CORAA

Standard Operating Procedure (SOP) Review Checklist

Tests whether documented SOPs exist for the process under review, are current and approved, and are actually followed in practice — the documentation-control test that typically precedes a detailed RCM review.

Free · CORAA original — SA-aligned
Updated 28 Jul 2026
Tests
Existence, approval, communication, currency, adherence
Typically precedes
A detailed RCM review of the same process
Key distinction
"SOP exists" vs. "SOP is actually followed"
Format
Microsoft Word (.docx)
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

STANDARD OPERATING PROCEDURE (SOP) REVIEW CHECKLIST

Entity: ___ · Functional area reviewed: ___

Scope: tests whether documented SOPs exist for the process reviewed, are current and approved, and are consistently followed in practice — a documentation-control test that typically precedes a detailed risk-and-control-matrix review of the same process.

Conclusion

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

Why review SOPs before doing a full risk-and-control-matrix review of the same process?
If documented procedures don't exist, are outdated, or don't match what actually happens, a control test performed against the "official" process description would be testing the wrong thing. Confirming SOP currency first ensures the subsequent RCM review is testing controls against how the process actually runs today.
What is the difference between "SOP exists" and "SOP is followed"?
A process can have a well-written, approved SOP that nobody on the floor actually follows — perhaps because it was written once and never updated as the process evolved, or because staff were never trained on it. The Adherence test specifically samples actual transactions/activities against the documented steps to check this gap, rather than assuming a good document means good practice.
Who should approve an SOP, and how often should it be reviewed?
The process owner (the person accountable for that activity, not necessarily the person who performs it day-to-day) should approve it, with a defined review cycle — commonly annual, or triggered by any material process change (new system, reorganisation, regulatory change). The checklist tests whether a version number and last-review date are actually maintained, not just whether the document looks complete.
Related templates

You might also need.

Procure-to-Pay (P2P) Risk & Control Matrix Template
Free Procure-to-Pay (P2P) internal audit RCM template. Risks, controls and control objectives for vendor onboa
Internal Audit Annual Plan Template — Risk-Scored Audit Universe
Free Internal Audit Annual Plan template. Risk-scored audit universe (impact × likelihood computed) with quart
Internal Audit Charter Template — Section 138 / IIA / SIA
Free Internal Audit Charter template for Indian companies under Section 138 of the Companies Act 2013. IIA / I