Sarbanes-Oxley Section 404: Guidance for Documenting Test Results

This guide outlines steps to complete when documenting your organization’s SOX Section 404 test results.

Steps in this tool include remembering to incorporate work paper references on the first page of each document using colored ink/pencils, developing an overall conclusion on the overall effectiveness or ineffectiveness of each control tested, documenting the deficiency to enable monitoring and timely retesting of remediated controls for ineffective controls resulting in a control deficiency, and filing testing work papers by business unit and process using colored file folders. These steps should be modified to reflect each organization’s Section 404 testing process.