CORAA

SOX User Access Review Test Worksheet (Word)

Test that the periodic user access review used complete data and that exceptions were fixed.

Free · CORAA original — SA-aligned
Updated 17 Oct 2026
Tests
Periodic access review
First step
Check the user list
Evidence
System shows removal
Format
Editable Word
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

SOX User Access Review Test Worksheet — ___

Scope / period: ___ | Prepared by: ___ | Reviewed by: ___ | Date: ___

Test that the periodic review of user access to a financial system was performed by the right person on complete data, and that the exceptions were fixed. The review control is only as good as the user list it was done on, so test the list first.

Conclusion on operating effectiveness: ________ | Exceptions to be taken to the deficiency evaluation: ________

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

Why test the user list first?
A review done on an incomplete list cannot find the users that were left out, so the control fails whatever the reviewer did.
Related templates

You might also need.

IT General Controls (ITGC) Checklist
Free IT General Controls (ITGC) checklist for internal audit. Access management, change management, SoD, backu
Segregation of Duties Conflict Matrix
Generate a segregation of duties matrix with incompatible duty pairs, conflicting users, compensating controls
SOX Control Test Workpaper — Design and Operating Effectiveness
Generate a SOX control test workpaper covering walkthrough, design effectiveness, operating effectiveness samp