What it is
This script tests the control over changes to pay rates, bank accounts and withholdings: approval, accuracy, effective dates, who made the change and the review of the change report.
The workbook holds the control details, a sample size lookup that reads your own policy table, the attributes to test with the procedure and evidence for each, a sample grid with Pass, Fail or N/A, and a conclusion that compares exceptions with your tolerance.
When to use it
- When management or internal audit tests a key control for operating effectiveness.
- When a test needs a documented, repeatable script a reviewer can follow.
- When retesting a control after remediation.
What’s inside
- Control tab with sample size policy lookup by frequency and risk
- Procedures tab with attributes and expected evidence
- Sample grid for up to 60 items with exception flags
- Five attributes, with population taken from the system change log
Standard cited
This template follows ICFR control testing. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Where does the sample size come from?
From your methodology. The sheet carries a policy table that you fill with your own sizes by frequency and risk level, then looks up the size for the control being tested. Nothing is pre-filled.
What happens if I find an exception?
Record it as Fail and describe it. If exceptions exceed the tolerance in your policy, the conclusion changes to evaluate the deficiency, and you consider compensating controls and the need for more testing.
Related templates
- Risk and Control Matrix: Hire to Retire (Payroll)
- SOX Control Test Workpaper (TOD / TOE)
- Segregation of Duties Conflict Matrix
Last updated 11/05/2026. All free templates.