Internal audit / United Kingdom
SOX ITGC testing
Test agreed IT general controls with traceable evidence, defined populations and clear reporting of exceptions.
Last reviewed . Fees in pounds sterling plus VAT.
Can you trace the sample back to the full population?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered.
Primary references
PCAOB: internal control over financial reportingInside the work
Can you trace the sample back to the full population?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Population | Define in-scope users, changes or events and the testing period. | Extraction method and completeness checks. |
| Sample | Agree the selection method and supporting records. | Traceable identifiers and evidence. |
| Exception | Evaluate the observation against the control. | Condition, impact, management response and retest scope. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Test agreed IT general controls with traceable evidence, defined populations and clear reporting of exceptions.
- Testing objectives, scope and independence assessment
- Population completeness and sample approach
- Agreed control testing and exception evaluation
- Report and management follow-up evidence
How the work moves forward
Agree. Examine. Follow up.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Agree criteria
Confirm scope, competence, impartiality and evidence access.
Examine records
Use agreed sampling and trace findings to evidence.
Report and follow up
State conclusions, limitations and required management actions.
A practical starting point
Can you trace the sample back to the full population?
Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered.
Population — Define in-scope users, changes or events and the testing period. — Extraction method and completeness checks. Sample — Agree the selection method and supporting records. — Traceable identifiers and evidence. Exception — Evaluate the observation against the control. — Condition, impact, management response and retest scope.
Before you commission the work
Your questions.
Clear answers.
Can you trace the sample back to the full population?
Before evaluating a control, agree the population, period and evidence of completeness. A clean sample from an incomplete population does not establish that all relevant activity was covered.
What is included in the engagement?
Testing objectives, scope and independence assessment; Population completeness and sample approach; Agreed control testing and exception evaluation; Report and management follow-up evidence. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
Testing is not a statutory audit opinion or automatic external-auditor reliance. Control design support, remediation and retesting must be scoped and conflicts assessed.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
What evidence should ITGC testing retain?
Agree the control objective, population, period, sampling rationale, evidence, exceptions and reviewer. Keep the distinction between control design and execution clear. Any reliance by an external auditor is their decision, not a promise made in the testing proposal.
Can remediation work and independent testing be combined?
They need distinct responsibilities and explicit safeguards. If the same person designed or operated a control, assess the conflict before assigning testing. Record management’s actions and the basis for any follow-up conclusion rather than marking a control effective because a document changed.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Let’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project