Test controls and resolve findings

Step by step

1. Schedule the required occurrence SOX Lead

   SOX Lead confirms the approved test plan, scope, cadence and event triggers. Create one SOX control tests occurrence with stable identity, retaining the control owner and plan revision. A repeated scheduler run must return the same occurrence. The company’s documented testing population determines what is required for this close, rather than a generic assumption about every control.

   • Publish required testing work
   • Updates SOX controls, SOX control tests

2. Execute and submit the test SOX Lead

   The assigned tester performs the documented procedures and records control test evidence. Keep the sampled items, results and immutable supporting files together. The tester differs from the captured control owner. Submit the evidence and conclusion for independent review; a status update cannot substitute for the actual work or silently amend the submitted sample population.

   • Submit the test evidence
   • Updates SOX control tests, Control test evidence

3. Review the test conclusion SOX Lead

   The independently assigned SOX Lead reviewer evaluates the submitted evidence and conclusion. The configured three-person route keeps owner, tester and reviewer distinct. Record the authorized approval against that evidence revision. A deficient result creates a finding for follow-up; approval of the test record does not mean that the underlying control was effective.

   • Record the independent conclusion
   • Updates SOX control tests, Control deficiencies
   Approvalfor the assigned decision

4. Resolve the close impact Controller / CFO

   Controller / CFO records the required disposition, compensating controls, unresolved risks and actual disclosure evidence. SOX Lead tracks remediation and retesting separately. An acknowledged finding is not automatically remediated, and mandatory blockers cannot be waived by a generic deferral. Close Manager sees the effect on period readiness with the retained basis for each permitted decision.

   • Retain the finding disposition
   • Updates Control deficiencies, Issues log
   Approvalfor the assigned decision

SOX Lead

Maintain the company control catalog and coordinate testing, independent review and deficiency follow-up.

Controller / CFO

Own financial review and final sign-off within assigned entities. Controller and CFO capacities have separately assigned authenticated signers where both are required.