IPE is any report, spreadsheet or data extract produced by your systems that a control relies on. If the report is wrong, a perfect review of it proves nothing. To test IPE, identify each report, confirm the data is complete and accurate, check the report logic, and keep evidence of how you did it.
Last reviewed: 17 October 2026. Facts checked. We opened KPMG's page on IPE and inspections (kpmg.com), the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read) and 15 U.S.C. 7262. We searched for PCAOB IPE requirements; results were secondary sources. We did not open the PCAOB standards (403 error), so we cite no paragraph numbers.
SOX applies to companies subject to US securities law. Indian companies are covered only if they are SEC registrants or part of a group that is.
What the sources say
KPMG's page uses the term information provided by the entity and says management and auditors both need to test that it is complete and accurate. It says management needs a process to confirm this, and that IPE includes key reports, spreadsheets and schedules used in executing control activities. It also says recent inspections of IPE call for greater evidence that companies perform and document their own procedures.
The SEC guidance says management may need to evaluate IT controls that other controls depend on. A report is one of those dependencies.
Two kinds of report
| Type | Used for | Example |
|---|---|---|
| Report used inside a control | The control works on the report | Aged debtor list used in a bad debt review |
| Population used for testing | Picking a sample | Full list of journal entries for testing |
Both need comfort. The first matters for the control itself. The second matters for whether your sample is from the whole population.
Step 1: Build an IPE inventory
For every key control, list the reports it uses. Capture:
- Report name and where it comes from.
- System and owner.
- Whether it is standard, custom or a spreadsheet.
- Parameters, such as date range and entity.
- Control that uses it.
Ask the control performer, not just IT. People often use a spreadsheet no one has recorded.
Step 2: Test completeness and accuracy
Completeness asks whether all the records are in the report. Accuracy asks whether the values are right.
| Check | Example procedure |
|---|---|
| Completeness, total | Agree the report total to the general ledger or a system control total |
| Completeness, record count | Compare record count with a second system query |
| Accuracy, fields | Trace a sample of lines to source documents |
| Parameters | Re-run the report with the stated filters and compare output |
| Date range | Confirm the dates cover the period under review |
| Sort and filter | Confirm no hidden rows or filters in an extract |
Keep screenshots of parameters, the query, and the person and date.
Step 3: Test the report logic
Standard reports need less logic testing than custom ones. For a custom report, check the query or code. Confirm:
- Joins do not drop records.
- Ageing buckets use the right date.
- Currency and entity filters are correct.
- Calculated fields follow the policy.
If the logic is stable, you can test it once and then rely on change controls to show it has not altered. This ties to SOX change management.
Step 4: Test spreadsheets
Spreadsheets are IPE too. Check:
- Who can edit the file and where it is stored.
- Whether formulas are locked or reviewed.
- Whether inputs tie to the source system.
- Whether a version history exists.
Do not treat a manual spreadsheet as reliable because it looks tidy.
Step 5: Document the result
Record the report, the procedure, the evidence, the exceptions and the conclusion. If you cannot confirm completeness and accuracy, say so. Then either use a different source or add other procedures. Do not rely on the report.
A worked row:
- Control: monthly review of aged debtors above a set amount.
- IPE: aged debtor report from the ERP.
- Test: agree total to the receivables ledger; re-run with the same date; trace ten lines to invoices; confirm the ageing logic.
- Evidence: reconciliation, screenshot of parameters, notes.
Use the SOX control test workpaper to record it.
Common failures
- No inventory of reports.
- Parameters not captured.
- Completeness tested, accuracy not.
- Spreadsheet changed after review.
- Testing done once and never re-done after a system change.
Frequently Asked Questions
Is every report IPE?
Any report a key control or a test relies on is IPE.
Can IT's testing cover IPE?
It can help with logic and change control, but someone must also confirm the specific output used.
How often do I re-test IPE?
Depends on the risk and the report's stability. Re-test after a change.
Do auditors rely on my IPE testing?
KPMG says inspections call for evidence that companies do and document their own procedures.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error