off.

What should a SOX workpaper contain?

The control and risk, testing period, population or sample, procedures performed, evidence reviewed, results, exceptions, conclusion and review details.

Is there one standard SOX workpaper template?

No. No single template fits every organization and control. Use a consistent format that meets your testing methodology and documentation requirements.

What is the difference between a SOX workpaper and audit evidence?

Audit evidence is the information that supports a testing conclusion. The workpaper documents the procedures performed, the evidence reviewed, the results and the reasoning behind the conclusion.

Can AI help prepare SOX workpapers?

Yes, with extracting information, evaluating testing attributes and preparing draft summaries. Testers still have to validate the output and make sure the conclusion is supported by the underlying evidence.

How can teams make SOX workpapers easier to review?

Clear control descriptions, specific testing procedures, consistent evidence references, documented exception investigations and a sign-off that reflects a real review.

Sources and further reading

The standards and guidance behind this article. Your external auditor's methodology and your company's own policy still set the requirements for your program.

• PCAOB AS 1215, Audit Documentation: what audit documentation should contain so an experienced reviewer can understand the work
• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting: the auditor's standard for ICFR audits
• SOX testing 101: the full testing cycle, from RCM row to signed-off test

Write every workpaper for the reviewer who opens it a year from now, with no one left to ask.

Back to top

Read these next

Testing

SOX sampling guidance: how to choose the right sample size for control testing

Define a complete population, choose an audit sampling method, weigh the AS 2315 factors, handle a failed sample and document the rationale, with a monthly reconciliation worked through.

Furqan Abaid·November 4, 2026·13 min read

Testing

SOX audit evidence: what counts and how to organize it

Six common evidence types, five checks that make evidence reliable, an eight-step way to organize it by control and period, and a worked journal entry approval example.

Furqan Abaid·October 26, 2026·11 min read