SOX Key Control Testing Cycle

flowchart TD
  A[Scope entities and processes by materiality] --> B[Identify key controls in the risk and control matrix]
  B --> C[Walkthrough with the control owner]
  C --> D{Design effective?}
  D -->|No| E[Raise a design deficiency and agree remediation]
  D -->|Yes| F[Select the sample by control frequency]
  F --> G[Daily 25, weekly 15, monthly 5, quarterly 2, annual 1]
  G --> H[Test operating effectiveness against retained evidence]
  H --> I{Any exceptions?}
  I -->|No| J[Conclude effective and archive the workpaper]
  I -->|Yes| K[Extend the sample and assess the severity]
  K --> L{Deficiency, significant deficiency or material weakness?}
  L --> M[Report to the audit committee and the external auditor]
  E --> N[Retest after remediation with sufficient time before year end]
  M --> N
  N --> J