Finance and insurance / Managed BPO
SOX testing support for control evidence and workpapers
Actigy BPO helps finance and internal controls teams prepare evidence and carry out documented test steps for Sarbanes-Oxley (SOX) controls. Your SOX program owner sets the scope and sampling method, approves the results and decides how to evaluate any deficiency.
Agree the scope, access and reviewer before a paid pilot.
- Control
- User access review
- Evidence
- Signed review spreadsheet
- Exception
- Signature date not evidenced
- Next decision
- Control owner supplies clarification
A worked example of the record and decision flow. Not a client case or promised result.
The work. The handoff. Your decision.
A defined workflow in your systems
For SOX program managers and finance controls leads who have a control matrix, a testing calendar and an internal reviewer responsible for conclusions.
You provide
Approved control, population, sample and test instructions.
Actigy BPO prepares
Workpaper linking the test step to original evidence and exceptions.
You retain
Control conclusions, deficiency assessment and management sign-off.
Decision owner: SOX program owner. Confirm this role and the escalation contact in the written scope.
Service detail / 01
Which part of the testing cycle can we hand over?
Assign a set of controls, a testing period and the approved test instructions. The preparer maps each test attribute to its evidence, records the result and returns the workpaper to your reviewer. If an approval date is absent, the file shows exactly which conclusion the evidence cannot support.
- Request population exports with source, period, extraction filters and record count. Route gaps in population completeness to the program owner.
- Work from your approved sample.Trace each item to evidence of performance, approval and timing. Keep the original evidence reference and record any unavailable item.
- Maintain the exception log with the control owner, request date, response and reviewer status. Record unresolved exceptions separately from ordinary requests for documents.
Worked example
What does a workpaper look like?
The file identifies the control, entity, period, population, sample item, test step, evidence location and reviewer. For example, an access review may have a signed spreadsheet but no evidence of when the reviewer signed it. The workpaper records the missing date and routes the question to the control owner. A later explanation stays separate from the original evidence.
Service detail / 03
How do we keep preparation and judgment separate?
Your SOX program owner assesses materiality, sets the testing scope and evaluates exceptions and deficiencies. Assign a preparer and a separate reviewer, and keep the person who operates a control out of its own review. The external auditor decides what evidence to obtain and whether to use work performed by others.
Service detail / 04
How can we test this with one control family?
Choose a family such as procure-to-pay or user access reviews. Provide the approved control descriptions and a representative sample in the agreed workspace. Compare reviewer corrections, elapsed time by step and cases blocked by unavailable evidence. Use those results to price a cycle by control family and sample size.
Before the first live queue
Bring the inputs that shape your scope
The proposal should identify what can be assigned, who can decide, and how you will accept the work. Start with one representative queue; agree any expansion after reviewing the pilot.
Define the workload
Control family, period, entity and approved sample selection.
Agree the controls
Evidence access plus separate preparer and reviewer permissions.
Review the right measures
Workpaper completeness, source traceability and reviewer rework.
Before you decide
Buyer questions
Clarify the work, access and approval boundaries before assigning a team.
Can Actigy work from our existing GRC platform?
Yes, where approved access permits. We can scope work in your governance, risk and compliance platform or a controlled workpaper folder. Your owner defines the evidence naming, retention and review requirements.
Will you sign the SOX evaluation or provide an audit opinion?
Management retains its assessment and sign-off. Your external auditor issues any applicable audit opinion. Actigy BPO’s deliverables are test workpapers, an evidence index and an exception register for your designated reviewers.
What determines the price?
The number of entities, controls, samples, systems, test attributes and follow-up rounds drives effort. Tell us which steps your team already performs and how many evidence owners are involved. Scope design testing and operating testing separately where their procedures differ.
Does a complete evidence file mean the control passed?
No. Evidence completeness and the control conclusion are different checks. The workpaper should show the period, population, selected item, test procedure and any missing support. The authorized evaluator assesses what the evidence establishes and records the conclusion; a file upload does not establish an effective control.
Plan a SOX testing cycle
Give the control count, testing period and workpapers you need prepared. Identify who evaluates exceptions. Use general descriptions rather than control evidence.
Your inquiry
SOX testing evidence support
Describe the workload and the decision owner. Keep confidential records out of the form; agree a suitable channel for any later sample.
- Review the fitWe review the workflow and the inputs you provide.
- Define the scopeDiscuss access, coverage, review and the proposed fee.
- Agree a paid pilotApprove the written scope before work begins.