What it is
Evaluates the severity of a control deficiency and records the classification and remediation.
A blank working form with [bracketed placeholders] for client, period and sign-off. Adapt it to your firm’s methodology; sample sizes and thresholds are your own decisions.
When to use it
- SOX 404 or ICFR engagements, internal audit and control reviews.
- Financial statement audits where you test or rely on controls.
What’s inside
- Description of the deficiency
- Severity factors: likelihood, magnitude, compensating controls
- Classification and rationale
- Remediation plan
Standard cited
This template follows SOX 404 / AU-C 265. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 265 explained.
Questions
Is this template tied to a specific methodology?
No. It is a neutral working form. Replace the headings and columns with your firm’s methodology where they differ, and set sample sizes and thresholds under that methodology.
Related templates
- Management Letter — Internal Control Communication (AU-C 265)
- SOX Control Test Workpaper (TOD / TOE)
- Root Cause Analysis (5 Whys and Fishbone)
Last updated 11/04/2026. All free templates.